Skip to content

Commit e3ba8bd

Browse files
curryooocurryooo
authored
Curry250211 (#125)
* base_url订正 * 问题review订正 * 不分case levle使用+ * fix config.json DifferentIfBranch_ArrayLength_002_F.java * 准确度case * sast case update * sast case update * case update * case update * case update * case update * update case cross * case update cross case error * case update&fromat * case error * tools update
1 parent 75ac4c0 commit e3ba8bd

File tree

574 files changed

+3733
-5652
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

574 files changed

+3733
-5652
lines changed

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,5 @@ iast-java/logs/
1111
logs/
1212
*.log
1313
*.iml
14-
*/.DS_Store
14+
*/.DS_Store
15+
.DS_Store

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/DifferentParamsForFunction_005_T.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/DifferentParamsForFunction_005_T.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import org.springframework.web.bind.annotation.PostMapping;
44
import org.springframework.web.bind.annotation.RequestMapping;
@@ -9,17 +9,17 @@
99
import java.util.Map;
1010

1111
/**
12-
* Introduction 上下文敏感-相同函数调用不同参数-VarargArrayAccess
13-
* Level 3
12+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->VarargArrayAccess
13+
* Level 2
1414
* Date 2024-06-28
1515
*/
1616
// evaluation information start
1717
// real case = true
18-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->VarargArrayAccess
19-
// bind_url = accuracy/context_sensitive/argument_value_passing/DifferentParamsForFunction_005_T
18+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
19+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/DifferentParamsForFunction_005_T
2020
// evaluation information end
2121
@RestController()
22-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
22+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2323
public class DifferentParamsForFunction_005_T {
2424
@PostMapping("DifferentParamsForFunction_005_T")
2525
public Map<String, Object> testcase(@RequestParam String cmd) {

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/DifferentParamsForFunction_006_F.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/DifferentParamsForFunction_006_F.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import org.springframework.web.bind.annotation.PostMapping;
44
import org.springframework.web.bind.annotation.RequestMapping;
@@ -9,18 +9,18 @@
99
import java.util.Map;
1010

1111
/**
12-
* Introduction 上下文敏感-相同函数调用不同参数-VarargArrayAccess
13-
* Level 3
12+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->VarargArrayAccess
13+
* Level 2
1414
* Date 2024-06-28
1515
*/
1616
// evaluation information start
1717
// real case = false
18-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->VarargArrayAccess
19-
// bind_url = accuracy/context_sensitive/argument_value_passing/DifferentParamsForFunction_006_F
18+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
19+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/DifferentParamsForFunction_006_F
2020
// evaluation information end
2121

2222
@RestController()
23-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
23+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2424
public class DifferentParamsForFunction_006_F {
2525
@PostMapping("DifferentParamsForFunction_006_F")
2626
public Map<String, Object> testcase(@RequestParam String cmd) {

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_CallExpression_Package_001_T.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_CallExpression_Package_001_T.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import org.springframework.web.bind.annotation.GetMapping;
44
import org.springframework.web.bind.annotation.PathVariable;
@@ -9,19 +9,19 @@
99
import java.util.Map;
1010

1111
/**
12-
* Introduction 污点链路样本中的表达式-变量赋值表达式直接引入而不是import
13-
* Level X
12+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->变量赋值表达式直接引入而不是import
13+
* Level 2
1414
* Date 2024-05-09
1515
*/
1616
// evaluation information start
1717
// real case = true
18-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->变量赋值表达式直接引入而不是import
19-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_CallExpression_Package_001_T
18+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
19+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_CallExpression_Package_001_T/{url}
2020
// evaluation information end
2121
@RestController()
22-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
22+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2323
public class Expression_CallExpression_Package_001_T {
24-
@GetMapping("Expression_NewExpression_Package_001_T/{url}")
24+
@GetMapping("Expression_CallExpression_Package_001_T/{url}")
2525
public Map<String, Object> aTaintCase0157(@PathVariable String url) {
2626

2727
Map<String, Object> modelMap = new HashMap<>();

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_CallExpression_Package_002_F.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_CallExpression_Package_002_F.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import org.springframework.web.bind.annotation.GetMapping;
44
import org.springframework.web.bind.annotation.PathVariable;
@@ -9,19 +9,19 @@
99
import java.util.Map;
1010

1111
/**
12-
* Introduction 污点链路样本中的表达式-变量赋值表达式直接引入而不是import
13-
* Level X
12+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->变量赋值表达式直接引入而不是import
13+
* Level 2
1414
* Date 2024-05-09
1515
*/
1616
// evaluation information start
1717
// real case = false
18-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->变量赋值表达式直接引入而不是import
19-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_CallExpression_Package_002_F
18+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
19+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_CallExpression_Package_002_F/{url}
2020
// evaluation information end
2121
@RestController()
22-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
22+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2323
public class Expression_CallExpression_Package_002_F {
24-
@GetMapping("Expression_NewExpression_Package_002_F/{url}")
24+
@GetMapping("Expression_CallExpression_Package_002_F/{url}")
2525
public Map<String, Object> aTaintCase0157(@PathVariable String url) {
2626

2727
Map<String, Object> modelMap = new HashMap<>();

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_001_T.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_001_T.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import com.sast.astbenchmark.common.utils.CmdUtil;
44
import org.springframework.web.bind.annotation.GetMapping;
@@ -10,24 +10,24 @@
1010
import java.util.Map;
1111

1212
/**
13-
* Introduction 污点链路样本中的表达式-中缀表达式样本
13+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->ast对象->函数调用
1414
* Level 2
1515
* Date 2024-05-09
1616
*/
1717
// evaluation information start
1818
// real case = true
19-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->ast对象->函数调用
20-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_001_T
19+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
20+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_001_T/{cmd}
2121
// evaluation information end
2222
@RestController()
23-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
23+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2424
public class Expression_MethodInvocation_001_T {
2525
@GetMapping("Expression_MethodInvocation_001_T/{cmd}")
2626
public Map<String, Object> aTaintCase013(@PathVariable String cmd) {
2727

2828
Map<String, Object> modelMap = new HashMap<>();
2929
try {
30-
CmdUtil.run(cmd+"|grep a");
30+
CmdUtil.run(cmd + "|grep a");
3131
modelMap.put("status", "success");
3232
} catch (Exception e) {
3333
modelMap.put("status", "error");

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_002_F.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_002_F.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import com.sast.astbenchmark.common.utils.CmdUtil;
44
import org.springframework.web.bind.annotation.GetMapping;
@@ -10,25 +10,25 @@
1010
import java.util.Map;
1111

1212
/**
13-
* Introduction 污点链路样本中的表达式-中缀表达式样本
13+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->ast对象->函数调用
1414
* Level 2
1515
* Date 2024-05-09
1616
*/
1717
// evaluation information start
1818
// real case = false
19-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->ast对象->函数调用
20-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_002_F
19+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
20+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_002_F/{cmd}
2121
// evaluation information end
2222
@RestController()
23-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
23+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2424
public class Expression_MethodInvocation_002_F {
2525
@GetMapping("Expression_MethodInvocation_002_F/{cmd}")
2626
public Map<String, Object> aTaintCase013(@PathVariable String cmd) {
2727

2828
Map<String, Object> modelMap = new HashMap<>();
2929
cmd = "safe";
3030
try {
31-
CmdUtil.run(cmd+"|grep a");
31+
CmdUtil.run(cmd + "|grep a");
3232
modelMap.put("status", "success");
3333
} catch (Exception e) {
3434
modelMap.put("status", "error");

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_InfixExpression_001_T.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_InfixExpression_001_T.java

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import com.sast.astbenchmark.common.utils.CmdUtil;
44
import com.sast.astbenchmark.common.utils.HttpUtil;
@@ -11,25 +11,26 @@
1111
import java.util.Map;
1212

1313
/**
14-
* Introduction 污点链路样本中的表达式-中缀表达式+函数调用表达式
14+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->中缀表达式
1515
* Level 2
1616
* Date 2024-05-09
1717
*/
1818
// evaluation information start
1919
// real case = true
20-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->中缀表达式
21-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_InfixExpression_001_T
20+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
21+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing
22+
// /Expression_MethodInvocation_InfixExpression_001_T/{cmd}
2223
// evaluation information end
2324
@RestController()
24-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
25+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2526
public class Expression_MethodInvocation_InfixExpression_001_T {
2627
@GetMapping("Expression_MethodInvocation_InfixExpression_001_T/{cmd}")
2728
public Map<String, Object> aTaintCase014(@PathVariable String cmd) {
2829

2930
Map<String, Object> modelMap = new HashMap<>();
3031

3132
try {
32-
CmdUtil.run(cmd+ HttpUtil.doGet("www.test.com"));
33+
CmdUtil.run(cmd + HttpUtil.doGet("www.test.com"));
3334
modelMap.put("status", "success");
3435
} catch (Exception e) {
3536
modelMap.put("status", "error");

sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_InfixExpression_002_F.java renamed to sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/argument_value_passing/Expression_MethodInvocation_InfixExpression_002_F.java

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_value_passing;
1+
package com.sast.astbenchmark.case_language_maturity.accuracy.context_sensitive.argument_return_value_passing.argument_value_passing;
22

33
import com.sast.astbenchmark.common.utils.CmdUtil;
44
import com.sast.astbenchmark.common.utils.HttpUtil;
@@ -11,25 +11,26 @@
1111
import java.util.Map;
1212

1313
/**
14-
* Introduction 污点链路样本中的表达式-中缀表达式+函数调用表达式
14+
* Introduction 准确度->上下文敏感分析->参数/返回值传递->参数值传递->中缀表达式
1515
* Level 2
1616
* Date 2024-05-09
1717
*/
1818
// evaluation information start
1919
// real case = false
20-
// evaluation item = 准确度->上下文敏感->相同函数调用不同参数->中缀表达式
21-
// bind_url = accuracy/context_sensitive/argument_value_passing/Expression_MethodInvocation_InfixExpression_002_F
20+
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
21+
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_value_passing
22+
// /Expression_MethodInvocation_InfixExpression_002_F/{cmd}
2223
// evaluation information end
2324
@RestController()
24-
@RequestMapping("accuracy/context_sensitive/argument_value_passing")
25+
@RequestMapping("accuracy/context_sensitive/argument_return_value_passing/argument_value_passing")
2526
public class Expression_MethodInvocation_InfixExpression_002_F {
2627
@GetMapping("Expression_MethodInvocation_InfixExpression_002_F/{cmd}")
2728
public Map<String, Object> aTaintCase014(@PathVariable String cmd) {
2829

2930
Map<String, Object> modelMap = new HashMap<>();
3031
cmd = "safe";
3132
try {
32-
CmdUtil.run(cmd+ HttpUtil.doGet("www.test.com"));
33+
CmdUtil.run(cmd + HttpUtil.doGet("www.test.com"));
3334
modelMap.put("status", "success");
3435
} catch (Exception e) {
3536
modelMap.put("status", "error");

‎sast-java/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/argument_return_value_passing/config.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"argument_return_value_passing": [
3+
{
4+
"evaluation item": "准确度->上下文敏感分析->参数/返回值传递",
5+
"level": "2",
6+
"scene_list": [
7+
{
8+
"compose": "DifferentParamsForFunction_005_T.java && !DifferentParamsForFunction_006_F.java",
9+
"scene": "参数值传递->VarargArrayAccess"
10+
},
11+
{
12+
"compose": "Expression_CallExpression_Package_001_T.java && !Expression_CallExpression_Package_002_F.java",
13+
"scene": "参数值传递->变量赋值表达式直接引入而不是import"
14+
},
15+
{
16+
"compose": "Expression_MethodInvocation_001_T.java && !Expression_MethodInvocation_002_F.java",
17+
"scene": "参数值传递->ast对象->函数调用"
18+
},
19+
{
20+
"compose": "Expression_MethodInvocation_InfixExpression_001_T.java && !Expression_MethodInvocation_InfixExpression_002_F.java",
21+
"scene": "参数值传递->中缀表达式"
22+
},
23+
{
24+
"compose": "return_value_passing_001_T.java && !return_value_passing_002_F.java",
25+
"scene": "返回值传递"
26+
}
27+
]
28+
}
29+
]
30+
}

0 commit comments

Comments
 (0)