up

bench/reachability-benchmark/cases/java/micronaut-deserialize/case.yaml

@@ -0,0 +1,48 @@
+id: "java-micronaut-deserialize:203"
+language: java
+project: micronaut-deserialize
+version: "1.0.0"
+description: "Micronaut-style controller performs unsafe deserialization on request payload"
+entrypoints:
+  - "POST /mn/upload"
+sinks:
+  - id: "MicronautDeserialize::handleUpload"
+    path: "bench.reachability.micronaut.Controller.handleUpload"
+    kind: "custom"
+    location:
+      file: src/Controller.java
+      line: 10
+    notes: "ObjectInputStream on user-controlled payload"
+environment:
+  os_image: "eclipse-temurin:21-jdk"
+  runtime:
+    java: "21"
+  source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
+build:
+  command: "./build/build.sh"
+  source_date_epoch: 1730000000
+  outputs:
+    artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
+    coverage_path: outputs/coverage.json
+    traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
+test:
+  command: "./build/build.sh"
+  expected_coverage: []
+  expected_traces: []
+  env:
+    JAVA_TOOL_OPTIONS: "-ea"
+ground_truth:
+  summary: "Deserialization reachable"
+  evidence_files:
+    - "../benchmark/truth/java-micronaut-deserialize.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/java/micronaut-deserialize/entrypoints.yaml

@@ -0,0 +1,8 @@
+case_id: "java-micronaut-deserialize:203"
+entries:
+  http:
+    - id: "POST /mn/upload"
+      route: "/mn/upload"
+      method: "POST"
+      handler: "Controller.handleUpload"
+      description: "Binary payload base64-deserialized"

bench/reachability-benchmark/cases/java/micronaut-deserialize/pom.xml

@@ -0,0 +1,12 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>org.stellaops.bench</groupId>
+  <artifactId>micronaut-deserialize</artifactId>
+  <version>1.0.0</version>
+  <packaging>jar</packaging>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+</project>

bench/reachability-benchmark/cases/java/micronaut-deserialize/src/Controller.java

@@ -0,0 +1,24 @@
+package bench.reachability.micronaut;
+
+import java.util.Map;
+import java.util.Base64;
+import java.io.*;
+
+public class Controller {
+    // Unsafe deserialization sink (reachable)
+    public static Response handleUpload(Map<String, String> body) {
+        String payload = body.get("payload");
+        if (payload == null) {
+            return new Response(400, "bad request");
+        }
+        try (ObjectInputStream ois = new ObjectInputStream(
+                new ByteArrayInputStream(Base64.getDecoder().decode(payload)))) {
+            Object obj = ois.readObject();
+            return new Response(200, obj.toString());
+        } catch (Exception ex) {
+            return new Response(500, ex.getClass().getSimpleName());
+        }
+    }
+
+    public record Response(int status, String body) {}
+}

bench/reachability-benchmark/cases/java/micronaut-deserialize/src/ControllerTest.java

@@ -0,0 +1,29 @@
+package bench.reachability.micronaut;
+
+import java.io.*;
+import java.util.*;
+import java.util.Base64;
+
+// Simple assertion-based oracle (JUnit-free for offline determinism)
+public class ControllerTest {
+    private static String serialize(Object obj) throws IOException {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        try (ObjectOutputStream oos = new ObjectOutputStream(bos)) {
+            oos.writeObject(obj);
+        }
+        return Base64.getEncoder().encodeToString(bos.toByteArray());
+    }
+
+    public static void main(String[] args) throws Exception {
+        Map<String, String> body = Map.of("payload", serialize("micronaut"));
+        var res = Controller.handleUpload(body);
+        assert res.status() == 200 : "status";
+        assert res.body().equals("micronaut") : "body";
+
+        File outDir = new File("outputs");
+        outDir.mkdirs();
+        try (FileWriter fw = new FileWriter(new File(outDir, "SINK_REACHED"))) {
+            fw.write("true");
+        }
+    }
+}