summaryrefslogtreecommitdiffstats
path: root/piolium/attack-surface/candidates.jsonl
diff options
context:
space:
mode:
Diffstat (limited to 'piolium/attack-surface/candidates.jsonl')
-rw-r--r--piolium/attack-surface/candidates.jsonl26
1 files changed, 26 insertions, 0 deletions
diff --git a/piolium/attack-surface/candidates.jsonl b/piolium/attack-surface/candidates.jsonl
new file mode 100644
index 0000000..197a62f
--- /dev/null
+++ b/piolium/attack-surface/candidates.jsonl
@@ -0,0 +1,26 @@
1{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"eval","score":90,"source":"builtin"}
2{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
3{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
4{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
5{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
6{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python eval","score":90,"source":"builtin"}
7{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"ruby eval","score":90,"source":"builtin"}
8{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
9{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
10{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
11{"slug":"command-execution","description":"Potential command execution or shell invocation with variable input.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"node child_process","score":80,"source":"builtin"}
12{"slug":"dynamic-code-execution","description":"Dynamic code execution, expression evaluation, or runtime compilation.","noise":"precise","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"function constructor","score":80,"source":"builtin"}
13{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
14{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
15{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
16{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
17{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"path join","score":55,"source":"builtin"}
18{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python file open","score":55,"source":"builtin"}
19{"slug":"path-traversal-file-access","description":"Filesystem access using path joins or user-controllable paths.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"python file open","score":55,"source":"builtin"}
20{"slug":"unsafe-html-or-template","description":"HTML injection sink or template escape bypass.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"dangerous html","score":55,"source":"builtin"}
21{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"request header read","score":55,"source":"builtin"}
22{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
23{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
24{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
25{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
26{"slug":"hidden-control-channel","description":"Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.","noise":"normal","filePath":"static/htmx.min.js","line":1,"snippet":"var htmx=function(){\"use strict\";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||\"post\");return n.values},remove:null,add","matchedPattern":"proxy or original request header","score":55,"source":"builtin"}
generated by cgit v1.2.3 (git 2.46.0) at 2026-11-08 03:52:03 +0000