This is a repost of issue #17 which was
accidentally closed.
CWE-Bench-Java currently spans four CWEs — CWE-022 (55),
CWE-079 (31), CWE-094 (21), CWE-078 (13) — with no
CWE-639 / broken-access-control cases. We would like
to contribute IDOR/access-control cases to close that gap.
We maintain a curated, source-verified label set of 59
A01 (broken access control) cases across Java Spring Boot
applications. Every label was adjudicated by reading the
actual source code, not automated tooling. On this
independently-reproducible stratum, our static analysis
tool Chanakya measures:
Precision: 0.719
Recall: 0.885
F1: 0.79
All target repositories are public open-source projects
(spring-petclinic, shopizer, WebGoat, ecommerce-microservice-
backend-app, IWA-Java, CentralBankSecLand, and others),
so the ground truth labels can be independently verified
by anyone without running our tool.
We can supply:
Labeled corpus in your existing CSV/advisory format
Per-case rationale for each TP/FP decision
Reproduction scripts pointing to pinned commits
No proprietary tool code required
Is a CWE-639 extension something the maintainers would
be interested in? We believe it would make CWE-Bench-Java
the most comprehensive Java vulnerability benchmark
available, covering the #1 OWASP category that is
currently absent.
Note: our detection tool (Chanakya) is currently
in private development. The labeled corpus itself
references only public repositories and can be
verified independently of our tool.
This contribution is a joint effort with my co-founder https://github.com/suman101. We are building Chanakya
together as a two-person team.
GitHub: https://github.com/sujanaacharya/CHANAKYA
This is a repost of issue #17 which was
accidentally closed.
CWE-Bench-Java currently spans four CWEs — CWE-022 (55),
CWE-079 (31), CWE-094 (21), CWE-078 (13) — with no
CWE-639 / broken-access-control cases. We would like
to contribute IDOR/access-control cases to close that gap.
We maintain a curated, source-verified label set of 59
A01 (broken access control) cases across Java Spring Boot
applications. Every label was adjudicated by reading the
actual source code, not automated tooling. On this
independently-reproducible stratum, our static analysis
tool Chanakya measures:
Precision: 0.719
Recall: 0.885
F1: 0.79
All target repositories are public open-source projects
(spring-petclinic, shopizer, WebGoat, ecommerce-microservice-
backend-app, IWA-Java, CentralBankSecLand, and others),
so the ground truth labels can be independently verified
by anyone without running our tool.
We can supply:
Labeled corpus in your existing CSV/advisory format
Per-case rationale for each TP/FP decision
Reproduction scripts pointing to pinned commits
No proprietary tool code required
Is a CWE-639 extension something the maintainers would
be interested in? We believe it would make CWE-Bench-Java
the most comprehensive Java vulnerability benchmark
available, covering the #1 OWASP category that is
currently absent.
Note: our detection tool (Chanakya) is currently
in private development. The labeled corpus itself
references only public repositories and can be
verified independently of our tool.
This contribution is a joint effort with my co-founder https://github.com/suman101. We are building Chanakya
together as a two-person team.
GitHub: https://github.com/sujanaacharya/CHANAKYA