Repository navigation
Corpus: add a Go SSRF detection test case #29
Description
Add a corpus case exercising SSRF detection in Go.
Where: signetry_eval/detection/corpus/ — add a case with a cited provenance (link/CWE), plus a SAFE decoy that must stay 0 false positives.
Acceptance criteria:
- One vulnerable Go snippet (
http.Get(r.URL.Query().Get("u"))-style) that the engine flags asssrf/CWE-918. - One safe Go snippet (constant URL) that is NOT flagged.
- Corpus-integrity test passes:
uv run pytest -q.
See existing cases in the corpus for the exact format. Depends on signetry-core@v0.6.0 (installed automatically).
Activity
feat(corpus): XXE, path-traversal and Go SSRF cases + pinned real rep…
bkd-dotcom commentedon Aug 18, 2026
Done in #31 (merged).
LANG-59-go-ssrf(CWE-918), giving SSRF a second language alongside Python, plus aLANG-60-SAFE-go-constant-urldecoy.Needed
go.taint.ssrfin core first (Signetry/core#95) — Go SSRF was undetected.The decoy is the interesting part: it immediately caught a false positive in that brand-new rule — a constant host with a user-supplied query string was reported as SSRF, when the destination is compiled in and only the query varies. Same FP class the Python rule is held to, so fixed in Signetry/core#97 before the corpus landed.
Corpus is now 60 cases at recall 1.0 with 0 false positives, verified against the published core v0.7.0 tag in a clean environment.