T3MP3ST public launch build

bench/cve-hunt/samples/DECOY-clean-java/ground-truth.yaml

@@ -0,0 +1,16 @@
+cve: NONE
+alias: Hardened XStream binder
+cwe_primary: NONE
+cwe_acceptable: []
+target_file: source.java
+vuln_lines: []
+severity: none
+vuln_class: clean
+exploit_pattern_regex: ''
+must_mention_any: []
+points: 0
+notes: |
+  Intentionally NOT vulnerable. XStream is configured with NoTypePermission.NONE
+  baseline plus an explicit class allowlist. fromXML on attacker XML cannot
+  instantiate ProcessBuilder or other RCE gadgets.
+  Reporting a vulnerability here = false positive.

bench/cve-hunt/samples/DECOY-clean-java/source.java

@@ -0,0 +1,34 @@
+// Clean Java reference - secure XStream usage with explicit allowlist.
+// Looks superficially similar to CVE-2017-9805 but configures typePermissions.
+
+package com.example.safe;
+
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.io.xml.DomDriver;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
+
+import java.io.Reader;
+
+public final class SafeXmlBinder {
+
+    private final XStream xstream;
+
+    public SafeXmlBinder(Class<?> allowedRoot) {
+        this.xstream = new XStream(new DomDriver());
+
+        // Lock down deserialisation to a deny-by-default allowlist.
+        xstream.addPermission(NoTypePermission.NONE);
+        xstream.addPermission(NullPermission.NULL);
+        xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
+        xstream.allowTypes(new Class<?>[] { allowedRoot });
+        xstream.allowTypesByWildcard(new String[] {
+            "com.example.dto.**",
+        });
+    }
+
+    public Object fromXml(Reader in) {
+        return xstream.fromXML(in);
+    }
+}