seed sast-triage cache by github-actions[bot] · Pull Request #13 · alexpermiakov/BenchmarkJava

github-actions · 2026-07-23T19:40:09Z

sast-triage · first run (seed)

65 findings — 46 exploitable · 15 benign (proposed suppressions) · 4 uncertain
0 from cache · 65 newly triaged · 1.4M in / 57k out tokens
Triaged by claude-opus-5

Verdict _{by sast-triage}	Severity _{by Opengrep OSS}	Why	Rule	Location
🚨 exploitable	high	doPost reads the attacker-controlled 'BenchmarkTest00092' cookie value and URL-decodes it into 'param' (BenchmarkTest00092.java:54-64); no validation or filtering is applied. The switch on switchTarget = "ABC".charAt(2) is constant 'C',…	`tainted-cmd-from-http-request`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00092.java:96`
🚨 exploitable	high	Header value 'BenchmarkTest00133' is read into param (line 44-45), URL-decoded (line 49), and assigned unchanged to bar via a ternary whose condition is constant-false ((7*42)-106 = 188 > 200 is false), so bar == param (line 54-56). bar…	`httpservlet-path-traversal`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00133.java:63`
🚨 exploitable	high	doPost reads the attacker-controlled HTTP header 'BenchmarkTest01907' into param (line 44-45), URL-decodes it (line 49), and passes it to doSomething, whose ternary at line 88 evaluates (7*42)-106 = 188 > 200 as false, so it returns param…	`httpservlet-path-traversal`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01907.java:59`
🚨 exploitable	high	The attacker-controlled HTTP header 'BenchmarkTest01907' is read at line 45, URL-decoded at line 49 (which re-enables encoded '../' sequences), and passed to doSomething() at line 51. doSomething (lines 80-91) computes (7*42)-106 = 188,…	`httpservlet-path-traversal`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01907.java:72`
🚨 exploitable	high	doPost reads attacker-controlled request parameter names via request.getParameterNames() (line 45), and assigns the raw parameter name to `param` whenever any of its values equals the literal "BenchmarkTest02333" (lines 47-55) — the…	`tainted-cmd-from-http-request`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02333.java:72`
🚨 exploitable	high	doPost iterates request.getParameterNames() and sets param to the attacker-supplied parameter NAME whose value equals "BenchmarkTest02333" (BenchmarkTest02333.java:45-58); param is passed to doSomething -> ThingFactory.createThing().doSomet…	`command-injection-process-builder`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02333.java:76`
🚨 exploitable	high	request.getParameterValues("BenchmarkTest02466")[0] is assigned to param (line 43-45) and passed to doSomething, where switchTarget = "ABC".charAt(2) == 'C', so the switch takes the case 'C'/'D' branch and returns bar = param unchanged…	`httpservlet-path-traversal`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02466.java:55`
🚨 exploitable	medium	doPost reads the attacker-controlled HTTP header 'BenchmarkTest00195' into param (BenchmarkTest00195.java:44-45), URL-decodes it (line 49) with no filtering, and the ternary at line 56 evaluates (7*42)-num = 294-106 = 188 > 200 as false,…	`tainted-sql-from-http-request`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00195.java:61`
🚨 exploitable	medium	request.getParameter("BenchmarkTest00385") (line 43) flows unmodified except for benign string plumbing: StringBuilder wrap/append/replace only appends and rewrites the appended suffix (lines 47-53), HashMap put/get is identity (54-56),…	`no-direct-response-writer`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00385.java:70`
🚨 exploitable	medium	The value from `new java.util.Random().nextInt()` (BenchmarkTest00486.java:52) is converted to a string (line 53) and used directly as a security token: it is stored as the session-scoped 'rememberMe' credential (line 86) and emitted to…	`weak-random`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00486.java:52`
🚨 exploitable	medium	The servlet reads an attacker-controlled request parameter (BenchmarkTest00693) at line 43-51, then instantiates a 56-bit DES cipher via Cipher.getInstance("DES/CBC/PKCS5Padding") at line 64 with a DES key from KeyGenerator.getInstance("DES…	`des-is-deprecated`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00693.java:64`
🚨 exploitable	medium	The flagged line instantiates a KeyGenerator for the raw DES algorithm (56-bit effective key) and the Cipher is created as "DES/CBC/PKCS5Padding" (src/.../BenchmarkTest00693.java:64,67). That key/cipher then encrypts data taken directly…	`desede-is-deprecated`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00693.java:67`
🚨 exploitable	medium	The servlet doPost hard-codes weak DES cryptography: Cipher.getInstance("DES/CBC/PKCS5Padding") (line 64) and KeyGenerator.getInstance("DES").generateKey() (line 67, 56-bit key) are used to encrypt request-supplied data (request.getParamete…	`des-is-deprecated`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00693.java:67`
🚨 exploitable	medium	The servlet's doPost reads attacker-controlled data from the raw query string (BenchmarkTest00789 parameter, src/.../BenchmarkTest00789.java:43-68), round-trips it through Base64 encode/decode which preserves the value unchanged (lines…	`use-of-sha1`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00789.java:80`
🚨 exploitable	medium	doPost reads the raw query string (line 43), extracts the BenchmarkTest00834 parameter value (lines 56-67) and URL-decodes it (line 68). The only transformation before the sink is a Base64 encode followed immediately by a Base64 decode…	`tainted-session-from-http-request`	`src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00834.java:80`

+50 high/medium — see the report.

Merging approves every verdict above. They live in .sast-triage/cache.json, which is part of this PR's diff — edit it like any other file:

Disagree with a verdict? Change its "verdict" to "exploitable". The finding stays unsuppressed, and an enforcing run fails on it.
Want it looked at again? Delete the whole entry. The next run triages it from scratch.

_{run summary · triage-report.md}

github-actions Bot force-pushed the sast-triage/seed branch 19 times, most recently from 1ba60a1 to 9f574a1 Compare July 27, 2026 08:09

github-actions Bot force-pushed the sast-triage/seed branch 5 times, most recently from f82a586 to dc45260 Compare August 3, 2026 11:27

chore(triage): verdict cache update 2026-08-03T11:37Z [skip ci]

2546eaf

github-actions Bot force-pushed the sast-triage/seed branch from dc45260 to 2546eaf Compare August 3, 2026 11:37

Navigation Menu

seed sast-triage cache - #13

seed sast-triage cache#13
github-actions[bot] wants to merge 1 commit into
masterfrom
sast-triage/seed

github-actions Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

sast-triage · first run (seed)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented Jul 23, 2026 •

edited

Loading