{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.27.2","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/kotlin-propagation-kernel","name":"dataflowbench/kotlin-propagation-kernel","shortDescription":{"text":"DataFlowBench Kotlin propagation kernel"},"fullDescription":{"text":"Finds benchmark-controlled taint flow between the Kotlin kernel's source and sink functions."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Finds benchmark-controlled taint flow between the Kotlin kernel's source and sink functions.","id":"dataflowbench/kotlin-propagation-kernel","kind":"path-problem","name":"DataFlowBench Kotlin propagation kernel","precision":"high","problem.severity":"warning"}},{"id":"dataflowbench/kotlin-kernel-endpoint-probe","name":"dataflowbench/kotlin-kernel-endpoint-probe","shortDescription":{"text":"DataFlowBench Kotlin kernel endpoint-observation probe"},"fullDescription":{"text":"Reports every benchmark-controlled source and sink endpoint the extracted database resolves. The runner evaluates this probe alongside `KotlinKernel.ql` so an empty kernel result set is read as a clean negative only when both endpoints were observed."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Reports every benchmark-controlled source and sink endpoint the\n              extracted database resolves. The runner evaluates this probe\n              alongside `KotlinKernel.ql` so an empty kernel result set is\n              read as a clean negative only when both endpoints were observed.","id":"dataflowbench/kotlin-kernel-endpoint-probe","kind":"problem","name":"DataFlowBench Kotlin kernel endpoint-observation probe","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-kotlin","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/codeql-kotlin-kernel/attempt-01/adapters/codeql/v0.9.2/kotlin/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/codeql-kotlin-kernel/attempt-01/adapters/codeql/v0.9.2/kotlin/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.3.2+a7057b836bf29767461026718b14d20790b9085f","taxa":[{"id":"ext/generated/modelgenerator/kotlinstdlib.model.yml/1/797","properties":{"CodeQL/DataExtensionLocation":{"artifactLocation":{"uri":"ext/generated/modelgenerator/kotlinstdlib.model.yml"},"region":{"startLine":824,"startColumn":9,"endLine":824,"endColumn":9}}}},{"id":"ext/generated/modelgenerator/kotlinstdlib.model.yml/1/777","properties":{"CodeQL/DataExtensionLocation":{"artifactLocation":{"uri":"ext/generated/modelgenerator/kotlinstdlib.model.yml"},"region":{"startLine":804,"startColumn":9,"endLine":804,"endColumn":9}}}},{"id":"ext/java.util.model.yml/1/139","properties":{"CodeQL/DataExtensionLocation":{"artifactLocation":{"uri":"ext/java.util.model.yml"},"region":{"startLine":152,"startColumn":9,"endLine":152,"endColumn":9}}}},{"id":"ext/generated/modelgenerator/kotlinstdlib.model.yml/1/720","properties":{"CodeQL/DataExtensionLocation":{"artifactLocation":{"uri":"ext/generated/modelgenerator/kotlinstdlib.model.yml"},"region":{"startLine":747,"startColumn":9,"endLine":747,"endColumn":9}}}}],"locations":[{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/tools/codeql-packs/codeql/java-all/9.3.2/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/tools/codeql-packs/codeql/java-all/9.3.2/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.59+a7057b836bf29767461026718b14d20790b9085f","locations":[{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/tools/codeql-packs/codeql/threat-models/1.0.59/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/tools/codeql-packs/codeql/threat-models/1.0.59/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-10-20T09:58:34.024990Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":68},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-10-20T09:58:34.025842Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"27.0.1"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-10-20T09:58:34.035247Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/kotlin-propagation-kernel","ruleIndex":0,"rule":{"id":"dataflowbench/kotlin-propagation-kernel","index":0},"message":{"text":"Controlled input reaches the benchmark sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":22,"endColumn":27}}}],"partialFingerprints":{"primaryLocationLineHash":"da6d30448bf5117c:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":12,"startColumn":29,"endColumn":41}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":12,"startColumn":9,"endColumn":16}},"message":{"text":"records [post update] : Map [<element>] : Object"}},"taxa":[{"index":0,"toolComponent":{"index":1},"properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":30,"endColumn":37}},"message":{"text":"records : Map [<element>] : Object"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":30,"endColumn":37}},"message":{"text":"mutableIterator(...) : Iterator"}},"taxa":[{"index":1,"toolComponent":{"index":1},"properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":30,"endColumn":37}},"message":{"text":"<iterator> : Iterator"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":30,"endColumn":37}},"message":{"text":"next(...) : Entry"}},"taxa":[{"index":2,"toolComponent":{"index":1},"properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":20,"endColumn":25}},"message":{"text":"<destruct> : Entry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":20,"endColumn":25}},"message":{"text":"component2(...) : String"}},"taxa":[{"index":3,"toolComponent":{"index":1},"properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":22,"endColumn":27}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":12,"startColumn":29,"endColumn":41}}}]},{"ruleId":"dataflowbench/kotlin-kernel-endpoint-probe","ruleIndex":1,"rule":{"id":"dataflowbench/kotlin-kernel-endpoint-probe","index":1},"message":{"text":"Benchmark source endpoint observed."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":12,"startColumn":29,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"6ea9589b56440ca4:1","primaryLocationStartColumnFingerprint":"20"}},{"ruleId":"dataflowbench/kotlin-kernel-endpoint-probe","ruleIndex":1,"rule":{"id":"dataflowbench/kotlin-kernel-endpoint-probe","index":1},"message":{"text":"Benchmark sink endpoint observed."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"MapIterationPositive.kt","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":22,"endColumn":27}}}],"partialFingerprints":{"primaryLocationLineHash":"da6d30448bf5117c:1","primaryLocationStartColumnFingerprint":"9"}}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]}