René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"False Positive in Python Path Traversal Benchmark – BenchmarkTest00008","articleBody":"Hi @davewichers ,\n \nWe identified a **false positive** in the OWASP Benchmark (Python) test case classified as a true positive under the Path Traversal category.\n**Test case: /benchmark/pathtraver-00/BenchmarkTest00008**\n\n**Rule: Path Traversal**\n\n_Case:_\n```\nparam = urllib.parse.unquote_plus(\n    request.cookies.get(\"BenchmarkTest00008\", \"noCookieValueSupplied\")\n)\n\nbar = \"This should never happen\"\nif 'should' not in bar:\n    bar = \"Ifnot case passed\"\n\ntestfiles = pathlib.Path(helpers.utils.TESTFILES_DIR)\np = testfiles / bar\n```\n\nThe variable bar, which is used to construct the filesystem path, is a **hardcoded constant** and is not derived from any user-controlled input. The conditional check is also deterministic and does not modify bar based on external input. Therefore, there is no feasible data flow from user input to the path construction.\n\nAs a result, the filesystem access does not expose a path traversal vulnerability, and the test case appears to be incorrectly marked as a true positive.\n\n_**Additional observations:**_\n\nWe have found multiple similar cases in the Python benchmark where user input is read but does not propagate to the sink, yet the test is still classified as a true positive. These cases may be worth re-evaluating to reduce false positives and improve benchmark accuracy.\n\nPlease let us know if you would like references to additional examples.","author":{"url":"https://github.com/KarthickRaja2002","@type":"Person","name":"KarthickRaja2002"},"datePublished":"2026-01-29T10:27:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/1/BenchmarkPython/issues/1"}