mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius Ciepluch
1ae41eea19
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
70 lines
1.9 KiB
Python
70 lines
1.9 KiB
Python
'''
|
|
OWASP Benchmark for Python v0.1
|
|
|
|
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
|
For details, please see https://owasp.org/www-project-benchmark.
|
|
|
|
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
|
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
|
|
|
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
PURPOSE. See the GNU General Public License for more details.
|
|
|
|
Author: Theo Cartsonis
|
|
Created: 2025
|
|
'''
|
|
|
|
from flask import redirect, url_for, request, make_response, render_template
|
|
from helpers.utils import escape_for_html
|
|
|
|
def init(app):
|
|
|
|
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['GET'])
|
|
def BenchmarkTest00350_get():
|
|
return BenchmarkTest00350_post()
|
|
|
|
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['POST'])
|
|
def BenchmarkTest00350_post():
|
|
RESPONSE = ""
|
|
|
|
import helpers.separate_request
|
|
|
|
wrapped = helpers.separate_request.request_wrapper(request)
|
|
param = wrapped.get_form_parameter("BenchmarkTest00350")
|
|
if not param:
|
|
param = ""
|
|
|
|
map11630 = {}
|
|
map11630['keyA-11630'] = 'a-Value'
|
|
map11630['keyB-11630'] = param
|
|
map11630['keyC'] = 'another-Value'
|
|
bar = "safe!"
|
|
bar = map11630['keyB-11630']
|
|
bar = map11630['keyA-11630']
|
|
|
|
import platform
|
|
import subprocess
|
|
import helpers.utils
|
|
|
|
argStr = ""
|
|
if platform.system() == "Windows":
|
|
argStr = "cmd.exe /c "
|
|
else:
|
|
argStr = "sh -c "
|
|
argStr += f"echo {bar}"
|
|
|
|
try:
|
|
proc = subprocess.run(argStr, shell=True, capture_output=True, encoding="utf-8")
|
|
|
|
RESPONSE += (
|
|
helpers.utils.commandOutput(proc)
|
|
)
|
|
except IOError:
|
|
RESPONSE += (
|
|
"Problem executing cmdi - subprocess.run(list) Test Case"
|
|
)
|
|
|
|
return RESPONSE
|
|
|