Documentation
¶
Overview ¶
Package corpus turns the vulnerable samples under test/{go,python,js} into first-class tests: each sample dir carries an expected.yaml declaring which rules must fire, and corpus_test.go asserts the real scan pipeline reproduces exactly that. This gives every sample a precise oracle — a dropped finding or a new false positive on any sample fails the build.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Expectation ¶
type Expectation struct {
Findings []ExpectedFinding `yaml:"findings"`
}
Expectation is a sample's expected.yaml. An empty (or absent) Findings list means the sample must produce NO findings (a clean-code / false-positive guard).
type ExpectedFinding ¶
type ExpectedFinding struct {
Rule string `yaml:"rule"`
Min int `yaml:"min"`
Max int `yaml:"max,omitempty"`
Line int32 `yaml:"line,omitempty"`
Sink string `yaml:"sink,omitempty"`
}
ExpectedFinding says a rule must fire at least Min times (Min defaults to 1) and, when Max is set, at most Max times. Max is what pins a sample's SAFE half: without it an over-count of an already-expected rule passes silently, so a sanitizer that stopped sanitizing or a sink pinned at the wrong argument index would go unnoticed.
Line and Sink are OPTIONAL location assertions: when set, at least one finding of that rule must land at that sink LINE and/or have a sink callee containing that substring. This upgrades the oracle from "rule fired" to "rule fired at the right place", catching a finding that reports the wrong location (which a count-only oracle silently accepts).
Source Files