Skip to content

test: add 15 Rust security scanner fixtures #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WNZhao wants to merge 1 commit into
base: master
Choose a base branch
from
Open

test: add 15 Rust security scanner fixtures #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 25 additions & 5 deletions docs/VULNERABILITY_CATALOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ from each file's header comment, so this page cannot drift from the source.

## Totals

- **Test cases:** 127
- **Expected detections:** 127
- **`VULNERABLE:` markers:** 236 (individual lines a scanner should flag)
- **`SAFE:` markers:** 144 (lines a scanner must not flag — the false-positive control group)
- **Languages:** 8 — dotenv, go, java, javascript, json, python, ruby, text
- **Test cases:** 142
- **Expected detections:** 142
- **`VULNERABLE:` markers:** 252 (individual lines a scanner should flag)
- **`SAFE:` markers:** 159 (lines a scanner must not flag — the false-positive control group)
- **Languages:** 9 — dotenv, go, java, javascript, json, python, ruby, rust, text
- **CWE categories:** 89 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-95, CWE-113, CWE-117, CWE-129, CWE-190, CWE-201, CWE-203, CWE-208, CWE-209, CWE-256, CWE-285, CWE-287, CWE-288, CWE-291, CWE-295, CWE-306, CWE-307, CWE-311, CWE-312, CWE-319, CWE-321, CWE-326, CWE-327, CWE-329, CWE-330, CWE-338, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-400, CWE-409, CWE-434, CWE-441, CWE-460, CWE-472, CWE-475, CWE-480, CWE-488, CWE-489, CWE-502, CWE-506, CWE-509, CWE-512, CWE-521, CWE-522, CWE-525, CWE-532, CWE-598, CWE-601, CWE-602, CWE-611, CWE-613, CWE-614, CWE-620, CWE-639, CWE-640, CWE-643, CWE-681, CWE-693, CWE-732, CWE-759, CWE-776, CWE-798, CWE-835, CWE-862, CWE-863, CWE-915, CWE-916, CWE-918, CWE-922, CWE-942, CWE-943, CWE-1021, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357

## How coverage is scored
Expand Down Expand Up @@ -166,6 +166,26 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
| SQL injection via string interpolation in ActiveRecord | [`sqli-string-interpolation.rb`](../vulns/ruby/sqli-string-interpolation.rb) | CWE-89 | critical | yes | 3 vuln / 1 safe |
| XSS via html_safe / raw on untrusted input | [`xss-erb-html-safe.rb`](../vulns/ruby/xss-erb-html-safe.rb) | CWE-79 | high | yes | 3 vuln / 1 safe |

## Rust

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| State-changing request accepted without CSRF verification | [`csrf-missing-token.rs`](../vulns/rust/csrf-missing-token.rs) | CWE-352 | high | yes | 1 vuln / 1 safe |
| Hard-coded encryption key embedded in source | [`hardcoded-crypto-key.rs`](../vulns/rust/hardcoded-crypto-key.rs) | CWE-321 | high | yes | 1 vuln / 1 safe |
| HTTP response splitting through a tainted header value | [`header-injection.rs`](../vulns/rust/header-injection.rs) | CWE-113 | high | yes | 1 vuln / 1 safe |
| IDOR through an unscoped record lookup | [`idor-unscoped-record.rs`](../vulns/rust/idor-unscoped-record.rs) | CWE-639 | high | yes | 1 vuln / 1 safe |
| Predictable recovery token derived from system time | [`insecure-random-token.rs`](../vulns/rust/insecure-random-token.rs) | CWE-330 | high | yes | 1 vuln / 1 safe |
| JWT claims trusted without signature verification | [`jwt-decode-without-verify.rs`](../vulns/rust/jwt-decode-without-verify.rs) | CWE-347 | critical | yes | 1 vuln / 1 safe |
| LDAP filter injection through string interpolation | [`ldap-filter-injection.rs`](../vulns/rust/ldap-filter-injection.rs) | CWE-90 | high | yes | 1 vuln / 1 safe |
| Log injection through unsanitized request data | [`log-injection.rs`](../vulns/rust/log-injection.rs) | CWE-117 | medium | yes | 1 vuln / 1 safe |
| Mass assignment of untrusted account attributes | [`mass-assignment.rs`](../vulns/rust/mass-assignment.rs) | CWE-915 | high | yes | 1 vuln / 1 safe |
| Open redirect via an unvalidated return URL | [`open-redirect.rs`](../vulns/rust/open-redirect.rs) | CWE-601 | medium | yes | 1 vuln / 1 safe |
| Credentialed CORS response reflects an arbitrary origin | [`permissive-cors.rs`](../vulns/rust/permissive-cors.rs) | CWE-942 | high | yes | 2 vuln / 1 safe |
| ReDoS through attacker-controlled pattern compilation | [`regex-dos-user-pattern.rs`](../vulns/rust/regex-dos-user-pattern.rs) | CWE-1333 | medium | yes | 1 vuln / 1 safe |
| Unsafe polymorphic deserialization of untrusted bytes | [`unsafe-polymorphic-deserialization.rs`](../vulns/rust/unsafe-polymorphic-deserialization.rs) | CWE-502 | critical | yes | 1 vuln / 1 safe |
| Password storage with a non-cryptographic hash | [`weak-password-hash.rs`](../vulns/rust/weak-password-hash.rs) | CWE-916 | high | yes | 1 vuln / 1 safe |
| XML parser resolves attacker-controlled external entities | [`xxe-parser.rs`](../vulns/rust/xxe-parser.rs) | CWE-611 | high | yes | 1 vuln / 1 safe |

## Secrets & Credentials

| Test case | File | CWE | Severity | Expected | Markers |
Expand Down
Loading