Skip to content

test: add fifteen Java vulnerability fixtures #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WNZhao wants to merge 3 commits into
base: master
Choose a base branch
from
Open

test: add fifteen Java vulnerability fixtures #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a82d9c
test: add Java path traversal fixture
WNZhao Aug 24, 2026
2129fbd
test: add four Java security fixtures
WNZhao Aug 24, 2026
c527da3
test: add ten Java security fixtures
WNZhao Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions docs/VULNERABILITY_CATALOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ from each file's header comment, so this page cannot drift from the source.

## Totals

- **Test cases:** 127
- **Expected detections:** 127
- **`VULNERABLE:` markers:** 236 (individual lines a scanner should flag)
- **`SAFE:` markers:** 144 (lines a scanner must not flag — the false-positive control group)
- **Test cases:** 142
- **Expected detections:** 142
- **`VULNERABLE:` markers:** 251 (individual lines a scanner should flag)
- **`SAFE:` markers:** 159 (lines a scanner must not flag — the false-positive control group)
- **Languages:** 8 — dotenv, go, java, javascript, json, python, ruby, text
- **CWE categories:** 89 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-95, CWE-113, CWE-117, CWE-129, CWE-190, CWE-201, CWE-203, CWE-208, CWE-209, CWE-256, CWE-285, CWE-287, CWE-288, CWE-291, CWE-295, CWE-306, CWE-307, CWE-311, CWE-312, CWE-319, CWE-321, CWE-326, CWE-327, CWE-329, CWE-330, CWE-338, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-400, CWE-409, CWE-434, CWE-441, CWE-460, CWE-472, CWE-475, CWE-480, CWE-488, CWE-489, CWE-502, CWE-506, CWE-509, CWE-512, CWE-521, CWE-522, CWE-525, CWE-532, CWE-598, CWE-601, CWE-602, CWE-611, CWE-613, CWE-614, CWE-620, CWE-639, CWE-640, CWE-643, CWE-681, CWE-693, CWE-732, CWE-759, CWE-776, CWE-798, CWE-835, CWE-862, CWE-863, CWE-915, CWE-916, CWE-918, CWE-922, CWE-942, CWE-943, CWE-1021, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357
- **CWE categories:** 90 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-95, CWE-113, CWE-117, CWE-129, CWE-190, CWE-201, CWE-203, CWE-208, CWE-209, CWE-256, CWE-285, CWE-287, CWE-288, CWE-291, CWE-295, CWE-297, CWE-306, CWE-307, CWE-311, CWE-312, CWE-319, CWE-321, CWE-326, CWE-327, CWE-329, CWE-330, CWE-338, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-400, CWE-409, CWE-434, CWE-441, CWE-460, CWE-472, CWE-475, CWE-480, CWE-488, CWE-489, CWE-502, CWE-506, CWE-509, CWE-512, CWE-521, CWE-522, CWE-525, CWE-532, CWE-598, CWE-601, CWE-602, CWE-611, CWE-613, CWE-614, CWE-620, CWE-639, CWE-640, CWE-643, CWE-681, CWE-693, CWE-732, CWE-759, CWE-776, CWE-798, CWE-835, CWE-862, CWE-863, CWE-915, CWE-916, CWE-918, CWE-922, CWE-942, CWE-943, CWE-1021, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357

## How coverage is scored

Expand All @@ -39,10 +39,25 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| AES configured with deterministic ECB mode | [`aes-ecb-mode.java`](../vulns/java/aes-ecb-mode.java) | CWE-327 | high | yes | 1 vuln / 1 safe |
| Trojanized logging library that exfiltrates sensitive data to a remote endpoint | [`cwe-512-java.java`](../vulns/java/cwe-512-java.java) | CWE-512 | critical | yes | 1 vuln / 1 safe |
| Insecure deserialisation via ObjectInputStream | [`deserialization-object-input-stream.java`](../vulns/java/deserialization-object-input-stream.java) | CWE-502 | critical | yes | 2 vuln / 2 safe |
| Hardcoded AES key embedded in application code | [`hardcoded-crypto-key.java`](../vulns/java/hardcoded-crypto-key.java) | CWE-321 | high | yes | 1 vuln / 1 safe |
| HTTP response splitting through an unsanitized header value | [`header-injection-map.java`](../vulns/java/header-injection-map.java) | CWE-113 | high | yes | 1 vuln / 1 safe |
| TLS hostname verification disabled by unconditional approval | [`hostname-verifier-always-true.java`](../vulns/java/hostname-verifier-always-true.java) | CWE-297 | high | yes | 1 vuln / 1 safe |
| IDOR through lookup without an ownership check | [`idor-document-lookup.java`](../vulns/java/idor-document-lookup.java) | CWE-639 | high | yes | 1 vuln / 1 safe |
| Predictable security token generated with java.util.Random | [`insecure-random-token.java`](../vulns/java/insecure-random-token.java) | CWE-330 | high | yes | 1 vuln / 1 safe |
| Integer overflow in caller-controlled size calculation | [`integer-overflow-product.java`](../vulns/java/integer-overflow-product.java) | CWE-190 | medium | yes | 1 vuln / 1 safe |
| LDAP filter injection through string concatenation | [`ldap-filter-injection.java`](../vulns/java/ldap-filter-injection.java) | CWE-90 | high | yes | 1 vuln / 1 safe |
| Open redirect through an unvalidated return URL | [`open-redirect-uri.java`](../vulns/java/open-redirect-uri.java) | CWE-601 | medium | yes | 1 vuln / 1 safe |
| Path traversal via untrusted child path | [`path-traversal-file.java`](../vulns/java/path-traversal-file.java) | CWE-22 | high | yes | 1 vuln / 1 safe |
| Permissive CORS response reflects an arbitrary origin | [`permissive-cors-header.java`](../vulns/java/permissive-cors-header.java) | CWE-942 | medium | yes | 1 vuln / 1 safe |
| SQL injection via Statement string concatenation | [`sqli-statement-concat.java`](../vulns/java/sqli-statement-concat.java) | CWE-89 | critical | yes | 2 vuln / 1 safe |
| TLS certificate validation disabled by a trust-all manager | [`trust-all-certificate-manager.java`](../vulns/java/trust-all-certificate-manager.java) | CWE-295 | high | yes | 1 vuln / 1 safe |
| Unsafe reflection method invocation on attacker-controlled class and method names | [`cwe-472-java.java`](../vulns/java/cwe-472-java.java) | CWE-472 | high | yes | 1 vuln / 1 safe |
| Regular-expression injection through an untrusted pattern | [`untrusted-regex-compile.java`](../vulns/java/untrusted-regex-compile.java) | CWE-1333 | medium | yes | 1 vuln / 1 safe |
| Unvalidated user-controlled array index | [`unvalidated-array-index.java`](../vulns/java/unvalidated-array-index.java) | CWE-129 | medium | yes | 1 vuln / 1 safe |
| Password hashing with fast MD5 digest | [`weak-password-hash-md5.java`](../vulns/java/weak-password-hash-md5.java) | CWE-327 | high | yes | 1 vuln / 1 safe |
| Reflected XSS via HttpServletResponse writer | [`xss-response-writer.java`](../vulns/java/xss-response-writer.java) | CWE-79 | high | yes | 2 vuln / 2 safe |
| XXE via unconfigured DocumentBuilderFactory | [`xxe-document-builder.java`](../vulns/java/xxe-document-builder.java) | CWE-611 | high | yes | 2 vuln / 1 safe |

Expand Down
Loading