Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -16,5 +16,5 @@ logs/
/dast-java/target
/tools/library/target
/tools/plugin/target
/tools/library/target
*.pyc
results/
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
// scene introduction = 参数值传递->引用传递->map
// level = 2
// bind_url = cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_005_F/argument_passing_reference_005_F
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_005_F/argument_passing_reference_005_F
// evaluation information end

package main
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
// scene introduction = 参数值传递->引用传递->map
// level = 2
// bind_url = cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T
// bind_url = accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T
// evaluation information end

package main
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
// scene introduction = 返回值传递->函数内交换位置
// level = 2
// bind_url = accuracy/context_sensitive/argument_return_value_passing_value_passing/multiple_return_value_passing_003_F/multiple_return_value_passing_003_F
// bind_url = accuracy/context_sensitive/argument_return_value_passing/multiple_return_value_passing_003_F/multiple_return_value_passing_003_F
// evaluation information end

package main
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->上下文敏感分析->参数/返回值传递
// scene introduction = 返回值传递->函数内交换位置
// level = 2
// bind_url = accuracy/context_sensitive/argument_return_value_passing_value_passing/multiple_return_value_passing_004_T/multiple_return_value_passing_004_T
// bind_url = accuracy/context_sensitive/argument_return_value_passing/multiple_return_value_passing_004_T/multiple_return_value_passing_004_T
// evaluation information end

package main
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

// evaluation information start
// real case = true
// evaluation item = 准确度->对象敏感与域敏感分析->区分一维字典/列表/数组的不同元素->索引值为数字的场景,能够区分不同索引上特定元素的状态(无需求解)
Expand All @@ -7,8 +6,8 @@
// bind_url = accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_no_solver_005_T/array_index_no_solver_005_T
// evaluation information end

// YASA中现在处理memberAccess时,以property的符号字面量作为key进行存取。导致精度损失。
package main

import "os/exec"

func array_index_no_solver_005_T(__taint_src string) {
Expand All @@ -23,8 +22,8 @@ func array_index_no_solver_005_T(__taint_src string) {

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", o.(string)).Run()
}
}
func main() {
__taint_src := "taint_src_value"
array_index_no_solver_005_T(__taint_src)
}
__taint_src := "taint_src_value"
array_index_no_solver_005_T(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->对象敏感与域敏感分析->区分一维字典/列表/数组的不同元素->索引值为数字的场景,能够区分不同索引上特定元素的状态(无需求解)
// scene introduction = 切片->切片截取
// level = 3
// bind_url = accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T
// bind_url = accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_003_T/slice_index_003_T
// evaluation information end

package main
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// evaluation item = 准确度->对象敏感与域敏感分析->区分一维字典/列表/数组的不同元素->索引值为数字的场景,能够区分不同索引上特定元素的状态(无需求解)
// scene introduction = 切片->切片截取
// level = 3
// bind_url = accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_002_F/slice_index_002_F
// bind_url = accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_004_F/slice_index_004_F
// evaluation information end

package main
Expand Down
18 changes: 18 additions & 0 deletions sast-go/cases/accuracy/flow_sensitive/normal_stmt/config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
{
"normal_stmt": [
{
"evaluation_item": "准确度->流敏感分析->常规顺序执行语句",
"scene_levels": [
{
"level": "2",
"scene_list": [
{
"compose": "sequential_assign_001_T/sequential_assign_001_T.go && !sequential_assign_002_F/sequential_assign_002_F.go",
"scene": "顺序赋值语句"
}
]
}
]
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
// evaluation information start
// real case = true
// evaluation item = 准确度->流敏感分析->常规顺序执行语句
// scene introduction = 顺序赋值语句
// level = 2
// bind_url = accuracy/flow_sensitive/normal_stmt/sequential_assign_001_T/sequential_assign_001_T
// date = 2025-12-01 16:19:24
// evaluation information end

package main

import (
"fmt"
"os/exec"
)

func sequentialAssign_001_T(__taint_src string) {
// 场景特点:按顺序执行多个赋值语句
var a string
var b string
a = __taint_src
b = a
__taint_sink(b)
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
sequentialAssign_001_T(__taint_src)
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
// evaluation information start
// real case = false
// evaluation item = 准确度->流敏感分析->常规顺序执行语句
// scene introduction = 顺序赋值语句
// level = 2
// bind_url = accuracy/flow_sensitive/normal_stmt/sequential_assign_002_F/sequential_assign_002_F
// date = 2025-12-01 16:19:24
// evaluation information end

package main

import (
"fmt"
"os/exec"
)

func sequentialAssign_002_F(__taint_src string) {
// 场景特点:按顺序执行多个赋值语句,但污点数据未传播到最终变量
var a string
var b string
a = __taint_src
b = "_"
_ = a // 使用变量a避免编译错误
__taint_sink(b)
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
sequentialAssign_002_F(__taint_src)
}
Empty file.
22 changes: 22 additions & 0 deletions sast-go/cases/accuracy/path_sensitive/exception_throw/config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
{
"exception_throw": [
{
"evaluation_item": "准确度->路径敏感分析->异常抛出和捕获",
"scene_levels": [
{
"level": "3",
"scene_list": [
{
"compose": "exception_catch_001_T/exception_catch_001_T.go && !exception_catch_002_F/exception_catch_002_F.go",
"scene": "异常抛出和捕获->不可控错误处理"
},
{
"compose": "exception_catch_003_T/exception_catch_003_T.go && !exception_catch_004_F/exception_catch_004_F.go",
"scene": "异常抛出和捕获->可控错误处理"
}
]
}
]
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
// evaluation information start
// real case = true
// evaluation item = 准确度->路径敏感分析->异常抛出和捕获
// scene introduction = 异常抛出路径
// level = 3
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_001_T/exception_catch_001_T
// date = 2025-12-01 16:29:18
// evaluation information end

package main

import (
"fmt"
"os/exec"
)

func exception_catch_001_T(__taint_src string) {
// 场景特点:在异常抛出路径中传播污点数据
defer func() {
// recover只能在defer函数中调用,并捕获最新一次panic的值
if r := recover(); r != nil {
__taint_sink(r)
}
}()

// 立即平直当前函数,依次执行 defer 函数
panic(__taint_src)
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
exception_catch_001_T(__taint_src)
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
// evaluation information start
// real case = false
// evaluation item = 准确度->路径敏感分析->异常抛出和捕获
// scene introduction = 异常抛出路径
// level = 3
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_002_F/exception_catch_002_F
// date = 2025-12-01 16:29:18
// evaluation information end

package main

import (
"fmt"
"os/exec"
)

func exception_catch_002_F(__taint_src string) {
// 场景特点:在异常抛出路径中传播污点数据,但污点数据未传播到汇聚点
defer func() {
if r := recover(); r != nil {
__taint_sink("_")
}
}()

panic(__taint_src)
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
exception_catch_002_F(__taint_src)
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
// evaluation information start
// real case = true
// evaluation item = 准确度->路径敏感分析->异常抛出和捕获
// scene introduction = 异常抛出路径
// level = 3
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_003_T/exception_catch_003_T
// date = 2025-12-01 16:29:18
// evaluation information end

package main

import (
"errors"
"fmt"
"os/exec"
)

func exception_catch_003_T(__taint_src string) {
// 场景特点:在异常抛出路径中传播污点数据
errMsg := createThrow(__taint_src)
__taint_sink(errMsg.Error())
}

func createThrow(msg string) error {
return errors.New(msg)
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
exception_catch_003_T(__taint_src)
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
// evaluation information start
// real case = false
// evaluation item = 准确度->路径敏感分析->异常抛出和捕获
// scene introduction = 异常抛出路径
// level = 3
// date = 2025-12-01 16:29:18
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_004_F/exception_catch_004_T
// evaluation information end

package main

import (
"errors"
"fmt"
"os/exec"
)

func exception_catch_003_T(__taint_src string) {
// 场景特点:在异常抛出路径中传播污点数据
errMsg := createThrow(__taint_src)
__taint_sink(errMsg.Error())
}

func createThrow(msg string) error {
return errors.New("_")
}

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}

func main() {
__taint_src := "taint_src_value"
exception_catch_003_T(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import "os/exec"
// evaluation item = 准确度->路径敏感分析->跳转语句
// scene introduction = return
// level = 4+
// bind_url = accuracy/path_sensitive/explicit_jump_control/return/return_001_T/return_001_T
// bind_url = accuracy/path_sensitive/explicit_jump_control/return_001_T/return_001_T
// evaluation information end

func return_001_T(__taint_src string) string {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import "os/exec"
// evaluation item = 准确度->路径敏感分析->跳转语句
// scene introduction = return
// level = 4+
// bind_url = accuracy/path_sensitive/explicit_jump_control/return/return_002_F/return_002_F
// bind_url = accuracy/path_sensitive/explicit_jump_control/return_002_F/return_002_F
// evaluation information end

func return_002_F(__taint_src string) string {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
package main
import "os/exec"

import "os/exec"

// evaluation information start
// real case = true
// evaluation item = 准确度->路径敏感分析->条件语句、条件表达式和循环结构->无需通过对不同的条件进行求解,即能够区分不同的执行路径的状态
// scene introduction = if->区分if else扁平化与分支(不求解)
// level = 3
// bind_url = accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_001_F/conditional_if_no_solver_001_F
// bind_url = accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_001_T/conditional_if_no_solver_001_T
// evaluation information end

func conditional_if_no_solver_001_F(__taint_src string) {
Expand All @@ -21,9 +21,9 @@ func conditional_if_no_solver_001_F(__taint_src string) {

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", o.(string)).Run()
}
}

func main() {
__taint_src := "taint_src_value"
conditional_if_no_solver_001_F(__taint_src)
}
__taint_src := "taint_src_value"
conditional_if_no_solver_001_F(__taint_src)
}
Loading
Loading