scabench/jsonorg-fn1simple application with a CVE-2022-45688 vulnerability
The project illustrates CVE-2022-45688 in json.org -- there is a simple application
XML2JSONConverter to read XML from input, convert it to JSON and
pretty-print it to the console.
Using malicious input, the application crashes with a stackoverflow.
The test case CVE202245688Test illustrates this behaviour, it
can be executed by running mvn test.
There are several sh scripts to run different analyses, result resports can be found in scan-results.
The SCA report (including the onces set up as GitHub actions) fail to report CVE-2022-45688, although the included test clearyly shows that it exists. The reason is that tools based on meta-data analysis only (i.e. declared dependencies) dont realise that the project uses a shaded version of (a vulnerable version of) json.org.
Note that shading is done manually, i.e. the Maven shade plugin is not used. Our recent research suggests that this is a common source of sofwtare composition analysis false negatives.
