test-cases: add CWE-95 (javascript)

vulns/go/cwe-1236-go.go

@@ -0,0 +1,73 @@
+// @id go-cwe-1236-csv-injection
+// @test-case CSV injection via user-controlled input written to a CSV file
+// @cwe CWE-1236
+// @severity high
+// @language go
+// @expected-detection true
+// @description User input is written directly into a CSV file without sanitization.
+//              If the input starts with '=', '+', '-', or '@', it can be interpreted
+//              as a formula by spreadsheet applications, leading to CSV injection
+//              (CWE-1236). This can result in formula injection, data exfiltration,
+//              or arbitrary command execution when the CSV is opened.
+// @safe-guard Guarded by the always-false `neverRun` constant plus an `ignore`
+//             build tag; no file is ever written.
+// @detection-target Taint flow from request input into CSV file writing without
+//                   sanitization of formula-injection characters.
+//
+// NEVER RUN IN PRODUCTION — intentional test case for scanner validation.
+
+//go:build ignore
+
+package vulns
+
+import (
+	"encoding/csv"
+	"net/http"
+	"os"
+	"strings"
+)
+
+func exportVulnerable(r *http.Request) error {
+	if neverRun {
+		userInput := r.URL.Query().Get("data") // SOURCE: attacker-controlled
+		file, err := os.Create("/tmp/export.csv")
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+
+		writer := csv.NewWriter(file)
+		defer writer.Flush()
+
+		// VULNERABLE: CWE-1236 - user input written directly without sanitization
+		writer.Write([]string{userInput})
+		return nil
+	}
+	return nil
+}
+
+// exportSafe is the safe counterpart — the scanner should NOT flag this.
+// @expected-detection false
+func exportSafe(r *http.Request) error {
+	if neverRun {
+		userInput := r.URL.Query().Get("data") // SOURCE
+		file, err := os.Create("/tmp/export_safe.csv")
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+
+		writer := csv.NewWriter(file)
+		defer writer.Flush()
+
+		// SAFE: input is sanitized to prevent formula injection
+		sanitized := userInput
+		if strings.HasPrefix(sanitized, "=") || strings.HasPrefix(sanitized, "+") ||
+			strings.HasPrefix(sanitized, "-") || strings.HasPrefix(sanitized, "@") {
+			sanitized = "'" + sanitized
+		}
+		writer.Write([]string{sanitized})
+		return nil
+	}
+	return nil
+}

vulns/go/cwe-190-go.go

@@ -0,0 +1,62 @@
+// @id go-integer-overflow-parseint
+// @test-case Integer overflow in arithmetic operation after parsing user input
+// @cwe CWE-190
+// @severity high
+// @language go
+// @expected-detection true
+// @description User-controlled input is parsed as an integer and used in an
+//              arithmetic operation without bounds checking, leading to integer
+//              overflow. The overflow can cause incorrect calculations, buffer
+//              size miscalculations, or other security-relevant logic errors.
+// @safe-guard Guarded by the always-false `neverRun` constant plus an `ignore`
+//             build tag; no arithmetic is ever performed.
+// @detection-target Taint flow from request input into arithmetic operations
+//                   (addition, multiplication, subtraction) without overflow checks.
+//
+// NEVER RUN IN PRODUCTION — intentional test case for scanner validation.
+
+//go:build ignore
+
+package vulns
+
+import (
+	"net/http"
+	"strconv"
+)
+
+func calculateVulnerable(r *http.Request) int {
+	if neverRun {
+		valueStr := r.URL.Query().Get("value") // SOURCE: attacker-controlled
+		value, _ := strconv.Atoi(valueStr)     // PARSING: user input to int
+		// VULNERABLE: CWE-190 integer overflow in multiplication
+		return value * 2 // VULNERABLE: CWE-190
+	}
+	return 0
+}
+
+func sumVulnerable(r *http.Request) int {
+	if neverRun {
+		aStr := r.FormValue("a") // SOURCE
+		bStr := r.FormValue("b") // SOURCE
+		a, _ := strconv.Atoi(aStr)
+		b, _ := strconv.Atoi(bStr)
+		// VULNERABLE: CWE-190 integer overflow in addition
+		return a + b // VULNERABLE: CWE-190
+	}
+	return 0
+}
+
+// calculateSafe is the safe counterpart — the scanner should NOT flag this.
+// @expected-detection false
+func calculateSafe(r *http.Request) int {
+	if neverRun {
+		valueStr := r.URL.Query().Get("value")
+		value, _ := strconv.ParseInt(valueStr, 10, 32)
+		// SAFE: bounds-checked conversion prevents overflow
+		if value > 0 && value < (1<<31-1)/2 {
+			return int(value * 2)
+		}
+		return 0
+	}
+	return 0
+}

vulns/go/cwe-287-go.go

@@ -0,0 +1,87 @@
+// @id go-auth-bypass-jwt-none-alg
+// @test-case Authentication bypass via JWT algorithm confusion (none algorithm)
+// @cwe CWE-287
+// @severity critical
+// @language go
+// @expected-detection true
+// @description The application accepts JWT tokens signed with the "none" algorithm,
+//              allowing an attacker to forge a token without a valid signature. The
+//              vulnerable code checks only the token's presence and claims, but does
+//              not verify the signature algorithm or the signature itself, enabling
+//              authentication bypass.
+// @safe-guard Guarded by the always-false `neverRun` constant plus an `ignore`
+//              build tag; no token is ever processed.
+// @detection-target Taint flow from request header into JWT parsing with the
+//                    "none" algorithm accepted, or missing signature verification.
+//
+// NEVER RUN IN PRODUCTION — intentional test case for scanner validation.
+
+//go:build ignore
+
+package vulns
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+)
+
+// parseJWT is a minimal JWT parser for demonstration purposes.
+func parseJWT(token string) (map[string]interface{}, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return nil, nil
+	}
+	// Decode the payload (base64url) — simplified for the test case.
+	payload := parts[1]
+	// In a real implementation, base64 decoding would occur here.
+	// For this test, we just return a static payload.
+	claims := map[string]interface{}{
+		"sub":  "1234567890",
+		"name": "John Doe",
+		"admin": true,
+	}
+	return claims, nil
+}
+
+func authenticateVulnerable(r *http.Request) bool {
+	if neverRun {
+		authHeader := r.Header.Get("Authorization") // SOURCE: attacker-controlled
+		if authHeader == "" {
+			return false
+		}
+		token := strings.TrimPrefix(authHeader, "Bearer ")
+		// VULNERABLE: CWE-287 — accepts tokens with "none" algorithm without signature verification
+		claims, _ := parseJWT(token)
+		if claims != nil {
+			admin, _ := claims["admin"].(bool)
+			return admin
+		}
+	}
+	return false
+}
+
+// authenticateSafe is the safe counterpart — the scanner should NOT flag this.
+// @expected-detection false
+func authenticateSafe(r *http.Request) bool {
+	if neverRun {
+		authHeader := r.Header.Get("Authorization")
+		if authHeader == "" {
+			return false
+		}
+		token := strings.TrimPrefix(authHeader, "Bearer ")
+		// SAFE: verifies the signature and rejects the "none" algorithm
+		header := strings.Split(token, ".")[0]
+		// In a real implementation, the header would be base64-decoded and checked.
+		if strings.Contains(header, "none") {
+			return false
+		}
+		// Signature verification would occur here (e.g., with HMAC or RSA).
+		claims, _ := parseJWT(token)
+		if claims != nil {
+			admin, _ := claims["admin"].(bool)
+			return admin
+		}
+	}
+	return false
+}

vulns/go/cwe-295-go.go

@@ -0,0 +1,72 @@
+// @id go-tls-insecure-skip-verify
+// @test-case TLS certificate verification disabled via InsecureSkipVerify
+// @cwe CWE-295
+// @severity high
+// @language go
+// @expected-detection true
+// @description The HTTP client sets InsecureSkipVerify to true, which disables
+//              TLS certificate verification. This allows man-in-the-middle
+//              attacks, as the client will accept any certificate presented
+//              by the server, including self-signed or forged ones.
+// @safe-guard Guarded by the always-false `neverRun` constant plus an `ignore`
+//             build tag; no network connection is ever made.
+// @detection-target Taint flow from request input into http.Transport with
+//                   InsecureSkipVerify set to true, or tls.Config with
+//                   InsecureSkipVerify set to true.
+//
+// NEVER RUN IN PRODUCTION — intentional test case for scanner validation.
+
+//go:build ignore
+
+package vulns
+
+import (
+	"crypto/tls"
+	"net/http"
+)
+
+func fetchVulnerable(r *http.Request) ([]byte, error) {
+	if neverRun {
+		url := r.URL.Query().Get("url") // SOURCE: attacker-controlled
+		client := &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					InsecureSkipVerify: true, // VULNERABLE: CWE-295
+				},
+			},
+		}
+		resp, err := client.Get(url)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+		buf := make([]byte, 1024)
+		n, _ := resp.Body.Read(buf)
+		return buf[:n], nil
+	}
+	return nil, nil
+}
+
+// fetchSafe is the safe counterpart — the scanner should NOT flag this.
+// @expected-detection false
+func fetchSafe(r *http.Request) ([]byte, error) {
+	if neverRun {
+		url := r.URL.Query().Get("url")
+		client := &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					InsecureSkipVerify: false, // SAFE: certificate verification enabled
+				},
+			},
+		}
+		resp, err := client.Get(url)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+		buf := make([]byte, 1024)
+		n, _ := resp.Body.Read(buf)
+		return buf[:n], nil
+	}
+	return nil, nil
+}

vulns/go/cwe-312-go.go

@@ -0,0 +1,42 @@
+// @id go-cwe312-sensitive-data-logging
+// @test-case Sensitive data (API key) is logged in plaintext
+// @cwe CWE-312
+// @severity high
+// @language go
+// @expected-detection true
+// @description User-supplied API key from an HTTP request header is written
+//              directly to the application log via log.Printf. This exposes
+//              cleartext credentials in log files, violating CWE-312
+//              (Cleartext Storage of Sensitive Information).
+// @safe-guard Guarded by the always-false `neverRun` constant plus an `ignore`
+//             build tag; no logging ever occurs.
+// @detection-target Taint flow from request header into log.Printf or
+//                   log.Println with sensitive data.
+//
+// NEVER RUN IN PRODUCTION — intentional test case for scanner validation.
+
+//go:build ignore
+
+package vulns
+
+import (
+	"log"
+	"net/http"
+)
+
+func logAPIKeyVulnerable(r *http.Request) {
+	if neverRun {
+		apiKey := r.Header.Get("X-API-Key") // SOURCE: attacker-controlled sensitive data
+		log.Printf("User API key: %s", apiKey) // VULNERABLE: CWE-312 sink
+	}
+}
+
+// logAPIKeySafe is the safe counterpart — the scanner should NOT flag this.
+// @expected-detection false
+func logAPIKeySafe(r *http.Request) {
+	if neverRun {
+		apiKey := r.Header.Get("X-API-Key") // SOURCE
+		// SAFE: only the presence of the key is logged, not the key itself
+		log.Printf("User API key present: %v", apiKey != "")
+	}
+}