80 lines
2.4 KiB
JSON
80 lines
2.4 KiB
JSON
{
|
|
"schema": "ground-truth-v1",
|
|
"sampleId": "sample:csharp:simple-reachable:001",
|
|
"generatedAt": "2025-12-13T12:00:00Z",
|
|
"generator": {
|
|
"name": "manual-annotation",
|
|
"version": "1.0.0",
|
|
"annotator": "scanner-guild"
|
|
},
|
|
"targets": [
|
|
{
|
|
"symbolId": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"display": "Newtonsoft.Json.JsonConvert.DeserializeObject<T>(string, JsonSerializerSettings)",
|
|
"purl": "pkg:nuget/Newtonsoft.Json@13.0.1",
|
|
"expected": {
|
|
"latticeState": "SR",
|
|
"bucket": "direct",
|
|
"reachable": true,
|
|
"confidence": 0.95,
|
|
"pathLength": 2,
|
|
"path": [
|
|
"sym:csharp:Program.Main",
|
|
"sym:csharp:JsonConvert.DeserializeObject"
|
|
]
|
|
},
|
|
"reasoning": "Direct call from Main() to JsonConvert.DeserializeObject with TypeNameHandling.All settings"
|
|
},
|
|
{
|
|
"symbolId": "sym:csharp:JsonConvert.SerializeObject",
|
|
"display": "Newtonsoft.Json.JsonConvert.SerializeObject(object)",
|
|
"purl": "pkg:nuget/Newtonsoft.Json@13.0.1",
|
|
"expected": {
|
|
"latticeState": "SU",
|
|
"bucket": "unreachable",
|
|
"reachable": false,
|
|
"confidence": 0.90,
|
|
"pathLength": null,
|
|
"path": null
|
|
},
|
|
"reasoning": "SerializeObject is present in the dependency but never called from any entry point"
|
|
}
|
|
],
|
|
"entryPoints": [
|
|
{
|
|
"symbolId": "sym:csharp:Program.Main",
|
|
"display": "SampleApp.Program.Main(string[])",
|
|
"phase": "runtime",
|
|
"source": "manifest"
|
|
}
|
|
],
|
|
"expectedUncertainty": {
|
|
"states": [],
|
|
"aggregateTier": "T4",
|
|
"riskScore": 0.0
|
|
},
|
|
"expectedGateDecisions": [
|
|
{
|
|
"vulnId": "CVE-2024-21907",
|
|
"targetSymbol": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"requestedStatus": "not_affected",
|
|
"expectedDecision": "block",
|
|
"expectedBlockedBy": "LatticeState",
|
|
"expectedReason": "SR state incompatible with not_affected - code path exists from entry point"
|
|
},
|
|
{
|
|
"vulnId": "CVE-2024-21907",
|
|
"targetSymbol": "sym:csharp:JsonConvert.DeserializeObject",
|
|
"requestedStatus": "affected",
|
|
"expectedDecision": "allow"
|
|
},
|
|
{
|
|
"vulnId": "CVE-2024-21907",
|
|
"targetSymbol": "sym:csharp:JsonConvert.SerializeObject",
|
|
"requestedStatus": "not_affected",
|
|
"expectedDecision": "allow",
|
|
"expectedReason": "SU state allows not_affected - unreachable code path"
|
|
}
|
|
]
|
|
}
|