feat(fixtures): curated demo targets + seed script + golden PLC baselines (#187) (#232)

2026-08-31 15:58:16 +00:00
parent 53bd93c96e
commit 8dcdad9fe7
6 changed files with 732 additions and 0 deletions
@@ -0,0 +1,161 @@
+{
+  "schema_version": 1,
+  "name_prefix": "Demo · ",
+  "targets": [
+    {
+      "key": "plc-pump-station",
+      "name": "PLC pump station (ST + FBD, composite)",
+      "target_type": "plc_sps",
+      "description": "Composite PlcSps demo: Structured Text + FBD-as-PLCopen-XML control logic, plus an optional live Modbus endpoint (in-cluster plc-sim) and an optional device firmware image. Exercises PLC SAST, ICS probe, semantic control mapping.",
+      "artifacts": [
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/pump_station.st",
+          "plc_format": "structured_text"
+        },
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/pump_fbd.xml",
+          "plc_format": "plcopen_xml"
+        },
+        {
+          "kind": "live_url",
+          "source_ref_env": "DEMO_PLC_MODBUS_URL",
+          "source_ref": "modbus://plc-sim:502",
+          "optional": true
+        },
+        {
+          "kind": "firmware_image",
+          "upload_env": "DEMO_PLC_FIRMWARE_IMAGE",
+          "optional": true
+        }
+      ],
+      "expect": {
+        "min_findings": 16,
+        "sast_rule_ids": [
+          "plc-hardcoded-credential",
+          "plc-default-password",
+          "plc-safety-bypass",
+          "plc-array-unchecked-index",
+          "plc-insecure-comm",
+          "plc-insecure-protocol-port",
+          "plc-unstructured-jump",
+          "plc-division-by-zero"
+        ],
+        "cwes": [
+          "CWE-798",
+          "CWE-319",
+          "CWE-1384"
+        ],
+        "control_refs_any": true
+      }
+    },
+    {
+      "key": "plc-conveyor-line",
+      "name": "PLC conveyor + traffic light (PLCopen XML + ST)",
+      "target_type": "plc_sps",
+      "description": "Pure PLC SAST demo: a PLCopen-XML conveyor program and a realistic OpenPLC-style traffic-light program with three planted defects. Exercises the control-logic rules without any dynamic infra.",
+      "artifacts": [
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/conveyor.xml",
+          "plc_format": "plcopen_xml"
+        },
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/traffic_light.st",
+          "plc_format": "structured_text"
+        }
+      ],
+      "expect": {
+        "min_findings": 8,
+        "sast_rule_ids": [
+          "plc-hardcoded-credential",
+          "plc-default-password",
+          "plc-safety-bypass",
+          "plc-insecure-comm",
+          "plc-insecure-protocol-port"
+        ]
+      }
+    },
+    {
+      "key": "git-cra-vuln-demo",
+      "name": "Git SAST · cra-vuln-demo",
+      "target_type": "backend_service",
+      "description": "Plain git SAST target. Small deliberately-vulnerable Python service (hardcoded credential, weak cipher, SQL injection, cleartext transport) used to prove the CWE → CRA control mapping.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://git.breakpilot.com/sharang/cra-vuln-demo.git",
+          "branch": "main",
+          "pin": "21951249b9977d0c7feb555a9d5ce42c70ab5ae4"
+        }
+      ],
+      "expect": {
+        "min_findings": 3,
+        "cwes": [
+          "CWE-798",
+          "CWE-327",
+          "CWE-89"
+        ],
+        "control_refs": [
+          "cra-ai-8",
+          "cra-ai-13",
+          "cra-ai-20"
+        ]
+      }
+    },
+    {
+      "key": "web-juice-shop",
+      "name": "Web app · OWASP Juice Shop",
+      "target_type": "web_app",
+      "description": "WebApp target: git repo for SAST/SBOM/CVE plus a live URL for DAST + pentest. Run the instance locally with `docker run -d -p 3000:3000 bkimminich/juice-shop:v19.2.1` or point DEMO_WEB_URL at a deployed copy.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://github.com/juice-shop/juice-shop.git",
+          "branch": "master",
+          "pin": "f87c6f58c49b61c9de20e4d69a9bdb1fbd4f3bd3",
+          "pin_tag": "v19.2.1"
+        },
+        {
+          "kind": "live_url",
+          "source_ref_env": "DEMO_WEB_URL",
+          "source_ref": "http://localhost:3000"
+        }
+      ],
+      "expect": {
+        "min_findings": 10,
+        "min_sbom_components": 500,
+        "scans_offered": [
+          "sast",
+          "dast"
+        ],
+        "pentest_supported": true
+      }
+    },
+    {
+      "key": "firmware-zephyr-example",
+      "name": "Firmware RTOS · Zephyr example-application",
+      "target_type": "firmware_rtos",
+      "description": "Upstream Zephyr example application (Apache-2.0). Exercises the tramiton detect handoff (build system = zephyr) and the firmware source SBOM path.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://github.com/zephyrproject-rtos/example-application.git",
+          "branch": "main",
+          "pin": "38a6d9b276ed434454900130cacc87d058d3ac62"
+        }
+      ],
+      "expect": {
+        "detected_facts": {
+          "build_system": "zephyr"
+        },
+        "scans_offered": [
+          "sast"
+        ],
+        "pentest_supported": false
+      }
+    }
+  ]
+}