secure-repo 1.3.0__tar.gz

secure_repo-1.3.0/LICENSE

@@ -0,0 +1,88 @@
+SECURE REPO ETHICAL SOURCE-AVAILABLE LICENSE
+Version 1.0
+
+Copyright (c) 2026 Wissen01720. All rights reserved.
+
+Secure Repo (the "Software") is the exclusive intellectual property of Wissen01720 (the "Author").
+This is NOT an open-source license. The Software is made available to the public under the terms
+below. By downloading, installing, copying, running or otherwise using the Software you ("You")
+accept these terms. If You do not accept them, You may not use the Software.
+
+1. OWNERSHIP
+
+   1.1 The Author is and remains the sole owner and the only author of the Software, including its
+       source code, detection rules, documentation, visual design and every derivative of them.
+   1.2 No ownership, authorship or other right is transferred to You except the limited license
+       expressly granted in Section 2. All rights not expressly granted are reserved by the Author.
+
+2. LICENSE GRANT
+
+   Subject to full and continuous compliance with this license, the Author grants You a worldwide,
+   royalty-free, non-exclusive, non-transferable, non-sublicensable and revocable license to:
+
+   a) download, install and run the Software on devices You control;
+   b) read and study the source code, and modify it for Your own private or internal use;
+   c) use the reports produced by the Software for any lawful purpose, including internal
+      security reviews, remediation work and compliance evidence, also within a company;
+   d) share an unmodified copy of the Software, provided that this LICENSE file, the copyright
+      notice and the attribution to the Author are kept intact and no fee is charged for it.
+
+3. LAWFUL AND AUTHORIZED USE ONLY
+
+   You may use the Software only against repositories, source code and systems that You own or
+   that You are explicitly authorized, in writing, to assess. You are solely responsible for
+   complying with every law, regulation, contract and policy that applies to Your use, including
+   computer misuse, privacy, data protection and intellectual property laws.
+
+4. PROHIBITED USES
+
+   You must NOT, directly or indirectly, and must not allow anyone else to:
+
+   a) use the Software to access, clone, scan or analyze any repository, code or system without
+      the permission of its owner;
+   b) steal, extract, collect, store, publish, sell or otherwise misuse secrets, credentials,
+      keys, tokens, personal data, trade secrets or any other information discovered with the
+      Software, beyond what is strictly necessary to report and fix it for its rightful owner;
+   c) use the Software or its results to exploit vulnerabilities, gain unauthorized access,
+      develop or distribute malware, commit fraud, extortion, espionage or any other unlawful act;
+   d) use the Software to monitor, profile, harass or harm any individual;
+   e) remove, hide or alter the copyright notice, this license, the authorship attribution or the
+      ethical-use safeguards built into the Software (such as secret redaction and the
+      authorization confirmation);
+   f) claim authorship of the Software, present it as Your own work, or register any right over it;
+   g) sell, rent, lease, sublicense, or offer the Software or a modified version of it as a paid
+      product or as a hosted/online service, without the Author's prior written permission;
+   h) publicly distribute modified versions of the Software without the Author's prior written
+      permission.
+
+5. CONTRIBUTIONS
+
+   The Author has no obligation to accept, review or merge contributions of any kind. Any
+   material You voluntarily submit to the Author may be used, changed or discarded by the Author
+   without any obligation, attribution or compensation.
+
+6. TERMINATION
+
+   This license terminates automatically and immediately, without notice, if You breach any of its
+   terms. Upon termination You must stop using the Software and destroy every copy in Your
+   possession. Sections 1, 4, 7 and 8 survive termination.
+
+7. NO WARRANTY
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+   NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND
+   NON-INFRINGEMENT. Automated security analysis can produce false positives and false negatives;
+   the absence of findings does not mean that the audited software is secure. Compliance results
+   are technical evidence only and are not a certification, attestation or legal advice.
+
+8. LIMITATION OF LIABILITY
+
+   IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+   ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE,
+   ITS RESULTS OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. You are solely responsible for how
+   You use the Software and for any consequence of that use.
+
+9. PERMISSIONS
+
+   Requests for permissions not granted by this license (commercial use as a product or service,
+   redistribution of modified versions, etc.) must be addressed to the Author, Wissen01720.

secure_repo-1.3.0/PKG-INFO

@@ -0,0 +1,145 @@
+Metadata-Version: 2.4
+Name: secure-repo
+Version: 1.3.0
+Summary: Repository security auditor with a hacker-style CLI and a neural-map GUI: static analysis, secrets, library vulnerabilities, supply chain and optional compliance evidence.
+Author: Wissen01720
+License-Expression: LicenseRef-SecureRepo-Ethical-Source-Available
+Keywords: security,sast,secrets,sbom,vulnerability,compliance,audit,git
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Environment :: Web Environment
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13.0
+Requires-Dist: defusedxml>=0.7
+Requires-Dist: tomli>=1.1; python_version < "3.11"
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: pytest-cov>=4; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+
+# SECURE//REPO
+
+**Repository security auditor with a command-line console and a neural-map GUI.**
+
+Static code analysis · secret detection · library & supply-chain intelligence · repository structure mapping ·
+optional compliance evidence (OWASP, PCI DSS, ISO 27001, SOC 2, GDPR, HIPAA, NIST SSDF)
+
+![Python](https://img.shields.io/badge/python-3.10%2B-00e5ff?style=flat-square)
+![Platforms](https://img.shields.io/badge/platforms-Windows%20%7C%20macOS%20%7C%20Linux-00ff9c?style=flat-square)
+![Precision](https://img.shields.io/badge/precision%20on%20third--party%20code-73%25-ff2e97?style=flat-square)
+![Recall](https://img.shields.io/badge/recall%20on%20documented%20weaknesses-93%25-ff2e97?style=flat-square)
+![License](https://img.shields.io/badge/license-Ethical%20Source--Available-9d7bff?style=flat-square)
+
+<img src="docs/images/cli-banner.svg" alt="Secure Repo CLI banner and boot sequence" width="900">
+
+[Español](README.es.md) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
+
+</div>
+
+---
+
+## What it does
+
+Point it at a Git repository (the one you are in, a local path or a Git URL, including private ones) and it audits it
+**read-only**: it never runs the audited code and never installs its dependencies.
+
+| Capability | Details |
+|---|---|
+| **Static analysis** | 175 rules for Python, JavaScript/TypeScript, Java/Kotlin, C#, PHP, Go, Ruby, C/C++, Rust, shell, Dockerfiles, Kubernetes, Terraform and CI pipelines. Python gets syntax-tree analysis with taint tracking, JavaScript/TypeScript a data-flow pass. |
+| **Secrets** | Cloud keys, tokens, private keys, connection strings, high-entropy credentials, sensitive files. Always redacted in the output. |
+| **Libraries** | 25+ manifest and lock formats; every library checked against OSV.dev and deps.dev; versions resolved even without a lockfile. Private package names can be kept off the network. |
+| **Reports** | A timestamped folder with HTML, JSON, SARIF, Markdown, CSV, a CycloneDX SBOM and an integrity manifest, written outside the audited repository by default. |
+| **Console and GUI** | A live terminal dashboard (`--theme plain` for a sober one) and a local web app with a neural map and a structure treemap that explain each weakness and its fix. |
+| **CI-friendly** | `--fail-on`, `--baseline` (fail only on new findings), `--since origin/main` (only changed files), SARIF for code scanning. |
+| **Learns from you** | Mark false positives and accepted risks once; they are re-applied on every scan. |
+| **Optional compliance evidence** | Maps findings to 7 frameworks as supporting evidence, never as a certification. |
+
+## Quick start
+
+```bash
+git clone https://github.com/Wissen01720/Secure_Repo.git
+cd Secure_Repo
+./run.sh scan /path/to/repo        # Windows: .\run.bat scan C:\path\to\repo
+./run.sh gui                       # the graphical interface
+```
+
+The launcher creates a private virtual environment on the first run. Inside a Git repository, `./run.sh` alone opens
+the interactive console. Python 3.10 or newer and Git are required. More options (pipx, from source, updating):
+[Installation](docs/installation.md).
+
+```bash
+secure-repo scan . --yes --plain --no-menu --baseline baseline.json --fail-on high     # a CI gate for new problems only
+```
+
+## How accurate is it?
+
+Measured on code the authors did not write: four public projects pinned to a commit (NodeGoat, DVPWA,
+Vulnerable-Flask-App and the clean library `requests`), every finding reviewed by hand.
+
+| | Result |
+|---|---|
+| Precision, findings of medium/high confidence | **73 %** |
+| Precision, every finding (tests and low confidence included) | 60 % |
+| Documented weaknesses found | **26 of 28 (93 %)** |
+
+Small sample, so read it as a floor of evidence and not as a guarantee: the details, the misses and how to reproduce
+it are in [How the analysis works](docs/analysis.md#how-accurate-is-it-measured-on-third-party-code). The limits of
+a static analyzer (what it cannot see) are in [Privacy, trust model and limitations](docs/security-model.md).
+
+## Documentation
+
+| Document | What is in it |
+|---|---|
+| [Installation](docs/installation.md) | Requirements, launchers, pipx, from source, in-place updates |
+| [Command-line guide](docs/cli-guide.md) | Step by step walkthrough, CI/CD usage, private and organization repositories |
+| [How the analysis works](docs/analysis.md) | Engines, accuracy, languages, scoring, false-positive reduction, compliance |
+| [Command and report reference](docs/reference.md) | Every flag and every file of a report folder |
+| [Graphical interface](docs/gui.md) | The neural map, structure boxes, triage and downloads |
+| [Privacy, trust model and limitations](docs/security-model.md) | What leaves your machine, how the audited repository is treated, suppressions, limits |
+| [Troubleshooting](docs/troubleshooting.md) | Common problems and fixes |
+| [Development](docs/development.md) | Project layout, tests, adding a rule |
+| [Releasing](docs/releasing.md) | Versions, tags, GitHub releases and publishing to PyPI |
+
+<p align="center"><img src="docs/images/gui-neural-map.png" alt="The neural map of a scan" width="860"></p>
+
+## Rules of engagement
+
+> **Only audit repositories you own or have explicit, written permission to assess.**
+
+Secure Repo is built for defenders and enforces that posture:
+
+- It **never executes** the audited code, never installs its dependencies and never exploits a finding.
+- It asks you to **confirm your authorization** before every engagement (`--yes` confirms it in automation).
+- Detected secrets are **redacted** in the terminal, the GUI and every report.
+- Git runs hardened: hooks disabled, `ext::` transport blocked, shallow clones, LFS downloads skipped.
+
+Using the tool to steal information or for any malicious purpose is forbidden by the [license](LICENSE).
+
+## License
+
+Copyright © 2026 **Wissen01720**. All rights reserved.
+
+Secure Repo is distributed under the **Secure Repo Ethical Source-Available License**: you may use it, study it
+and use its reports (also inside your company) for lawful, authorized security work. You may **not** use it to
+access code without permission, steal or misuse the information it finds, attack systems, remove the
+attribution, claim authorship, sell it or publish modified versions without permission. Read the full
+[LICENSE](LICENSE). It is *source-available*, not open source: if your organization requires an OSI-approved license,
+contact the author.

secure_repo-1.3.0/README.md

@@ -0,0 +1,110 @@
+<div align="center">
+
+# SECURE//REPO
+
+**Repository security auditor with a command-line console and a neural-map GUI.**
+
+Static code analysis · secret detection · library & supply-chain intelligence · repository structure mapping ·
+optional compliance evidence (OWASP, PCI DSS, ISO 27001, SOC 2, GDPR, HIPAA, NIST SSDF)
+
+![Python](https://img.shields.io/badge/python-3.10%2B-00e5ff?style=flat-square)
+![Platforms](https://img.shields.io/badge/platforms-Windows%20%7C%20macOS%20%7C%20Linux-00ff9c?style=flat-square)
+![Precision](https://img.shields.io/badge/precision%20on%20third--party%20code-73%25-ff2e97?style=flat-square)
+![Recall](https://img.shields.io/badge/recall%20on%20documented%20weaknesses-93%25-ff2e97?style=flat-square)
+![License](https://img.shields.io/badge/license-Ethical%20Source--Available-9d7bff?style=flat-square)
+
+<img src="docs/images/cli-banner.svg" alt="Secure Repo CLI banner and boot sequence" width="900">
+
+[Español](README.es.md) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
+
+</div>
+
+---
+
+## What it does
+
+Point it at a Git repository (the one you are in, a local path or a Git URL, including private ones) and it audits it
+**read-only**: it never runs the audited code and never installs its dependencies.
+
+| Capability | Details |
+|---|---|
+| **Static analysis** | 175 rules for Python, JavaScript/TypeScript, Java/Kotlin, C#, PHP, Go, Ruby, C/C++, Rust, shell, Dockerfiles, Kubernetes, Terraform and CI pipelines. Python gets syntax-tree analysis with taint tracking, JavaScript/TypeScript a data-flow pass. |
+| **Secrets** | Cloud keys, tokens, private keys, connection strings, high-entropy credentials, sensitive files. Always redacted in the output. |
+| **Libraries** | 25+ manifest and lock formats; every library checked against OSV.dev and deps.dev; versions resolved even without a lockfile. Private package names can be kept off the network. |
+| **Reports** | A timestamped folder with HTML, JSON, SARIF, Markdown, CSV, a CycloneDX SBOM and an integrity manifest, written outside the audited repository by default. |
+| **Console and GUI** | A live terminal dashboard (`--theme plain` for a sober one) and a local web app with a neural map and a structure treemap that explain each weakness and its fix. |
+| **CI-friendly** | `--fail-on`, `--baseline` (fail only on new findings), `--since origin/main` (only changed files), SARIF for code scanning. |
+| **Learns from you** | Mark false positives and accepted risks once; they are re-applied on every scan. |
+| **Optional compliance evidence** | Maps findings to 7 frameworks as supporting evidence, never as a certification. |
+
+## Quick start
+
+```bash
+git clone https://github.com/Wissen01720/Secure_Repo.git
+cd Secure_Repo
+./run.sh scan /path/to/repo        # Windows: .\run.bat scan C:\path\to\repo
+./run.sh gui                       # the graphical interface
+```
+
+The launcher creates a private virtual environment on the first run. Inside a Git repository, `./run.sh` alone opens
+the interactive console. Python 3.10 or newer and Git are required. More options (pipx, from source, updating):
+[Installation](docs/installation.md).
+
+```bash
+secure-repo scan . --yes --plain --no-menu --baseline baseline.json --fail-on high     # a CI gate for new problems only
+```
+
+## How accurate is it?
+
+Measured on code the authors did not write: four public projects pinned to a commit (NodeGoat, DVPWA,
+Vulnerable-Flask-App and the clean library `requests`), every finding reviewed by hand.
+
+| | Result |
+|---|---|
+| Precision, findings of medium/high confidence | **73 %** |
+| Precision, every finding (tests and low confidence included) | 60 % |
+| Documented weaknesses found | **26 of 28 (93 %)** |
+
+Small sample, so read it as a floor of evidence and not as a guarantee: the details, the misses and how to reproduce
+it are in [How the analysis works](docs/analysis.md#how-accurate-is-it-measured-on-third-party-code). The limits of
+a static analyzer (what it cannot see) are in [Privacy, trust model and limitations](docs/security-model.md).
+
+## Documentation
+
+| Document | What is in it |
+|---|---|
+| [Installation](docs/installation.md) | Requirements, launchers, pipx, from source, in-place updates |
+| [Command-line guide](docs/cli-guide.md) | Step by step walkthrough, CI/CD usage, private and organization repositories |
+| [How the analysis works](docs/analysis.md) | Engines, accuracy, languages, scoring, false-positive reduction, compliance |
+| [Command and report reference](docs/reference.md) | Every flag and every file of a report folder |
+| [Graphical interface](docs/gui.md) | The neural map, structure boxes, triage and downloads |
+| [Privacy, trust model and limitations](docs/security-model.md) | What leaves your machine, how the audited repository is treated, suppressions, limits |
+| [Troubleshooting](docs/troubleshooting.md) | Common problems and fixes |
+| [Development](docs/development.md) | Project layout, tests, adding a rule |
+| [Releasing](docs/releasing.md) | Versions, tags, GitHub releases and publishing to PyPI |
+
+<p align="center"><img src="docs/images/gui-neural-map.png" alt="The neural map of a scan" width="860"></p>
+
+## Rules of engagement
+
+> **Only audit repositories you own or have explicit, written permission to assess.**
+
+Secure Repo is built for defenders and enforces that posture:
+
+- It **never executes** the audited code, never installs its dependencies and never exploits a finding.
+- It asks you to **confirm your authorization** before every engagement (`--yes` confirms it in automation).
+- Detected secrets are **redacted** in the terminal, the GUI and every report.
+- Git runs hardened: hooks disabled, `ext::` transport blocked, shallow clones, LFS downloads skipped.
+
+Using the tool to steal information or for any malicious purpose is forbidden by the [license](LICENSE).
+
+## License
+
+Copyright © 2026 **Wissen01720**. All rights reserved.
+
+Secure Repo is distributed under the **Secure Repo Ethical Source-Available License**: you may use it, study it
+and use its reports (also inside your company) for lawful, authorized security work. You may **not** use it to
+access code without permission, steal or misuse the information it finds, attack systems, remove the
+attribution, claim authorship, sell it or publish modified versions without permission. Read the full
+[LICENSE](LICENSE). It is *source-available*, not open source: if your organization requires an OSI-approved license,
+contact the author.

secure_repo-1.3.0/pyproject.toml

@@ -0,0 +1,104 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "secure-repo"
+version = "1.3.0"
+description = "Repository security auditor with a hacker-style CLI and a neural-map GUI: static analysis, secrets, library vulnerabilities, supply chain and optional compliance evidence."
+readme = "README.md"
+license = "LicenseRef-SecureRepo-Ethical-Source-Available"
+license-files = ["LICENSE"]
+authors = [{ name = "Wissen01720" }]
+requires-python = ">=3.10"
+dependencies = [
+    "rich>=13.0",
+    "defusedxml>=0.7",
+    "tomli>=1.1; python_version < '3.11'",
+]
+keywords = ["security", "sast", "secrets", "sbom", "vulnerability", "compliance", "audit", "git"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Environment :: Web Environment",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Information Technology",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: MacOS",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "pytest-cov>=4", "ruff>=0.5", "mypy>=1.10"]
+
+[project.scripts]
+secure-repo = "secure_repo.cli.main:main"
+
+[tool.setuptools.packages.find]
+include = ["secure_repo*"]
+
+[tool.setuptools.package-data]
+"secure_repo.gui" = ["static/*"]
+"secure_repo.benchmark" = ["corpus/*"]
+"secure_repo.ruledata" = ["*.toml"]
+"secure_repo.data" = ["*.json"]
+"secure_repo.benchmark.extdata" = ["*.toml"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+# ---------------------------------------------------------------------------------------------- lint
+[tool.ruff]
+line-length = 120
+target-version = "py310"
+extend-exclude = ["secure_repo/benchmark/corpus"]   # deliberately vulnerable / false-positive samples
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "B", "UP", "S"]
+ignore = [
+    "E501",                       # long lines: the rule tables are one-liners on purpose
+    "S603", "S607",               # git / pip are started with argument lists, never through a shell
+    "S310",                       # urlopen is only used with fixed https endpoints
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S"]                                   # asserts, fixtures with fake secrets, temp paths
+"secure_repo/core/rules.py" = ["S"]                 # detection signatures, not executable code
+"secure_repo/core/checks.py" = ["S"]
+
+# ---------------------------------------------------------------------------------------------- types
+[tool.mypy]
+python_version = "3.10"
+ignore_missing_imports = true
+warn_unused_ignores = false
+exclude = ["secure_repo/benchmark/corpus/"]
+
+# Type debt: these modules still have errors. Remove a module from this list when it is fixed; new modules
+# are type-checked from the first commit.
+[[tool.mypy.overrides]]
+module = [
+    "secure_repo.core.triage", "secure_repo.core.updater", "secure_repo.core.pyast",
+    "secure_repo.core.versions", "secure_repo.core.checks", "secure_repo.core.compliance", "secure_repo.core.deps",
+    "secure_repo.core.gitops", "secure_repo.core.intel", "secure_repo.core.summary", "secure_repo.core.walker",
+    "secure_repo.cli.views", "secure_repo.cli.learning", "secure_repo.cli.dashboard", "secure_repo.gui.server",
+]
+ignore_errors = true
+
+# ---------------------------------------------------------------------------------------------- coverage
+[tool.coverage.run]
+source = ["secure_repo"]
+omit = ["secure_repo/benchmark/corpus/*"]
+
+[tool.coverage.report]
+# Measured at about 75 %. The gate is a little lower so platform differences do not make CI flaky;
+# raise it as coverage grows (the CLI menus and the update flow are the least tested parts).
+fail_under = 70
+show_missing = false
+skip_covered = true

secure_repo-1.3.0/secure_repo/__init__.py

@@ -0,0 +1,7 @@
+"""Secure Repo - repository security auditing toolkit (CLI + GUI)."""
+
+__app_name__ = "Secure Repo"
+__version__ = "1.3.0"
+__author__ = "Wissen01720"
+
+__all__ = ["__app_name__", "__version__", "__author__"]

secure_repo-1.3.0/secure_repo/__main__.py

@@ -0,0 +1,6 @@
+"""Allows running the tool with ``python -m secure_repo``."""
+
+from secure_repo.cli.main import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

secure_repo-1.3.0/secure_repo/benchmark/__init__.py

@@ -0,0 +1 @@
+"""Labeled corpus used by ``secure-repo benchmark`` to measure precision and recall."""

secure_repo-1.3.0/secure_repo/benchmark/corpus/JavaCases.java

@@ -0,0 +1,11 @@
+import javax.crypto.Cipher;
+
+class JavaCases {
+    void run(String user) throws Exception {
+        Runtime.getRuntime().exec("ping " + user); // expect: SR-JAVA-001
+        Cipher weak = Cipher.getInstance("DES"); // expect: SR-JAVA-004
+        // Runtime.getRuntime().exec(command) inside a comment must not match
+        String doc = "Never call Runtime.getRuntime().exec(input)";
+        /* Cipher.getInstance("DES") in a block comment must not match */
+    }
+}

secure_repo-1.3.0/secure_repo/benchmark/corpus/infrastructure.tf

@@ -0,0 +1,12 @@
+resource "aws_s3_bucket_acl" "logs" {
+  acl = "public-read" # expect: SR-IAC-002
+}
+
+resource "aws_db_instance" "database" {
+  publicly_accessible = true  # expect: SR-IAC-004
+  storage_encrypted   = false # expect: SR-IAC-003
+}
+
+resource "aws_security_group_rule" "ssh" {
+  cidr_blocks = ["0.0.0.0/0"] # expect: SR-IAC-001
+}

secure_repo-1.3.0/secure_repo/benchmark/corpus/js_false_positives.js

@@ -0,0 +1,32 @@
+// expect-none: SR-JS-001, SR-JS-002, SR-JS-007, SR-JS-008, SR-JS-009, SR-JS-011
+const { exec } = require('child_process');
+
+/*
+ * Never call eval(userInput) here.
+ * el.innerHTML = userInput is forbidden.
+ */
+function ui() {
+  document.getElementById('status').innerHTML = '';
+  document.getElementById('spinner').innerHTML = '<span class="spin"></span>';
+  const pattern = /[a-z]+/g;
+  const match = pattern.exec(window.title);
+  console.log("never use eval(code) with untrusted input");
+  exec('git rev-parse HEAD');
+  return match;
+}
+
+function query(db) {
+  return db.query('SELECT * FROM users WHERE active = ?', [true]);
+}
+
+// Taint must not leak between functions that reuse short variable names.
+function onMessage(msg) {
+  const e = JSON.parse(msg.data);
+  return e;
+}
+
+function schedule(e) {
+  setTimeout(() => refresh(e), 500);
+  setInterval(function () { poll(e); }, 1000);
+  return eval;
+}

secure_repo-1.3.0/secure_repo/benchmark/corpus/js_flow.js

@@ -0,0 +1,23 @@
+const { exec } = require('child_process');
+const express = require('express');
+const app = express();
+
+app.get('/ping', (req, res) => {
+  const host = req.query.host;
+  exec('ping -c 1 ' + host); // expect: SR-JS-008
+  const id = req.params.id;
+  db.query('SELECT * FROM users WHERE id = ' + id); // expect: SR-JS-011
+  res.redirect(req.query.next); // expect: SR-JS-018
+  res.send('<p>' + req.query.name + '</p>'); // expect: SR-JS-023
+});
+
+app.get('/file', (req, res) => {
+  const name = req.query.file;
+  res.sendFile(name); // expect: SR-JS-016
+});
+
+function render() {
+  const fragment = location.hash.slice(1);
+  document.getElementById('out').innerHTML = fragment; // expect: SR-JS-002
+  eval(fragment); // expect: SR-JS-001
+}

secure_repo-1.3.0/secure_repo/benchmark/corpus/python_false_positives.py

@@ -0,0 +1,39 @@
+# expect-none: SR-PY-001, SR-PY-002, SR-PY-003, SR-PY-004, SR-PY-005, SR-PY-009, SR-PY-011, SR-SEC-019
+import os
+import random
+import subprocess
+
+import yaml
+from sqlalchemy import text
+
+
+def documentation():
+    """Never call eval(user_input) or pickle.loads(untrusted) in this module.
+
+    os.system(command) with user input is forbidden as well.
+    """
+    message = "do not use os.system(command) or subprocess.call(cmd, shell=True)"
+    return message
+
+
+def safe_calls(user_id: int):
+    subprocess.run(["git", "status"], check=True)
+    os.system("clear")
+    cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
+    session.execute(text("SELECT 1"))
+    config = yaml.safe_load(open("config.yml"))
+    data = yaml.load(open("other.yml"), Loader=yaml.SafeLoader)
+    retry_delay = random.uniform(0.5, 1.5)
+    sample = random.sample(range(10), 3)
+    value = eval("1 + 2")
+    return config, data, retry_delay, sample, value
+
+
+def placeholders():
+    password = "changeme"
+    api_key = os.environ["API_KEY"]
+    token_url = "https://auth.example.com/token"
+    secret_name = "prod/db/password"
+    return password, api_key, token_url, secret_name
+
+# eval(request.args["x"])   <- commented-out code is not code

secure_repo-1.3.0/secure_repo/benchmark/corpus/python_taint.py

@@ -0,0 +1,62 @@
+import os
+import pickle
+import subprocess
+
+import yaml
+from flask import Flask, redirect, render_template_string, request
+
+app = Flask(__name__)
+
+
+@app.route("/ping")
+def ping():
+    host = request.args.get("host", "")
+    command = "ping -c 1 " + host
+    subprocess.call(command, shell=True)  # expect: SR-PY-004
+    os.system("echo " + host)  # expect: SR-PY-005
+    return "ok"
+
+
+@app.route("/user/<name>")
+def user(name):
+    query = f"SELECT * FROM users WHERE name = '{name}'"
+    cursor.execute(query)  # expect: SR-PY-011
+    return f"<h1>Hello {name}</h1>"  # expect: SR-PY-024
+
+
+@app.route("/calc", methods=["POST"])
+def calc():
+    expression = request.form["expr"]
+    return str(eval(expression))  # expect: SR-PY-001
+
+
+@app.route("/go")
+def go():
+    return redirect(request.args["next"])  # expect: SR-PY-023
+
+
+@app.route("/render")
+def render():
+    template = request.args.get("t", "")
+    return render_template_string(template)  # expect: SR-PY-022
+
+
+@app.route("/file")
+def read_file():
+    path = request.args["path"]
+    with open(path) as handle:  # expect: SR-PY-018
+        return handle.read()
+
+
+def load_blob(blob):
+    return pickle.loads(blob)  # expect: SR-PY-002
+
+
+def load_config(path):
+    return yaml.load(open(path))  # expect: SR-PY-003
+
+
+def make_reset_token():
+    import random
+    reset_token = random.randint(100000, 999999)  # expect: SR-PY-009
+    return reset_token