Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
77 commits
Select commit Hold shift + click to select a range
a60653f
chore: 更新 .gitignore 文件
Bangbabazz Dec 12, 2025
38ad15c
feat: 更新 sast-go case
Bangbabazz Dec 12, 2025
0f6ceff
feat: 更新 sast-java case
Bangbabazz Dec 12, 2025
005c448
perf: 调整输出语句
Bangbabazz Dec 16, 2025
d3f6c28
feat: tool 加入更详细的日志
Bangbabazz Dec 16, 2025
7f47a5f
perf: 修正 sast-java 中重复和示例不正确的 case
Bangbabazz Dec 16, 2025
f403816
Merge remote-tracking branch 'github/main' into huanhua_251212
Bangbabazz Dec 16, 2025
a6c332e
feat:sast-js 集合
Bangbabazz Dec 22, 2025
ea3830a
feat: sast-js 返回值传递
Bangbabazz Dec 22, 2025
3bcdde9
feat:sast-js 简单对象
Bangbabazz Dec 22, 2025
69a6d82
feat:sast-js 条件语句、条件表达式和循环结构
Bangbabazz Dec 22, 2025
f3724ef
feat:sast-js 方法重写
Bangbabazz Dec 22, 2025
93cdabf
feat:sast-js 数组
Bangbabazz Dec 22, 2025
8155526
feat:sast-js 循环顺序执行语句
Bangbabazz Dec 22, 2025
7a7bfb5
feat:sast-js 循环结构
Bangbabazz Dec 22, 2025
bd62418
feat:sast-js 异步执行
Bangbabazz Dec 22, 2025
bb60851
feat:sast-js 异常抛出和捕获
Bangbabazz Dec 22, 2025
c862f9f
feat:sast-js 延迟执行异步
Bangbabazz Dec 22, 2025
c646c5d
feat:sast-js 延迟执行
Bangbabazz Dec 22, 2025
2b107fa
feat:sast-js 字符串
Bangbabazz Dec 22, 2025
ad9b94c
feat:sast-js 字典
Bangbabazz Dec 22, 2025
81353a4
feat:sast-js 子类对象
Bangbabazz Dec 22, 2025
60ddfdf
feat:sast-js 多线程
Bangbabazz Dec 22, 2025
a565cae
feat:sast-js 多次调用
Bangbabazz Dec 22, 2025
8c89cec
feat:sast-js 多态
Bangbabazz Dec 22, 2025
a888591
feat:sast-js 复杂对象
Bangbabazz Dec 22, 2025
1ed7496
feat:sast-js 基础表达式
Bangbabazz Dec 22, 2025
cd5f3da
feat:sast-js 基础数据类型
Bangbabazz Dec 22, 2025
936b20a
feat:sast-js 同步原语
Bangbabazz Dec 22, 2025
51608f4
feat:sast-js 反射调用
Bangbabazz Dec 22, 2025
9eb64fd
feat:sast-js 参数传递
Bangbabazz Dec 22, 2025
f9ab5ed
feat:sast-js 匿名对象
Bangbabazz Dec 22, 2025
4f1e1db
feat:sast-js 区分多维字典/列表/数组的不同元素
Bangbabazz Dec 22, 2025
2ab5727
feat:sast-js 区分不同的类对象、结构体/联合体和字典/列表/数组
Bangbabazz Dec 22, 2025
9b2378e
feat:sast-js 区分不同对象的不同字段
Bangbabazz Dec 22, 2025
347e846
feat:sast-js 区分一维字典/列表/数组的不同元素
Bangbabazz Dec 22, 2025
f6ed16e
feat: sast-js 别名
Bangbabazz Dec 22, 2025
6eb4839
feat: sast-js public 变量
Bangbabazz Dec 22, 2025
975818e
feat: sast-js private 变量
Bangbabazz Dec 22, 2025
04fe07f
feat: sast-js 修正注释错误
Bangbabazz Dec 22, 2025
1fddb40
fix: 修复 sast-python2 中重复引用的问题
Bangbabazz Dec 23, 2025
0cce77c
Merge remote-tracking branch 'github/main' into huanhua_251212
Bangbabazz Dec 23, 2025
4f2a76f
feat: sast-py3 静态变量
Bangbabazz Dec 26, 2025
1c0fc08
feat: sast-python3 跳转语句
Bangbabazz Dec 26, 2025
b0722dd
feat: sast-python3 条件语句、条件表达式和循环结构
Bangbabazz Dec 26, 2025
9dc9840
feat: sast-python3 条件语句
Bangbabazz Dec 26, 2025
fed30f0
feat: sast-python3 断言
Bangbabazz Dec 26, 2025
2bd07df
feat: sast-python3 数组
Bangbabazz Dec 26, 2025
7c4cd69
feat: sast-python3 循环结构
Bangbabazz Dec 26, 2025
eb25055
feat: sast-python3 异步执行
Bangbabazz Dec 26, 2025
b619f79
feat: sast-python3 异常抛出和捕获
Bangbabazz Dec 26, 2025
5ee1a74
feat: sast-python3 异常抛出与捕获
Bangbabazz Dec 26, 2025
df0bc06
feat: sast-python3 区分不同对象的不同字段
Bangbabazz Dec 26, 2025
9cccea3
feat: sast-python3 区分一维字典/列表/数组的不同元素
Bangbabazz Dec 26, 2025
bc97095
fix: sast-python3 格式化
Bangbabazz Dec 26, 2025
9e35ebc
perf: 调整 sast-go 的等级
Bangbabazz Dec 29, 2025
727b838
perf: 调整 sast-java 的等级
Bangbabazz Dec 29, 2025
25b44ac
perf: 调整 sast-js 的等级
Bangbabazz Dec 29, 2025
2926ce6
perf: 调整 sast-python2 的等级
Bangbabazz Dec 29, 2025
9fd26a1
perf: 调整 sast-python3 的等级
Bangbabazz Dec 29, 2025
a618ab8
fix: 修复文件中带 target 会被过滤的问题
Bangbabazz Dec 29, 2025
f7acedc
chore: 屏蔽 go.mod
Bangbabazz Dec 29, 2025
e15fde9
chore: 删除无用文件
Bangbabazz Dec 29, 2025
0f331dd
Merge remote-tracking branch 'refs/remotes/github/main' into huanhua_…
Bangbabazz Dec 29, 2025
2f758c5
feat: 新增 yasa 结果解析器
Bangbabazz Dec 30, 2025
3bfafa3
feat: 工具新增检测规范脚本
Bangbabazz Dec 30, 2025
5a0ca03
fix: sast-go case 规范化
Bangbabazz Dec 30, 2025
da3ea76
Merge remote-tracking branch 'github/main' into huanhua_251212
Bangbabazz Dec 30, 2025
c0c6810
fix: sast-python3 规范化
Bangbabazz Dec 31, 2025
d1f363e
feat: 新增根据 check 结果修复问题(目前只支持修复 bind_url)
Bangbabazz Dec 31, 2025
c6820b7
refactor(check): 优化配置检查器性能与结构
Bangbabazz Dec 31, 2025
12ae812
fix: sast-python2 规范化
Bangbabazz Jan 5, 2026
56fe48b
fix: sast-js 规范化
Bangbabazz Jan 5, 2026
f1d3422
feat(tool): 加入不同语言的检测白名单,修复路径问题
Bangbabazz Jan 5, 2026
94e0ca9
feat(check、fix): 新增检测config.json字段名与所在文件夹名是否一致,在fix.py中支持自动修复config字段…
Bangbabazz Jan 7, 2026
1f8cf0a
feat: YASARender 升级为通用的 SarifRender
Bangbabazz Jan 7, 2026
4e7f9f0
feat: 自动获取工具名称,生成正确的文件名
Bangbabazz Jan 8, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import (
"os/exec"
)

func sequentialAssign_001_T(__taint_src string) {
func sequential_assign_001_T(__taint_src string) {
// 场景特点:按顺序执行多个赋值语句
var a string
var b string
Expand All @@ -29,5 +29,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
sequentialAssign_001_T(__taint_src)
sequential_assign_001_T(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import (
"os/exec"
)

func sequentialAssign_002_F(__taint_src string) {
func sequential_assign_002_F(__taint_src string) {
// 场景特点:按顺序执行多个赋值语句,但污点数据未传播到最终变量
var a string
var b string
Expand All @@ -30,5 +30,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
sequentialAssign_002_F(__taint_src)
sequential_assign_002_F(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// scene introduction = 异常抛出路径
// level = 3
// date = 2025-12-01 16:29:18
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_004_F/exception_catch_004_T
// bind_url = accuracy/path_sensitive/exception_throw/exception_catch_004_F/exception_catch_004_F
// evaluation information end

package main
Expand All @@ -15,7 +15,7 @@ import (
"os/exec"
)

func exception_catch_003_T(__taint_src string) {
func exception_catch_004_F(__taint_src string) {
// 场景特点:在异常抛出路径中传播污点数据
errMsg := createThrow(__taint_src)
__taint_sink(errMsg.Error())
Expand All @@ -31,5 +31,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
exception_catch_003_T(__taint_src)
exception_catch_004_F(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import "os/exec"
// bind_url = accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_001_T/conditional_if_no_solver_001_T
// evaluation information end

func conditional_if_no_solver_001_F(__taint_src string) {
func conditional_if_no_solver_001_T(__taint_src string) {
var res string
if true {
res = __taint_src
Expand All @@ -25,5 +25,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
conditional_if_no_solver_001_F(__taint_src)
conditional_if_no_solver_001_T(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import "os/exec"
// bind_url = accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_001_T/conditional_switch_no_solver_001_T
// evaluation information end

func conditional_switch_no_solver_001_F(__taint_src string) {
func conditional_switch_no_solver_001_T(__taint_src string) {
res := ""
switch 2 {
case 1:
Expand All @@ -27,5 +27,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
conditional_switch_no_solver_001_F(__taint_src)
conditional_switch_no_solver_001_T(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_directory_011_T_b
import "os/exec"

func SayHello(taint_src string) {
func Cross_directory_011_T_b(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ package main
import "cross/cross_01"

func cross_directory_011_T_a(__taint_src string) {
cross_directory_011_T_b.SayHello(__taint_src)
cross_directory_011_T_b.Cross_directory_011_T_b(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_directory_012_F_b
import "os/exec"

func SayHello(taint_src string) {
func Cross_directory_012_F_b(taint_src string) {
__taint_sink("_")
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ package main
import "cross/cross_01"

func cross_directory_012_F_a(__taint_src string) {
cross_directory_012_F_b.SayHello(__taint_src)
cross_directory_012_F_b.Cross_directory_012_F_b(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_directory_013_T_b
import "os/exec"

func SayHello(taint_src string) {
func Cross_directory_013_T_b(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ package main
import "cross/other/cross_01"

func cross_directory_013_T_a(__taint_src string) {
cross_directory_013_T_b.SayHello(__taint_src)
cross_directory_013_T_b.Cross_directory_013_T_b(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_directory_014_F_b
import "os/exec"

func SayHello(taint_src string) {
func Cross_directory_014_F_b(taint_src string) {
__taint_sink("_")
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ package main
import "cross/other/cross_01"

func cross_directory_014_F_a(__taint_src string) {
cross_directory_014_F_b.SayHello(__taint_src)
cross_directory_014_F_b.Cross_directory_014_F_b(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_same_name_021_T
import "os/exec"

func SayHello(taint_src string) {
func Cross_same_name_021_T(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ import "cross_directory_021_T/cross"
var __taint_src = "taint_src_value"

func init() {
cross_same_name_021_T.SayHello(__taint_src)
cross_same_name_021_T.Cross_same_name_021_T(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import "cross_directory_021_T/other/cross"
var __taint_src = "taint_src_value"

func init() {
cross_same_name_021_T.SayHello(__taint_src)
cross_same_name_021_T.Cross_same_name_021_T(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

package cross_same_name_021_T
import "os/exec"
func SayHello(taint_src string) {
func Cross_same_name_021_T(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
package cross_same_name_022_F
import "os/exec"

func SayHello(taint_src string) {
func Cross_same_name_022_F(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ import "cross_directory_022_F/cross"
var __taint_src = "_"

func init() {
cross_same_name_022_F.SayHello(__taint_src)
cross_same_name_022_F.Cross_same_name_022_F(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import "cross_directory_022_F/other/cross"
var __taint_src = "abc"

func init() {
cross_same_name_022_F.SayHello(__taint_src)
cross_same_name_022_F.Cross_same_name_022_F(__taint_src)
}

func main() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
package cross_same_name_022_F
import "os/exec"

func SayHello(taint_src string) {
func Cross_same_name_022_F(taint_src string) {
__taint_sink(taint_src)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"scene": "跨module-别名"
},
{
"compose": "(cross_module_005_T/cross_module_005_T_a/cross_module_005_T.go || cross_module_005_T/cross_module_005_T_b/cross_module_005_T.go) && !(cross_module_006_F/cross_module_006_F_a/cross_module_006_F.go || cross_module_006_F/cross_module_006_F_b/cross_module_006_F.go)",
"compose": "(cross_module_005_T/cross_module_005_T_a/cross_module_005_T_a.go || cross_module_005_T/cross_module_005_T_b/cross_module_005_T_b.go) && !(cross_module_006_F/cross_module_006_F_a/cross_module_006_F_a.go || cross_module_006_F/cross_module_006_F_b/cross_module_006_F_b.go)",
"scene": "多Main包模块化管理"
}
]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// evaluation item = 完整度->单应用跟踪完整度->文件、包、命名空间->跨模块
// scene introduction = 多Main包模块化管理
// level = 2
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/cross_module_005_T_a/cross_module_005_T
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/cross_module_005_T_a/cross_module_005_T_a
// evaluation information end

// 先cd sast-go/cases/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T
Expand All @@ -24,6 +24,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "taint_src_value_main1"
__taint_src := "taint_src_value"
cross_module_005_T_a(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// evaluation item = 完整度->单应用跟踪完整度->文件、包、命名空间->跨模块
// scene introduction = 多Main包模块化管理
// level = 2
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/cross_module_005_T_b/cross_module_005_T
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/cross_module_005_T_b/cross_module_005_T_b
// evaluation information end

// 先cd sast-go/cases/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T
Expand All @@ -24,6 +24,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "taint_src_value_main2"
__taint_src := "taint_src_value"
cross_module_005_T_b(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// evaluation item = 完整度->单应用跟踪完整度->文件、包、命名空间->跨模块
// scene introduction = 多Main包模块化管理
// level = 2
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/cross_module_006_F_a/cross_module_006_F
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/cross_module_006_F_a/cross_module_006_F_a
// evaluation information end

// 先cd sast-go/cases/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F
Expand All @@ -24,6 +24,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "taint_src_value_main1"
__taint_src := "taint_src_value"
cross_module_006_F_a(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// evaluation item = 完整度->单应用跟踪完整度->文件、包、命名空间->跨模块
// scene introduction = 多Main包模块化管理
// level = 2
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/cross_module_006_F_b/cross_module_006_F
// bind_url = completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/cross_module_006_F_b/cross_module_006_F_b
// evaluation information end

// 先cd sast-go/cases/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F
Expand All @@ -24,6 +24,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "taint_src_value_main2"
__taint_src := "taint_src_value"
cross_module_006_F_b(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ func (e *CustomError) Error() string {
return e.message
}

func exception_throw_004_T(__taint_src string) {
func exception_throw_004_F(__taint_src string) {
defer func() {
if r := recover(); r != nil {
defer func() {
Expand All @@ -48,5 +48,5 @@ func __taint_sink(o interface{}) {

func main() {
__taint_src := "taint_src_value"
exception_throw_004_T(__taint_src)
exception_throw_004_F(__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "tainted_string"
__taint_src := "taint_src_value"
type_cast_007_T(&__taint_src)
}
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@ func __taint_sink(o interface{}) {
}

func main() {
__taint_src := "tainted_string"
__taint_src := "taint_src_value"
type_cast_008_F(&__taint_src)
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
package main


// evaluation information start
// real case = true
// evaluation item = 完整度->单应用跟踪完整度->函数和方法调用->库函数调用
Expand All @@ -10,13 +9,13 @@ package main
// evaluation information end

import (
"os/exec"
"encoding/json"
"fmt"
"os/exec"
)

func arg_arg_001_T(__taint_src string) {
taintedData := __taint_src
taintedData := "{\"key\": \"" + __taint_src + "\"}"
result, err := process(taintedData)
_ = err
__taint_sink(result)
Expand All @@ -30,9 +29,9 @@ func process(arg string) (map[string]interface{}, error) {

func __taint_sink(o interface{}) {
_ = exec.Command("sh", "-c", fmt.Sprintf("%v", o)).Run()
}
}

func main() {
__taint_src := "taint_src_value"
arg_arg_001_T(__taint_src)
}
__taint_src := "taint_src_value"
arg_arg_001_T(__taint_src)
}
Loading