codejury 0.10.5__tar.gz → 0.10.6__tar.gz

{codejury-0.10.5 → codejury-0.10.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.5
+Version: 0.10.6
 Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/ag_arbitrary_tool_vuln.yaml

@@ -1,4 +1,5 @@
 capability: excessive_agency
+split: held-out
 vulnerable: true
 expected_verdict: VULNERABLE
 cwe: CWE-862

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/authn_sha256_password.yaml

@@ -1,4 +1,5 @@
 capability: authn
+split: held-out
 vulnerable: true
 code: |
   def store_password(pwd: str) -> str:

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/authz_idor_vuln.yaml

@@ -1,4 +1,5 @@
 capability: authz
+split: held-out
 vulnerable: true
 code: |
   def get_invoice(request):

codejury-0.10.6/codejury/data/golden/business_logic_atomic_safe.yaml

@@ -0,0 +1,15 @@
+capability: business_logic
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+notes: >
+  A single atomic conditional update debits only when the balance suffices, so
+  there is no check-then-act race.
+code: |
+  def withdraw(account, amount):
+      result = db.execute(
+          "UPDATE accounts SET balance = balance - %s WHERE id = %s AND balance >= %s",
+          (amount, account.id, amount),
+      )
+      return result.rowcount == 1

codejury-0.10.6/codejury/data/golden/business_logic_toctou_vuln.yaml

@@ -0,0 +1,14 @@
+capability: business_logic
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-367
+source: synthetic
+notes: >
+  The balance is checked and then debited without a lock or atomic update, so two
+  concurrent withdrawals both pass the check and overdraw the account.
+code: |
+  def withdraw(account, amount):
+      if account.balance >= amount:
+          account.balance -= amount
+          return True
+      return False

codejury-0.10.6/codejury/data/golden/crypto_aesgcm_nonce_safe.yaml

@@ -0,0 +1,13 @@
+capability: crypto
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+split: held-out
+notes: >
+  Authenticated encryption (AES-GCM) with a fresh random nonce per message. No
+  fixed IV, no unauthenticated mode.
+code: |
+  def encrypt(data, key):
+      nonce = os.urandom(12)
+      return nonce + AESGCM(key).encrypt(nonce, data, None)

codejury-0.10.6/codejury/data/golden/crypto_static_iv_vuln.yaml

@@ -0,0 +1,14 @@
+capability: crypto
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-329
+source: synthetic
+notes: >
+  A fixed all-zero IV with CBC makes encryption deterministic, so identical
+  plaintexts produce identical ciphertexts and patterns leak. The IV must be
+  random per message.
+code: |
+  def encrypt(data, key):
+      iv = b"\x00" * 16
+      cipher = AES.new(key, AES.MODE_CBC, iv)
+      return cipher.encrypt(pad(data))

codejury-0.10.6/codejury/data/golden/data_protection_cleartext_http_vuln.yaml

@@ -0,0 +1,11 @@
+capability: data_protection
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-319
+source: synthetic
+notes: >
+  PII is posted over plaintext http, so it can be read by anyone on the network
+  path. It must travel over TLS.
+code: |
+  def sync(user):
+      requests.post("http://crm.internal/contacts", json={"ssn": user.ssn, "email": user.email})

codejury-0.10.6/codejury/data/golden/data_protection_encrypted_at_rest_safe.yaml

@@ -0,0 +1,11 @@
+capability: data_protection
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+notes: >
+  The SSN is encrypted before it is stored, so no plaintext PII is persisted.
+code: |
+  def save(user):
+      ciphertext = AESGCM(KEY).encrypt(os.urandom(12), user.ssn.encode(), None)
+      db.store(user.id, ciphertext)

codejury-0.10.6/codejury/data/golden/dependency_config_debug_off_safe.yaml

@@ -0,0 +1,12 @@
+capability: dependency_config
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+split: held-out
+notes: >
+  An ordinary run with the debugger left at its safe default. A normal app.run
+  must not be flagged.
+code: |
+  def main():
+      app.run(host="127.0.0.1")

codejury-0.10.6/codejury/data/golden/dependency_config_debug_true_vuln.yaml

@@ -0,0 +1,11 @@
+capability: dependency_config
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-489
+source: synthetic
+notes: >
+  Running with the debugger enabled in production exposes an interactive console
+  that can execute code on the server.
+code: |
+  def main():
+      app.run(host="0.0.0.0", debug=True)

codejury-0.10.6/codejury/data/golden/error_logging_reraise_safe.yaml

@@ -0,0 +1,15 @@
+capability: error_logging
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+split: held-out
+notes: >
+  The error is logged and re-raised, so the failure is recorded and not hidden.
+code: |
+  def charge(card):
+      try:
+          gateway.charge(card)
+      except PaymentError:
+          logger.exception("charge failed")
+          raise

codejury-0.10.6/codejury/data/golden/error_logging_swallow_vuln.yaml

@@ -0,0 +1,14 @@
+capability: error_logging
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-390
+source: synthetic
+notes: >
+  The bare except discards every error, including security-relevant failures, so
+  a failed charge looks like a success and nothing is logged.
+code: |
+  def charge(card):
+      try:
+          gateway.charge(card)
+      except Exception:
+          pass

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/ioh_exec_output_vuln.yaml

@@ -1,4 +1,5 @@
 capability: insecure_output_handling
+split: held-out
 vulnerable: true
 expected_verdict: VULNERABLE
 cwe: CWE-94

codejury-0.10.6/codejury/data/golden/output_encoding_header_injection_vuln.yaml

@@ -0,0 +1,11 @@
+capability: output_encoding
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-113
+source: synthetic
+notes: >
+  User input is concatenated into a response header without stripping CR or LF, so
+  a crafted value can inject extra headers or split the response.
+code: |
+  def download(response, filename):
+      response.headers["Content-Disposition"] = "attachment; filename=" + filename

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/pi_system_concat_vuln.yaml

@@ -1,4 +1,5 @@
 capability: prompt_injection
+split: held-out
 vulnerable: true
 expected_verdict: VULNERABLE
 cwe: CWE-1427

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/sc_trust_remote_code_vuln.yaml

@@ -1,4 +1,5 @@
 capability: model_supply_chain
+split: held-out
 vulnerable: true
 expected_verdict: VULNERABLE
 cwe: CWE-494

codejury-0.10.6/codejury/data/golden/secrets_from_config_safe.yaml

@@ -0,0 +1,12 @@
+capability: secrets
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+split: held-out
+notes: >
+  The token is read from settings at runtime, not a literal. A variable named
+  token that holds a config lookup must not be flagged.
+code: |
+  def client():
+      return Service(token=settings.API_TOKEN)

codejury-0.10.6/codejury/data/golden/secrets_hardcoded_token_vuln.yaml

@@ -0,0 +1,13 @@
+capability: secrets
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-798
+source: synthetic
+notes: >
+  A credential literal committed in source is exposed to everyone with repo
+  access and lives forever in version history. It belongs in the environment.
+code: |
+  API_TOKEN = "9c1185a5c5e9fc54612808977ee8f548b2258d31"
+
+  def client():
+      return Service(token=API_TOKEN)

codejury-0.10.6/codejury/data/golden/session_cookie_flags_safe.yaml

@@ -0,0 +1,10 @@
+capability: session
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+notes: >
+  The session cookie sets Secure, HttpOnly, and SameSite.
+code: |
+  def set_session(response, sid):
+      response.set_cookie("session", sid, secure=True, httponly=True, samesite="Lax")

codejury-0.10.6/codejury/data/golden/session_insecure_cookie_vuln.yaml

@@ -0,0 +1,11 @@
+capability: session
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-614
+source: synthetic
+notes: >
+  The session cookie is set without Secure, HttpOnly, or SameSite, so it is
+  readable by JavaScript and sent over plaintext.
+code: |
+  def set_session(response, sid):
+      response.set_cookie("session", sid)

{codejury-0.10.5 → codejury-0.10.6}/codejury/data/golden/xss_innerhtml_vuln.yaml

@@ -1,4 +1,5 @@
 capability: output_encoding
+split: held-out
 vulnerable: true
 code: |
   function render(name) {

{codejury-0.10.5 → codejury-0.10.6}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.5
+Version: 0.10.6
 Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.10.5 → codejury-0.10.6}/codejury.egg-info/SOURCES.txt

@@ -56,21 +56,31 @@ codejury/data/golden/authn_sha256_password.yaml
 codejury/data/golden/authn_weak_hash_indirect_vuln.yaml
 codejury/data/golden/authz_idor_vuln.yaml
 codejury/data/golden/authz_owner_safe.yaml
+codejury/data/golden/business_logic_atomic_safe.yaml
 codejury/data/golden/business_logic_price_tamper_vuln.yaml
 codejury/data/golden/business_logic_server_checked_safe.yaml
+codejury/data/golden/business_logic_toctou_vuln.yaml
 codejury/data/golden/cmdi_fixed_argv_safe.yaml
 codejury/data/golden/cmdi_ossystem_vuln.yaml
 codejury/data/golden/cmdi_subprocess_safe.yaml
+codejury/data/golden/crypto_aesgcm_nonce_safe.yaml
 codejury/data/golden/crypto_aesgcm_safe.yaml
 codejury/data/golden/crypto_ecb_vuln.yaml
+codejury/data/golden/crypto_static_iv_vuln.yaml
+codejury/data/golden/data_protection_cleartext_http_vuln.yaml
+codejury/data/golden/data_protection_encrypted_at_rest_safe.yaml
 codejury/data/golden/data_protection_plaintext_pii_vuln.yaml
 codejury/data/golden/data_protection_tokenized_safe.yaml
+codejury/data/golden/dependency_config_debug_off_safe.yaml
+codejury/data/golden/dependency_config_debug_true_vuln.yaml
 codejury/data/golden/dependency_config_tls_verify_off_vuln.yaml
 codejury/data/golden/dependency_config_tls_verify_on_safe.yaml
 codejury/data/golden/deserialize_json_safe.yaml
 codejury/data/golden/deserialize_pickle_vuln.yaml
 codejury/data/golden/error_logging_redacted_safe.yaml
+codejury/data/golden/error_logging_reraise_safe.yaml
 codejury/data/golden/error_logging_secret_leak_vuln.yaml
+codejury/data/golden/error_logging_swallow_vuln.yaml
 codejury/data/golden/ioh_escaped_output_safe.yaml
 codejury/data/golden/ioh_exec_output_vuln.yaml
 codejury/data/golden/ioh_innerhtml_output_vuln.yaml
@@ -78,6 +88,7 @@ codejury/data/golden/ioh_json_response_safe.yaml
 codejury/data/golden/ioh_output_to_sql_vuln.yaml
 codejury/data/golden/ioh_schema_validated_safe.yaml
 codejury/data/golden/literal_eval_safe.yaml
+codejury/data/golden/output_encoding_header_injection_vuln.yaml
 codejury/data/golden/path_basename_safe.yaml
 codejury/data/golden/path_contained_safe.yaml
 codejury/data/golden/path_traversal_vuln.yaml
@@ -92,8 +103,12 @@ codejury/data/golden/sc_safetensors_safe.yaml
 codejury/data/golden/sc_torch_load_vuln.yaml
 codejury/data/golden/sc_trust_remote_code_vuln.yaml
 codejury/data/golden/secrets_env_safe.yaml
+codejury/data/golden/secrets_from_config_safe.yaml
+codejury/data/golden/secrets_hardcoded_token_vuln.yaml
 codejury/data/golden/secrets_hardcoded_vuln.yaml
+codejury/data/golden/session_cookie_flags_safe.yaml
 codejury/data/golden/session_fixation_vuln.yaml
+codejury/data/golden/session_insecure_cookie_vuln.yaml
 codejury/data/golden/session_secure_cookie_safe.yaml
 codejury/data/golden/sql_constant_concat_safe.yaml
 codejury/data/golden/sqli_format_vuln.yaml

{codejury-0.10.5 → codejury-0.10.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.10.5"
+version = "0.10.6"
 description = "General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data"
 readme = "README.md"
 requires-python = ">=3.12"