mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius Ciepluch
1ae41eea19
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
12 lines
462 B
Java
12 lines
462 B
Java
/* Juliet CWE-78 flow variant 01 — bad sink only.
|
|
* Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
|
|
* https://github.com/UnitTestBot/juliet-java-test-suite (NIST Juliet 1.3, CC0)
|
|
*/
|
|
public class CWE78_OS_Command_Injection__console_readLine_01 {
|
|
public void bad(String data) throws Throwable {
|
|
String osCommand = "/bin/ls ";
|
|
Process process = Runtime.getRuntime().exec(osCommand + data);
|
|
process.waitFor();
|
|
}
|
|
}
|