0sec-cli 0.15.0 → 0.18.0

package/chunks/corpus-v1.json

@@ -0,0 +1,403 @@
+{
+  "id": "0sec-bench-corpus-v1",
+  "version": 1,
+  "_comment": "LABELED, UNCONTAMINATED REGRESSION CORPUS v1 (0sec#657). Ground truth the #656 A/B tournament + CI gate measures against. REFERENCES ONLY — no exploit material. A source-audit case is a PUBLIC registry coordinate (package@version) the engine installs at run time; a kernel case is a reproducerRef resolved OUTSIDE the repo. Positives are sourced from our own confirmed disclosures (disclosure/*.md); sinkMarkers are literal file/symbol substrings drawn from those writeups, used for DETERMINISTIC marker-based grading (never LLM-judged). Known-negatives are (a) real triage false-positive controls — findings the maintainer rejected as by-design / unreachable / superseded / refuted, where a 'verified' verdict is itself a false positive — and (b) PUBLIC fixed-CVE packages pinned at a PATCHED version: re-reporting the historical class there is a false positive. EMBARGO: references pending-disclosure findings; do not publish externally without operator approval (disclosure/AGENTS.md rules apply). Provenance + full label table: docs/operations/bench-corpus-v1.md.",
+  "cases": [
+    {
+      "id": "src-sequelize-set-sqli",
+      "name": "sequelize Sequelize.prototype.set SQLi via unescaped names/values",
+      "target": { "kind": "source-audit", "package": "sequelize", "version": "6.37.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "sql-injection", "sinkMarkers": ["Sequelize.prototype.set", "quoteIdentifier", "sequelize.set"] },
+      "ci": true,
+      "tags": ["npm", "sqli", "disclosure"]
+    },
+    {
+      "id": "src-sequelize-fn-cast-json-sqli",
+      "name": "sequelize SQLi via fn(), cast(), json() APIs",
+      "target": { "kind": "source-audit", "package": "sequelize", "version": "6.37.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "sql-injection", "sinkMarkers": ["ALLOWED_CAST_TYPES", "sequelize.fn", "sequelize.cast", "sequelize.json"] },
+      "tags": ["npm", "sqli", "disclosure"]
+    },
+    {
+      "id": "src-sequelize-pg-startup-sqli",
+      "name": "sequelize PostgreSQL connection-startup SQLi via dialectOptions",
+      "target": { "kind": "source-audit", "package": "sequelize", "version": "6.37.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "sql-injection", "sinkMarkers": ["clientMinMessages", "SET client_min_messages TO", "dialectOptions"] },
+      "tags": ["npm", "sqli", "disclosure"]
+    },
+    {
+      "id": "src-eta-renderstring-ssti-rce",
+      "name": "eta SSTI to RCE via constructor chain in renderString",
+      "target": { "kind": "source-audit", "package": "eta", "version": "4.5.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["renderString", "renderStringAsync", "new Function", "constructor"] },
+      "ci": true,
+      "tags": ["npm", "ssti-rce", "disclosure"]
+    },
+    {
+      "id": "src-nunjucks-ssti-rce",
+      "name": "nunjucks SSTI to RCE via constructor chain in renderString()",
+      "target": { "kind": "source-audit", "package": "nunjucks", "version": "3.2.4", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["memberLookup", "renderString", "new Template", "constructor"] },
+      "tags": ["npm", "ssti-rce", "disclosure"]
+    },
+    {
+      "id": "src-expr-eval-tojsfunction-sandbox-escape",
+      "name": "expr-eval toJSFunction sandbox escape to RCE via global-scope leak",
+      "target": { "kind": "source-audit", "package": "expr-eval", "version": "2.0.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["toJSFunction", "new Function"] },
+      "tags": ["npm", "sandbox-escape", "disclosure"]
+    },
+    {
+      "id": "src-mathjs-sandbox-escape-chain-import",
+      "name": "mathjs sandbox escape via Chain.import from expression context",
+      "target": { "kind": "source-audit", "package": "mathjs", "version": "15.1.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["Chain.import", "Chain.fromJSON", "math.import", "math.evaluate"] },
+      "tags": ["npm", "sandbox-escape", "disclosure"]
+    },
+    {
+      "id": "src-jsonpath-plus-vm-sandbox-escape",
+      "name": "jsonpath-plus VM sandbox escape via eval:'native'",
+      "target": { "kind": "source-audit", "package": "jsonpath-plus", "version": "10.4.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["vm.Script", "constructor.constructor", "process.binding", "eval"] },
+      "tags": ["npm", "rce", "disclosure"]
+    },
+    {
+      "id": "src-vm2-sandbox-escape-vm-builtin",
+      "name": "vm2 sandbox escape via vm builtin module in NodeVM",
+      "target": { "kind": "source-audit", "package": "vm2", "version": "3.10.5", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["runInThisContext", "NodeVM", "runInNewContext"] },
+      "tags": ["npm", "rce", "disclosure"]
+    },
+    {
+      "id": "src-pug-compileclient-name-toctou-rce",
+      "name": "pug compileClient() name option TOCTOU RCE (CVE-2024-36361 bypass)",
+      "target": { "kind": "source-audit", "package": "pug", "version": "3.0.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["compileClientWithDependenciesTracked", "options.name", "isIdentifier"] },
+      "tags": ["npm", "rce", "disclosure"]
+    },
+    {
+      "id": "src-dd-trace-esbuild-banner-code-injection",
+      "name": "dd-trace datadog-esbuild banner code injection via unescaped git remote URL",
+      "target": { "kind": "source-audit", "package": "dd-trace", "version": "5.26.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["datadog-esbuild", "remote.origin.url", "repositoryURL", "DD_GIT_REPOSITORY_URL"] },
+      "tags": ["npm", "code-injection", "disclosure"]
+    },
+    {
+      "id": "src-justeattakeaway-eslint-plugin-rce",
+      "name": "@justeattakeaway/eslint-plugin-snacks-pie-migration RCE via execSync command injection",
+      "target": { "kind": "source-audit", "package": "@justeattakeaway/eslint-plugin-snacks-pie-migration", "version": "0.7.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "command-injection", "sinkMarkers": ["git-utils", "execSync", "isFileNew", "git cat-file"] },
+      "tags": ["npm", "command-injection", "disclosure"]
+    },
+    {
+      "id": "src-express-session-constructor-proto-pollution",
+      "name": "express-session Session constructor prototype pollution from store data",
+      "target": { "kind": "source-audit", "package": "express-session", "version": "1.19.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["createSession", "new Session", "__proto__"] },
+      "tags": ["npm", "prototype-pollution", "disclosure"]
+    },
+    {
+      "id": "src-joi-object-rename-proto-pollution",
+      "name": "joi object.rename Template destination sets __proto__",
+      "target": { "kind": "source-audit", "package": "joi", "version": "18.1.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["rename", "__proto__", "Joi.expression"] },
+      "tags": ["npm", "prototype-pollution", "disclosure"]
+    },
+    {
+      "id": "src-jsonwebtoken-proto-pollution-gadget",
+      "name": "jsonwebtoken verify() prototype-pollution gadget bypasses expiry/algorithm checks",
+      "target": { "kind": "source-audit", "package": "jsonwebtoken", "version": "9.0.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["Object.assign", "ignoreExpiration", "ignoreNotBefore", "clockTimestamp"] },
+      "tags": ["npm", "prototype-pollution", "disclosure"]
+    },
+    {
+      "id": "src-jsonwebtoken-audience-regex-redos",
+      "name": "jsonwebtoken verify() audience regex ReDoS",
+      "target": { "kind": "source-audit", "package": "jsonwebtoken", "version": "9.0.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "regex-dos", "sinkMarkers": ["options.audience", "payload.aud", ".test("] },
+      "tags": ["npm", "redos", "disclosure"]
+    },
+    {
+      "id": "src-jsonata-tomillis-redos",
+      "name": "jsonata ReDoS in $toMillis ISO-8601 validation regex",
+      "target": { "kind": "source-audit", "package": "jsonata", "version": "2.1.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "regex-dos", "sinkMarkers": ["toMillis", "(-[01]", "(-[0-3]"] },
+      "tags": ["npm", "redos", "disclosure"]
+    },
+    {
+      "id": "src-extract-zip-symlink-chain-traversal",
+      "name": "extract-zip symlink-chain write outside opts.dir",
+      "target": { "kind": "source-audit", "package": "extract-zip", "version": "2.0.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["opts.dir", "symlink"] },
+      "tags": ["npm", "zip-slip", "disclosure"]
+    },
+    {
+      "id": "src-unzipper-prefix-check-sibling-escape",
+      "name": "unzipper zip-slip sibling escape via raw string-prefix containment check",
+      "target": { "kind": "source-audit", "package": "unzipper", "version": "0.12.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["extractPath.indexOf", "Open.directory", "extract.js"] },
+      "tags": ["npm", "zip-slip", "disclosure"]
+    },
+    {
+      "id": "src-ollama-image-path-auto-read",
+      "name": "ollama local file disclosure via image path auto-read",
+      "target": { "kind": "source-audit", "package": "ollama", "version": "0.5.11", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["encodeImage", "existsSync", "readFile", "resolve(image)"] },
+      "tags": ["npm", "file-read", "disclosure"]
+    },
+    {
+      "id": "src-wrangler-deploy-symlink-following",
+      "name": "wrangler (@cloudflare/workers-sdk) deploy symlink following via stat() instead of lstat()",
+      "target": { "kind": "source-audit", "package": "wrangler", "version": "4.20.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["statSync", "lstatSync", "stat(", "lstat("] },
+      "tags": ["npm", "symlink-following", "disclosure"]
+    },
+    {
+      "id": "src-next-auth-forwarded-host",
+      "name": "next-auth unvalidated forwarded host in trusted-host modes",
+      "target": { "kind": "source-audit", "package": "next-auth", "version": "4.24.13", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "security-misconfiguration", "sinkMarkers": ["detectOrigin", "createActionURL", "x-forwarded-host", "TRUST_HOST"] },
+      "tags": ["npm", "host-header-injection", "disclosure"]
+    },
+    {
+      "id": "src-mysql2-url-option-override",
+      "name": "mysql2 URL option override + packet-parsing robustness issues",
+      "target": { "kind": "source-audit", "package": "mysql2", "version": "3.19.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "missing-validation", "sinkMarkers": ["parseUrl", "readNullTerminatedString", "multipleStatements"] },
+      "tags": ["npm", "missing-validation", "disclosure"]
+    },
+    {
+      "id": "src-jsonpath-plus-safe-mode-mutation",
+      "name": "jsonpath-plus data mutation via filter expressions in safe mode",
+      "target": { "kind": "source-audit", "package": "jsonpath-plus", "version": "10.4.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["evalCallExpression", "splice", "reverse", "sort"] },
+      "tags": ["npm", "data-integrity", "disclosure"]
+    },
+    {
+      "id": "src-adm-zip-zip64-corruption",
+      "name": "adm-zip broken readUInt64LE corrupts Zip64 parsing",
+      "target": { "kind": "source-audit", "package": "adm-zip", "version": "0.5.16", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["readUInt64LE", "zipEntry", "readBigUInt64LE"] },
+      "tags": ["npm", "data-corruption", "disclosure"]
+    },
+    {
+      "id": "src-adm-zip-zipbomb-dos",
+      "name": "adm-zip zip-bomb DoS via unchecked uncompressed size allocation",
+      "target": { "kind": "source-audit", "package": "adm-zip", "version": "0.5.16", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["Buffer.alloc", "uncompressedSize", "getData"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+    {
+      "id": "src-js-yaml-stack-overflow-dos",
+      "name": "js-yaml stack-overflow DoS via deeply nested structures",
+      "target": { "kind": "source-audit", "package": "js-yaml", "version": "4.1.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["composeNode"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+    {
+      "id": "src-jsonata-untrusted-expression-dos",
+      "name": "jsonata CPU/memory exhaustion via untrusted expressions",
+      "target": { "kind": "source-audit", "package": "jsonata", "version": "2.1.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["evaluate", "sequence", "[1..5000]"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+    {
+      "id": "src-mysql2-binlog-statusvars-dos",
+      "name": "mysql2 binlog QueryEvent status-vars parser DoS (RangeError)",
+      "target": { "kind": "source-audit", "package": "mysql2", "version": "3.19.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["binlog_query_statusvars", "parseStatusVars", "RangeError"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+    {
+      "id": "src-protobufjs-skiptype-stack-overflow",
+      "name": "protobufjs skipType unbounded recursion stack overflow DoS",
+      "target": { "kind": "source-audit", "package": "protobufjs", "version": "8.0.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["skipType", "Reader.prototype.skipType"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+    {
+      "id": "src-yaml-quadratic-map-dos",
+      "name": "yaml O(n^2) CPU exhaustion via large maps with unique keys",
+      "target": { "kind": "source-audit", "package": "yaml", "version": "2.8.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["mapIncludes", "uniqueKeys", "items.some"] },
+      "tags": ["npm", "dos", "disclosure"]
+    },
+
+    {
+      "id": "kernel-bluetooth-cig-uaf",
+      "name": "Linux kernel UAF in hci_le_create_cis_sync() (Bluetooth CIG/CIS)",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/bluetooth-cig-uaf", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit", "signature": "use-after-free" },
+      "tags": ["kernel", "uaf", "disclosure"]
+    },
+    {
+      "id": "kernel-nfc-digital-sensf-overflow",
+      "name": "Linux kernel stack buffer overflow in NFC digital sensf_res memcpy",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/nfc-digital-sensf-overflow", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit", "signature": "stack-out-of-bounds" },
+      "tags": ["kernel", "stack-overflow", "disclosure"]
+    },
+    {
+      "id": "kernel-nfc-llcp-tlv-underflow",
+      "name": "Linux kernel NFC LLCP TLV parser integer underflow + OOB reads",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/nfc-llcp-tlv-underflow", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit", "signature": "out-of-bounds" },
+      "tags": ["kernel", "oob", "disclosure"]
+    },
+    {
+      "id": "kernel-skb-zerocopy-fragnesia",
+      "name": "Linux kernel SKBFL_SHARED_FRAG flag loss in skb_zerocopy() (Fragnesia variant)",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/skb-zerocopy-fragnesia", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit" },
+      "tags": ["kernel", "memory-corruption", "disclosure"]
+    },
+    {
+      "id": "kernel-mac802154-no-cow",
+      "name": "Linux kernel mac802154 llsec in-place AEAD decrypt on cloned skb without COW guard",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/mac802154-no-cow", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit" },
+      "tags": ["kernel", "memory-corruption", "disclosure"]
+    },
+
+    {
+      "id": "neg-bydesign-webpack-cli-proto-pollution",
+      "name": "[FP control] webpack cli.processArguments proto-pollution — rejected by maintainer (developer-authored config, not attacker input)",
+      "target": { "kind": "source-audit", "package": "webpack", "version": "5.107.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["getObjectAndProperty", "setValue", "processArguments", "__proto__"] },
+      "knownNegative": true,
+      "ci": true,
+      "tags": ["npm", "known-negative", "by-design", "disclosure-fp"]
+    },
+    {
+      "id": "neg-unreachable-node-forge-proto-pollution",
+      "name": "[FP control] node-forge form.serialize proto-pollution — unreachable dead code (forge.form unexported)",
+      "target": { "kind": "source-audit", "package": "node-forge", "version": "1.3.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["serialize", "_addField", "__proto__"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "unreachable", "disclosure-fp"]
+    },
+    {
+      "id": "neg-superseded-formidable-traversal",
+      "name": "[FP control] formidable createDirsFromUploads traversal — superseded duplicate of GHSA-3pj2-wmw4-qpcx",
+      "target": { "kind": "source-audit", "package": "formidable", "version": "3.5.4", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["_joinDirectoryName", "createDirsFromUploads", "uploadDir"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "superseded", "disclosure-fp"]
+    },
+    {
+      "id": "neg-patched-lodash-proto-pollution",
+      "name": "[FP control] lodash @4.17.21 — proto-pollution (CVE-2019-10744) patched since 4.17.12",
+      "target": { "kind": "source-audit", "package": "lodash", "version": "4.17.21", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["defaultsDeep", "mergeWith", "zipObjectDeep", "setWith", "baseSet"] },
+      "knownNegative": true,
+      "ci": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-minimist-proto-pollution",
+      "name": "[FP control] minimist @1.2.8 — proto-pollution (CVE-2021-44906) patched since 1.2.6",
+      "target": { "kind": "source-audit", "package": "minimist", "version": "1.2.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["setKey", "__proto__", "constructor"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-json5-proto-pollution",
+      "name": "[FP control] json5 @2.2.3 — proto-pollution (CVE-2022-46175) patched since 2.2.2",
+      "target": { "kind": "source-audit", "package": "json5", "version": "2.2.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["internalize", "reviver", "__proto__"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-y18n-proto-pollution",
+      "name": "[FP control] y18n @5.0.8 — proto-pollution (CVE-2020-7774) patched since 5.0.5",
+      "target": { "kind": "source-audit", "package": "y18n", "version": "5.0.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["__proto__", "setLocale", "update"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-async-proto-pollution",
+      "name": "[FP control] async @3.2.6 — proto-pollution (CVE-2021-43138) patched since 3.2.2",
+      "target": { "kind": "source-audit", "package": "async", "version": "3.2.6", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["autoInject", "mapValuesLimit", "__proto__"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-qs-proto-pollution",
+      "name": "[FP control] qs @6.11.0 — proto-pollution (CVE-2022-24999) patched since 6.10.3/6.5.3",
+      "target": { "kind": "source-audit", "package": "qs", "version": "6.11.0", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "prototype-pollution", "sinkMarkers": ["parseObject", "__proto__", "allowPrototypes"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-handlebars-ssti",
+      "name": "[FP control] handlebars @4.7.8 — SSTI/RCE (CVE-2019-20920) patched since 4.7.7",
+      "target": { "kind": "source-audit", "package": "handlebars", "version": "4.7.8", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["compile", "registerHelper", "lookupProperty"] },
+      "knownNegative": true,
+      "ci": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-ejs-rce",
+      "name": "[FP control] ejs @3.1.10 — RCE via options (CVE-2022-29078) patched since 3.1.7",
+      "target": { "kind": "source-audit", "package": "ejs", "version": "3.1.10", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "code-injection", "sinkMarkers": ["outputFunctionName", "escapeFunction", "new Function"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-tar-traversal",
+      "name": "[FP control] tar @6.2.1 — path traversal / symlink (CVE-2021-37701) patched since 6.1.2",
+      "target": { "kind": "source-audit", "package": "tar", "version": "6.2.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "path-traversal", "sinkMarkers": ["stripAbsolutePath", "preservePaths", "Unpack"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-semver-redos",
+      "name": "[FP control] semver @7.6.3 — ReDoS in range parsing (CVE-2022-25883) patched since 7.5.2",
+      "target": { "kind": "source-audit", "package": "semver", "version": "7.6.3", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "regex-dos", "sinkMarkers": ["parseRange", "new Range", "safeRe"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-ansi-regex-redos",
+      "name": "[FP control] ansi-regex @5.0.1 — ReDoS (CVE-2021-3807) patched in 5.0.1",
+      "target": { "kind": "source-audit", "package": "ansi-regex", "version": "5.0.1", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "regex-dos", "sinkMarkers": ["ansiRegex", "pattern"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-glob-parent-redos",
+      "name": "[FP control] glob-parent @5.1.2 — ReDoS (CVE-2020-28469) patched in 5.1.2",
+      "target": { "kind": "source-audit", "package": "glob-parent", "version": "5.1.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "regex-dos", "sinkMarkers": ["globParent", "enclosure", "isglob"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+    {
+      "id": "neg-patched-decode-uri-component-dos",
+      "name": "[FP control] decode-uri-component @0.2.2 — DoS (CVE-2022-38900) patched in 0.2.1",
+      "target": { "kind": "source-audit", "package": "decode-uri-component", "version": "0.2.2", "ecosystem": "npm" },
+      "objective": { "type": "finding-match", "vulnClass": "other", "sinkMarkers": ["decodeURIComponent", "tokenize", "singleMatcher"] },
+      "knownNegative": true,
+      "tags": ["npm", "known-negative", "patched-cve"]
+    },
+
+    {
+      "id": "kernel-neg-algif-skcipher-refuted",
+      "name": "[FP control] Linux kernel algif_skcipher splice page-cache corruption — refuted (no crash on 7.0.0-15)",
+      "target": { "kind": "kernel", "reproducerRef": "corpus://kernel/algif-skcipher-pagecache-corruption", "ecosystem": "linux-kernel" },
+      "objective": { "type": "kasan-hit" },
+      "knownNegative": true,
+      "tags": ["kernel", "known-negative", "refuted", "disclosure-fp"]
+    }
+  ]
+}

package/chunks/cost-ledger-NU63MYZM.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  ScanCostLedger
+} from "./chunk-242TMK6G.js";
+import "./chunk-H2FFLZNK.js";
+import "./chunk-6L26OBWI.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  ScanCostLedger
+};

package/chunks/data/appsec-archetypes.json

@@ -0,0 +1,102 @@
+{
+  "provenance": "0sec-authored appsec bug-class registry, 2026-07-21. Mirrors the SCHEMA of kernel-archetypes.json but is a SEPARATE, cross-language application-security pack (domain: appsec), NOT ported from 0verse (0verse's registry is Linux-kernel-only). Grounded in OWASP Top-10 / CWE and in the concrete misses these lenses were built to close: the Swiss engagement's gever OS-command-injection CRITICAL and the sibling-route authz / template-XSS / SSO-trust / resource-exhaustion classes the four generic finder lenses (memory-safety, input-validation, auth-logic, secrets-crypto) under-weighted. Unlike the kernel pack there is NO build/boot/sanitizer lane for these — every entry is route 'appsec-source-static': a grep/read hit is a hypothesis for the skeptic + multi-lens verify quorum, never an auto-confirmed finding. The load-bearing field for the finder surface is 'challenge_hint' (the cross-language, sink-shape-citing hunt angle), which the loader maps directly onto FinderLens.challengeHint; 'detection_signature' is the human/skeptic-facing grep evidence. 'engine_lens' is null for every entry (no pre-existing engine lens implements these — this registry IS their implementation).",
+  "archetypes": [
+    {
+      "id": "os-command-injection",
+      "name": "OS command injection via attacker-influenced process/shell exec",
+      "cwe": "CWE-78",
+      "domain": "appsec",
+      "subsystem": "process / shell execution (any runtime)",
+      "pattern": "Attacker-controlled data (a request param, header, filename, upload name, DB value, config field) is concatenated or interpolated into a command line, a shell string, or a process argument that is then handed to an OS command/shell interpreter. The sink executes with the app's privileges; even when the base command is fixed, an unescaped argument, a shell metacharacter (; | & $() ` > <), or argument-injection (a value beginning with -) subverts it. The tell is DATA (not developer-authored code) reaching an exec sink without an allow-list, tokenized argv, or a proven-safe escaper.",
+      "detection_signature": "Language-agnostic sink hunt. Node: child_process exec/execSync/spawn/spawnSync/execFile with a shell:true option or a string-built command, template literals inside exec(`...${x}...`). .NET: System.Diagnostics.Process.Start / ProcessStartInfo where FileName is cmd.exe/powershell/bash or Arguments is string-concatenated, UseShellExecute=true. Java: Runtime.getRuntime().exec(String), ProcessBuilder(command) built from concatenation, especially exec(\"sh\", \"-c\", cmd). Python: subprocess.run/Popen/call with shell=True, os.system, os.popen, commands.getoutput. PHP: system/exec/shell_exec/passthru/proc_open/backticks. Ruby: system/`backticks`/%x/Open3 with interpolation. Perl: system/open with a pipe. Trace the taint from the entry point to the argv/shell string; a fixed argv array with no shell and no attacker-controlled flag is safe.",
+      "challenge_hint": "Hunt OS COMMAND INJECTION only, ACROSS ALL LANGUAGES: attacker-influenced data reaching a process/shell exec sink. Look for — Node child_process exec/execSync/spawn(..., {shell:true})/execFile and backtick-built commands; .NET Process.Start / ProcessStartInfo.FileName=cmd.exe|powershell with a concatenated Arguments (or UseShellExecute=true); Java Runtime.exec(String) / ProcessBuilder built by string concatenation (esp. sh -c); Python subprocess(..., shell=True) / os.system / os.popen; PHP system/exec/shell_exec/passthru/proc_open/backticks; Ruby system/%x/backticks; any string-built shell command. Cite the exact sink (file:line) and the concrete taint path from the entry point (route param, header, filename, upload, config, DB value) to the command string or argv. A fixed argv array with NO shell and NO attacker-controlled leading-dash flag is safe — do not flag it. This is the class that missed the gever CRITICAL.",
+      "grounding": [
+        "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
+        "OWASP Top 10 A03:2021 Injection",
+        "0sec Swiss engagement: gever OS-command-injection CRITICAL (missed by the generic input-validation lens)"
+      ],
+      "confirmable": "Source-static hypothesis. A grep/read hit needs the skeptic + multi-lens verify quorum to confirm the argument is genuinely attacker-reachable and not escaped/tokenized upstream; no build/exec lane proves it in this repo.",
+      "uid": "appsec/os-command-injection",
+      "engine_lens": null,
+      "route": "appsec-source-static"
+    },
+    {
+      "id": "method-authz-differential",
+      "name": "Method-level authorization differential (sibling route/handler missing its siblings' authz + IDOR-by-id)",
+      "cwe": "CWE-862",
+      "domain": "appsec",
+      "subsystem": "web routing / controllers / service layer (any framework)",
+      "pattern": "Two or more handlers act on the SAME resource, but one is missing the authorization guard its siblings carry: a controller action without the [Authorize]/policy/role attribute its neighbors have; a service-layer method that mutates or reads an object WITHOUT the ownership/tenant/scope check its Update/Delete siblings enforce; a route that trusts a caller-supplied id and fetches by id alone (IDOR) instead of scoping to the authenticated principal. The vulnerability is the DIFFERENCE between siblings, not the absence of auth everywhere — the guard exists and is proven necessary on one path and simply omitted on another.",
+      "detection_signature": "Compare sibling handlers on one resource. .NET: an action lacking [Authorize]/[Authorize(Policy=...)]/[Authorize(Roles=...)] present on peer actions in the same controller, or a controller relying on a global filter that a specific action opts out of with [AllowAnonymous]. Spring: a @GetMapping/@PostMapping without the @PreAuthorize/@Secured its siblings have, or a SecurityConfig antMatcher that omits one path. Express/Koa/Fastify: a route registered without the requireAuth/authorize middleware its siblings chain. Rails: a controller action skipped in before_action :authorize, or skip_before_action. Service layer (any language): an Update/Delete method that checks resource.ownerId == currentUser before mutating, next to a sibling (e.g. GetById, Export, a bulk op) that fetches/mutates by id with NO such check. Also flag repository calls keyed only by a request-supplied id with no tenant/owner predicate.",
+      "challenge_hint": "Hunt METHOD-LEVEL AUTHORIZATION DIFFERENTIALS and IDOR only. Find sibling routes/handlers/methods on the SAME resource where ONE lacks the guard its siblings carry: a controller action missing the [Authorize]/@PreAuthorize/policy/role attribute or requireAuth middleware its peers have; a service method that mutates/reads by id WITHOUT the ownership/tenant/scope check its Update/Delete siblings enforce; a repository/query keyed only on a caller-supplied id with no owner/tenant predicate (IDOR-by-id). The signal is the DIFFERENCE between siblings — prove the guard is present and necessary on one path and genuinely absent or mis-scoped on the reachable one, not merely that an auth keyword appears somewhere in the file. Cite both the guarded sibling and the unguarded reachable handler (file:line each).",
+      "grounding": [
+        "CWE-862: Missing Authorization",
+        "CWE-639: Authorization Bypass Through User-Controlled Key (IDOR)",
+        "OWASP Top 10 A01:2021 Broken Access Control"
+      ],
+      "confirmable": "Source-static hypothesis. The skeptic must confirm the sibling truly shares the resource, the guard is genuinely absent (not enforced by a global filter/middleware or an earlier check), and the unguarded path is reachable by a lower-privileged principal.",
+      "uid": "appsec/method-authz-differential",
+      "engine_lens": null,
+      "route": "appsec-source-static"
+    },
+    {
+      "id": "template-xss-ssti",
+      "name": "Template / HTML-render XSS and server-side template injection (SSTI)",
+      "cwe": "CWE-79",
+      "domain": "appsec",
+      "subsystem": "view / template rendering (client and server frameworks)",
+      "pattern": "User- or controller-supplied input reaches an HTML or template render context WITHOUT context-correct escaping — either interpolated into markup that the browser parses as HTML/JS (XSS), or concatenated into the TEMPLATE SOURCE itself so the engine evaluates attacker text as template code (SSTI, which can reach RCE). This is DATA crossing into a code/markup context, distinct from a template engine legitimately compiling a developer-authored template (that is by-design and NOT a finding).",
+      "detection_signature": "Client: Angular bypassSecurityTrustHtml/bypassSecurityTrustScript/bypassSecurityTrustResourceUrl and [innerHTML]=userValue; React dangerouslySetInnerHTML={{__html: userValue}}; Vue v-html=userValue; raw DOM innerHTML/outerHTML/insertAdjacentHTML/document.write with tainted data. Server-side templates: Handlebars triple-mustache {{{x}}} / Handlebars.SafeString(userInput); Velocity/Freemarker/Thymeleaf where user input is spliced into the template STRING (not the model) — e.g. new Template(userStr) or th:utext with tainted data; JSP <%= %> without <c:out>; Jinja2/Django render_template_string(userStr) / Template(userStr); ERB/Liquid built from user input; EJS/Pug/Mustache raw-output helpers fed tainted data; string concatenation building the template passed to a compile()/render() call. Trace user input to the render/interpolation sink and check for a context-correct escaper on the path.",
+      "challenge_hint": "Hunt TEMPLATE/HTML XSS and SERVER-SIDE TEMPLATE INJECTION (SSTI) only. Find user/controller input reaching an HTML or template render without context-correct escaping: Angular bypassSecurityTrustHtml/[innerHTML]; React dangerouslySetInnerHTML; Vue v-html; raw innerHTML/document.write; Handlebars {{{triple}}}/SafeString; Velocity/Freemarker/Thymeleaf(th:utext)/JSP(<%= %>)/Jinja2 render_template_string / Template(userStr) where DATA is spliced into the template SOURCE (SSTI → possible RCE); EJS/Pug/Mustache raw helpers fed tainted data. Trace the taint from entry point to the render sink and cite the missing/incorrect escaper (file:line). IMPORTANT: a template engine compiling a DEVELOPER-authored template is by-design — the finding is untrusted DATA reaching the markup/template-code context. Do NOT let the intended-use gate talk you out of hunting this class; hunt it and report the precondition explicitly.",
+      "grounding": [
+        "CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)",
+        "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine (SSTI)",
+        "OWASP Top 10 A03:2021 Injection"
+      ],
+      "confirmable": "Source-static hypothesis. The skeptic must confirm the sink renders into a browser/template-code context, the escaper is absent or context-wrong, and the input is genuinely untrusted DATA rather than a developer-authored template (the intended-use gate distinguishes these).",
+      "uid": "appsec/template-xss-ssti",
+      "engine_lens": null,
+      "route": "appsec-source-static"
+    },
+    {
+      "id": "sso-trust",
+      "name": "SSO / identity-federation trust flaw (SAML / OIDC / JWT assertion validation)",
+      "cwe": "CWE-347",
+      "domain": "appsec",
+      "subsystem": "authentication / identity federation (SAML, OIDC, OAuth2, JWT)",
+      "pattern": "A relying party accepts a federated identity assertion without fully verifying its authenticity, integrity, or provenance: an unverified or forged SAML assertion/response signature, XML signature wrapping (XSW) where the signed element and the consumed element differ, the IdP↔RP allowlist (issuer / audience / entityID / redirect_uri) not enforced SERVER-SIDE, RelayState/redirect_uri reflected or validated with a loose prefix/substring match, or a JWT accepted with alg:none, an unverified signature, or algorithm-confusion (RS256 verified as HS256 with the public key as the HMAC secret). The trust boundary is the assertion — any gap lets an attacker mint or replay an identity.",
+      "detection_signature": "SAML: assertion consumed before/without signature validation, validateSignature disabled or wrapped in try/catch that continues, response parsed with an XML lib vulnerable to XSW, Assertion vs Response signature scope not pinned, audience/issuer/NotOnOrAfter/InResponseTo unchecked. OIDC/OAuth2: id_token accepted without verifying iss/aud/exp/nonce, redirect_uri matched by startsWith/contains instead of exact registered value, state/PKCE absent, IdP discovery/JWKS fetched over an attacker-influenceable URL. JWT: jwt.decode without verify, algorithms allowing 'none', a verify call that trusts the token's own alg header, or an HMAC verify keyed with a public key. Look for the MISSING or bypassable check on the assertion path, not just the presence of a SAML/OIDC library.",
+      "challenge_hint": "Hunt SSO / IDENTITY-FEDERATION TRUST flaws only (SAML, OIDC, OAuth2, JWT). Find where a relying party trusts a federated assertion without full server-side verification: unverified/forged SAML signature or signature-validation that continues on failure; XML signature wrapping (signed element ≠ consumed element); issuer/audience/entityID or redirect_uri allowlist NOT enforced server-side (or matched by startsWith/substring); RelayState/redirect_uri reflection; missing state/nonce/PKCE; JWT with alg:none, unverified signature, or RS256↔HS256 algorithm-confusion (public key used as HMAC secret). Prove the specific check on the assertion path is absent or bypassable and cite it (file:line) — the mere presence of a SAML/OIDC/JWT library is not the finding.",
+      "grounding": [
+        "CWE-347: Improper Verification of Cryptographic Signature",
+        "CWE-287: Improper Authentication",
+        "CWE-290: Authentication Bypass by Spoofing",
+        "OWASP Top 10 A07:2021 Identification and Authentication Failures"
+      ],
+      "confirmable": "Source-static hypothesis. The skeptic must confirm the assertion is consumed on a path where the specific verification (signature, issuer/audience, redirect_uri exact-match, JWT alg pinning) is genuinely missing or bypassable and reachable by an unauthenticated attacker.",
+      "uid": "appsec/sso-trust",
+      "engine_lens": null,
+      "route": "appsec-source-static"
+    },
+    {
+      "id": "resource-exhaustion-dos",
+      "name": "Resource-exhaustion / algorithmic DoS from attacker-controlled loop, sleep, or allocation",
+      "cwe": "CWE-400",
+      "domain": "appsec",
+      "subsystem": "request handling / parsing / scheduling (any runtime)",
+      "pattern": "An attacker-controlled value drives an unbounded loop, sleep/delay, allocation, decompression, fan-out, or backtracking, with no cap, timeout, or ratio check — letting a single cheap request consume disproportionate CPU, memory, threads, or time. Includes a header/param fed into a sleep (Retry-After → Thread.sleep), a decompression ratio / zip-bomb (inflate without a size/ratio limit), catastrophic-backtracking regex (ReDoS) on user input, an unbounded fan-out (N sub-requests from a user-supplied N), and mass-assignment / unbounded collection sizing driven by request data.",
+      "detection_signature": "A loop bound, sleep duration, allocation size, or recursion depth read from request data without a clamp: Thread.sleep/setTimeout/time.sleep/Task.Delay whose argument is a parsed header/param (e.g. Retry-After); GZIP/Zip/Inflater/gunzip/zlib reading into an unbounded buffer with no maxSize/ratio guard; new byte[n]/Array(n)/malloc(n)/list * n where n is attacker-supplied; regexes with nested quantifiers ((a+)+, (.*)*, (\\d+)+) matched against user input; a for/while whose iteration count is a request field; JSON/XML/YAML parsed with no depth/size limit; a paginated/batch endpoint taking a user-supplied count/limit with no server cap; ORM/mass-assignment binding an entire request body to a model. Trace the attacker-controlled magnitude to the unbounded consumer.",
+      "challenge_hint": "Hunt RESOURCE-EXHAUSTION / ALGORITHMIC DoS only: an attacker-controlled value driving an unbounded loop, sleep, allocation, decompression, fan-out, or regex backtracking with no cap/timeout/ratio. Look for — a header/param fed into Thread.sleep/setTimeout/time.sleep/Task.Delay (e.g. Retry-After → sleep); decompression without a size/ratio limit (zip-bomb, Inflater/gunzip/zlib into an unbounded buffer); ReDoS (nested quantifiers on user input); new byte[n]/Array(n)/malloc(n) with attacker-supplied n; a loop whose count is a request field; JSON/XML/YAML parsed with no depth/size limit; an endpoint honoring a user-supplied count/limit with no server cap; mass-assignment binding a whole request body. Cite the attacker-controlled magnitude and the unbounded consumer (file:line) and show there is no clamp on the path.",
+      "grounding": [
+        "CWE-400: Uncontrolled Resource Consumption",
+        "CWE-1333: Inefficient Regular Expression Complexity (ReDoS)",
+        "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification / zip-bomb)",
+        "OWASP Top 10 A04:2021 Insecure Design / A05:2021 Security Misconfiguration"
+      ],
+      "confirmable": "Source-static hypothesis. The skeptic must confirm the magnitude is genuinely attacker-controlled, the consumer is genuinely unbounded on the reachable path, and the impact is disproportionate (a single request → outsized CPU/memory/time), not a trivially bounded operation.",
+      "uid": "appsec/resource-exhaustion-dos",
+      "engine_lens": null,
+      "route": "appsec-source-static"
+    }
+  ]
+}