mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius Ciepluch
1ae41eea19
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
13 lines
489 B
Java
13 lines
489 B
Java
/* Juliet CWE-78 goodG2B — hardcoded source, same Runtime.exec sink.
|
|
* Regex SAST is expected to keep firing — Juliet goodG2B trap.
|
|
* Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
|
|
*/
|
|
public class CWE78_OS_Command_Injection__console_readLine_01 {
|
|
public void goodG2B() throws Throwable {
|
|
String data = "foo";
|
|
String osCommand = "/bin/ls ";
|
|
Process process = Runtime.getRuntime().exec(osCommand + data);
|
|
process.waitFor();
|
|
}
|
|
}
|