id: "go-gin-exec:301"
language: go
project: gin-exec
version: "1.0.0"
description: "Command injection sink reachable via GET /run in Gin handler"
entrypoints:
  - "GET /run"
sinks:
  - id: "CommandInjection::handleRun"
    path: "main.handleRun"
    kind: "custom"
    location:
      file: main.go
      line: 22
    notes: "os/exec.Command with user-controlled input"
environment:
  os_image: "golang:1.22-alpine"
  runtime:
    go: "1.22"
  source_date_epoch: 1730000000
  resource_limits:
    cpu: "2"
    memory: "2Gi"
build:
  command: "go build -o outputs/app ."
  source_date_epoch: 1730000000
  outputs:
    artifact_path: outputs/app
    sbom_path: outputs/sbom.cdx.json
    coverage_path: outputs/coverage.json
    traces_dir: outputs/traces
    attestation_path: outputs/attestation.json
test:
  command: "go test -v ./..."
  expected_coverage: []
  expected_traces: []
ground_truth:
  summary: "Command injection reachable"
  evidence_files:
    - "../benchmark/truth/go-gin-exec.json"
sandbox:
  network: loopback
  privileges: rootless
redaction:
  pii: false
  policy: "benchmark-default/v1"