108d1c64b3
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Findings Ledger CI / build-test (push) Has been cancelled
Findings Ledger CI / migration-validation (push) Has been cancelled
Scanner Analyzers / Discover Analyzers (push) Has been cancelled
Signals Reachability Scoring & Events / reachability-smoke (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
cryptopro-linux-csp / build-and-test (push) Has been cancelled
Scanner Analyzers / Validate Test Fixtures (push) Has been cancelled
Signals CI & Image / signals-ci (push) Has been cancelled
sm-remote-ci / build-and-test (push) Has been cancelled
Findings Ledger CI / generate-manifest (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Scanner Analyzers / Build Analyzers (push) Has been cancelled
Scanner Analyzers / Test Language Analyzers (push) Has been cancelled
Scanner Analyzers / Verify Deterministic Output (push) Has been cancelled
Signals Reachability Scoring & Events / sign-and-upload (push) Has been cancelled
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
id: "java-spring-reflection:205"
|
|
language: java
|
|
project: spring-reflection
|
|
version: "1.0.0"
|
|
description: "Spring-style controller exposes reflection endpoint that loads arbitrary classes"
|
|
entrypoints:
|
|
- "POST /api/reflect"
|
|
sinks:
|
|
- id: "SpringReflection::run"
|
|
path: "bench.reachability.springreflection.ReflectController.run"
|
|
kind: "custom"
|
|
location:
|
|
file: src/ReflectController.java
|
|
line: 7
|
|
notes: "User-controlled Class.forName + newInstance"
|
|
environment:
|
|
os_image: "eclipse-temurin:21-jdk"
|
|
runtime:
|
|
java: "21"
|
|
source_date_epoch: 1730000000
|
|
resource_limits:
|
|
cpu: "2"
|
|
memory: "4Gi"
|
|
build:
|
|
command: "./build/build.sh"
|
|
source_date_epoch: 1730000000
|
|
outputs:
|
|
artifact_path: outputs/binary.tar.gz
|
|
sbom_path: outputs/sbom.cdx.json
|
|
coverage_path: outputs/coverage.json
|
|
traces_dir: outputs/traces
|
|
attestation_path: outputs/attestation.json
|
|
test:
|
|
command: "./build/build.sh"
|
|
expected_coverage: []
|
|
expected_traces: []
|
|
env:
|
|
JAVA_TOOL_OPTIONS: "-ea"
|
|
ground_truth:
|
|
summary: "Reflection sink reachable with user-controlled class name"
|
|
evidence_files:
|
|
- "../benchmark/truth/java-spring-reflection.json"
|
|
sandbox:
|
|
network: loopback
|
|
privileges: rootless
|
|
redaction:
|
|
pii: false
|
|
policy: "benchmark-default/v1"
|