From 689c656f20cb504d03d9fabe7b989d06d5765f4a Mon Sep 17 00:00:00 2001 From: StellaOps Bot Date: Tue, 9 Dec 2025 09:40:36 +0200 Subject: [PATCH] up --- .../outputs/attestation.json | 22 ++++++++++++++++++ .../outputs/binary.tar.gz | Bin 0 -> 2529 bytes .../micronaut/Controller$Response.class | Bin 0 -> 1455 bytes .../reachability/micronaut/Controller.class | Bin 0 -> 1626 bytes .../micronaut/ControllerTest.class | Bin 0 -> 2357 bytes .../outputs/classes/outputs/SINK_REACHED | 1 + .../outputs/coverage.json | 13 +++++++++++ .../outputs/sbom.cdx.json | 14 +++++++++++ .../outputs/traces/trace.json | 9 +++++++ .../outputs/attestation.json | 22 ++++++++++++++++++ .../micronaut-guarded/outputs/binary.tar.gz | Bin 0 -> 2541 bytes .../micronautguard/Controller$Response.class | Bin 0 -> 1480 bytes .../micronautguard/Controller.class | Bin 0 -> 1951 bytes .../micronautguard/ControllerTest.class | Bin 0 -> 2461 bytes .../outputs/classes/outputs/SINK_BLOCKED | 1 + .../micronaut-guarded/outputs/coverage.json | 13 +++++++++++ .../micronaut-guarded/outputs/sbom.cdx.json | 14 +++++++++++ .../outputs/traces/trace.json | 8 +++++++ .../outputs/attestation.json | 22 ++++++++++++++++++ .../spring-deserialize/outputs/binary.tar.gz | Bin 0 -> 2589 bytes .../bench/reachability/App$Response.class | Bin 0 -> 1363 bytes .../classes/bench/reachability/App.class | Bin 0 -> 1370 bytes .../classes/bench/reachability/AppTest.class | Bin 0 -> 2203 bytes .../outputs/classes/outputs/SINK_REACHED | 1 + .../spring-deserialize/outputs/coverage.json | 14 +++++++++++ .../spring-deserialize/outputs/sbom.cdx.json | 14 +++++++++++ .../outputs/traces/trace.json | 9 +++++++ .../spring-guarded/outputs/attestation.json | 22 ++++++++++++++++++ .../java/spring-guarded/outputs/binary.tar.gz | Bin 0 -> 2532 bytes .../bench/reachability/App$Response.class | Bin 0 -> 1363 bytes .../classes/bench/reachability/App.class | Bin 0 -> 1661 bytes .../classes/bench/reachability/AppTest.class | Bin 0 -> 2290 bytes .../outputs/classes/outputs/SINK_BLOCKED | 1 + .../java/spring-guarded/outputs/coverage.json | 13 +++++++++++ .../java/spring-guarded/outputs/sbom.cdx.json | 14 +++++++++++ .../spring-guarded/outputs/traces/trace.json | 8 +++++++ .../outputs/attestation.json | 22 ++++++++++++++++++ .../spring-reflection/outputs/binary.tar.gz | Bin 0 -> 2398 bytes .../ReflectController$Marker.class | Bin 0 -> 456 bytes .../ReflectController$Response.class | Bin 0 -> 1532 bytes .../springreflection/ReflectController.class | Bin 0 -> 1491 bytes .../ReflectControllerTest.class | Bin 0 -> 1880 bytes .../outputs/classes/outputs/SINK_REACHED | 1 + .../spring-reflection/outputs/coverage.json | 13 +++++++++++ .../spring-reflection/outputs/sbom.cdx.json | 14 +++++++++++ .../outputs/traces/trace.json | 9 +++++++ 46 files changed, 294 insertions(+) create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/attestation.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/binary.tar.gz create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/Controller$Response.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/Controller.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/ControllerTest.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/outputs/SINK_REACHED create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/coverage.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/sbom.cdx.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/traces/trace.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/attestation.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/binary.tar.gz create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/Controller$Response.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/Controller.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/ControllerTest.class create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/outputs/SINK_BLOCKED create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/coverage.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/sbom.cdx.json create mode 100644 bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/traces/trace.json create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/attestation.json create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/binary.tar.gz create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App$Response.class create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App.class create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/AppTest.class create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/outputs/SINK_REACHED create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/coverage.json create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/sbom.cdx.json create mode 100644 bench/reachability-benchmark/cases/java/spring-deserialize/outputs/traces/trace.json create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/attestation.json create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/binary.tar.gz create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/bench/reachability/App$Response.class create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/bench/reachability/App.class create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/bench/reachability/AppTest.class create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/outputs/SINK_BLOCKED create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/coverage.json create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/sbom.cdx.json create mode 100644 bench/reachability-benchmark/cases/java/spring-guarded/outputs/traces/trace.json create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/attestation.json create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/binary.tar.gz create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Marker.class create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Response.class create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController.class create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectControllerTest.class create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/outputs/SINK_REACHED create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/coverage.json create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/sbom.cdx.json create mode 100644 bench/reachability-benchmark/cases/java/spring-reflection/outputs/traces/trace.json diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/attestation.json b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/attestation.json new file mode 100644 index 000000000..310df298d --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/attestation.json @@ -0,0 +1,22 @@ +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicate": { + "buildType": "stub", + "builder": { + "id": "stub" + }, + "metadata": { + "buildFinishedOn": "1970-01-01T00:00:00Z", + "buildStartedOn": "1970-01-01T00:00:00Z" + } + }, + "predicateType": "https://slsa.dev/provenance/v0.2", + "subject": [ + { + "digest": { + "sha256": "stub" + }, + "name": "java-micronaut-deserialize:203" + } + ] +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/binary.tar.gz b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/binary.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..e9737cac21ad3e92a48588b69536e52251beaab3 GIT binary patch literal 2529 zcmV<72_E(ziwFP!000001MOLDbK5o&&S(A#9GhvWt4T_>9L*?}=N#L;q~}DQ*zR2~ zm(f5ZWFaOA762_P8UOcN03=1dIQHDcZl{Nx#3F#jF0fcUyGsflh0h+D+CaTtPyYg~ z{_5vWx7Y6N>}+rA{ujGDyU)<>V=qimAtdGqJ%y@2A_+MELzYR-l7#T!6TZgZT*p1< z-|2Qc%je(e>~6n!hT7kJB^&7f{QPqqUExcD#w3fT0Vg<`;xSFAoChh5ILmM$Upfv= zbH*i7?hzD{Cc#^rzg+Kqg#~%hT^^t;_$x@ri*Z6D6eU;)wD36e#X&$}h%PdLCj`Yr z5KeJIKVwN*h6K&7kXJ4&AuY{b3WKAQ@bjLCoMnQbDbC`AT;vJEu?H*MJCmGdms`mE z?xQh_=dDtuBGZp@JXcfDKr;lFM0#%7=eAzf+;oDxnstD(B1xLU6mcR8o}rA)>Q#B& zc6$rCW0=IrZv_#uDf6~|l6;Q5;rJ7YA`y!T_gX=$pQ;_TfL1nR6e2eM1S^1bDEEj>r`OoRUHjfv`-aJZWX8^3 ztGRI$VHr)4cYG6(Tpu;Ld5Af8l~{74_HwA433dXHXW()Pd52T7ti>^Zn_k0V-#lIj zq?y#7REWw^DnGe(Zk^xzf<7`W#i80 zytV|6oYQM8NfjB&>s&Pph2)g8nLuxb3j|uAPmQ9(LN35~%qlS6INn6X2AnU6 zU~C!Bm*#`~H57&k!HiQ$O5{~*-xNPetXv@daaJKc(NE_U41*TH%sFcYkhsc)7vRs?6#VD{_nxX`C-*MIUF6FoD2>fN3eoNYDbI3g_5yEgesVU zX+*)v=u>EbD~wrS|gk>{%YJ0mSs6keOCIQN2dqpuLtI2 zP(GJahygy@+xy}4*B|OsK(Gvo0LZL!ET;(_I}Z2-KwQ}jPT|*scm&QzLF)&%66}6# zIT5=iTxBPN65!kk*iN|p2Hv?F-e4>-XeO0Qh>?~@Vi^9=>1?4+7yj?U|K7)~P3)3M zoB(sTy|n>A6&j-uxz!>AwO6-gkar}>jr3Gc5Ep4KyozfJ(JUsJ9Bf160}G9=$XpE0 z0j66mNBhZQv%tpZpx-?mo}HsG&B7u#LDP&Y8>+pycf>^quI^gV*eK%Ma@($|v6Y^; z)yW^#ML6mAmqnTx8I$@PT$66p74#%gIRR8uY`t7XGYUQeM!PI9SCVechQ%n>0kpJd zby*f;CTv2X%E2PWSgHb~LXOy#v7O^JL{&n*ej=LXtH*KrtGcm^3{<5HBP!5k6?c( z_IwS?+=?gqJSnd-AU5Xn0Q3cypQ~}W3url_LzOK^Fvn?vv^(Vt4o8@doTb4{nm7}% zL5Z+{GxHoWaKMHe0=s1el;{eWHZJPRE&B1#ULgO;sdkS?)NxP#2gUx*%KQJ`?(VM5 z|DJ+q3?QyzreBABKW?D^c6-Nl5}W~MUy{Bq?VX%61?_#baf$XAIpI+Irveq5-vz_J@)c?oa8xcC_~nG-C>mP4kAmt&T$FsZH}if?rCU>0AdZYzvSd7ooy z`6>ljaG5@{Dha12_35vOYK$0Zs(HUnpo#%EAn~YL3gm(xoBc+4)tg-#>->E1%faY; zI6N5*PtV^B-<^SYC1;IypBw;2J_L zr*963xC*t*@NS$jshT5TvtxFnWMo9n7{BVnjbZs1M^}z{y9YWh)t)$G64VI?5_&l5 z@=E2D_R$0dXf&^Guv!PGoZupn;Wha3?+v|w2wF`FA4A7|-~V^Iz18o(kQ3PW z{}iP1ztMw|0Ocvv-0!KBd3DeA+_jKvf*0V4RB>i~1nQ+Jt7cZ6CV&EX-dWI=jLQkd zD-G*)2|CslX>USpz<*j{Cm5A?RSjk>xNSE$yI$6`-J&kxM=D@&T{pAl!$$8 zvOTlo^0hG!Odh=7>FtG^M>ftfFON6PDo2#+u&Gb#_X^fAT>R zi3tz>0DqM6YXm;d+jVxc?wsEJ#+P3U#**Vkl?ST0`&y%bQrV`3b4DNpgW#a+tt{WYLsJU>?U zMO7CIpBYB;rPxL!PhpqD3rT0njwd!-jfzk^yy8+C*$+b3W$hDJydktuL}xhPMTK^8 zOAI6V*afkh)7!G8s$$&9r(}Oq*^KoQ%o;y|VJ)0s@R(dwmna-GUDNcP>LDzOr8Pw3e2+o`j485= ztYMv!AK&To;@KfOf4@uc2=J{-@Hies!PCSp$RcUYpJJ?AH1*gy^aPy>c=TI8U|a^K zzCWiN4;{QrxF0iw(}P(&Y}+{$$lf4NsAZ_6)%G#i=p(h~@d%4}PQDz)B}v&AMENCN IV+CV>0TEVRAOHXW literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/Controller.class b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/Controller.class new file mode 100644 index 0000000000000000000000000000000000000000..c5ed7fede8eef6208f642841db414a39dd5b0ed7 GIT binary patch literal 1626 zcmbVMU3U{j7=9*Ay6I-yCMjZrM2Z$jT1xm5ZBs!KK&nkpQi?rXO_Dk7;&wM~HfsNc z|H50mN!6aC-0AW6aOtr=vq_qidckooW@g`cKc46Pn7{t{^)~aOq0y%7x)S-flDoP{}@A5aOCQIc(S>!yIoeB4tF zuc>_c%Jq{lqB7sVEt+^A^9C+hxQI&vv%|#pd<_&?oMz}y)A|oq&q^lFAg`G(2*h&F zO8HF_v$(7!OLW{fBI6Mz%!XDfSh$L7giZdYKyhl` zFvig!6q&eMARAwE9{WKiYWB7(gO1OD_G=MVPqxrW$?gA#!>oB7zo8!3n(6d#Xs_tx za$2h#(~8pBU{S0!*HwO)Y{lRBV6gf0^hX5e@fi!MzX;e#80WgqzbtpbJ+`n9@e>aM z6|VXkFff5C9?^uVVvf=nrNKhl_yrRYykt=p|3LBpsjZawAw9E?w_Y4zcIyCVwtmLh z#V+34M{XaBmCIdRsfK#^bE%8#)Le;Dcq#&H?H4d4iNKdQ6Fs| literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/ControllerTest.class b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/bench/reachability/micronaut/ControllerTest.class new file mode 100644 index 0000000000000000000000000000000000000000..8bb01d8dd983b84d9f478457b76ea86a70735bde GIT binary patch literal 2357 zcmb7FTUQfT6#h;~a>6huL{NfatD+JRqOF&fs1-0G8o(OFa%t@(Ifc<-CeBR6*sHzY z^auFTM;`i8+qDu_S*yNw^&k1r(tReG7%dO>Av2k?@8ACRK7al5`yT+#;Gu#5nmB?g zLI^Xo-PG=A2}3iN64Tk6BIh!MPwS@co@Hq2i_daI7TrpzXT4}oI7K(1h zwS~5#fJ=`p4Bft7)z$M#3R-2%Z49x#bX~E*PclBMKtY>|c0?IkR&CuCeo~z^n}$ql z`W-4dWhJ4UVL5_h7sHNcMa?YR)~c2@go2%jsp!UThE^?~&lC#@+_IL{4c#pz>bi+B%XDqaFoZoL z93n`wBWztW^m~HgP$P8JW+k`Cr3I((2FIH!hLNNOJgaU}D=-AC4;W5t;i?Mfb4_nR zm~08wGdRofmWp#2VL1Gfl`yEwnwdAmwSt6)VXPM2gIqd}r(e=l?^WRxEYlImWpAdM?>@S-yERTUY`5aqH~zQoYs6Sk2z3TAPg;~f=qnD%8WCO1nLN39Q`b5a~ z7xd$^5zv4KUAst|WC^Z{qD(&IEh%}@q2Mk`9QRawD3jjqrRc#nW)KxW!>O0aynd;n_)RM5Pu8(#pp5-x9QuVk zwbSj;L%+S)kAw6Mc=5U^A}Cq}Eu^8+c`IqPAc1Z8gd_KEGa z=TB(eKzc4ZRl)QVPZA@^+tHyiu05*B7Nl$gi*wQUDtLctu#DXG4J^&cqrs?N!L16+ z;b1HnyL$D0WEsN)?D3#VA^bP`IZknm@7}~wggCyeesU~w8lWn4%?Q6B z@BxfGrG$I{zowpiTc^u$j~76D^jI0IkHCX#2sZtOQAwR@D}Cz7wuKN-&(WoW?>zDM W_`xeDKsRs?ex%ln)1C4Fv3~(nK08DJ literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/outputs/SINK_REACHED b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/outputs/SINK_REACHED new file mode 100644 index 000000000..f32a5804e --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/classes/outputs/SINK_REACHED @@ -0,0 +1 @@ +true \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/coverage.json b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/coverage.json new file mode 100644 index 000000000..d9842ff5b --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/coverage.json @@ -0,0 +1,13 @@ +{ + "files": { + "src/Controller.java": { + "lines_covered": [ + 11, + 14, + 15, + 17 + ], + "lines_total": 40 + } + } +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/sbom.cdx.json b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/sbom.cdx.json new file mode 100644 index 000000000..b7a8b9f4d --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/sbom.cdx.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "components": [], + "metadata": { + "component": { + "name": "micronaut-deserialize", + "type": "application", + "version": "1.0.0" + }, + "timestamp": "1970-01-01T00:00:00Z" + }, + "specVersion": "1.5", + "version": 1 +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/traces/trace.json b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/traces/trace.json new file mode 100644 index 000000000..2d75dfb4c --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-deserialize/outputs/traces/trace.json @@ -0,0 +1,9 @@ +{ + "entry": "POST /mn/upload", + "notes": "Base64 payload flows into ObjectInputStream without guard", + "path": [ + "Controller.handleUpload", + "ObjectInputStream.readObject" + ], + "sink": "MicronautDeserialize::handleUpload" +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/attestation.json b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/attestation.json new file mode 100644 index 000000000..dd450804f --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/attestation.json @@ -0,0 +1,22 @@ +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicate": { + "buildType": "stub", + "builder": { + "id": "stub" + }, + "metadata": { + "buildFinishedOn": "1970-01-01T00:00:00Z", + "buildStartedOn": "1970-01-01T00:00:00Z" + } + }, + "predicateType": "https://slsa.dev/provenance/v0.2", + "subject": [ + { + "digest": { + "sha256": "stub" + }, + "name": "java-micronaut-guarded:204" + } + ] +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/binary.tar.gz b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/binary.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..282b5979007bca10392431e6d1c238272a052236 GIT binary patch literal 2541 zcmV`niwFP!000001MOLDbKAHP&S(A#9GkhLt|lqTRy3nXo;tSglAaTJV&|^c zG^2q?NJdN&EC5PYGXC$k07!{?@i}c{_ol^8ViCY%cL6M(-6aK&!Y2<*O`vYKtABwu zfAw?gpxf;3@3-5!|5<0h^8|Gs+Au|hkeDO%7^?n=B;fpyStdD462gOzc!s~aj(g6( z)$Q!BpMR^>**|!KnqS?L9rS;G{yC1W@syx3$)c-(6C7RPF-@pk1SyR;%Wxs51?KT{ z$DwJ?xJ1fFfPS2T;!gkV{4f+h)`K1W4X+L;h|P6)_4Iy)QwGJ5@HbaHxe`gS0BLA1zH zA)K*;Ve$byF6hy_FxtL3(09V-9zU05RF;9*h9NUNH%Mf_9~(iQx?z!6M|9P$$~!9^lHcilR754jUyByOWo7o~_3SZ9VZGG7|&9W?jV493Sa zj!EV=o-e1|E}x8fD8~!6CN$71P-b{;*;k*ZtX{GXP*x<#ms!#TOU5vX!&-@uyKRwt zfxO}PBZ=gzEH5P3MsSK46=0VVxHaajsaB-eUMwUz;v6sPoW{G<%1%hcV#2*f5bLLE zMUCxkH3|_Me*_D_4&~^v>GWz#xNF^QwQiUkNM`ogYt$ExA}pgT)2|-`?!o`|R{U?Z_dCxl{yzr&yZCPaeGB_{^;PlUF7#JUSKgMK(;1ee!t2t9 ztB^pv)je(?dBxdWpjX4ywOd`eC3Fl6xk8{Zs}N}CcpVCA7`7&Yv2_qzn-B80pa&)d zb512G;YQiM3p7iBSi#$AR>2$5PnQ+;fEECvfk0DR;2j~fChE@MxDqmh8_J2=_*$yE7Q;=v zR!4ASH>LJ&3xjWgFG_~(0p4UUKnyE%%-g4p(6!H*O$P>y- z*HAs4%d~5V`a%p>kY2}>i!FCk(|%E|!qH@26J`3mrDP)oHtOQlo1aE6&W6W7ou2GS zCMI*^d7jBnb_A1KXI#)E4)xzaTs;iN+=u_&XPpiFZ+2Q8i~o;7fBGgY1P{kF3)Qt8 zV{zpOB9TuDhH{!i3QH5`?QnQGaG!cnjNmUgZwBcJJT~1%7z8f*_FI(CRgZ;ww$Cr6j3 zqto-@@yo%}&s%*xzt!C@UF^1+dHMIjyUXLMb#^=g^cfsGj$j3k)QVQdg_5yEges1~ z)(9v+MjzvAxFlePY3i7%I-LzeLmlFXaLcCTID(erC}9!u<4rcd)ZgkNAKVepUp=}{ zVe8z@@_f5{nYB65rev)V4in!W;DdF6j>p}PeSEHc%y;})(KQx?(%?MYy$e_eAcLHc9 z++GdV+#T;L))+KXLNg*pS{{U>9(vzu@1Yh{QLPUA?|#_Z#V(n|2{0eD_jcf<0$mg$ zw=yzNYjqn2U`LYNNKf?yagpZ2tGMW0fVUe2{YsS?cst>nC}j(1g5lONSdlepJgn^{iGnAF?t zYA%ST5ct4vH;U_xVq9rMFcWFlA~6~-P;3fckb7%ZDMqmlj^!p+_hB_=LLyXf9Jayi zkSdL+kRx_&Hq7yAqADT3e+-)CchBJbSI1HK@B3^-~Vs&bUq%CeT7pEodEhz;&Y(RdJzdc`IcKVj>7gxl2Ov*C zAp!DQK{IH&PE16^sje>SaO4ZQfQ&g>z5de@1i;45mw%h^1F(a<`a8fC;xtrjUS63V zTrhtdPaOqW<)B{vmjk6KumFfv8SpOz)L>i6H7pIJMBslcHC<3X>4o>o_@lyK5ABF} z<+zGlJ=ALHrUq{ixc%O33Kg}6<&8?qDWh--Tc%VpF`}tHX_rI^%?0r#NeigidhM1E zX^ygz7ny=QW1_MJxZ5o?Vp5n<4BAE{XA$htDgje7Ny(AWl$ygqD9Q^Zz^p$dDdP)h zAN)vNQ<*5Ph@~mkn-zrXNckmd%QV!e!(7q{j^xOkVL7%A%m$UmEZtyIT|pGz=#XQK zFQfbh<64T~nCh+yTq`cqXRMNNbW$JvhN#+zk*1pW?+K*0-~%KcRi;4N@S)yslvlmk z%!>K0saXXWr}n%6?fRrlrl1S|?fZN8yLoNo zj6zt3qtjWQu>fu>lmPl>fr9H$YYcb8lL`HffNdDF8#O;8a?bd54=xhR$2hun%o`<; zKUJ&cj7epY16d(BL3z`1N_$AZa!?JH&}dQJZe@dCLQ6OUFaK|&_1CA(4C5hm-1q%= zAAqi1El`vqFjT^u(eHl4oa3!v>Dg0gk ztSwQKs?LyDwOw1kW$4Wpc2h_qWgu;004Bq7Rk*c=r39}vc-3}nePlK5nvyQ}^`6gF z-CCEfR?=~Vn%xp!OS+yQOiy#|dkm}`AP$+xAj{BKmGvWrT&2TeTPxe$E9Ho7&crQ@ zFeJ4My$m1ol^ZcA6}qPwGjSVtC`E&NjdfWksw+26Q4UDoH8FvERI&K(bB8Lf+!Qay z_;Yn%)O4xvm0>Jjj{S(#D(sS$A^l9ncEzUOtO~Wms}2>E{Umfl*1vGYn?egkoJR6p z^k_G{%rKgdC5UBCZ%bd*#0NV7&2-wl6f}<{+!UVPke)V>XIQ*Wn@Fv*;mf|0QhQqQ zR>;~*Vv%7W9G_A!E*S=cp2184PttgbX9k{|c!6bx>CPA_-_>?gSRwxiiy>7#gJ(F7 z*J-R{!G!=d~mIh%@luw6(>$$6cbj{-ls1W({$6g)%hf+~{5g;R`oi>4Vnhn}QU0gwLT zFBq4BY5316$3q7%6Yj?>;q+h*kJ@$~1+qir3AGHBEVg|N7Wzo-1w6(QUXm|IaY<74 M6;XbT6|7?XKf^d@ssI20 literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/Controller.class b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/Controller.class new file mode 100644 index 0000000000000000000000000000000000000000..a9fae38c24d4f1cdb885bd25ac2671de26dea2cf GIT binary patch literal 1951 zcmbVNTUQ%Z6#h;~m@o{t5U^1ytzu1pHfk@{greN4(IhCLP>PBtnL{#lG7~2=)%<|^ z>{`CK`s#zP^(9zYOMTPj@A1(k?lVjvKp(7GS#!?p+xhml_dfIIKR^Eh;1&!OA@nE+ zYlxtiVfa3Oz|$tTs_E78eNk~4dglzwaOW9%lBta-q6}fz@kA6V!{9)56#oT)X@Y}i(l7?@z_+qIptq3gm@k-&?R#z}_pWUdSAA(X6S z?;?ZJ;4RbUx@72O4O4i9s3kfWE%yT} z$)FNlCR2entKurIDY&lT2Hs>icU<_xSRF&EjP3`NY;`5sA!~b4#WdcMgl4FzlG}@^ z4HZeuNy#k=95_+NU6~Nc(&%js?_hyoQ~r9Vk>efMUF}V9Ls-(Vj1`8cYj?Wlq-}sn zMt)brdvZ`B71M4C1@AMA9=Gm#&9T4aWmBlgA+Mo;BK1Dk^^(_UIHK7U`Z01J#*qgh zSMcG9Xe(b;M8h>~YON5~G?cJTAgK~dCT~(lkDf@#7g9bO*i>*=!w6o+nZrCs8DC>gNZ(R zP352E+@rC}5~C%TS3akUBsjRQWK=EgdJcj3{?w^+XM5|cWd0Pk|LFApGf+#m=TyXP zL-ICse7Rha^`hx6(pVRSoR{WO@(mN7^uaLQkm%6!hU!?2rqYvJH~xQIt{Kr4NUJG4hX-_Xv59;cJZJ zGxE%%ck*vcD2N}>WfoR2=>Ovi%|BC+J3thXZYjxpMf8BUq_1gUFJ-IX6fuM{dQkCq bIs~m@sz3s}w2P58LFKE`^D14$HT3-p0E_mC literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/ControllerTest.class b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/bench/reachability/micronautguard/ControllerTest.class new file mode 100644 index 0000000000000000000000000000000000000000..ef821dc3ea20bf27cea2783adddd06567857e7c9 GIT binary patch literal 2461 zcmbVNTUQfT6#fn*Ibj$SMpU9=tD+JCl|XDMAy|V@uq{q92N;=T;$)(ty<2;+ zwKw}xUi#=mUuwHnV3oD%d;gIy+I=P$1B(~ClFZ4Rz0baU``i2c`|R(30G!1y3L4PJ z;Zxy9fT8u8enXE~dTuTA7vk=UXu1{_CU94or{ zqMLFZp=T9vX|b7MM^&$EYORuj7U^>nL#R7ZQ>?SoAD&R4pjAa1G=}Dzj_HbOP+Kc! z>LRV^x2xDHGx29EyC68WGi-U0)cCw(-_+BVP_PXl6+5t#p+z^0R571-M4=!IhK_pU zwG*EGPVDA*Ma8SwQw6K&npPyH7sRO(49c8v#osFs;|J#AX1yBNuu8OP4)MR%^K zJ4R&C&bf|lS;83?1>#6kK{%#vnYRVQfqL}H_3GasoMxQHYaFkuh@zir@FKxcJx31@Q(^Vpg{bRQUnKI0jV=AO;nOMRlJ2^qHmW@ymVZX zBtvFFvX?xwX$2!laEz)*VvNB0U!JJH3$E@K3toQ@bG%a}n+Neg)pOi&Y$u4Mf{PfJ zjjKub6DlV0E>SjZ8;cC>Rl=|3-82zo)^^gSVThc9_wYW)2P$T8wc0~<`V^43UZg@X zY}n+}K}>RFs1ntoaly1i5X3xgd*h>^AdNX0w;7GROP?1EuB<@~2P zatvC%T7<5Lx%$)GoTA$lGLEusf?y&(#wBaB+b zQkAm$25B16iG-OG$znE5Ju4|hEk_!e1tM+bU5Veyh`dKLj<2d?lX4m!t4S!xtZouU zG-T>Ju?8&1w{&m=5yyk7MK9_)i@`G)t8&FCDZA)oganba*G`$kGG!{la4shtFKIz( z^V+lxR+|TVsCgRbdSk5}vV-WK4+JIx^!%LOI%#FJ`VTFGJ(h~NOHU~VO=U%nK{6m! ze@7!71fr|pQ_E;dtU{UUS%x~=d#HrXy(MgUgssW)+8p)ug?uG+^gUU@uAUP1mT=$? zveZVGO(*?!V=wm8+Ti)yK^}o71j%C?nrUApEd>#@;0uyO;CoIRbeA@8a2Xfl*!G+v z^wqX#!`tOgDfoMINM`ya8T}gHlv7|aauX!UlGdvoUcr$SoJweCv~#qM_VljceDY6R zSi<(c65eiO4}U|;DlSfGmzI%w;z>dzxvWit$7BgHI`zDze`ZlHb>ObiyMH#it!D;iDyR-y`@M|H1{ysd55U kPRV-u(V(8En+-pB;vex7ts1=_q$>YRH5;Lu=^;Y@0frt~Qvd(} literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/outputs/SINK_BLOCKED b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/outputs/SINK_BLOCKED new file mode 100644 index 000000000..f32a5804e --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/classes/outputs/SINK_BLOCKED @@ -0,0 +1 @@ +true \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/coverage.json b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/coverage.json new file mode 100644 index 000000000..cb48c78cf --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/coverage.json @@ -0,0 +1,13 @@ +{ + "files": { + "src/Controller.java": { + "lines_covered": [ + 12, + 13, + 15, + 17 + ], + "lines_total": 42 + } + } +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/sbom.cdx.json b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/sbom.cdx.json new file mode 100644 index 000000000..7d464b71d --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/sbom.cdx.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "components": [], + "metadata": { + "component": { + "name": "micronaut-guarded", + "type": "application", + "version": "1.0.0" + }, + "timestamp": "1970-01-01T00:00:00Z" + }, + "specVersion": "1.5", + "version": 1 +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/traces/trace.json b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/traces/trace.json new file mode 100644 index 000000000..dadf3b0b1 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/micronaut-guarded/outputs/traces/trace.json @@ -0,0 +1,8 @@ +{ + "entry": "POST /mn/upload", + "notes": "Guard enforces ALLOW_MN_DESER feature flag; sink not reached by default", + "path": [ + "Controller.handleUpload" + ], + "sink": "MicronautDeserializeGuarded::handleUpload" +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/attestation.json b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/attestation.json new file mode 100644 index 000000000..221f2bba1 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/attestation.json @@ -0,0 +1,22 @@ +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicate": { + "buildType": "stub", + "builder": { + "id": "stub" + }, + "metadata": { + "buildFinishedOn": "1970-01-01T00:00:00Z", + "buildStartedOn": "1970-01-01T00:00:00Z" + } + }, + "predicateType": "https://slsa.dev/provenance/v0.2", + "subject": [ + { + "digest": { + "sha256": "stub" + }, + "name": "java-spring-deserialize:201" + } + ] +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/binary.tar.gz b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/binary.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..fb19054f1c6083ec9ae9062e824961acdf5d9cc2 GIT binary patch literal 2589 zcmV+&3gY!2iwFP!000001MOOEbK5o&&S(A#9GhvWt3^ukizbTYsbl*t={b=nc6!&# zWi${8S%^u31whG4#{d0x0aBt~QfF?)ZZpRn+aiI*?qadneE?a>FnIF7)B@^uyXF&U z{nI?R_qwg_?rx`J+7I@3_n(mchc*l;SDH#f9z)fikrb@|ahCZX>6AW{j(gU>z29!H zu7A7L?zEqf)$#C ze6#fhRqSAIwSx=)uOK1IM==jc7*nMP#2NYQ5TGC+?@~p_jQkADBw~t5PGkOwYA#Zu zczQ#;!kCyf%$PzHESH9lw@hUsRg6q%8pZ4_`z>cmdtl(S!uZxo7= zY&*&5JQg$}eZ$~iGwr!Wo7;H4;O1lEEm->`&EvQ#3`sJb%ao*SwlK@vYqfTWJAy&d znpTy0w|LTWz9wum*X;cV5>ZXTH0xS4?v#ZhV$y5)k$EbOs)$7zj6SkZze=-Q!#o*H zh~NqYp>Z319=5&!g~w9Td9?%8H@1o?bocpK8j_x=(`gPKkytpUP6$@>1Sk^iqCLLaOK+>`%1?bhCU{_h^N>iqv0^ws&_ zCiIQmzpbsT2M(lpyWdQfZb}iyEFv0W4H{(1peA^!fK95IOlb^tAX5#JE8JS9Fu=BD z68F6FH%bYHY>@^s$){AavNjZ(v#cr1TV}2X(Gw|Vio6;u^T{%oEOOx>*UJn#5@iP6 z+F#9aR@2I8Ay)J6%1{tp84axdOmfYNtcnJ&_HHEABJ(Zl#93O_31*(I%A^XaAj2+Z zutRPcx-l&78@4Hb#XYqfCSHs@{B)#U=X6Bfs!S^~dRs9_j%`C_~*#ye!Q z)J8lB7l=Cp!?_bBw;UxHl8V8qja zrBgDZYT_uSNt5M*WISVI%46s4U~tuUpL$_L;4dVe6aX|lw%kVG`!4zZdy>tfhU*O8 zAs?~_W$JP+-=36hfHqy{#o3#am%|m2rqlQBPeq(ba-^973rKbyc59%<<>1}hle6LJ z@zvSz>|${8vj6n+Mq97h?(P;Lc2|zP`gi}`)k*nwelk2hKkuJ7juN>HaYjqy0xd+W z0)#c-8kI{n{21N9CIK_-tHDgz=&TtU7?8r0TiWe>M?#Tgka!)G7m{YQ&e<$XXm?2y zA`&V&KDtlAd+y?frt-c(>?mC3=_;(6aXqP^C&E%ZNJmb%uGiQDt4+5cK)+C9%`a-# zkG7a8zyq3(X{eR6SVFV@!;9mqmwh{NlFju5Kthuo9{zCg>kkX8s6+~9K82-SPhviD z90(UESH-J;0iPZK7KlkMMf%{QLJ1nw94&OYL{ER*jni^y)g$j4UHfc zLHGM-JEXl2zX$N!h2Li%cD9YsLem)dI|n;k3L#ci5)ijE(8qbY4O>Bn8gQCaf~RXK z^2|J?c>=x(Z6EoMacQ%eXr8dX`_t2nq~?}9;iqx2lOc6eIrl-IfBmWKhv+A(rJaPZ zD*l`%F)=}u2@YP=&9rxY;?6x~=-~V*?_YP|O_ZY+@NZnW?n<~Roc(anNd!1I>bz+)AUcY8NbHn3g zQed^{kxhOF>X`z#0TSDO%Wt_3bcT|fi-Mw{Y`^PYT=kPFr(~nHIhBmngZ$RqQvVzj zRP>rj-BZ5or3X|?JkD>0KK_;gH;^G=KnPJI65AAu(9EP)00P7!JyL}qMF%2?9(iWo zOw}wrk5_A3uI*EjgYnH!z})S{S$QGi6sRZxx1d&`hCDGV}Lh#5EIpauHaKt>}b^!D{=<^)3o0U3U+lGrBXv~;$fJd-623K1h zu;<`(W_AkRZUshW@P*7_F_@!ZrXz8S0#c@DLf-UXyNGN=!yCt5+k%2?oRAbkgD&L& z9*1=<_EW}rkBn)o7`}*@hx2l~q7k5SO!HU=QwZcgI+K2zw2lQILdSjo|FOHb_WvL4 zc4xQ#{^wB$@!#-%5P)IAZ7P^(os}uU4BRZmw%$SR(O8qVbR|qrL^-x>wB;5u?Uu7^ z!Lo`cUYP8^IA_{pXLIGaS!acNs5tsPsE+&o|EIOS|6AS8L4E)GD0Eohc>+O@s=jM> zcMv3W%2JVR zlp7cb2KJQcJui^+S7;?);<#0jZEPAoAKu*~PsXl%2>};!k+pOp%8{r5m}6bI?)Ss-0Fe+V9)(>&}l<9tO)-(a(zlTLsNFpbw)bouWp9(WjVgLjbx_r9-Y_bT>ik(#O*Pe2Q%yD1 zR8vhg)l^eWHPuv8O*Pe2Q%yD1R8vhg)l^eWHPuv8O*Pf@C#C-a$Bqbn08jt`{9FOZ literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App$Response.class b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App$Response.class new file mode 100644 index 0000000000000000000000000000000000000000..d7200ca5b1ad5d9155ddf593f72d98e67c0f9eb0 GIT binary patch literal 1363 zcma)5T~8BH5Iwg*cUu-(Dxipbs72ZZS--%Kf{9`bO)457Jm}Ni_J%H$z3c8R3IE9l zNhBsb_yhb=#@X&xme7C?H*~$b z1I1N4U|`iSci2Dl%eG$^ z@0}1-r|B$(J*VrY2-JoQl!g-V>)l@GaRNm7dA9?1h?MS&aKZL~yCtVwy$ z_9_X*aZ3}PIC1CL6YoS&_Z?43Kbf-L;z5vf#28;LgCwh8cxZ8>8H}py3cmv>XjFQ4 z1vI>5m^+t$g&YkPhUu$AX&{ky>aR|_3p#~x8N;;+cZ+NqjJA1-{!G)?e7NCcbLLMl zbMh3Lxp<196LQg9;&5OBvvkj-2#aFrjL;6=rH~L~hAbninP=q3ce-B89ibh&*CTig z_|_wM68GcaSz;He(9MN2;?N_S-q=6rDas0Y446NlT?S@Eyh}M5I&_)v0E&c@!W^#b3hshK5GU}w+@iAEFr*1FcA(pU0z5>PR)Y<1m`2}8K6%&5}UI#Y0 literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App.class b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/App.class new file mode 100644 index 0000000000000000000000000000000000000000..4b84e4b0791bb6a35a4664d0983442c60666c0f3 GIT binary patch literal 1370 zcma)6*-{fh6g?dhCd(jU6_f~Qzz~)w0xCg~uxJ#55{r`Jsgrbt!O0{{CYJdNKSf^> zlq$Jw zW80ZSk+m4wmo!7O9y7E>CU(8>GAJcp)r&kAfFA(`s)`O=Vd${26-(1&Tf9X6c|q{; z$mV&@_{2q%g5a6xY0K1%yn=3q;fye{2QgFd>;cbcx@J{lE2UC+N0duNqb$7WWe8+= zZp0Kv6;ZbQ=t93N=qf{hB-s+I!5W{~^`@nrR4Sx6BrsJM>@3|_0)=rY4uw9|V9iwr%dl30JA z6(vh68j@s5B~6mlywv5wd zEx%kv4DMChVbWs!+Esy^ztUq0>m|3x*$wItzT4rRA=$NGFd~69>CG}QK z8ip|Ko(cN(Hcu2CaYx)3#TxC4d|aUIMmvog^cSKpqpv4g2m3@5hNm>jWk7)s&yXaD zbUh}RhrXF;xAGZ27rs%mC%+?jg08(T_My9{j=qn_7?`Z##?}eKdnXv*o2nyH$7E`{ zhM7e-jkC5pehj*6n3o80mH1y%HNNU>!;QM#f)uZjSIG=|WLF`CWO z6%j`_meE7ry?BW}JSR^TuHOhL=sZ%0;{{n<*hCw)?3rW++!UpY5FosZW@~swx5+TQ HJMjGlCXZ3q literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/AppTest.class b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/bench/reachability/AppTest.class new file mode 100644 index 0000000000000000000000000000000000000000..c6416f90e66a6f77d2dd5d2244fe63b5c6b106ec GIT binary patch literal 2203 zcmah~-E$LF6#v~e$xXLgpxaWqe27S?OZ4?z#Uw`tvUUXYiAP z7PNANRD=;>*mcdgVZ<$?uo|DwToYN3Au?tbOz$j1>p(2U5oI{wJDGNTe8Uq-$1yhM zOJ1?$EqabH@(Q?&*v_yw@T-P;+DSo&%(;U>ADF2-HpEH9QVJC8Qqc*Gq5Y;~dLjU| zySAqRY0bY|#cs(YoV9FMDAvHutWIymTVHtEUYs0 z46KaT68nUz>xn2{CLU|TvTOx03~~&q7{*ajHbWuS;v{!=&B&OR>21W5#p051sbFoc za7@E8ZwrS0W;#_VKAkDfz>CI)WgEG69LEU92^A-CilO5Pky)e2&|+U@IMpO>L)dDW z5{+WgUQ+N?yvFgmicutpc5@b#a?L2@EU_TgOFpBKS~g!z87MZ>d~4r=aEo@q6^S+y z?2L-Dc!Qy<&u~c-&m_xv(={@d$T6^G1xbu^OsF`INrr>}6O)dD>lt3j^^d|d$D2Ww zeJPVcj!DO{ohZ&LxPZ50k83i~jEY&zQLkj|+y+B;&}ofjP;d!vb1bM>#8S|$4Gx5W zBrz;P(DVQ-M={HBnL!N>)CJQLQKYH3wtuu-1u3jZQ13kxqt7 z{?`~fpYe~SqOeFd&neMqHc(JuOYmWT9>|q$4m!GBJ}_Ubr8URCDXXkt9iEC3ZctAd zx!hu@Sabx{i2(ODc5r=%KSXX}gX6Y}kE8@UpTwQ8sE?>^bHX(pk*gPcvDOu#37R6b zW5z6qxl%qOoF$2ZX3XTRtSI{Z$MIQ!l@yttuUm*>-Y^UPFleR`F`zuz>(u^!RF1DG z(8}|!9A5_+d^H*}M8~pLZI~;IcFD;KSrRHq6GZ6$WBNKkPe#x1U%d#yX8L3Lsr)(Mmty$ToPo zg0`7$DCwaJ)Y;*|GIkD^(Y1x1p)&TD@#1gfSPj)f*+7A!Xr~K8MGrb?#_zzVv?{UO zK^s2D7u6&zL8+r;`9JJPm|R9bttg5}YW9xCJg%iA#0a#0Uy*$PAjYolR3tX(f7uZPPh z-iJOKslBPAT#x9y3|Egld_WNM@JNew0)H3x=-J|{HA1uiji7fCxo&#fO}h193cWNS zbfk%J9{XtTe%iekKa=ctX~!HQk1)(}iQ_m&a^GW|K!oGV`U(eKmL}C<*pJ4$}K^K(W0KC+XLVF=I`)5 UJvI71L|60=gd$0o!;jGa0~^8;UH||9 literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/outputs/SINK_REACHED b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/outputs/SINK_REACHED new file mode 100644 index 000000000..f32a5804e --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/classes/outputs/SINK_REACHED @@ -0,0 +1 @@ +true \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/coverage.json b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/coverage.json new file mode 100644 index 000000000..288abce0a --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/coverage.json @@ -0,0 +1,14 @@ +{ + "files": { + "src/App.java": { + "lines_covered": [ + 9, + 15, + 16, + 17, + 19 + ], + "lines_total": 26 + } + } +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/sbom.cdx.json b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/sbom.cdx.json new file mode 100644 index 000000000..803d8958d --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/sbom.cdx.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "components": [], + "metadata": { + "component": { + "name": "spring-deserialize", + "type": "application", + "version": "1.0.0" + }, + "timestamp": "1970-01-01T00:00:00Z" + }, + "specVersion": "1.5", + "version": 1 +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/traces/trace.json b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/traces/trace.json new file mode 100644 index 000000000..cb0d10da4 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-deserialize/outputs/traces/trace.json @@ -0,0 +1,9 @@ +{ + "entry": "POST /api/upload", + "notes": "No guard; base64 payload deserialized", + "path": [ + "App.handleRequest", + "ObjectInputStream.readObject" + ], + "sink": "JavaDeserialize::handleRequest" +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-guarded/outputs/attestation.json b/bench/reachability-benchmark/cases/java/spring-guarded/outputs/attestation.json new file mode 100644 index 000000000..a176cbc57 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-guarded/outputs/attestation.json @@ -0,0 +1,22 @@ +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicate": { + "buildType": "stub", + "builder": { + "id": "stub" + }, + "metadata": { + "buildFinishedOn": "1970-01-01T00:00:00Z", + "buildStartedOn": "1970-01-01T00:00:00Z" + } + }, + "predicateType": "https://slsa.dev/provenance/v0.2", + "subject": [ + { + "digest": { + "sha256": "stub" + }, + "name": "java-spring-guarded:202" + } + ] +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-guarded/outputs/binary.tar.gz b/bench/reachability-benchmark/cases/java/spring-guarded/outputs/binary.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..c8490106c60a01de82c0f0c656f20c34680fa2f0 GIT binary patch literal 2532 zcmV|9t;59A4uoL1U7JGoKS2&hVJVR4!gR4oxz~B~r2B=aR<$Tb#Yz zZheIXd9l0RL7D$I(2(Whn1(2fu@DI241IPGAPCSg5rk75(@$7ZmLfsZYc$O)`NixxYm zu7{*Ijlv=YIzirduH-p!eb9$v;emudC347*$pq)I^xVVK)8U_^16ObZq zqfynPzzJBNqLj>+rh2=rt{TDkm_`vv-Nwu1kh|qKV;jowB4#*318u&t!E=kY>NsWc zQgndQJdPh`Nee6)!ys-PS8t2tiw$Mtg(M$7q6kY2rkRab#vPN8MTC0|Khobyqbh0@ zhT|&|$~S42OIRnt31U=$B4ylGpQl=1!GwpL<3+VYP2Z?hjoA1K^nq3t%aLjHHbhl# z7&Gw0Mn|2iI?7d`)tAg{jaQxd4ux2TGvuAzh9uL0Ol}{t1A9s>xmCV9QilUP2VXDX z2*u?X2ORv&qm@FMN_{qRQO3899I)lixpTgF{tN!Ugcx|V9B?oH_x3jV zUo~0&e*!$1{|%vUaerM~nGd$uUqxAQHZo3cup}j&7ZF>g1mdlZa|6j4XLEtx3|EJ2 zb-rKPmD>L5!8bFljb?0}l-7oV>dI&k_2-;QQc#UDc)fRvX$m@6k>^QT zk|)vME=#6?sepEtD_C;EIujHwykRs#38txMMgvV_J{3#%)j4k~*{n9eozZGi_)=np zG0^3+$tpeVpl$O1LiVkUuFtD04L5K~IZ^wf%GLF(Z!)~f<|}y!IRa4$LwrMvUPEO_ z$ib+OT+`&%iYskuFH8kc&DUzA>aC3XJBzi{>~T2e9{%t2+O19g-)nU(|33x3|1QV{55_bN)Oj3ZF>?fws7Z2$GMYizOJnDJ zIJ_LV&%H20@E77Yg%Sn6w%kVG`!4$72b9gDhU*O9D>)?|lqbNsI6o@epxSVqS10d| zUXRvP>Q3J`|0?SASwYPVL_l+(6A2Nnd2}6et258V@csGG$>{j-@?>;!HavPgc>Z~- zt>0|-x<$m@l_M|zIe340R6d;^jevy)M~)*{&O^1pm92qfEEa*va^NWeSCi3IbPZ<) z%rK8Sg{nr!QBomlMw@mw3&rgoYC_ln_p7h&b8wNnyoOhvmt~m~ZtBu=z&7EU)a@5T z9p`%#vKzuxhW`n828Y0)m`ggrp%l*2_j=<-XNQ-s2gbE1TgVxtiYD6M|MBdvAD2m9 zuoTK+p*UX7Vmfvl*k_=t;?X~YPY==-1QX>f{ot00-H#1tY0ID>D|Z5vCft67yWHv< ziM1Zx8`G4Ckyb<^=>E`#I=bD4|8Tcz?|s~<6PHZl7=$}N@6@oMqEr+hx3tbzi*y@? zK1Y(=N>8=;QJ!SNE2VZ2O(7}BL1zaEaLwqNEX3dvxVF)7w5M0A1TnsV`Q5YO#U%=G zMuR*vxzY$I@2SPOTe;0GR^+Ptu~P9HxMg*BCcl~+bHBensu+|qsom>pF@4#iDv4H- z?Lei6m*)Bn;&3M+VJ^)bJTjMF&~|5*Bu0_WbA`uDn_KBK*$r-g9M){yp{_Yp$Pv3X z-f_H&s#3|hQC_oN6>HN^drm)Ic*;v&rTu;e!@@n{t+C`dgYO;KtDOp?_(Y zHJgc~2^qM*Jl~=ax0DG#O^VY9yove3hxz>Jr?MX+7_H}3xFrhWFK`kg9Sa$Q>zXhP z8B6@zBz7jSyn@((92OZt6FA`@YJnz6u-Z*L}##(;}TgalPW9hDx=|)6<8u)~uma zM^RbPt5^3h#xyr7;9*tc*Jf0|X23NZS{M*Q6tToK#Vph->=&sN%h!2^zs36UBWz{k=dsOtT6R=_5F-tatRFfY@w>rxh5cKuZ-;*zjxLA8 z)6wwk^3Cww1*nJG&~;R{OVy|xj8i_(VRpS!rX(0cxL%8`)0wAGmu=Sx+QJ(OX&ClR z*KTHdIEPTW>th4juLC_@P(v#w&pQGfFlM)Ea7yHy@#{XE8%L!f-B*2x)@ z$`%LeJ=p%@U}co{k$y*@9#~AnMR{(O0nLIjf*XkM|24&a)7UIW9%GLCe*f+6ZT|k( z?(DW~{(lOn`fv30B0z-*H79*0WmcYeJ!m`on%oAgBULu4=}HLPEX%QFqe-p6u{AfK zLS((BFmF$nZ!RBJU05#ILUH?e)H&|^{ioI4-K_sRFYNFCPlElTrbiG2sTjEWga<)_ zZ%FFn3@TvaGd>N@hHryiUECYV{;i-(>G^!_&%0U<_OBiM`2n+{FG<{r$TT*!oDa|L0Zg`^u!zKen2X7Q?%NO6+LVxf7w{%J08PG- zB#tr5gs;np{h;hrf@SpykLwhH5dQ&g_kdymPyhhlecm1b literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/bench/reachability/App$Response.class b/bench/reachability-benchmark/cases/java/spring-guarded/outputs/classes/bench/reachability/App$Response.class new file mode 100644 index 0000000000000000000000000000000000000000..5d0c3232a4339eb239feee36aeb9ce4303e549fc GIT binary patch literal 1363 zcma)5+fLg+5IxH!c7h=x1zO6rZ77MMxHsq}P>E7iL`rD|h==xRoverm4r*HLd6dW)sKG<2jjWDE?zV3@ImTWeUp;I#&~ou;EstaZ;TY>U8?ZXhT- zP+YYF2384khYVzqW9YMG{e&T3y{NaNe8=4{=ZRO|z%7h0=t@RjhUH@QhFaxPcd#)7 zw{eHS8a!xh$U2cK{0CSiBy!il1SUy^_}b!4Qn7M#W`e~>`#{uGx%8P~tXN6>h_#mX zs1p&TY}IkaR_n+X{w}whL^Ah5sD`Y6;yynTO88WLq}WAcdoUG-(PE-NqH<glociL1BtX#e|6ej(8-6(7_LpYTVzvUw9QlWXPUm|!wn~!HGhJc z6KBxO#WM_^l8fdNhXa$CrF*)Euqc+!Fzw(y3JEc0$TG5;c}{+Or|ae1VcN0#U4ln} zZ(V{X@E{JJC3c|--CQ`wc(-VJWB;J1C@bXAZ~lOG6_^q64&`L%;8nu?C=gB$=J2p> q=TRa%M4qUZQ76r|kHJD8b$bDiu!I%zZJI*6mN$utBB`>> zkau30VTLz;1$}WSnPGT?;cxI4cx0HKRiwtbJX8<6(%EzQ&bQyu-~a#iJAj)oRKyTh zkkF7s7enuJ{w*(9+}C7R8hb+1s`g-j*l3I4sYlnSL8?(HiCq**$#|RuN!3rA2Vcwc+&|*vt+w1 zpIijrQSb>tiH^&=z9@Mf-|g^FF^x|pp)(|(+(tRSreX@S(sGlKg;gncM+}iHoj%j> zIZD(wRcb_f?T`BIP%-s8g?SANQsYU(a+*R4|CWZ^xWkb0ok%f9qr)~8e8JFnDAL96 z4B`5wLt==bqG1_TNpKD=FcN~hxTj!MLrs?KIm{LYWhlO8?zony@*Sbz z0a1RsG-(3o>5eH$#k57WwNn?~eO|Z7lG)~V!xF0pieV^)^hLuL4%VB`eC6~KZ`5C; zoHd^t-_YcSHPSV6%jSN|qk2Ca%RhTkBPT6$$56aw(A!{DYfj5E#4S^jk)koaDtV?k zs?q>03&|ASkG5pn!V7p8^qGoAou)P%5M020x?B0gK$1Zht!wmkj&??Sa%>OmCA}~_ zq*WdR3etFlbqbNL{{&&c_qsB!r}gev$i&e`-_PjXM|S-T`$>Oq59fXv)6c)c2QmDC z{^f~3qr)Hd%kuD7!2mc0De5dd z4B;_FWDpWWBv43U#o&hkz(H1|bkITVInzLI6fMv9&ob{w-fRq*l! zFX=hLTvNfN#a4#ys$Rv^(@HAZq|Yr3Mqi?)SZ8M_I;%p(HVy628CusJ%M(>lJAyNH zNCW*24Lc;0a5`(dLdA3F;xIIHV`r6K!Lzcl5z`gNk20t$!i(q9c1Ac1J$=y%mO7Q* zKsqFe?b7f(b`u)Uu90U5^+gv)RP4cv9D6nNVjn}7eOhAqPPH)B)4tlSDiXW!yT z;MgZr*&kBy5<}Cfr6P(09Q_&waFD{9qVuaUigkL`Oj%jWE5?TN`5EC-wpv`_SZ3C` zDH!%Q3Q~pN({5r6JZ~1WwwYlBa13<=JvnagCww76FA*$xLt z{4h%=b=i}j(L`fQz0<oW=@neRWyU!!RI9;{`f$}p+;MD2!8sM@F)4dNmyX`la1ql~Qz<)B zWay|?8eG@iA#4E1j${>gZ}%10QlAR5{Tcn}tO9E2kmnSrx>n$6 zC`j;Oe~ieT4vrg?b03&*cV^YG*JaXGtmCGJ_wYVdoSDfa3;DbwC~Z^?UG=qJJK=-* z5Fc^e((thi!PX~sN3&E`RMZ*aT8_xn@}CTfBs5CHhfXA{oR}=ErGzshQP60L-$;wR zUydAKRIyS-#;0l$qPS*SIe&)K^QLyP}a<@m1Z!H-6r2jyfs z8{7eE(k?h@AyY!h3#QH?$(26Gb2;JoYz6V*T<}4Ga#3e#4o2=rTejjJ317_tCbA^YeP5jEP6Ss9TDr^kfNd z-3x?^Qn-nwdHqru?+%8Ia0%(TO{~nzO(U#ZWn3*IHyAM@`n3{VBT~Zk2QUVC@TLta z1~-%viUxo5kl+?^i(s$gHh#bzTATdH9Vcoaq7mrywwX?Oc0J zGa8D7EJP&10-zq3^LOt8Aocb+lZl!B4>$b}3zLXRQpYlMLFza-I7^=9oD&cF8gRJa@8`1xl+I1O$H8j&=dc$@^`BpA_{%B3eVPSYE1oP)CT znd8tTV_YKT9$qeK?7a#y7|!xhOhXjLfe>iVo6rXb0erul0$xbablO3=fa%as3e;EY zy)omjgM=VBmK!4V(tHf7D_D=>>a!I!9iz$yX%D4&9HZZVU$6J5_&E;JX{EX;MS&BU^Ax3IzS6RCT&o=+ zJPIP1{a;Rm+!S`Z`X>2uhnY4<_pc{NE;FU`mU-4HZg5i=jNXHZ5lz8bX{gqzc0QuRRBmj!KQht;9oG}LZN=ALB6wqS{kJ)tm=;RIFA79q*>X_Ljr zSgNIXlZDb%?-jIzuUFu7G0}Uj?pf~E*>n(2LdK&tLz+tMG`T39qx6mKb%kRY|9utk z>B?ypej3aO=QJX#kz!fFa&3ged&G(6i1&5Bb-wiVKOFzB!An154!AG=H|l%w|7rW! z#{b8_r^kQFyuZChM zpmn@i-^07|1H?s`^4Pe{07v_ZcqSBhnm~o3y&yCL*Wp9}v;D;?JLzb%CI>bI%mFJr z6P6%kK!O3EM;(OC5I#t*7(qCM1QNueQbv@jTBfF8(Q1{lKVrFjPC4kM0<0RTU>M4B zxs~b+m6uE-%Ee~%SIMZdK1ej4Z?H0Bl@({h1#;Zg%h&%LUY?!yUz|P1)xG36o_lk( zw1Oe~ko_$9Rm8(@4WpdKk+1)HV)8ID?uq|RnB9s0wN|ZZ&edhV9D`~DJ3pVj?!OprvDA~EXZ~%l(~$|e8IS;H?2v`dCs%_vm;JNh^V93I z;n~HY|DyNg!`@iOt+$(ni`|whum96~bKNhW&iljD^YdQcaRkeGsCKkg&X)|D5?|#m zFpbDL8NQFEa7jQ7^Qd#C8gzCP^>xM|0vC^x2O&H;j$#%fH`*n03;Fdna!uc(zTzif zI($cae&_6}cyq#CIa)p(ZSXPa-aE+IaaISWPkVTAdi|njjt6B+If3l!qHgzxi(h|O zrGLTFBgCKx&jLA#>Bw=wIUu7HkKP4*R+#X>11V?eTU;{6@2XD7p!`-PO0UQ#cnn!b z;Lb*R!FRvL*rL<4F-?gWYPKYT>9_48RByunWBA{CcXWtaG8x1`+xW}TfvlxcAo39| zRrS=4an+=|p(G1gQ6pZICz+^}RH~1PNGf}cBP761!zo#c-ZkXLYSqy$v)(e0@g>N| z7lW&7Y_KYs{ITsd$sZd2;#bE}8NqecR8Mctb=f>6yjO#7H=N~}{+8wm;WRXJ=)c-h zuA4}jkRJZ&$zDLhB~AF-xVV@Qb_2fjK%RH=TR9KDjJDG!%bh15c<;`x^WeB4l4EG7X4`Ju5T49&w4-^_tbxl<3@ew z{eQc4+_v@KV}M2w)m5H!P5yV+1wf}!Yhfo2(wiKzRY!O6PR5yfzt};0?;j_j)+bnYRs)LRCZkDYcQe;xdIm3|vBRES8v|n1z9sRn!iu zfa##SYnFmcl^z|`)=xSE7YW#1SufgoXZ|DFOtwx@PbFX|C7OvLP4rP>62>$W#FZq; zVQZa6-Gw?c;d zAt4FlOL#v1JH?L9Zi*^oNfKzIdH#0d`xvoBpJBuWT+(q6%Aq;SVs1Onnj|}7$qtbk z^1^7LD+r@}QK{_^Zk2hCd0$f2A!{l#X0(!Ucv8E-4y%nB!%aQjZxgsP;58%~ma0JE z_il6C2roy|nX%44PJcNaUJnN6!@aQ#sK;;B30%x+2tS&M4GbaCo|6H#)#Ag)UFuG4&S9*E0RX5y;eXjsQc9*g~yO ziJUV&?ZA~{*(eC7Fb1n;!2d?=mop|olyIQ555n@!Wt4W%IEaOMg`csQhRgDvD;?Yj zy4*aL{tW#5O9$jf#%?|N5Hjxj{lD3Iy7T_0-e}tV|0q!P-|*fdKzRu@H+UjtR^DX2 z?m*5p=?h|tRJrERTtei8m8;9a3EXo?f$OMqD7_-IT~=HkC>!pq7{0W%zdjW0+SnVFe9lKWRUEM$M}tZF?i)4>$2WZb{2xJ zsOR&!H*ab>IKR68?^ownurLW+x~fH2Z`5F6N9ft}qAdOhspu|>g^0|ctLZ#=#wQ@G zo3Mz)znGTfM9+2otuaNUU*^1wPJojqB#GmIWx~^iLDw%Q6=7Ld!sA|u?D`wCinwTm zPU=SLY(t>=xmEoN`99!XfBmQ@Im-yJBH~1wt7~=(rC>%?3^bMSNxj|m56>K2W!@(r zT2;&_(f+1v{iK}Y#0E?Y3kwSi3kwSi3kwSi3kwSi3kwSi3kwSi3kwSi3kwSi3kwSi Qi?0#?2kuM8?*LE$0L0*{od5s; literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Marker.class b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Marker.class new file mode 100644 index 0000000000000000000000000000000000000000..0be486ffe697828acb9f8b6340eb2aa913df467e GIT binary patch literal 456 zcmbVI!A=4(6rAn?%dRMhh>6C7i3jlDo;-D?OQb@B{oP z<0~9A@n#P*uhV(cm-qSg{sG_w?F0eB2&Edzs4z69{E4TE>v4LOO-1e)Dm|&CJ7owv z-P=>(949*C#e-YpYTj7>7LW#(MmnG;$BgJG&;RrmVKk0HA)G)f4N9t zDD};qV5kqI7Q^{06ZVE@ij=A|Bj;lnTAl9TXRM`q%#e)C+~(p;dVBlN7l*!ua)zRC z=caHGHW-fnH7!H!LTh3BiWh|_XaURdv4@z}=T89U7f855w_RdJTt0XMd!>RB2>mm# oMYxJJLT}w6_G;LSUWk4hw-KUFT7U-D7u-aPI3ZVzCN>d&19LNJ-2eap literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Response.class b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/bench/reachability/springreflection/ReflectController$Response.class new file mode 100644 index 0000000000000000000000000000000000000000..8deb4a49ba445c01e196b9581c05a42007d30480 GIT binary patch literal 1532 zcmbtUT~pIQ6g|sFla@eB1r!lM1!)5kzwoQTgLND_Q_%tBL7$R#rGb#Gn=Lc^Cm&=+ z#u*;`0sbh*n@z#vi#xqbV{wmjS4 zv$l9m$T~x6)%9Jq&d^^d?xvw5ts!Gz2nNHt!~I&rlH9H}Y{&Inb!-Jq>H2$;fAM%t zxxy!)_O>j1C57j4Ik&}wrtkw!;DNGLD_~%i5PHNw7CD9iN7RoQ^3`)X+bV=D<%xFQ zz%`69=t@LhhMhw7YE(+a-nk|WT*nQ{)v$v`S=5Ph`RchUVHr0KOyL%3z`wR^k2Lsr zW#B{&@11?pzf}ChFj1%^e#Al+cS+``plsFk`DW|T;c~}zJSs8wj;n^Kf3T%}$Q74F zZmiHlq4rQz7{&{U1c}U!0w%2X~H}{0$Fk(rqdslSj&)9Rx{7 zjPbb}B$@rfOvhbeFe<*!WgC)HU-iyq)bNsF{=EE4%F$3_xP5sjH6*H?^wsH+0j+%a zYJ?X!yyaw5VD#)v)1TY)wGci^h!Ysliy%iMPS=*4-#!v%)E zXr>8e4Nfw);m05@Nw_Ry2*V7)Ms8_A3BlYpt(>yY8Ah8kKXTCIvucnO4zI|FV3cAK zV~d=)wfGj{wH>RhI;O=i6WwevY$mauZlcME9FHR^Atqx2afZPL(o?jF2ZJAED5PSj zgnj&2z*-}mRyNT*Q!=KJVDLI-ElY-;XfwKc?h>vsbT?ouy;ONglt?(4k#PgF;Pg^Jdvn z`LZUG?`s*IX;D4ul^hLAmJ6P23Cj%gXQLylSbLn>Th15;x2hH9G(z5^0j1SbQ^7Fi zs7b`f1zJDw(3zxPgLE^x+b0ge-qVAy&?){VA$+vpQe+}j-=dAaz~)3)`Usy3->Ba4 z@9@Vf=z4?DXY@YpVz0yfhZuMl|A33xN%t2FRxm=BtAepyRRce!Dwq^H*_y?#$qKGl za8rmVYy>M<#Z?L_fQ-OPrx!9o>8EuWp;Z|}CuI{Ptq?Nk!adRm!2KKj5`wZSk@0;J jx$ppPEL2}BE2!d_xCK+I1vm0kOrM&c< z{($xe@X|-0ZO;jwa!!5i=|Ad2Ywv7Ah{zK!Gqd;Jx%a#Ges}io|Ni(Bz%4w}(1mV} zkd81S4Dn6#doyF3&U)s4X;YMahRCGlSpIE>?veCT6j6q7*)~0oLt~gM38%b~k-{u* zm?g`${GE(fla{kC#hOj`E!W8`G>YvORl#t2Bt3hmF8V4$wg(3KIZo?1g8_!#z@YA1c4p43F?6|W3^ztP?ln`&zAb4v zKe(IKFo-0_IUVQm4mmkdmQ*oWcNiYFAhf-wXHVoWwIIBj>v$p?!!X|Ecu&XsxWI7p zMD7-aN8RmDQKf}cee$L)&n(%Z!oXHFr0@a9hdM4{gyHsyLbMSRi#*@->(ofbbO6(XynXFrC6`kq@WHGZw5Pi)xMEc#nACo$9Jk20~O&}QdHVqFSe)= z%DEMq^}bol5%cwGNytSNkU&>Wiw0?6MhM2(wq93g{;OHiXD%_okW9ZW6F z>M%XF0E-XO`2wA~LDfctR+GMlXlJyCNB6*9C_|KJRce4EhB7MTfJ|AMq@1L`7~F_8 z(DM?B*~>3+cJ4O}?c(f}1}-M>*RSZ^M|#D$yoW2V0!@-M8RMe{uJ5*V6H2#_?22(~ z51-GEHSopqJ_;*JG-ll0!&iHln+PRC#)AeHlA#73Jx6jP+&bwKkz_a-X<#)Oe)WRT zZNSAgF=Pin;wRd>f*i)tLug~PYKYT1N^~gT6dusa|A-_TNYFilZpQI5`XR_VkI26m z=U?M0!W?VOPmV07`;6o9Yw{X7q9Adgi~bV;0zyfXeBPM9)C4f>AJkHV!jMSBg&{{fp=({um; literal 0 HcmV?d00001 diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/outputs/SINK_REACHED b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/outputs/SINK_REACHED new file mode 100644 index 000000000..f32a5804e --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/classes/outputs/SINK_REACHED @@ -0,0 +1 @@ +true \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/coverage.json b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/coverage.json new file mode 100644 index 000000000..0113cf0f8 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/coverage.json @@ -0,0 +1,13 @@ +{ + "files": { + "src/ReflectController.java": { + "lines_covered": [ + 7, + 13, + 14, + 15 + ], + "lines_total": 29 + } + } +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/sbom.cdx.json b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/sbom.cdx.json new file mode 100644 index 000000000..cc69ede30 --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/sbom.cdx.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "components": [], + "metadata": { + "component": { + "name": "spring-reflection", + "type": "application", + "version": "1.0.0" + }, + "timestamp": "1970-01-01T00:00:00Z" + }, + "specVersion": "1.5", + "version": 1 +} \ No newline at end of file diff --git a/bench/reachability-benchmark/cases/java/spring-reflection/outputs/traces/trace.json b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/traces/trace.json new file mode 100644 index 000000000..ff8466e0c --- /dev/null +++ b/bench/reachability-benchmark/cases/java/spring-reflection/outputs/traces/trace.json @@ -0,0 +1,9 @@ +{ + "entry": "POST /api/reflect", + "notes": "User controls class name flowing into Class.forName/newInstance", + "path": [ + "ReflectController.run", + "Class.forName" + ], + "sink": "SpringReflection::run" +} \ No newline at end of file