{"file": "lib/response.js", "id": "dee6a804fa26391f9a92", "justification": "Framework helper resolves caller-selected paths; actionable issue belongs at route call sites.", "label": "false_positive", "line": 598, "repo": "express", "rule_id": "js/no-path-traversal"}
{"file": "lib/router/index.js", "id": "c33db8eb7ee0d56a7964", "justification": "Request URL reaches a debug log sink, matching the log-injection rule model.", "label": "true_positive", "line": 139, "repo": "express", "rule_id": "js/taint-log-injection"}
{"file": "src/flask/cli.py", "id": "3066268b81c21e30ff08", "justification": "PYTHONSTARTUP is a local developer-shell feature and not remote path input.", "label": "false_positive", "line": 1028, "repo": "flask", "rule_id": "py/no-path-traversal"}
{"file": "src/flask/cli.py", "id": "2cdbd5c77a8692973742", "justification": "The eval executes the developer-controlled PYTHONSTARTUP file in the CLI shell.", "label": "false_positive", "line": 1029, "repo": "flask", "rule_id": "py/no-eval"}
{"file": "src/flask/cli.py", "id": "22e0bd5b21d922c2a570", "justification": "The tainted environment value is local shell configuration, not application attacker input.", "label": "false_positive", "line": 1029, "repo": "flask", "rule_id": "py/taint-eval"}
{"file": "src/flask/config.py", "id": "53fb0df303901b505308", "justification": "Flask config files are trusted Python modules loaded intentionally by operators.", "label": "false_positive", "line": 209, "repo": "flask", "rule_id": "py/no-eval"}
{"file": "src/flask/helpers.py", "id": "31f2bd3379eca7707974", "justification": "Framework redirect helper cannot know whether caller-supplied locations are validated.", "label": "false_positive", "line": 261, "repo": "flask", "rule_id": "py/no-open-redirect"}
{"file": "src/flask/sessions.py", "id": "88824f58ed94658e15e8", "justification": "SHA-1 is used as a signing digest default for compatibility, not password hashing.", "label": "false_positive", "line": 295, "repo": "flask", "rule_id": "py/no-weak-crypto"}
{"file": "middleware/proxy.go", "id": "55f523d5c4f944f2b9d1", "justification": "Randomness selects proxy targets for load balancing, not a security decision.", "label": "false_positive", "line": 188, "repo": "echo", "rule_id": "go/math-random-used"}
{"file": "middleware/proxy.go", "id": "756c9ccb52629123adb3", "justification": "Duplicate report for non-security load-balancing randomness.", "label": "false_positive", "line": 188, "repo": "echo", "rule_id": "go/math-random-used"}
{"file": "routes/captcha.ts", "id": "10d7816dc58fcea16601", "justification": "Expression is generated server-side from numeric terms and fixed operators.", "label": "false_positive", "line": 23, "repo": "juice-shop", "rule_id": "js/no-eval"}
{"file": "routes/chatbot.ts", "id": "11109ce9c8ed62527296", "justification": "Training file URL comes from application config, not a request parameter.", "label": "false_positive", "line": 30, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/chatbot.ts", "id": "0bd72769cb34b5a26d6c", "justification": "Downloaded training file name is derived from application config, not user input.", "label": "false_positive", "line": 31, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/chatbot.ts", "id": "2d38edb5e23f2536aaf4", "justification": "Chatbot training file is a configured local resource loaded at startup.", "label": "false_positive", "line": 40, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/fileServer.ts", "id": "9c3c61b33d548c4cf2d2", "justification": "Route parameter reaches sendFile and the file-server challenge tracks traversal bypasses.", "label": "true_positive", "line": 33, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/fileUpload.ts", "id": "837c3a15e2dd2d5fe2fa", "justification": "ZIP entry path is written under uploads without normalization, matching Zip Slip.", "label": "true_positive", "line": 45, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/keyServer.ts", "id": "37ab25c93ab6b4dcec3a", "justification": "Route blocks slashes before sendFile, so traversal is not shown at this site.", "label": "false_positive", "line": 14, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/languages.ts", "id": "86c147a722d8251bca23", "justification": "Filename comes from fs.readdir over the i18n directory, not from user input.", "label": "false_positive", "line": 27, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/logfileServer.ts", "id": "e9368de99e6e661c543f", "justification": "Route blocks slashes before sendFile, so traversal is not shown at this site.", "label": "false_positive", "line": 14, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/login.ts", "id": "304da078b34df6c9bfb7", "justification": "Request body email flows into a raw SQL template in the vulnerable login route.", "label": "true_positive", "line": 34, "repo": "juice-shop", "rule_id": "js/taint-sql-injection"}
{"file": "routes/login.ts", "id": "affbbfa07744a7d86b37", "justification": "Raw SQL query interpolates request body data in the vulnerable login route.", "label": "true_positive", "line": 34, "repo": "juice-shop", "rule_id": "js/no-sql-injection"}
{"file": "routes/profileImageUrlUpload.ts", "id": "79508ce00a7ff4ff9a0c", "justification": "Request body URL is fetched server-side and the route records an SSRF challenge.", "label": "true_positive", "line": 24, "repo": "juice-shop", "rule_id": "js/no-ssrf"}
{"file": "routes/profileImageUrlUpload.ts", "id": "e2c4485265b506ed7ea3", "justification": "Request body URL is tainted into fetch, matching the SSRF taint rule.", "label": "true_positive", "line": 24, "repo": "juice-shop", "rule_id": "js/taint-ssrf"}
{"file": "routes/profileImageUrlUpload.ts", "id": "9f995cd16c3db0a5ca5b", "justification": "Write path uses authenticated user id plus allowlisted extension, not raw path input.", "label": "false_positive", "line": 29, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/quarantineServer.ts", "id": "dc510257d6269955ff93", "justification": "Route blocks slashes before sendFile, so traversal is not shown at this site.", "label": "false_positive", "line": 14, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/search.ts", "id": "fd06d43c3774ba60d860", "justification": "Search criteria reaches a raw SQL template in the SQL injection challenge route.", "label": "true_positive", "line": 23, "repo": "juice-shop", "rule_id": "js/taint-sql-injection"}
{"file": "routes/search.ts", "id": "394cb609e069754cb9c1", "justification": "Search criteria is interpolated into raw SQL in the SQL injection challenge route.", "label": "true_positive", "line": 23, "repo": "juice-shop", "rule_id": "js/no-sql-injection"}
{"file": "routes/userProfile.ts", "id": "6e308ff1cdcf3de1b30b", "justification": "User-controlled profile code is evaluated in the vulnerable profile route.", "label": "true_positive", "line": 62, "repo": "juice-shop", "rule_id": "js/no-eval"}
{"file": "routes/userProfile.ts", "id": "10ae9372630233d92888", "justification": "Tainted request-controlled profile code reaches eval.", "label": "true_positive", "line": 62, "repo": "juice-shop", "rule_id": "js/taint-eval"}
{"file": "routes/verify.ts", "id": "4527cf8aa640bd3055c7", "justification": "JWT token is decoded without verification in an auth-adjacent route.", "label": "true_positive", "line": 111, "repo": "juice-shop", "rule_id": "js/jwt-decode-without-verify"}
{"file": "routes/videoHandler.ts", "id": "ef56fda8ee6aa4250ddb", "justification": "Subtitle filename comes from application config and is normalized elsewhere.", "label": "false_positive", "line": 82, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/vulnCodeFixes.ts", "id": "97a8b3f2029a5a2f3224", "justification": "Filename is selected from directory entries and not directly controlled as a path.", "label": "false_positive", "line": 29, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/vulnCodeFixes.ts", "id": "a310856f5589d8b68ba3", "justification": "Request key controls a YAML file path loaded with yaml.load.", "label": "true_positive", "line": 81, "repo": "juice-shop", "rule_id": "js/no-unsafe-deserialization"}
{"file": "routes/vulnCodeFixes.ts", "id": "6c174f35a4b9248e8a22", "justification": "Request key is concatenated into the codefix metadata file path.", "label": "true_positive", "line": 81, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}
{"file": "routes/vulnCodeSnippet.ts", "id": "430035c00efd3b029f26", "justification": "Request key controls a YAML metadata path loaded with yaml.load.", "label": "true_positive", "line": 95, "repo": "juice-shop", "rule_id": "js/no-unsafe-deserialization"}
{"file": "routes/vulnCodeSnippet.ts", "id": "06f6c8baaa3ddf24dacd", "justification": "Request key is concatenated into the codefix metadata file path.", "label": "true_positive", "line": 95, "repo": "juice-shop", "rule_id": "js/no-path-traversal"}