Fix tests metadata

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008178.metadata.json

@@ -16,7 +16,7 @@
         ],
         "used_extensions": [],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008178.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>00008178</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>89</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000822.metadata.json

@@ -16,7 +16,7 @@
         ],
         "used_extensions": [],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000822.xml

@@ -2,6 +2,6 @@
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>0000822</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>89</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000828.metadata.json

@@ -16,7 +16,7 @@
         ],
         "used_extensions": [],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000828.xml

@@ -2,6 +2,6 @@
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>0000828</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>89</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000843.metadata.json

@@ -16,7 +16,7 @@
         ],
         "used_extensions": [],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000843.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>0000843</test-number>
     <vulnerability>false</vulnerability>
     <cwe>89</cwe>
-</test-metadata>
+</test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00098122.xml

@@ -1,3 +1,4 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>trustbound</category>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest000981223.metadata.json

@@ -26,7 +26,7 @@
             "MACRO_SetName -> set787231"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest000981223.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>trustbound</category>
     <test-number>000981223</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>501</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0010091.java

@@ -75,7 +75,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
 
         try {
 
-            ServiceI service111 = new ServiceSimple(request.getPathInfo());
+            ServiceI service111 = new ServiceSimple(sql);
             ConsumerInterface ci111 = new ConsumerInterface(service111);
             sql = ci111.getFieldValue();
 

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0010091.metadata.json

@@ -18,7 +18,7 @@
             " MACRO_VarName -> obj12321"
         ],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0010091.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>0010091</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>89</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00216125.metadata.json

@@ -30,7 +30,7 @@
             "MACRO_ListName -> list787231"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00216125.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>pathtraver</category>
     <test-number>00216125</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>22</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest002164.metadata.json

@@ -30,7 +30,7 @@
             "MACRO_QueueName -> queue787231"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest002164.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>pathtraver</category>
     <test-number>002164</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>22</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest003281.java

@@ -78,8 +78,10 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
                             ("[^abc]"
                                     + (("[a-z]+" + "+")
                                             + "|"
-                                            + ((("[^abc]" + "*?") + "??") + "|" + "\0mnn"))));
-            Matcher matcher = pattern.matcher(request.changeSessionId());
+                                            + ((("[^abc]" + "*?")) + "|" + "\0mnn"))));
+            if (request.getSession() != null) {
+                Matcher matcher = pattern.matcher(request.changeSessionId());
+            }
 
             java.sql.CallableStatement statement = connection.prepareCall(sql);
             java.sql.ResultSet rs = statement.executeQuery();

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0057315.java

@@ -59,7 +59,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
 
                         Queue<String> queue787231 = new PriorityQueue<>();
                         queue787231.offer(
-                                param.concat(value).replaceAll("\\", param.toLowerCase()));
+                                param.concat(value).replaceAll("\\.", param.toLowerCase()));
                         param = queue787231.poll();
 
                         flag = false;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest011439.java

@@ -93,7 +93,7 @@ public <T9> T9 varargsWithGenerics(T9... elements) {
     }
 
     public String combineStrings(String... strings) {
-        return String.join(", ", strings);
+        return String.join("_", strings);
     }
 
     private class Test9 {

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0120422.java

@@ -73,8 +73,8 @@ public String doSomething(HttpServletRequest request, String param)
 
             List<String> list787232 = new ArrayList<>();
             list787232.add(request.getRemoteUser());
-            list787232.clear();
             String value7846 = list787232.get(0);
+            list787232.clear();
 
             String a40584 = param; // assign
             StringBuilder b40584 = new StringBuilder(a40584); // stick in stringbuilder

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01242179.metadata.json

@@ -23,7 +23,7 @@
             "MACRO_QueueName@1 -> queue787231"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01242179.xml

@@ -2,6 +2,6 @@
     <benchmark-version>1.2</benchmark-version>
     <category>ldapi</category>
     <test-number>01242179</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>90</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0124324.metadata.json

@@ -18,7 +18,7 @@
             " MACRO_VarName -> obj09823"
         ],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0124324.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>ldapi</category>
     <test-number>0124324</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>90</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01287156.java

@@ -56,7 +56,9 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
         String[] args = {cmd};
 
         Pattern pattern = Pattern.compile(("\r" + "*"));
-        Matcher matcher = pattern.matcher(request.getRemoteUser().substring(42));
+        if (request.getRemoteUser() != null) {
+            Matcher matcher = pattern.matcher(request.getRemoteUser().substring(42));
+        }
 
         String[] argsEnv = {bar};
 

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest012871561.metadata.json

@@ -22,7 +22,7 @@
             "MACRO_VarName -> sealed21341"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest012871561.xml

@@ -2,6 +2,6 @@
     <benchmark-version>1.2</benchmark-version>
     <category>cmdi</category>
     <test-number>012871561</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>78</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0130294.metadata.json

@@ -19,7 +19,7 @@
             "MACRO_VarName -> obj12321"
         ],
         "region": null,
-        "kind": "pass"
+        "kind": "fail"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0130294.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>sqli</category>
     <test-number>0130294</test-number>
-    <vulnerability>false</vulnerability>
+    <vulnerability>true</vulnerability>
     <cwe>89</cwe>
-</test-metadata>
+</test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0132635.java

@@ -58,7 +58,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
         list787231.add("wcgbs");
         list787231.add(bar);
         Stream<String> stream787231 = list787231.stream();
-        stream787231.map(entry111 -> entry111 + "mcbgw");
+        stream787231 = stream787231.map(entry111 -> entry111 + "mcbgw");
         bar = stream787231.findFirst().get();
 
         org.owasp.benchmark.helpers.LDAPManager ads = new org.owasp.benchmark.helpers.LDAPManager();

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0147879.xml

@@ -1,3 +1,4 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>xpathi</category>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01497174.java

@@ -140,9 +140,9 @@ public String InterfaceCall(String t) {
 
                 File f = new File(bar);
 
-                valuesList.remove(0); // remove the 1st safe value
-
                 bar = valuesList.get(0); // get the param value
+
+                valuesList.remove(0); // remove the 1st safe value
             }
 
             return bar;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01497174.metadata.json

@@ -21,7 +21,7 @@
             "EXPR_NestedRecord -> (new NestedRecord(new SimpleRecord(~[EXPR_String]~), new SimpleRecord(~[EXPR_String]~)))"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01497174.xml

@@ -2,6 +2,6 @@
     <benchmark-version>1.2</benchmark-version>
     <category>pathtraver</category>
     <test-number>01497174</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>22</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01517108.metadata.json

@@ -20,7 +20,7 @@
             "EXPR_String -> ~[EXPR_String]~.concat(~[EXPR_String]~)"
         ],
         "region": null,
-        "kind": "fail"
+        "kind": "pass"
     },
     "tool_results": []
 }

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01517108.xml

@@ -1,7 +1,8 @@
+<?xml version='1.0' encoding='utf-8'?>
 <test-metadata>
     <benchmark-version>1.2</benchmark-version>
     <category>cmdi</category>
     <test-number>01517108</test-number>
-    <vulnerability>true</vulnerability>
+    <vulnerability>false</vulnerability>
     <cwe>78</cwe>
 </test-metadata>

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0153396.java

@@ -80,10 +80,11 @@ public String doSomething(HttpServletRequest request, String param)
             if (param != null) {
                 bar = bar = bar;
 
-                new String(
-                        org.apache.commons.codec.binary.Base64.decodeBase64(
-                                org.apache.commons.codec.binary.Base64.encodeBase64(
-                                        param.getBytes())));
+                bar =
+                        new String(
+                                org.apache.commons.codec.binary.Base64.decodeBase64(
+                                        org.apache.commons.codec.binary.Base64.encodeBase64(
+                                                param.getBytes())));
             }
 
             return bar;