up

bench/reachability-benchmark/benchmark/truth/java-micronaut-deserialize.json

@@ -0,0 +1,34 @@
+{
+  "version": "1.0.0",
+  "cases": [
+    {
+      "case_id": "java-micronaut-deserialize:203",
+      "case_version": "1.0.0",
+      "notes": "Micronaut-style controller deserializes base64 payload",
+      "sinks": [
+        {
+          "sink_id": "MicronautDeserialize::handleUpload",
+          "label": "reachable",
+          "confidence": "high",
+          "dynamic_evidence": {
+            "covered_by_tests": [
+              "src/ControllerTest.java"
+            ],
+            "coverage_files": [
+              "outputs/coverage.json"
+            ]
+          },
+          "static_evidence": {
+            "call_path": [
+              "POST /mn/upload",
+              "Controller.handleUpload",
+              "ObjectInputStream.readObject"
+            ]
+          },
+          "config_conditions": [],
+          "notes": "No guard; ObjectInputStream invoked on user-controlled bytes"
+        }
+      ]
+    }
+  ]
+}

bench/reachability-benchmark/benchmark/truth/java-micronaut-guarded.json

@@ -0,0 +1,35 @@
+{
+  "version": "1.0.0",
+  "cases": [
+    {
+      "case_id": "java-micronaut-guarded:204",
+      "case_version": "1.0.0",
+      "notes": "Deserialization guarded by ALLOW_MN_DESER flag (unreachable by default)",
+      "sinks": [
+        {
+          "sink_id": "MicronautDeserializeGuarded::handleUpload",
+          "label": "unreachable",
+          "confidence": "high",
+          "dynamic_evidence": {
+            "covered_by_tests": [
+              "src/ControllerTest.java"
+            ],
+            "coverage_files": [
+              "outputs/coverage.json"
+            ]
+          },
+          "static_evidence": {
+            "call_path": [
+              "POST /mn/upload",
+              "Controller.handleUpload"
+            ]
+          },
+          "config_conditions": [
+            "ALLOW_MN_DESER=true"
+          ],
+          "notes": "Feature flag defaults to false; sink not executed without ALLOW_MN_DESER"
+        }
+      ]
+    }
+  ]
+}

bench/reachability-benchmark/benchmark/truth/java-spring-deserialize.json

@@ -14,7 +14,9 @@
             "covered_by_tests": [
               "src/AppTest.java"
             ],
-            "coverage_files": []
+            "coverage_files": [
+              "outputs/coverage.json"
+            ]
           },
           "static_evidence": {
             "call_path": [

bench/reachability-benchmark/benchmark/truth/java-spring-guarded.json

@@ -12,7 +12,7 @@
           "confidence": "high",
           "dynamic_evidence": {
             "covered_by_tests": ["src/AppTest.java"],
-            "coverage_files": []
+            "coverage_files": ["outputs/coverage.json"]
           },
           "static_evidence": {
             "call_path": [

bench/reachability-benchmark/benchmark/truth/java-spring-reflection.json

@@ -0,0 +1,34 @@
+{
+  "version": "1.0.0",
+  "cases": [
+    {
+      "case_id": "java-spring-reflection:205",
+      "case_version": "1.0.0",
+      "notes": "Reflection endpoint loads arbitrary classes supplied by caller",
+      "sinks": [
+        {
+          "sink_id": "SpringReflection::run",
+          "label": "reachable",
+          "confidence": "high",
+          "dynamic_evidence": {
+            "covered_by_tests": [
+              "src/ReflectControllerTest.java"
+            ],
+            "coverage_files": [
+              "outputs/coverage.json"
+            ]
+          },
+          "static_evidence": {
+            "call_path": [
+              "POST /api/reflect",
+              "ReflectController.run",
+              "Class.forName"
+            ]
+          },
+          "config_conditions": [],
+          "notes": "User-controlled class name flows into Class.forName and reflection instantiation"
+        }
+      ]
+    }
+  ]
+}