Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: OWASP-Benchmark/BenchmarkPython
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: DomKoe/BenchmarkPython
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: main
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 71 files changed
  • 2 contributors

Commits on Sep 5, 2026

  1. test: add 70 test cases to the 7 smallest categories 

    sqli (16), cmdi (20), xxe (28), ldapi (29), redirect (34), trustbound
(37), and securecookie (39) were all far below the largest category
(weakrand, 326) - a 20.38x spread, worse than the equivalent imbalance
found and partially addressed in BenchmarkJava. This suite shares the
same BenchmarkUtils scoring engine, so the macro-averaging formula fix
made there applies here automatically with no code changes needed.

Adds 10 cases per category (5 true/5 false, 70 total) using taint
dimensions genuinely absent from the existing 1230 test cases (verified
by grep across the whole suite before use, not assumed):
- Flask session as a taint source (relayed between the GET and POST
  handlers of the same test, mirroring how existing tests relay state
  via cookies)
- Multipart form-data (request.files) as a taint source
- JSON request body (request.get_json()) as a taint source
- WSGI environ dict (request.environ) as a taint source
- Extra data-flow hops via small helper functions

trustbound already uses flask.session as its *sink* (an attacker-
controlled value becoming a session dict key), so session-as-source
was deliberately not reused there to avoid a confusing session-to-
session pattern; multipart/json/environ/helper-hop dimensions were
used instead.

securecookie follows the same redesign already applied in Java: every
existing case there decides the cookie's secure/httponly flags via a
hardcoded literal, so the new cases instead make that decision itself
attacker-influenceable (via header, session, multipart, or a helper),
plus one pair using a manually-built Set-Cookie header as an
alternative sink to the response.set_cookie() object API.

Category-size ratio improves from 20.38x to 12.54x. Verified via
ast.parse + py_compile on all 70 files, a full `import app` (which
executes init(app) for every one of the suite's 1300 test files and
registers 2604 routes without error), and live Flask test-client
requests against a representative sample covering every category and
dimension.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01TKvdacc4QAZZ37awNy94nT
    @DomKoe @claude
    DomKoe and claude committed Sep 5, 2026
    Configuration menu
    Copy the full SHA
    c7515f2 View commit details
    Browse the repository at this point in the history
Loading