blitzstrike 1.0.35 → 1.0.38

package/bench/corpus/py-cmd-subprocess.md

@@ -0,0 +1,9 @@
+- id: py-cmd-subprocess
+- language: python
+- vulnerable: false
+- sink_type: command_execution
+```python
+import subprocess
+cmd = request.args.get("cmd")
+subprocess.run(["ls", cmd])
+```

package/bench/corpus/{py-command-injection-vuln.md → py-cmd-vuln.md}

@@ -1,9 +1,9 @@
-- id: py-command-injection-vuln
+- id: py-cmd-vuln
 - language: python
 - vulnerable: true
 - sink_type: command_execution
 ```python
 import os
-x = request.args.get("cmd")
-os.system(x)
+cmd = request.args.get("cmd")
+os.system(cmd)
 ```

package/bench/corpus/py-deser-json.md

@@ -0,0 +1,9 @@
+- id: py-deser-json
+- language: python
+- vulnerable: false
+- sink_type: deserialization
+```python
+import json
+data = request.get_data()
+json.loads(data)
+```

package/bench/corpus/py-deser-vuln.md

@@ -0,0 +1,9 @@
+- id: py-deser-vuln
+- language: python
+- vulnerable: true
+- sink_type: deserialization
+```python
+import pickle
+data = request.get_data()
+pickle.loads(data)
+```

package/bench/corpus/py-eval-vuln.md

@@ -0,0 +1,8 @@
+- id: py-eval-vuln
+- language: python
+- vulnerable: true
+- sink_type: code_execution
+```python
+code = request.args.get("code")
+eval(code)
+```

package/bench/corpus/py-pathtraversal-vuln.md

@@ -0,0 +1,8 @@
+- id: py-pathtraversal-vuln
+- language: python
+- vulnerable: true
+- sink_type: file_operations
+```python
+f = request.args.get("file")
+open("/data/" + f)
+```

package/bench/corpus/py-sqli-param.md

@@ -0,0 +1,9 @@
+- id: py-sqli-param
+- language: python
+- vulnerable: false
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.execute("SELECT * FROM t WHERE id=?", (id,))
+```

package/bench/corpus/py-sqli-vuln.md

@@ -0,0 +1,9 @@
+- id: py-sqli-vuln
+- language: python
+- vulnerable: true
+- sink_type: sql_execution
+```python
+import sqlite3
+id = request.args.get("id")
+cursor.execute(f"SELECT * FROM t WHERE id={id}")
+```

package/bench/corpus/py-ssrf-vuln.md

@@ -0,0 +1,9 @@
+- id: py-ssrf-vuln
+- language: python
+- vulnerable: true
+- sink_type: http_request
+```python
+import requests
+url = request.args.get("url")
+requests.get(url)
+```

package/bench/corpus/py-xss-vuln.md

@@ -0,0 +1,8 @@
+- id: py-xss-vuln
+- language: python
+- vulnerable: true
+- sink_type: html_render
+```python
+name = request.args.get("name")
+return render_template_string("<p>" + name + "</p>")
+```