87 lines
2.6 KiB
JSON
87 lines
2.6 KiB
JSON
{
|
|
"schema": "ground-truth-v1",
|
|
"sampleId": "sample:csharp:dead-code:001",
|
|
"generatedAt": "2025-12-13T12:00:00Z",
|
|
"generator": {
|
|
"name": "manual-annotation",
|
|
"version": "1.0.0",
|
|
"annotator": "scanner-guild"
|
|
},
|
|
"targets": [
|
|
{
|
|
"symbolId": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"display": "Newtonsoft.Json.JsonConvert.DeserializeObject<T>(string, JsonSerializerSettings)",
|
|
"purl": "pkg:nuget/Newtonsoft.Json@13.0.1",
|
|
"expected": {
|
|
"latticeState": "CU",
|
|
"bucket": "unreachable",
|
|
"reachable": false,
|
|
"confidence": 0.95,
|
|
"pathLength": null,
|
|
"path": null
|
|
},
|
|
"reasoning": "DeserializeObject referenced in deprecated LegacyParser class but LegacyParser is never instantiated - new SafeParser uses System.Text.Json instead"
|
|
},
|
|
{
|
|
"symbolId": "sym:csharp:LegacyParser.ParseJson",
|
|
"display": "SampleApp.LegacyParser.ParseJson(string)",
|
|
"purl": "pkg:generic/SampleApp@1.0.0",
|
|
"expected": {
|
|
"latticeState": "SU",
|
|
"bucket": "unreachable",
|
|
"reachable": false,
|
|
"confidence": 0.90,
|
|
"pathLength": null,
|
|
"path": null
|
|
},
|
|
"reasoning": "LegacyParser.ParseJson exists but LegacyParser is never instantiated - replaced by SafeParser"
|
|
},
|
|
{
|
|
"symbolId": "sym:csharp:SafeParser.ParseJson",
|
|
"display": "SampleApp.SafeParser.ParseJson(string)",
|
|
"purl": "pkg:generic/SampleApp@1.0.0",
|
|
"expected": {
|
|
"latticeState": "SR",
|
|
"bucket": "direct",
|
|
"reachable": true,
|
|
"confidence": 0.95,
|
|
"pathLength": 2,
|
|
"path": [
|
|
"sym:csharp:Program.Main",
|
|
"sym:csharp:SafeParser.ParseJson"
|
|
]
|
|
},
|
|
"reasoning": "SafeParser.ParseJson is the active implementation called from Main"
|
|
}
|
|
],
|
|
"entryPoints": [
|
|
{
|
|
"symbolId": "sym:csharp:Program.Main",
|
|
"display": "SampleApp.Program.Main(string[])",
|
|
"phase": "runtime",
|
|
"source": "manifest"
|
|
}
|
|
],
|
|
"expectedUncertainty": {
|
|
"states": [],
|
|
"aggregateTier": "T4",
|
|
"riskScore": 0.0
|
|
},
|
|
"expectedGateDecisions": [
|
|
{
|
|
"vulnId": "CVE-2024-21907",
|
|
"targetSymbol": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"requestedStatus": "not_affected",
|
|
"expectedDecision": "allow",
|
|
"expectedReason": "CU state allows not_affected - confirmed unreachable"
|
|
},
|
|
{
|
|
"vulnId": "CVE-2024-21907",
|
|
"targetSymbol": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"requestedStatus": "affected",
|
|
"expectedDecision": "warn",
|
|
"expectedReason": "Marking as affected when CU suggests false positive"
|
|
}
|
|
]
|
|
}
|