False Positive in Python Path Traversal Benchmark – BenchmarkTest00008 #1
Description
Hi @davewichers ,
We identified a false positive in the OWASP Benchmark (Python) test case classified as a true positive under the Path Traversal category.
Test case: /benchmark/pathtraver-00/BenchmarkTest00008
Rule: Path Traversal
Case:
param = urllib.parse.unquote_plus(
request.cookies.get("BenchmarkTest00008", "noCookieValueSupplied")
)
bar = "This should never happen"
if 'should' not in bar:
bar = "Ifnot case passed"
testfiles = pathlib.Path(helpers.utils.TESTFILES_DIR)
p = testfiles / bar
The variable bar, which is used to construct the filesystem path, is a hardcoded constant and is not derived from any user-controlled input. The conditional check is also deterministic and does not modify bar based on external input. Therefore, there is no feasible data flow from user input to the path construction.
As a result, the filesystem access does not expose a path traversal vulnerability, and the test case appears to be incorrectly marked as a true positive.
Additional observations:
We have found multiple similar cases in the Python benchmark where user input is read but does not propagate to the sink, yet the test is still classified as a true positive. These cases may be worth re-evaluating to reduce false positives and improve benchmark accuracy.
Please let us know if you would like references to additional examples.