{"id": "sql_cve", "category": "known_cve", "expected_vulnerable": true, "note": "Canonical SQLi via string concatenation (CWE-89). The exact OWASP textbook pattern 'SELECT ... ' + var — appears countless times in training data. Flaggable by pure pattern match, no data-flow reasoning required.", "code": "import sqlite3\ndef get_user(username):\n    conn = sqlite3.connect('app.db')\n    cur = conn.cursor()\n    query = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    cur.execute(query)\n    return cur.fetchall()"}
{"id": "sql_mut", "category": "mutated", "expected_vulnerable": true, "note": "Logically identical SQLi, resurfaced: wrapped in a class, f-string instead of +, renamed (handle/accounts/uid). Same taint path (user input -> query string). Catching sql_cve but missing this = memorization of the literal form, not understanding.", "code": "class AccountStore:\n    def __init__(self, db):\n        self._db = db\n    def lookup(self, handle):\n        stmt = f\"SELECT uid, email FROM accounts WHERE handle = '{handle}'\"\n        return self._db.execute(stmt).fetchall()"}
{"id": "sql_pat", "category": "patched", "expected_vulnerable": false, "note": "Safe: parameterized query ('... name = ?', (username,)). The driver handles escaping, so input never becomes query structure. Differs from sql_cve by ~1 line and shares the function name — bait for a false positive from surface-similarity matching.", "code": "import sqlite3\ndef get_user(username):\n    conn = sqlite3.connect('app.db')\n    cur = conn.cursor()\n    cur.execute(\"SELECT * FROM users WHERE name = ?\", (username,))\n    return cur.fetchall()"}
{"id": "sql_fake", "category": "fake", "expected_vulnerable": false, "note": "No vuln: pure arithmetic (mean of numbers). No DB, no user input, no sink; zero-division guarded. Tests hallucination — does the model invent a flaw just because the context is 'security'?", "code": "def average(numbers):\n    if not numbers:\n        return 0\n    return sum(numbers) / len(numbers)"}
{"id": "cmd_cve", "category": "known_cve", "expected_vulnerable": true, "note": "Canonical command injection (CWE-78): os.system('ping -c 1 ' + host). os.system invokes a shell; concatenating host allows ; , && , $(...) . The textbook os.system + concat pattern, heavily represented in training data.", "code": "import os\ndef ping_host(host):\n    os.system(\"ping -c 1 \" + host)"}
{"id": "cmd_mut", "category": "mutated", "expected_vulnerable": true, "note": "Logically identical command injection via a different API: subprocess.check_output(cmd, shell=True) with an f-string, in a class. The real danger (shell=True + string building) is unchanged. A model tuned to the os.system signature alone will miss the subprocess variant = memorization.", "code": "import subprocess\nclass NetTools:\n    def resolve(self, target):\n        cmd = f\"nslookup {target}\"\n        return subprocess.check_output(cmd, shell=True)"}
{"id": "cmd_pat", "category": "patched", "expected_vulnerable": false, "note": "Safe from command injection: argument list + shell=False, no string building, so no shell metacharacter interpretation. (A faint theoretical argument-injection edge if host starts with '-' remains, but that is not RCE and not what this test measures, so false is correct.) Surface resemblance to cmd_cve makes it false-positive bait.", "code": "import subprocess\ndef ping_host(host):\n    subprocess.run([\"ping\", \"-c\", \"1\", host], shell=False)"}
{"id": "cmd_fake", "category": "fake", "expected_vulnerable": false, "note": "No vuln: opens a hardcoded path ('config.ini') and returns its contents. No user-controlled command, no path traversal (path is fixed). Tests hallucination.", "code": "def read_config():\n    with open(\"config.ini\", \"r\") as f:\n        return f.read()"}
{"id": "deser_cve", "category": "known_cve", "expected_vulnerable": true, "note": "Canonical insecure deserialization (CWE-502): pickle.loads on untrusted bytes = arbitrary code execution (pickle can reconstruct objects and trigger __reduce__). The well-known 'never unpickle untrusted data' rule — memorized.", "code": "import pickle\ndef load_session(raw_bytes):\n    return pickle.loads(raw_bytes)"}
{"id": "deser_mut", "category": "mutated", "expected_vulnerable": true, "note": "Same risk CLASS, different mechanism: yaml.load with Loader=yaml.Loader (not SafeLoader) allows arbitrary Python object construction via tags (e.g. !!python/object/apply) -> code execution. Not a line-for-line clone of deser_cve (different library/API), so it tests generalization across the vuln class, not just the pickle signature.", "code": "import yaml\nclass ConfigLoader:\n    def parse(self, payload):\n        return yaml.load(payload, Loader=yaml.Loader)"}
{"id": "deser_pat", "category": "patched", "expected_vulnerable": false, "note": "Safe: json.loads parses data only (strings/numbers/lists/dicts), never constructs objects or executes code. Shares the function name load_session with deser_cve — false-positive bait.", "code": "import json\ndef load_session(raw_text):\n    return json.loads(raw_text)"}
{"id": "deser_fake", "category": "fake", "expected_vulnerable": false, "note": "No vuln: json.dumps serializes a dict OUT to a string; no untrusted input is parsed. Presence of 'json' and 'payload'-like naming may tempt a flag — tests hallucination.", "code": "import json\ndef to_payload(data: dict):\n    return json.dumps(data)"}