e1262eb916
- Introduced a new JSON fixture `receipt-input.json` containing base, environmental, and threat metrics for CVSS scoring. - Added corresponding SHA256 hash file `receipt-input.sha256` to ensure integrity of the JSON fixture.
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
id: "py-guarded-exec:102"
|
|
language: py
|
|
project: guarded-exec
|
|
version: "1.0.0"
|
|
description: "Python eval guarded by FEATURE_ENABLE flag; unreachable by default"
|
|
entrypoints:
|
|
- "POST /api/exec"
|
|
sinks:
|
|
- id: "PyGuardedExec::handle_request"
|
|
path: "src/app.py::handle_request"
|
|
kind: "process"
|
|
location:
|
|
file: src/app.py
|
|
line: 7
|
|
notes: "eval guarded by FEATURE_ENABLE"
|
|
environment:
|
|
os_image: "python:3.12-alpine"
|
|
runtime:
|
|
python: "3.12"
|
|
source_date_epoch: 1730000000
|
|
resource_limits:
|
|
cpu: "2"
|
|
memory: "4Gi"
|
|
build:
|
|
command: "./build/build.sh"
|
|
source_date_epoch: 1730000000
|
|
outputs:
|
|
artifact_path: outputs/binary.tar.gz
|
|
sbom_path: outputs/sbom.cdx.json
|
|
coverage_path: outputs/coverage.json
|
|
traces_dir: outputs/traces
|
|
attestation_path: outputs/attestation.json
|
|
test:
|
|
command: "./tests/run-tests.sh"
|
|
expected_coverage:
|
|
- outputs/coverage.json
|
|
expected_traces:
|
|
- outputs/traces/traces.json
|
|
ground_truth:
|
|
summary: "Guard blocks eval when FEATURE_ENABLE != 1"
|
|
evidence_files:
|
|
- "../benchmark/truth/py-guarded-exec.json"
|
|
sandbox:
|
|
network: loopback
|
|
privileges: rootless
|
|
redaction:
|
|
pii: false
|
|
policy: "benchmark-default/v1"
|