javascript — Seeded corpus

Seeded JavaScript defects — prototype pollution, dynamic code execution, floating promises.

What this is

9 deliberate defects, each carrying a marker naming the rule in standards/ it violates. It measures recall, and its pass condition is that every one of the 7 BLOCKER markers is flagged. The rule id in each marker means the scorer grades attribution too: a reviewer that finds the bug but cites the wrong rule counts as caught, and separately as misattributed.

How to onboard it

Nothing is installed and nothing here is ever merged. The corpus is used by opening a throwaway pull request on a pilot repository already onboarded for this stack, adding this directory and seeded/clean together. Label it redline-exempt so the readiness gate does not block a pull request nobody will merge, wait for the automated review to finish, then score it.

seed-canary.yml does exactly this on a schedule and closes the pull request afterwards, including when the run fails.

How to use it

terminal

$ GH_TOKEN=... npx redlinegate metrics score-seeds --repo <org>/<repo> --pr <n>

Seed	Severity	Rule it violates	Defect
1	BLOCKER	`core/hardcoded-secrets`	hardcoded credential
2	BLOCKER	`javascript/prototype-pollution`	prototype pollution: recursive merge over external input
3	BLOCKER	`javascript/shared-module-state-mutation`	shared module-scope mutable state across requests
4	BLOCKER	`javascript/unvalidated-boundary-input`	JSON.parse of an external payload with no try/catch or size limit
5	BLOCKER	`javascript/shell-injection`	shell command built by interpolating external input
7	BLOCKER	`javascript/floating-promises`	floating promise
9	BLOCKER	`core/type-checker-suppression`	linter suppression with no explanation and no ticket
6	HIGH	`javascript/async-callback-ignored-promise`	async callback in forEach — rejections are swallowed
8	HIGH	`javascript/unsafe-numeric-coercion`	parseInt without a radix

Expected output

A score from scripts/score-seeds.mjs: BLOCKER recall, false positives, and rule attribution. The canary appends it to data/seed-scores.jsonl and fails the run if BLOCKER recall drops below 1.0 or the clean corpus attracts a false positive. Of the 9 defects here, 7 BLOCKER and 2 HIGH — only the BLOCKER count is a pass condition.

How to edit it

Add a defect by adding the code and one marker line above it. There is no separate expectations file to keep in sync — scripts/score-seeds.mjs parses the markers straight out of the source:

marker format

SEED <n> [BLOCKER|HIGH|SUGGESTION] (<stack>/<rule-slug>) <short description>

scripts/validate.mjs fails CI if a seed cites a rule that does not exist, or claims a severity higher than that rule carries in the standard — so a marker cannot quietly drift away from the rule it is testing.

The full file

seeded/javascript/seeded-violations.js · 62 lines · 2.1 KB

// DO NOT MERGE — Redline validation seed.
// Every `SEED n [SEVERITY] (rule-id)` marker must be flagged at that severity or higher,
// citing that rule id. Score with scripts/score-seeds.mjs.
'use strict';

const { exec } = require('child_process');

// SEED 1 [BLOCKER] (core/hardcoded-secrets) hardcoded credential
const SLACK_WEBHOOK = 'https://hooks.acme-chat.internal/services/T0A1B2C3/B4D5E6F7/Zx9Qr2Kd7Wm4Tz6Hb3Vy8Wn1';

// SEED 2 [BLOCKER] (javascript/prototype-pollution) prototype pollution: recursive merge over external input
function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === 'object' && source[key] !== null) {
      target[key] = merge(target[key] || {}, source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

// SEED 3 [BLOCKER] (javascript/shared-module-state-mutation) shared module-scope mutable state across requests
const cache = {};

async function handler(req, res) {
  // SEED 4 [BLOCKER] (javascript/unvalidated-boundary-input) JSON.parse of an external payload with no try/catch or size limit
  const body = JSON.parse(req.rawBody);
  merge(cache, body);

  // SEED 5 [BLOCKER] (javascript/shell-injection) shell command built by interpolating external input
  exec(`convert ${body.filename} -resize 100x100 out.png`, () => {});

  // SEED 6 [HIGH] (javascript/async-callback-ignored-promise) async callback in forEach — rejections are swallowed
  body.items.forEach(async (item) => {
    await persist(item);
  });

  // SEED 7 [BLOCKER] (javascript/floating-promises) floating promise
  notify(body.userId);

  // SEED 8 [HIGH] (javascript/unsafe-numeric-coercion) parseInt without a radix
  const page = parseInt(req.query.page);

  res.end(JSON.stringify({ page, webhook: SLACK_WEBHOOK }));
}

async function persist(item) {
  return item;
}
async function notify(userId) {
  await fetch(SLACK_WEBHOOK, { method: 'POST', body: String(userId) });
}

module.exports = { handler, merge };

// SEED 9 [BLOCKER] (core/type-checker-suppression) linter suppression with no explanation and no ticket
// eslint-disable-next-line no-unused-vars
function coerce(value) {
  return String(value);
}