{
  "corpus": "copilot-code-review-corpus",
  "version": "1.0.0",
  "file": "src/orders.py",
  "note": "Ground truth for scoring a code review. Each defect has a trigger a reviewer should be able to state. A finding without a trigger scores as unsupported, not as a hit. Every trigger in this key has been executed and confirmed to reproduce, except D06 which is timing-dependent by nature and is marked as such.",
  "defects": [
    {
      "id": "D01",
      "category": "injection",
      "severity": "critical",
      "function": "find_order",
      "summary": "SQL built by string concatenation from user input",
      "trigger": "order_id of \"' OR '1'='1\" returns every row"
    },
    {
      "id": "D02",
      "category": "path-traversal",
      "severity": "critical",
      "function": "load_invoice",
      "summary": "User-controlled segment joined into a path with no containment check",
      "trigger": "name of \"../../etc/passwd\" escapes /var/invoices"
    },
    {
      "id": "D03",
      "category": "crypto",
      "severity": "high",
      "function": "verify_signature",
      "summary": "Secret compared with == rather than a constant-time comparison",
      "trigger": "Response time varies with the number of matching leading characters"
    },
    {
      "id": "D04",
      "category": "injection",
      "severity": "critical",
      "function": "archive_orders",
      "summary": "Shell command built by concatenation with shell=True",
      "trigger": "directory of \"/tmp; rm -rf ~\" executes the second command"
    },
    {
      "id": "D05",
      "category": "crypto",
      "severity": "medium",
      "function": "order_reference",
      "summary": "MD5 used to derive an identifier",
      "trigger": "Collisions are constructible; disputed whether security-relevant here"
    },
    {
      "id": "D06",
      "category": "concurrency",
      "severity": "high",
      "function": "reserve_stock",
      "summary": "Check-then-act on shared state without holding the module lock",
      "trigger": "Two threads reserving the last unit can both pass the check; timing-dependent, so a single run may not expose it"
    },
    {
      "id": "D07",
      "category": "correctness",
      "severity": "high",
      "function": "apply_discount",
      "summary": "Decimal converted through float, reintroducing binary rounding error",
      "trigger": "total=Decimal('0.01'), percent=10 yields 0.009000000000000001 instead of 0.009"
    },
    {
      "id": "D08",
      "category": "resource",
      "severity": "medium",
      "function": "read_config",
      "summary": "File handle not closed on the error path",
      "trigger": "A malformed line raising inside the comprehension leaks the handle"
    },
    {
      "id": "D09",
      "category": "authorization",
      "severity": "critical",
      "function": "cancel_order",
      "summary": "user_id accepted and never checked against the order's owner",
      "trigger": "Any authenticated user can cancel any order by id"
    },
    {
      "id": "D10",
      "category": "error-handling",
      "severity": "medium",
      "function": "parse_quantity",
      "summary": "Bare except swallows every error and returns a valid-looking 0",
      "trigger": "parse_quantity(None) returns 0 rather than raising"
    }
  ]
}