stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

Refactor JSON structures for reachability cases in reachbench-2025

Browse Source 
- Updated symbols.json for rust-axum-header-parsing-TBD to include case_id and schema_version, removing unnecessary components.
- Modified vex.openvex.json for rust-axum-header-parsing-TBD to change author and role, and updated vulnerability status.
- Simplified attestation.dsse.json for wordpress-core-CVE-2022-21661-sqli to remove unnecessary fields and added payloadType.
- Adjusted callgraph.framework.json and callgraph.static.json for wordpress-core-CVE-2022-21661-sqli to include empty nodes and edges with updated schema_version.
- Enhanced manifest.json for wordpress-core-CVE-2022-21661-sqli to include case_id and files with checksums, and updated schema_version.
- Updated reachgraph.truth.json for wordpress-core-CVE-2022-21661-sqli to reflect empty paths and added case_id.
- Modified sbom.cdx.json and sbom.spdx.json for wordpress-core-CVE-2022-21661-sqli to include metadata and updated specVersion.
- Refined symbols.json for wordpress-core-CVE-2022-21661-sqli to include case_id and schema_version, with an empty symbols array.
- Updated vex.openvex.json for wordpress-core-CVE-2022-21661-sqli to change author and role, and updated vulnerability status.
- Adjusted unreachable cases for wordpress-core-CVE-2022-21661-sqli to reflect similar structural changes as reachable cases.
This commit is contained in:
master
2025-11-19 00:24:12 +02:00
parent 33c7e77273
commit 616ec73133
416 changed files with 2378 additions and 4824 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/attestation.dsse.json
View File

@@ -1,30 +1,5 @@
{
"dsse_version": "1.0",
"subject": [
{
"name": "ghcr.io/reachbench/rust-axum-header-parsing-TBD:reachable",
"digest": {
"sha256": "STUB_DIGEST"
}
}
],
"statement": {
"type": "reachbench.attestation",
"materials": [
"sbom.cdx.json",
"sbom.spdx.json",
"symbols.json",
"callgraph.static.json",
"callgraph.framework.json",
"reachgraph.truth.json",
"vex.openvex.json"
]
},
"signatures": [
{
"keyid": "STUB",
"sig": "STUB_SIGNATURE",
"alg": "dilithium2"
}
]
"payload": "",
"payloadType": "application/vnd.in-toto+json",
"signatures": []
}

5
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/callgraph.framework.json
View File

@@ -1,4 +1,5 @@
{
"schema_version": "1.0",
"edges": []
"edges": [],
"nodes": [],
"schema_version": "reachbench.callgraph.framework/v1"
}

19
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/callgraph.static.json
View File

@@ -1,18 +1,5 @@
{
"schema_version": "1.0",
"nodes": [
{
"sid": "sym://rust:rust.c#entry"
},
{
"sid": "sym://rust:rust.c#sink"
}
],
"edges": [
{
"from": "sym://rust:rust.c#entry",
"to": "sym://rust:rust.c#sink",
"kind": "direct"
}
]
"edges": [],
"nodes": [],
"schema_version": "reachbench.callgraph.static/v1"
}

17
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/manifest.json
View File

@@ -1,8 +1,15 @@
{
"image": "ghcr.io/reachbench/rust-axum-header-parsing-TBD:reachable",
"config_flags": {
"FEATURE_FLAG": true,
"POLICY_MODE": "permissive"
"case_id": "rust-axum-header-parsing-TBD",
"files": {
"attestation.dsse.json": "12ced21ccc633b0f458df44e276c954ccdbb14c5acd0d234fdf7934eec48696f",
"callgraph.framework.json": "86ebf343e4b684a3bf2b3200e0bd1849397ea69f280330b1095aceefdff799ce",
"callgraph.static.json": "99c850cccba6641635d1c668f831c80667930ddcd1f7acb2fe9c4c7771c63e7e",
"reachgraph.truth.json": "f34d41548950529728b47d39699260a5a3b496f5b729c7981ef2d70622136df9",
"sbom.cdx.json": "ff9bfeeef7e41d934a051d5c4e20965819d2c4be0ff9ad68ba250eccae3aa487",
"sbom.spdx.json": "1de691c4665d49162633b6571bd142fbfdcf79a0c8bdfb6bbf8f8d4783587d01",
"symbols.json": "fc3923137f963fe08398a0cfc11d51d063104758ea574705476bb5fb07b0d6e0",
"vex.openvex.json": "f0aa98d011f0012ff230c44f69aaed51847a4ad9930bac52aa4467405c2122f5"
},
"sha256": "STUB_DIGEST"
"schema_version": "reachbench.manifest/v1",
"variant": "reachable"
}

12
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/reachgraph.truth.json
View File

@@ -1,16 +1,12 @@
{
"schema_version": "1.0",
"sinks": [
{
"sid": "sym://rust:rust.c#sink",
"kind": "generic"
}
],
"case_id": "rust-axum-header-parsing-TBD",
"paths": [
[
"sym://net:handler#read",
"sym://rust:rust.c#entry",
"sym://rust:rust.c#sink"
]
]
],
"schema_version": "reachbench.reachgraph.truth/v1",
"variant": "reachable"
}

10
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/sbom.cdx.json
View File

@@ -1,5 +1,11 @@
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"components": []
"components": [],
"metadata": {
"component": {
"name": "rust-axum-header-parsing-TBD",
"version": "0.0.0"
}
},
"specVersion": "1.5"
}

8
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/sbom.spdx.json
View File

@@ -1,6 +1,6 @@
{
"spdxVersion": "SPDX-3.0",
"creationInfo": {
"created": "2025-11-07T22:40:04Z"
}
"SPDXID": "SPDXRef-DOCUMENT",
"name": "rust-axum-header-parsing-TBD",
"packages": [],
"spdxVersion": "SPDX-2.3"
}

35
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/symbols.json
View File

@@ -1,31 +1,8 @@
{
"schema_version": "1.0",
"components": [
{
"purl": "pkg:generic/rust@0.0.1",
"files": [
{
"path": "/src/rust.c",
"funcs": [
{
"sid": "sym://rust:rust.c#entry",
"name": "entry",
"range": {
"start": 10,
"end": 20
}
},
{
"sid": "sym://rust:rust.c#sink",
"name": "sink",
"range": {
"start": 30,
"end": 60
}
}
]
}
]
}
]
"case_id": "rust-axum-header-parsing-TBD",
"schema_version": "reachbench.symbols/v1",
"symbols": [
"sym://rust:rust.c#sink"
],
"variant": "reachable"
}

15
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/reachable/vex.openvex.json
View File

@@ -1,12 +1,15 @@
{
"author": "reachbench-2025",
"timestamp": "2025-11-07T22:40:04Z",
"author": "StellaOps",
"role": "reachbench",
"statements": [
{
"vulnerability": "TBD",
"products": [
"pkg:rust-axum-header-parsing-TBD"
],
"status": "affected",
"justification": "reasoning_provided",
"impact_statement": "Function-level path is reachable."
"statusJustification": "component_present",
"vulnerability": "rust-axum-header-parsing-TBD"
}
]
],
"timestamp": "2025-11-18T00:00:00Z"
}

31
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/attestation.dsse.json
View File

@@ -1,30 +1,5 @@
{
"dsse_version": "1.0",
"subject": [
{
"name": "ghcr.io/reachbench/rust-axum-header-parsing-TBD:unreachable",
"digest": {
"sha256": "STUB_DIGEST"
}
}
],
"statement": {
"type": "reachbench.attestation",
"materials": [
"sbom.cdx.json",
"sbom.spdx.json",
"symbols.json",
"callgraph.static.json",
"callgraph.framework.json",
"reachgraph.truth.json",
"vex.openvex.json"
]
},
"signatures": [
{
"keyid": "STUB",
"sig": "STUB_SIGNATURE",
"alg": "dilithium2"
}
]
"payload": "",
"payloadType": "application/vnd.in-toto+json",
"signatures": []
}

5
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/callgraph.framework.json
View File

@@ -1,4 +1,5 @@
{
"schema_version": "1.0",
"edges": []
"edges": [],
"nodes": [],
"schema_version": "reachbench.callgraph.framework/v1"
}

19
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/callgraph.static.json
View File

@@ -1,18 +1,5 @@
{
"schema_version": "1.0",
"nodes": [
{
"sid": "sym://rust:rust.c#entry"
},
{
"sid": "sym://rust:rust.c#sink"
}
],
"edges": [
{
"from": "sym://rust:rust.c#entry",
"to": "sym://rust:rust.c#sink",
"kind": "direct"
}
]
"edges": [],
"nodes": [],
"schema_version": "reachbench.callgraph.static/v1"
}

17
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/manifest.json
View File

@@ -1,8 +1,15 @@
{
"image": "ghcr.io/reachbench/rust-axum-header-parsing-TBD:unreachable",
"config_flags": {
"FEATURE_FLAG": false,
"POLICY_MODE": "enforcing"
"case_id": "rust-axum-header-parsing-TBD",
"files": {
"attestation.dsse.json": "12ced21ccc633b0f458df44e276c954ccdbb14c5acd0d234fdf7934eec48696f",
"callgraph.framework.json": "86ebf343e4b684a3bf2b3200e0bd1849397ea69f280330b1095aceefdff799ce",
"callgraph.static.json": "99c850cccba6641635d1c668f831c80667930ddcd1f7acb2fe9c4c7771c63e7e",
"reachgraph.truth.json": "918f742dbfd9e786640660f13f60b1f9da329caee367851990c7d5b678fa5c8e",
"sbom.cdx.json": "ff9bfeeef7e41d934a051d5c4e20965819d2c4be0ff9ad68ba250eccae3aa487",
"sbom.spdx.json": "1de691c4665d49162633b6571bd142fbfdcf79a0c8bdfb6bbf8f8d4783587d01",
"symbols.json": "4ff5b34b01575558256364c017f6e3ed4dcb9c6d077b732d2dff1936431f607b",
"vex.openvex.json": "48e178a71126b1c57aaedf47ed85da10a8b391ddcff61e118f7fc26b1786e490"
},
"sha256": "STUB_DIGEST"
"schema_version": "reachbench.manifest/v1",
"variant": "unreachable"
}

18
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/reachgraph.truth.json
View File

@@ -1,16 +1,6 @@
{
"schema_version": "1.0",
"sinks": [
{
"sid": "sym://rust:rust.c#sink",
"kind": "generic"
}
],
"paths": [
[
"sym://net:handler#read",
"sym://rust:rust.c#entry",
"sym://rust:rust.c#sink"
]
]
"case_id": "rust-axum-header-parsing-TBD",
"paths": [],
"schema_version": "reachbench.reachgraph.truth/v1",
"variant": "unreachable"
}

10
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/sbom.cdx.json
View File

@@ -1,5 +1,11 @@
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"components": []
"components": [],
"metadata": {
"component": {
"name": "rust-axum-header-parsing-TBD",
"version": "0.0.0"
}
},
"specVersion": "1.5"
}

8
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/sbom.spdx.json
View File

@@ -1,6 +1,6 @@
{
"spdxVersion": "SPDX-3.0",
"creationInfo": {
"created": "2025-11-07T22:40:04Z"
}
"SPDXID": "SPDXRef-DOCUMENT",
"name": "rust-axum-header-parsing-TBD",
"packages": [],
"spdxVersion": "SPDX-2.3"
}

33
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/symbols.json
View File

@@ -1,31 +1,6 @@
{
"schema_version": "1.0",
"components": [
{
"purl": "pkg:generic/rust@0.0.1",
"files": [
{
"path": "/src/rust.c",
"funcs": [
{
"sid": "sym://rust:rust.c#entry",
"name": "entry",
"range": {
"start": 10,
"end": 20
}
},
{
"sid": "sym://rust:rust.c#sink",
"name": "sink",
"range": {
"start": 30,
"end": 60
}
}
]
}
]
}
]
"case_id": "rust-axum-header-parsing-TBD",
"schema_version": "reachbench.symbols/v1",
"symbols": [],
"variant": "unreachable"
}

15
tests/reachability/fixtures/reachbench-2025-expanded/cases/rust-axum-header-parsing-TBD/images/unreachable/vex.openvex.json
View File

@@ -1,12 +1,15 @@
{
"author": "reachbench-2025",
"timestamp": "2025-11-07T22:40:04Z",
"author": "StellaOps",
"role": "reachbench",
"statements": [
{
"vulnerability": "TBD",
"products": [
"pkg:rust-axum-header-parsing-TBD"
],
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "Pruned by configuration; path unreachable."
"statusJustification": "component_not_present",
"vulnerability": "rust-axum-header-parsing-TBD"
}
]
],
"timestamp": "2025-11-18T00:00:00Z"
}