up

bench/reachability-benchmark/cases/java/spring-reflection/case.yaml

@@ -0,0 +1,48 @@
+id: "java-spring-reflection:205"
+language: java
+project: spring-reflection
+version: "1.0.0"
+description: "Spring-style controller exposes reflection endpoint that loads arbitrary classes"
+entrypoints:
+  - "POST /api/reflect"
+sinks:
+  - id: "SpringReflection::run"
+    path: "bench.reachability.springreflection.ReflectController.run"
+    kind: "custom"
+    location:
+      file: src/ReflectController.java
+      line: 7
+    notes: "User-controlled Class.forName + newInstance"
+environment:
+  os_image: "eclipse-temurin:21-jdk"
+  runtime:
+    java: "21"
+  source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
+build:
+  command: "./build/build.sh"
+  source_date_epoch: 1730000000
+  outputs:
+    artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
+    coverage_path: outputs/coverage.json
+    traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
+test:
+  command: "./build/build.sh"
+  expected_coverage: []
+  expected_traces: []
+  env:
+    JAVA_TOOL_OPTIONS: "-ea"
+ground_truth:
+  summary: "Reflection sink reachable with user-controlled class name"
+  evidence_files:
+    - "../benchmark/truth/java-spring-reflection.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"