feat(three-stage-scan): add split-sink fixtures the regex scan misses

benchmarks/fixtures/split-sink-c/src/vuln.c

@@ -0,0 +1,8 @@
+#include <stdio.h>
+#include <sqlite3.h>
+
+void search(sqlite3 *db, char *term) {
+  char query[512];
+  snprintf(query, sizeof(query), "SELECT * FROM items WHERE title LIKE '%%%s%%'", term);
+  sqlite3_exec(db, query, 0, 0, 0); /* CWE-89 split-sink: query built on prior line (regex blind spot) */
+}

benchmarks/fixtures/split-sink-java/src/main/java/example/SplitSinkServlet.java

@@ -0,0 +1,12 @@
+package example;
+
+import jakarta.servlet.http.HttpServletRequest;
+import java.sql.Connection;
+
+class SplitSinkServlet {
+  void search(HttpServletRequest request, Connection connection) throws Exception {
+    String term = request.getParameter("q");
+    String sql = String.format("select * from items where title like '%%%s%%'", term);
+    connection.createStatement().executeQuery(sql); // CWE-89 split-sink: sql built on prior line (regex blind spot)
+  }
+}

benchmarks/fixtures/split-sink-javascript/src/app.js

@@ -0,0 +1,12 @@
+// Split-sink SQL injection: query is built, then executed on the next line.
+const express = require("express");
+const app = express();
+
+app.get("/search", (req, res) => {
+  const term = req.query.q;
+  const query = "select * from items where title like '%" + term + "%'";
+  db.query(query); // CWE-89 split-sink: query built on prior line (regex blind spot)
+  res.send("ok");
+});
+
+module.exports = app;

benchmarks/fixtures/split-sink-python/app.py

@@ -0,0 +1,11 @@
+"""Split-sink SQL injection: query is built, then executed on the next line."""
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+@app.get("/search")
+def search(db):
+    term = request.args["q"]
+    query = "select * from items where title like '%" + term + "%'"
+    return db.execute(query)  # CWE-89 split-sink: query built on prior line (regex blind spot)

benchmarks/manifests/split-sink-c.toml

@@ -0,0 +1,20 @@
+name = "split-sink-c"
+language = "c_cpp"
+frameworks = ["native"]
+setup = []
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/split-sink-c"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "src/vuln.c"
+line = 7
+function = "search"
+sink = "sqlite3_exec"
+evidence = "sqlite3_exec runs a SQL query string built from attacker input on a prior line"

benchmarks/manifests/split-sink-java.toml

@@ -0,0 +1,20 @@
+name = "split-sink-java"
+language = "java_web"
+frameworks = ["servlet"]
+setup = ["mvn test"]
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/split-sink-java"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "src/main/java/example/SplitSinkServlet.java"
+line = 10
+function = "search"
+sink = "executeQuery"
+evidence = "executeQuery runs a SQL string built from request input on a prior line"

benchmarks/manifests/split-sink-javascript.toml

@@ -0,0 +1,19 @@
+name = "split-sink-javascript"
+language = "javascript_node_web"
+frameworks = ["node", "express"]
+setup = ["npm install"]
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/split-sink-javascript"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "src/app.js"
+line = 8
+sink = "query"
+evidence = "query runs a SQL string built from request input on a prior line"

benchmarks/manifests/split-sink-python.toml

@@ -0,0 +1,20 @@
+name = "split-sink-python"
+language = "python_web"
+frameworks = ["flask"]
+setup = ["pip install flask"]
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/split-sink-python"
+
+[[expected]]
+cwe = "CWE-89"
+class = "sql injection"
+path = "app.py"
+line = 11
+function = "search"
+sink = "execute"
+evidence = "execute runs a SQL query string built from request input on a prior line"