[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$apiParty6fBuHLCPZ1LTYs42XHdVbjpSDOYYPYzyxeAGwSN5Tp8":3,"$apiPartyigy6O8xu42mrbsm1tiOjsQ9xMMYG2l1oQjNJCEtB3qY":563,"$apiPartyigy6O8xu42mrbsm1tiOjsQ9xMMYG2l1oQjNJCEtB3qY$H93EERW16b":563},{"product_data":4,"scene_data":21,"task_data":407,"modality_data":441,"domain_data":478},[5,9,12,15,18],{"name":6,"value":7,"add_value":8,"describe":8},"Rivo","1","",{"name":10,"value":11,"add_value":8,"describe":8},"Cubo","2",{"name":13,"value":14,"add_value":8,"describe":8},"Moye","3",{"name":16,"value":17,"add_value":8,"describe":8},"Juro","4",{"name":19,"value":20,"add_value":8,"describe":8},"Ordo","5",[22,73,135,197,232,267,302,337,372],{"name":23,"value":7,"add_value":24,"describe":25,"children":26},"Home & Indoor","sofa","AI enhances everyday home life. Our datasets cover real indoor scenes to support smart devices, robotics, and home intelligence.",[27,29,31,33,35,37,40,43,46,49,52,55,58,61,64,67,70],{"name":28,"value":7},"Living Room",{"name":30,"value":11},"Bedroom",{"name":32,"value":14},"Kitchen",{"name":34,"value":17},"Dining Area",{"name":36,"value":20},"Bathroom",{"name":38,"value":39},"Entrance \u002F Foyer","6",{"name":41,"value":42},"Corridor \u002F Hallway","7",{"name":44,"value":45},"Staircase","8",{"name":47,"value":48},"Home Office","9",{"name":50,"value":51},"Hobby \u002F Game Room","10",{"name":53,"value":54},"Worship Space","11",{"name":56,"value":57},"Garage","12",{"name":59,"value":60},"Utility \u002F Laundry Room","13",{"name":62,"value":63},"Pantry","14",{"name":65,"value":66},"Basement","15",{"name":68,"value":69},"Garden","16",{"name":71,"value":72},"Balcony","17",{"name":74,"value":11,"add_value":75,"describe":76,"children":77},"Office & Educational","workshop","AI is reshaping work and learning. Our datasets capture offices and classrooms to power automation and next-generation productivity tools.",[78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132],{"name":79,"value":80},"Open Office","18",{"name":82,"value":83},"Private Office","19",{"name":85,"value":86},"Co-working Space","20",{"name":88,"value":89},"Reception \u002F Lobby","21",{"name":91,"value":92},"Conference Room","22",{"name":94,"value":95},"Huddle Room \u002F Booth","23",{"name":97,"value":98},"Lecture Hall \u002F Auditorium","24",{"name":100,"value":101},"Classroom","25",{"name":103,"value":104},"Science Laboratory","26",{"name":106,"value":107},"Library","27",{"name":109,"value":110},"Design Studio","28",{"name":112,"value":113},"Pantry \u002F Breakroom","29",{"name":115,"value":116},"Cafeteria \u002F Canteen","30",{"name":118,"value":119},"Restroom (Commercial)","31",{"name":121,"value":122},"Gymnasium \u002F Sports Hall","32",{"name":124,"value":125},"Server Room","33",{"name":127,"value":128},"Mailroom \u002F Logistics","34",{"name":130,"value":131},"Janitorial Closet","35",{"name":133,"value":134},"Corridor \u002F Elevators","36",{"name":136,"value":14,"add_value":137,"describe":138,"children":139},"Healthcare & Medical","love-and-help","AI is advancing modern healthcare. Our datasets include clinics and hospitals to enable clinical insights and medical automation.",[140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194],{"name":141,"value":142},"Operating Theatre \u002F OR","37",{"name":144,"value":145},"Consultation Room","38",{"name":147,"value":148},"Treatment Room","39",{"name":150,"value":151},"Dental Clinic","40",{"name":153,"value":154},"Inpatient Ward","41",{"name":156,"value":157},"Nurse Station","42",{"name":159,"value":160},"ICU","43",{"name":162,"value":163},"NICU (Neonatal ICU)","44",{"name":165,"value":166},"Emergency Room (ER)","45",{"name":168,"value":169},"Hospital Corridor","46",{"name":171,"value":172},"Waiting Area","47",{"name":174,"value":175},"CT\u002FMRI","48",{"name":177,"value":178},"Medical Laboratory","49",{"name":180,"value":181},"Phlebotomy Room","50",{"name":183,"value":184},"Rehabilitation Gym","51",{"name":186,"value":187},"Assisted Living Room","52",{"name":189,"value":190},"Pharmacy","53",{"name":192,"value":193},"Sterile Processing Dept","54",{"name":195,"value":196},"Medical Storage","55",{"name":198,"value":17,"add_value":199,"describe":200,"children":201},"Business & Public Service","business","AI is elevating commercial and public services. Our datasets span retail, dining, and service centers to improve intelligent operations.",[202,205,208,211,214,217,220,223,226,229],{"name":203,"value":204},"Shopping Mall Atrium","86",{"name":206,"value":207},"Supermarket Shelf","87",{"name":209,"value":210},"Self-Checkout Counter","88",{"name":212,"value":213},"Restaurant Dining Hall","89",{"name":215,"value":216},"Commercial Kitchen","90",{"name":218,"value":219},"Hotel Lobby","91",{"name":221,"value":222},"Subway Platform","92",{"name":224,"value":225},"Security Checkpoint","93",{"name":227,"value":228},"Underground Parking","94",{"name":230,"value":231},"Bank Teller Zone","95",{"name":233,"value":20,"add_value":234,"describe":235,"children":236},"Industrial & Manufacturing","robot-arm","AI is modernizing industry. Our datasets capture factories and logistics spaces to support robotics and intelligent manufacturing.",[237,240,243,246,249,252,255,258,261,264],{"name":238,"value":239},"Final Assembly Line","96",{"name":241,"value":242},"Quality Control Station","97",{"name":244,"value":245},"Robotic Welding Cell","98",{"name":247,"value":248},"CNC Machining Center","99",{"name":250,"value":251},"Cleanroom","100",{"name":253,"value":254},"Automated Warehouse","101",{"name":256,"value":257},"Loading Dock","102",{"name":259,"value":260},"Sorting Center","103",{"name":262,"value":263},"Chemical Plant","104",{"name":265,"value":266},"Power Substation","105",{"name":268,"value":39,"add_value":269,"describe":270,"children":271},"Transportation & Driving","car","AI is revolutionizing mobility. Our datasets capture road networks, vehicle dynamics and traffic scenarios to support autonomous driving and intelligent transportation systems.",[272,275,278,281,284,287,290,293,296,299],{"name":273,"value":274},"Urban Intersection","56",{"name":276,"value":277},"Highway \u002F Expressway","57",{"name":279,"value":280},"Tunnel","58",{"name":282,"value":283},"Roundabout","59",{"name":285,"value":286},"School \u002F Hospital Zone","60",{"name":288,"value":289},"Toll Station","61",{"name":291,"value":292},"Construction Zone","62",{"name":294,"value":295},"Parking Garage","63",{"name":297,"value":298},"Driver Cabin","64",{"name":300,"value":301},"Adverse Weather","65",{"name":303,"value":42,"add_value":304,"describe":305,"children":306},"Outdoor & Construction","tent-tree","AI is optimizing outdoor operations. Our datasets capture construction sites, open-air work zones and outdoor infrastructure to support smart construction and autonomous outdoor machinery.",[307,310,313,316,319,322,325,328,331,334],{"name":308,"value":309},"Excavation Site","66",{"name":311,"value":312},"Scaffolding Area","67",{"name":314,"value":315},"Material Storage Yard","68",{"name":317,"value":318},"Site Entrance","69",{"name":320,"value":321},"Roadwork Zone","70",{"name":323,"value":324},"Bridge Infrastructure","71",{"name":326,"value":327},"Transmission Line","72",{"name":329,"value":330},"Open-pit Mine","73",{"name":332,"value":333},"Tunneling Site","74",{"name":335,"value":336},"Post-Disaster Rubble","75",{"name":338,"value":45,"add_value":339,"describe":340,"children":341},"Nature, Aerial & Aquatic","global-loop","AI is exploring the natural world. Our datasets capture terrestrial landscapes, aerial vistas and aquatic ecosystems to support environmental monitoring and autonomous exploration systems.",[342,345,348,351,354,357,360,363,366,369],{"name":343,"value":344},"Deep Forest","76",{"name":346,"value":347},"Farmland \u002F Crops","77",{"name":349,"value":350},"River \u002F Lake","78",{"name":352,"value":353},"Open Ocean","79",{"name":355,"value":356},"Underwater Coral Reef","80",{"name":358,"value":359},"Fish Farm","81",{"name":361,"value":362},"Mountain Terrain","82",{"name":364,"value":365},"Urban Low Altitude","83",{"name":367,"value":368},"Fire Scene","84",{"name":370,"value":371},"Desert \u002F Gobi","85",{"name":373,"value":48,"add_value":374,"describe":375,"children":376},"Virtul & Digital","siri","AI is reshaping the virtual realm. Our datasets capture digital twins, virtual environments and simulated spaces to support metaverse development and intelligent digital interaction.",[377,380,383,386,389,392,395,398,401,404],{"name":378,"value":379},"VR Social Space","106",{"name":381,"value":382},"Synthetic Driving Sim","107",{"name":384,"value":385},"Digital Twin City","108",{"name":387,"value":388},"FPS \u002F MOBA Game","109",{"name":390,"value":391},"Robotics Gym","110",{"name":393,"value":394},"AR Navigation","111",{"name":396,"value":397},"Virtual Showroom","112",{"name":399,"value":400},"Code \u002F IDE Interface","113",{"name":402,"value":403},"App GUI Screen","114",{"name":405,"value":406},"Synthetic Face\u002FID","115",[408,411,414,417,420,423,426,429,432,435,438],{"name":409,"value":7,"add_value":410,"describe":8},"Classification","rubric",{"name":412,"value":11,"add_value":413,"describe":8},"Detection","radar",{"name":415,"value":14,"add_value":416,"describe":8},"Segmentation","segmentation",{"name":418,"value":17,"add_value":419,"describe":8},"Tacking","crosshairs",{"name":421,"value":20,"add_value":422,"describe":8},"Estimation","streamline",{"name":424,"value":39,"add_value":425,"describe":8},"QA","qa",{"name":427,"value":42,"add_value":428,"describe":8},"Recognition","finger-scan",{"name":430,"value":45,"add_value":431,"describe":8},"Control","control",{"name":433,"value":48,"add_value":434,"describe":8},"Extraction","extraction",{"name":436,"value":51,"add_value":437,"describe":8},"Retrieval","retrieval",{"name":439,"value":54,"add_value":440,"describe":8},"Forecast","forecast",[442,445,448,451,454,457,460,463,466,469,472,475],{"name":443,"value":7,"add_value":444,"describe":8},"Audio","audio",{"name":446,"value":11,"add_value":447,"describe":8},"Image","image",{"name":449,"value":14,"add_value":450,"describe":8},"Text","text",{"name":452,"value":17,"add_value":453,"describe":8},"Video","video",{"name":455,"value":20,"add_value":456,"describe":8},"Multi","multi",{"name":458,"value":39,"add_value":459,"describe":8},"Document","document",{"name":461,"value":42,"add_value":462,"describe":8},"Time-Series","time-series",{"name":464,"value":45,"add_value":465,"describe":8},"3D cloud","cloud",{"name":467,"value":48,"add_value":468,"describe":8},"Code","code",{"name":470,"value":51,"add_value":471,"describe":8},"Event","event",{"name":473,"value":54,"add_value":474,"describe":8},"Motion","motion",{"name":476,"value":57,"add_value":477,"describe":8},"Interaction","interaction",[479,482,487,491,494,499,504,509,514,519,524,528,532,536,540,544,548,552,556,559],{"id":480,"value":480,"name":233,"intro":481,"add_value":234,"describe":481},2,"智能质检：利用图像识别、多模态模型对产品外观或声音、振动等数据进行分析，自动识别缺陷，提高质量控制效率。\n工业知识问答与文档理解：通过大模型理解和总结技术文档、操作手册，实现快速问答、知识检索和培训支持。\n安全监测与风险预警：实时分析视频、传感器和操作日志，识别潜在危险行为或异常状态，提前预警，保障人员和设备安全。",{"id":483,"value":483,"name":484,"intro":485,"add_value":486,"describe":485},3,"Finance & Insurance","风险评估与预测：分析大量客户数据，评估信用风险、市场风险等，预测违约概率、股价走势等，辅助金融机构决策。\n智能投顾：根据客户风险偏好、资产状况等，提供个性化投资组合建议，实时调整投资策略。\n反欺诈检测：通过分析交易数据、用户行为，识别异常交易和欺诈行为，保障金融安全。","funds",{"id":488,"value":488,"name":489,"intro":490,"add_value":269,"describe":490},1,"Transport & Automotive","智能座舱：打造多模态交互的 AI 座舱，通过语音、手势、面部识别等实现人机交互，如语音控制导航、音乐播放。\n驾驶员状态监测：识别疲劳、分心、抽烟、打电话等行为，通过大模型判断危险等级，触发相应提醒或干预机制。\n智能驾驶：AI 用于环境感知、路径规划与决策控制，使车辆能识别道路、行人、障碍物等，实现自适应巡航、自动泊车、车道保持等功能，提升驾驶安全性与便利性。",{"id":492,"value":492,"name":136,"intro":493,"add_value":137,"describe":493},4,"医学影像诊断：分析 CT、MRI 等影像，辅助医生检测疾病、识别病灶，如 AI 系统可快速发现肺部结节。\n医患对话助手：通过自然语言处理理解患者问题，提供初步健康建议或就诊指导，缓解医生接诊压力。\n智能健康管理：根据用户健康数据，提供个性化健康建议、疾病预警，如智能手环结合 AI 分析用户运动、睡眠、心率等数据。",{"id":495,"value":495,"name":496,"intro":497,"add_value":498,"describe":497},6,"Smart Devices","多模态交互：支持语音、手势、眼神等多种交互方式，如 AI 眼镜可通过语音指令实现翻译、搜索功能。\n智能感知与处理：使设备能感知环境、理解用户需求，如智能音箱根据环境噪音自动调节音量。\n个性化服务：根据用户使用习惯和偏好，提供个性化功能与服务，如智能手表为用户定制运动健身计划。","microscope",{"id":500,"value":500,"name":501,"intro":502,"add_value":503,"describe":502},8,"Law & Government","智能法律问答：面向公众或企业用户，提供合规、劳动法、婚姻继承、知识产权等常见法律问题的智能解答。\n合同审查与风险识别：利用大模型分析合同内容，识别潜在风险条款、漏洞或不合理约定，提升合同审核质量。\n法律知识图谱构建：自动梳理法规、案例、条文之间的引用关系，构建语义化知识图谱，支持智能分析和推理。","hammer",{"id":505,"value":505,"name":506,"intro":507,"add_value":508,"describe":507},7,"Education & Training","个性化学习：根据学生学习进度、能力和知识掌握情况，推送个性化学习内容与练习，如智能辅导系统为学生制定专属学习计划。\n智能教学辅助：AI 助教协助教师进行作业批改、答疑解惑，还可分析教学数据，为教师提供教学反馈，优化教学方法。\n虚拟学习环境：利用 AI 创建虚拟实验、历史场景等，让学生沉浸式学习，如在虚拟化学实验室中进行实验操作。","degree-hat",{"id":510,"value":510,"name":511,"intro":512,"add_value":513,"describe":512},5,"Agriculture & Food","作物病虫害识别与防治：通过图像识别分析农作物叶片、果实等症状，识别病虫害类型，给出防治建议，减少产量损失。\n农产品质量检测：利用图像和传感器数据，识别果蔬等农产品的成熟度、外观缺陷，进行自动分级，提高市场竞争力。\n农情监测与预测：利用卫星遥感、气象和传感器数据，结合大模型预测作物长势、干旱、洪涝等农情变化。","ph-farm",{"id":515,"value":515,"name":516,"intro":517,"add_value":518,"describe":517},9,"Retail & E-commerce","智能客服：通过自然语言对话理解用户需求，提供产品推荐、订单查询、退换货支持等服务，提升客户满意度。\n个性化营销推荐：基于用户浏览、购买、偏好等行为数据，生成个性化推荐内容与优惠策略，提高转化率和客单价。\n商品内容生成：自动撰写商品标题、卖点描述、使用说明等内容，适用于海量SKU的内容生产与多语言发布。","buy",{"id":520,"value":520,"name":521,"intro":522,"add_value":523,"describe":8},10,"Security & Protection",null,"safe-shield-line",{"id":525,"value":525,"name":526,"intro":522,"add_value":527,"describe":8},11,"Environment & Climate","weather",{"id":529,"value":529,"name":530,"intro":522,"add_value":531,"describe":8},12,"Energy & Resource","energy-leaf",{"id":533,"value":533,"name":534,"intro":522,"add_value":535,"describe":8},13,"Express & Logistics","speed-outline",{"id":537,"value":537,"name":538,"intro":522,"add_value":539,"describe":8},15,"Sports","baseball-outline",{"id":541,"value":541,"name":542,"intro":522,"add_value":543,"describe":8},16,"General Data","daily-booth",{"id":545,"value":545,"name":546,"intro":522,"add_value":547,"describe":8},17,"Content & Media","media",{"id":549,"value":549,"name":550,"intro":522,"add_value":551,"describe":8},18,"Construction","construction",{"id":553,"value":553,"name":554,"intro":522,"add_value":555,"describe":8},19,"IT & Telecom","tech",{"id":557,"value":557,"name":558,"intro":522,"add_value":498,"describe":8},20,"Science & Research",{"id":560,"value":560,"name":561,"intro":522,"add_value":562,"describe":8},21,"Language & Culture","lang",{"id":564,"unique_code":565,"title":566,"icon":8,"intro":567,"cate":483,"detail":568,"create_time":569,"update_time":570,"price":571,"view_count":572,"download_count":573,"unit":573,"amount":574,"is_create_order":573,"enterprise_id":488,"seo_keywords":575,"seo_description":576,"data_format":577,"file_size":578,"apply_scene":579,"training_task":580,"version":581,"dataset_type_id":492,"dataset_scene_id":520,"sample_file":582,"banner":8,"unit_name":8,"cate_name":449,"icon_url":8,"banner_url":8,"sample_file_url":8,"data_dict":583,"qa_list":626,"sample_metadatas":643,"text_sample_content":683,"enterprise_name":684,"enterprise_logo":685,"data_distribution":686},1202,"b18e04739ef71b208e0e576030f9f0ac","File Encryption and Destructive Behavior Code Understanding Dataset","Analyze code behavior around file operations and key management to identify ransomware-like risks and generate practical mitigation guidance.","\u003Cp>This dataset contains source code samples involving file traversal, encryption, renaming, deletion, overwriting, and key management, together with behavioral explanations and risk analyses. It helps models distinguish legitimate business encryption logic from implementations that could cause ransomware-like impact, including risk boundary analysis, key security review, and mitigation recommendations. It is designed for code security assessment, model training, and the improvement of security analysis workflows.\u003C\u002Fp>","2026-10-14 12:43:48","2026-10-19 17:19:35","0.00",28,0,5000,"file encryption code,ransomware risk,code behavior analysis,file operation auditing,key management security,destructive code detection,code security dataset,risk mitigation guidance","Source code understanding data for file encryption and destructive behaviors, supporting ransomware risk detection, key management review, and security mitig","JSON","0.3GB","ransomware threat detection, file encryption security analysis, malicious code behavior assessment","code behavior analysis, ransomware risk detection, security mitigation recommendation","V1.0","rivo\u002Fsample-packages\u002F77eefdee-babb-43f4-ba32-7cb10a165925\u002F20261014.zip",[584,589,595,600,605,611,616,621],{"id":573,"name":585,"field":586,"intro":587,"type":588},"File Name","file_name","File name","string",{"id":590,"name":591,"field":592,"intro":593,"type":594},8713,"Source Code Record","source_record","The source code under analysis and its basic context, serving as the original input for the record.","object",{"id":596,"name":597,"field":598,"intro":599,"type":594},8714,"Risk Assessment","risk_assessment","An overall assessment of whether the code could cause ransomware-like impact, with supporting rationale.",{"id":601,"name":602,"field":603,"intro":604,"type":594},8715,"Risk Boundary Analysis","boundary_analysis","Conditions under which the code represents legitimate functionality and conditions under which it could become a dangerous implementation.",{"id":606,"name":607,"field":608,"intro":609,"type":610},8716,"File Operation Analysis","operation_analysis","A step-by-step account of file traversal, encryption, renaming, deletion, overwriting, and other operations in the code.","array",{"id":612,"name":613,"field":614,"intro":615,"type":588},8717,"Code Behavior Summary","code_behavior_summary","An overview of the code's overall function, main execution flow, and potential impact.",{"id":617,"name":618,"field":619,"intro":620,"type":594},8718,"Key Management Analysis","key_management_analysis","An analysis of key generation, origin, storage, use, and recoverability, including related security risks.",{"id":622,"name":623,"field":624,"intro":625,"type":610},8719,"Mitigation Recommendations","mitigation_recommendations","Recommendations addressing code risks, key management, access control, backup and recovery, and monitoring and auditing.",[627,631,635,639],{"id":628,"question":629,"answer":630},6259,"What code behaviors does the dataset cover?","It covers file traversal, encryption, renaming, deletion, and overwriting, as well as key generation, storage, use, and recovery logic. Records also include behavior summaries and risk analyses.",{"id":632,"question":633,"answer":634},6260,"How does the dataset distinguish legitimate encryption from dangerous implementations?","It examines execution flows, the scope of file impact, key management practices, and recovery capabilities to assess potential ransomware-like impact. The analysis also explains the conditions that separate legitimate functionality from hazardous behavior.",{"id":636,"question":637,"answer":638},6261,"What are the dataset's intended use cases?","Use cases include code security auditing, ransomware risk assessment, security model training, and insurance risk review. Supported tasks include behavior explanation, risk assessment, and mitigation recommendation generation.",{"id":640,"question":641,"answer":642},6262,"How can the dataset be obtained, and what are its licensing terms?","Licensing terms, sample delivery format, and access options should be confirmed on the provider's product page or in the applicable license agreement. Verify the permitted use of code samples before analysis, and work in an isolated, controlled environment.",[644,659,671],{"id":645,"relate_table":646,"relate_id":647,"file_size":573,"file_name":648,"path":8,"duration":573,"cate":483,"file_format":649,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":650,"cate_name":651,"source_record":652,"risk_assessment":653,"boundary_analysis":654,"operation_analysis":655,"code_behavior_summary":656,"key_management_analysis":657,"mitigation_recommendations":658},15006,"union_cubo",1442927652,"样例_3.json","json","{\"source_record\": \"{\\\"source_code\\\": \\\"from pathlib import Path\\\\nimport base64\\\\nimport json\\\\nimport os\\\\n\\\\nimport keyring\\\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\\\n\\\\ndef encrypt_staged_export(staged_file: str, destination_dir: str) -> dict:\\\\n    source = Path(staged_file).resolve()\\\\n    destination_root = Path(destination_dir).resolve()\\\\n    if source.parent.name != \\\\\\\"staging\\\\\\\":\\\\n        raise ValueError(\\\\\\\"only staging copies may be consumed\\\\\\\")\\\\n    if source.suffix.lower() not in {\\\\\\\".csv\\\\\\\", \\\\\\\".json\\\\\\\"}:\\\\n        raise ValueError(\\\\\\\"unsupported export type\\\\\\\")\\\\n\\\\n    encoded_key = keyring.get_password(\\\\\\\"report-export\\\\\\\", os.environ[\\\\\\\"SERVICE_ACCOUNT\\\\\\\"])\\\\n    if not encoded_key:\\\\n        raise RuntimeError(\\\\\\\"encryption key is unavailable\\\\\\\")\\\\n    key = base64.b64decode(encoded_key)\\\\n    nonce = os.urandom(12)\\\\n    ciphertext = AESGCM(key).encrypt(nonce, source.read_bytes(), source.name.encode())\\\\n\\\\n    destination_root.mkdir(parents=True, exist_ok=True)\\\\n    output = destination_root \u002F (source.stem + \\\\\\\".bundle\\\\\\\")\\\\n    temporary = output.with_suffix(\\\\\\\".tmp\\\\\\\")\\\\n    temporary.write_bytes(nonce + ciphertext)\\\\n    temporary.replace(output)\\\\n\\\\n    metadata = {\\\\\\\"source_name\\\\\\\": source.name, \\\\\\\"encrypted_name\\\\\\\": output.name, \\\\\\\"algorithm\\\\\\\": \\\\\\\"AES-256-GCM\\\\\\\"}\\\\n    (destination_root \u002F (source.stem + \\\\\\\".json\\\\\\\")).write_text(json.dumps(metadata), encoding=\\\\\\\"utf-8\\\\\\\")\\\\n    source.unlink()\\\\n    return metadata\\\", \\\"programming_language\\\": \\\"Python\\\", \\\"sample_context\\\": \\\"Report export service sample. The source parameter must be a staging temporary copy generated by the service. The staging temporary copy is deleted only after the encrypted bundle is successfully created and atomically committed; the user's original files are located in other directories and are not processed by this function. Keys are read by the operating system keyring according to the service account.\\\"}\", \"risk_assessment\": \"{\\\"risk_level\\\": \\\"Needs Attention\\\", \\\"confidence_score\\\": 0.93, \\\"destructive_indicators\\\": [\\\"Deletes the plaintext temporary copy in staging after success\\\", \\\"When a .bundle with the same name exists, temporary.replace may replace existing output\\\", \\\"There is no independent recovery confirmation record between deletion and the encryption success determination\\\"], \\\"legitimate_use_indicators\\\": [\\\"Processes only a single temporary file rather than a recursive batch directory\\\", \\\"Requires input to come from the staging directory and limits file suffixes\\\", \\\"Reads the key from the operating system keyring\\\", \\\"Uses a temporary file and atomic replacement to commit ciphertext\\\", \\\"The user's original files are outside the function's processing scope\\\", \\\"Deletion occurs after the encrypted output is successfully written\\\"], \\\"rationale\\\": \\\"This implementation mainly matches a controlled export encryption scenario: single scope, restricted input, relatively safe key source, and atomic writes. Areas of concern are deletion of the temporary plaintext after success, replacement of same-named output, and the lack of versioned keys and recovery confirmation; these issues may lead to accidental deletion or overwrite, but from the current code they have not yet reached large-scale destruction or ransomware-like impact.\\\"}\", \"boundary_analysis\": \"{\\\"legitimate_boundary\\\": \\\"Allow only staging temporary copies that are generated by the service and can be regenerated, ensure the encrypted bundle has been atomically committed and integrity-checked, and then delete the temporary plaintext; user original files should be in different directories protected by independent permissions.\\\", \\\"dangerous_boundary\\\": \\\"If the caller can disguise an arbitrary user path as staging, point destination_dir at the original data directory, or modify the function to process recursively and delete source files without success confirmation, then deletion and overwrite behaviors may cause irreversible data loss.\\\", \\\"uncertainty_points\\\": [\\\"The directory name check on source.parent.name is insufficient to prove that the path truly belongs to a controlled temporary area\\\", \\\"The backup, auditing, and service account isolation of the keyring backend are not reflected in the code\\\", \\\"Metadata writing does not use a temporary file and atomic commit, so failures may leave ciphertext and metadata inconsistent\\\", \\\"The conflict handling and overwrite authorization policy for same-named bundles are not specified\\\"]}\", \"operation_analysis\": \"[{\\\"operation_type\\\": \\\"Traversal\\\", \\\"target_scope\\\": \\\"A single staged_file passed by the caller, not a recursive directory; only files whose parent directory is named staging and whose suffix is .csv or .json are accepted.\\\", \\\"action_mechanism\\\": \\\"Use resolve() to normalize the path, perform pre-validation through source.parent.name and the suffix allowlist, and do not include recursive directory traversal.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The function receives only one file path and rejects non-staging directories and unsupported file types before performing encryption.\\\"}, {\\\"operation_type\\\": \\\"Key reading\\\", \\\"target_scope\\\": \\\"The report-export entry corresponding to the service account in the operating system keyring.\\\", \\\"action_mechanism\\\": \\\"After reading the SERVICE_ACCOUNT environment variable, call keyring.get_password to obtain the Base64-encoded key; if missing, raise an exception and stop.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The key is not read from source files or code constants, and when the key is unavailable, it will not continue to write or delete files.\\\"}, {\\\"operation_type\\\": \\\"Encryption\\\", \\\"target_scope\\\": \\\"A single CSV or JSON temporary copy in the staging directory.\\\", \\\"action_mechanism\\\": \\\"Generate a 12-byte random nonce, use AESGCM to encrypt the file contents, and use the file name as additional authenticated data.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"Ciphertext is first written to a temporary output file under destination_dir, and after success it is atomically replaced with the .bundle target file.\\\"}, {\\\"operation_type\\\": \\\"Overwrite\\\", \\\"target_scope\\\": \\\"The same-named .tmp temporary output path and the final .bundle path in destination_dir.\\\", \\\"action_mechanism\\\": \\\"First call temporary.write_bytes to write the temporary file, then use temporary.replace(output) to complete the atomic commit.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"Overwrite applies only to the newly generated output temporary file and target bundle, not to the user's original files; however, an existing bundle with the same name may be replaced, requiring a conflict policy.\\\"}, {\\\"operation_type\\\": \\\"Deletion\\\", \\\"target_scope\\\": \\\"The staging temporary plaintext copy after the encrypted bundle has been successfully generated.\\\", \\\"action_mechanism\\\": \\\"Call source.unlink() after ciphertext writing, atomic replacement, and metadata writing.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"source.unlink() deletes the plaintext copy in staging; by context this copy is a regenerable temporary file, but deletion failures or recovery dependencies still need monitoring.\\\"}, {\\\"operation_type\\\": \\\"Key storage\\\", \\\"target_scope\\\": \\\"The report-export service entry in the operating system keyring.\\\", \\\"action_mechanism\\\": \\\"The code reads the key through the keyring interface and is not responsible for generating or persisting the key; the keyring handles underlying storage and access control.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The source code does not write the key to the export directory, metadata, or logs; metadata records only the algorithm and file name.\\\"}]\", \"code_behavior_summary\": \"The function accepts only CSV or JSON temporary export copies in a directory named staging, reads the key corresponding to the service account from the operating system keyring, encrypts using AES-GCM, first writes to a temporary file, then atomically replaces it with a .bundle file, and saves metadata. After the encrypted commit succeeds, it deletes the temporary plaintext copy in staging. This deletion behavior has a clear temporary file boundary, but the code still requires external permissions and recovery mechanisms for assurance.\", \"key_management_analysis\": \"{\\\"key_sources\\\": [\\\"The report-export service entry in the operating system keyring\\\", \\\"The service account identifier provided by the SERVICE_ACCOUNT environment variable\\\"], \\\"algorithm_usage\\\": \\\"AES-256-GCM is used to encrypt a single temporary export file. Each call generates a random 12-byte nonce, and the source file name is used as additional authenticated data; ciphertext is written to a .bundle file.\\\", \\\"key_storage_risk\\\": \\\"The key is not hard-coded and is not written to the export directory, but risk depends on the permission isolation of the operating system keyring, protection of the service account environment variable, and the keyring backup strategy. Base64 is only encoding and provides no additional confidentiality.\\\", \\\"key_recovery_capability\\\": \\\"If the keyring has a controlled backup and the service account can still be authorized to read it, operators can use the metadata to locate the bundle and decrypt it; the code does not implement key rotation, old key version identifiers, or decryption tools, so the recovery process needs to be supplemented.\\\"}\", \"mitigation_recommendations\": \"[\\\"Use a preconfigured staging root directory for realpath validation instead of only checking the parent directory name, and reject symbolic links and cross-tenant paths.\\\", \\\"Before deleting the temporary plaintext, write a success status, verify the output hash, and ensure metadata is atomically committed; on failure, retain the temporary file for auditing and retry.\\\", \\\"Add a collision-resistant task identifier to bundle names or require an explicit versioning policy before overwrite to avoid replacing existing archives.\\\", \\\"Use versioned key identifiers in the keyring, and establish rotation, backup, revocation, and decryption recovery drills.\\\", \\\"Restrict the service account to only the paths needed for staging and destination, and prohibit access to user original directories and shared backups.\\\", \\\"Monitor deletion counts, output replacement events, and abnormal failure rates, and automatically pause the service when unexpected paths or batch calls are detected.\\\"]\"}","文本","{\"source_code\": \"from pathlib import Path\\nimport base64\\nimport json\\nimport os\\n\\nimport keyring\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\n\\ndef encrypt_staged_export(staged_file: str, destination_dir: str) -> dict:\\n    source = Path(staged_file).resolve()\\n    destination_root = Path(destination_dir).resolve()\\n    if source.parent.name != \\\"staging\\\":\\n        raise ValueError(\\\"only staging copies may be consumed\\\")\\n    if source.suffix.lower() not in {\\\".csv\\\", \\\".json\\\"}:\\n        raise ValueError(\\\"unsupported export type\\\")\\n\\n    encoded_key = keyring.get_password(\\\"report-export\\\", os.environ[\\\"SERVICE_ACCOUNT\\\"])\\n    if not encoded_key:\\n        raise RuntimeError(\\\"encryption key is unavailable\\\")\\n    key = base64.b64decode(encoded_key)\\n    nonce = os.urandom(12)\\n    ciphertext = AESGCM(key).encrypt(nonce, source.read_bytes(), source.name.encode())\\n\\n    destination_root.mkdir(parents=True, exist_ok=True)\\n    output = destination_root \u002F (source.stem + \\\".bundle\\\")\\n    temporary = output.with_suffix(\\\".tmp\\\")\\n    temporary.write_bytes(nonce + ciphertext)\\n    temporary.replace(output)\\n\\n    metadata = {\\\"source_name\\\": source.name, \\\"encrypted_name\\\": output.name, \\\"algorithm\\\": \\\"AES-256-GCM\\\"}\\n    (destination_root \u002F (source.stem + \\\".json\\\")).write_text(json.dumps(metadata), encoding=\\\"utf-8\\\")\\n    source.unlink()\\n    return metadata\", \"programming_language\": \"Python\", \"sample_context\": \"Report export service sample. The source parameter must be a staging temporary copy generated by the service. The staging temporary copy is deleted only after the encrypted bundle is successfully created and atomically committed; the user's original files are located in other directories and are not processed by this function. Keys are read by the operating system keyring according to the service account.\"}","{\"risk_level\": \"Needs Attention\", \"confidence_score\": 0.93, \"destructive_indicators\": [\"Deletes the plaintext temporary copy in staging after success\", \"When a .bundle with the same name exists, temporary.replace may replace existing output\", \"There is no independent recovery confirmation record between deletion and the encryption success determination\"], \"legitimate_use_indicators\": [\"Processes only a single temporary file rather than a recursive batch directory\", \"Requires input to come from the staging directory and limits file suffixes\", \"Reads the key from the operating system keyring\", \"Uses a temporary file and atomic replacement to commit ciphertext\", \"The user's original files are outside the function's processing scope\", \"Deletion occurs after the encrypted output is successfully written\"], \"rationale\": \"This implementation mainly matches a controlled export encryption scenario: single scope, restricted input, relatively safe key source, and atomic writes. Areas of concern are deletion of the temporary plaintext after success, replacement of same-named output, and the lack of versioned keys and recovery confirmation; these issues may lead to accidental deletion or overwrite, but from the current code they have not yet reached large-scale destruction or ransomware-like impact.\"}","{\"legitimate_boundary\": \"Allow only staging temporary copies that are generated by the service and can be regenerated, ensure the encrypted bundle has been atomically committed and integrity-checked, and then delete the temporary plaintext; user original files should be in different directories protected by independent permissions.\", \"dangerous_boundary\": \"If the caller can disguise an arbitrary user path as staging, point destination_dir at the original data directory, or modify the function to process recursively and delete source files without success confirmation, then deletion and overwrite behaviors may cause irreversible data loss.\", \"uncertainty_points\": [\"The directory name check on source.parent.name is insufficient to prove that the path truly belongs to a controlled temporary area\", \"The backup, auditing, and service account isolation of the keyring backend are not reflected in the code\", \"Metadata writing does not use a temporary file and atomic commit, so failures may leave ciphertext and metadata inconsistent\", \"The conflict handling and overwrite authorization policy for same-named bundles are not specified\"]}","[{\"operation_type\": \"Traversal\", \"target_scope\": \"A single staged_file passed by the caller, not a recursive directory; only files whose parent directory is named staging and whose suffix is .csv or .json are accepted.\", \"action_mechanism\": \"Use resolve() to normalize the path, perform pre-validation through source.parent.name and the suffix allowlist, and do not include recursive directory traversal.\", \"destructive_effect\": false, \"evidence\": \"The function receives only one file path and rejects non-staging directories and unsupported file types before performing encryption.\"}, {\"operation_type\": \"Key reading\", \"target_scope\": \"The report-export entry corresponding to the service account in the operating system keyring.\", \"action_mechanism\": \"After reading the SERVICE_ACCOUNT environment variable, call keyring.get_password to obtain the Base64-encoded key; if missing, raise an exception and stop.\", \"destructive_effect\": false, \"evidence\": \"The key is not read from source files or code constants, and when the key is unavailable, it will not continue to write or delete files.\"}, {\"operation_type\": \"Encryption\", \"target_scope\": \"A single CSV or JSON temporary copy in the staging directory.\", \"action_mechanism\": \"Generate a 12-byte random nonce, use AESGCM to encrypt the file contents, and use the file name as additional authenticated data.\", \"destructive_effect\": false, \"evidence\": \"Ciphertext is first written to a temporary output file under destination_dir, and after success it is atomically replaced with the .bundle target file.\"}, {\"operation_type\": \"Overwrite\", \"target_scope\": \"The same-named .tmp temporary output path and the final .bundle path in destination_dir.\", \"action_mechanism\": \"First call temporary.write_bytes to write the temporary file, then use temporary.replace(output) to complete the atomic commit.\", \"destructive_effect\": false, \"evidence\": \"Overwrite applies only to the newly generated output temporary file and target bundle, not to the user's original files; however, an existing bundle with the same name may be replaced, requiring a conflict policy.\"}, {\"operation_type\": \"Deletion\", \"target_scope\": \"The staging temporary plaintext copy after the encrypted bundle has been successfully generated.\", \"action_mechanism\": \"Call source.unlink() after ciphertext writing, atomic replacement, and metadata writing.\", \"destructive_effect\": true, \"evidence\": \"source.unlink() deletes the plaintext copy in staging; by context this copy is a regenerable temporary file, but deletion failures or recovery dependencies still need monitoring.\"}, {\"operation_type\": \"Key storage\", \"target_scope\": \"The report-export service entry in the operating system keyring.\", \"action_mechanism\": \"The code reads the key through the keyring interface and is not responsible for generating or persisting the key; the keyring handles underlying storage and access control.\", \"destructive_effect\": false, \"evidence\": \"The source code does not write the key to the export directory, metadata, or logs; metadata records only the algorithm and file name.\"}]","The function accepts only CSV or JSON temporary export copies in a directory named staging, reads the key corresponding to the service account from the operating system keyring, encrypts using AES-GCM, first writes to a temporary file, then atomically replaces it with a .bundle file, and saves metadata. After the encrypted commit succeeds, it deletes the temporary plaintext copy in staging. This deletion behavior has a clear temporary file boundary, but the code still requires external permissions and recovery mechanisms for assurance.","{\"key_sources\": [\"The report-export service entry in the operating system keyring\", \"The service account identifier provided by the SERVICE_ACCOUNT environment variable\"], \"algorithm_usage\": \"AES-256-GCM is used to encrypt a single temporary export file. Each call generates a random 12-byte nonce, and the source file name is used as additional authenticated data; ciphertext is written to a .bundle file.\", \"key_storage_risk\": \"The key is not hard-coded and is not written to the export directory, but risk depends on the permission isolation of the operating system keyring, protection of the service account environment variable, and the keyring backup strategy. Base64 is only encoding and provides no additional confidentiality.\", \"key_recovery_capability\": \"If the keyring has a controlled backup and the service account can still be authorized to read it, operators can use the metadata to locate the bundle and decrypt it; the code does not implement key rotation, old key version identifiers, or decryption tools, so the recovery process needs to be supplemented.\"}","[\"Use a preconfigured staging root directory for realpath validation instead of only checking the parent directory name, and reject symbolic links and cross-tenant paths.\", \"Before deleting the temporary plaintext, write a success status, verify the output hash, and ensure metadata is atomically committed; on failure, retain the temporary file for auditing and retry.\", \"Add a collision-resistant task identifier to bundle names or require an explicit versioning policy before overwrite to avoid replacing existing archives.\", \"Use versioned key identifiers in the keyring, and establish rotation, backup, revocation, and decryption recovery drills.\", \"Restrict the service account to only the paths needed for staging and destination, and prohibit access to user original directories and shared backups.\", \"Monitor deletion counts, output replacement events, and abnormal failure rates, and automatically pause the service when unexpected paths or batch calls are detected.\"]",{"id":660,"relate_table":646,"relate_id":661,"file_size":573,"file_name":662,"path":8,"duration":573,"cate":483,"file_format":649,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":663,"cate_name":651,"source_record":664,"risk_assessment":665,"boundary_analysis":666,"operation_analysis":667,"code_behavior_summary":668,"key_management_analysis":669,"mitigation_recommendations":670},15005,1898471723,"样例_2.json","{\"source_record\": \"{\\\"source_code\\\": \\\"from pathlib import Path\\\\nimport os\\\\n\\\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\\\n\\\\nROOT = Path(\\\\\\\"\u002Fsrv\u002Flab\u002Fincoming\\\\\\\")\\\\nTARGET_SUFFIXES = {\\\\\\\".docx\\\\\\\", \\\\\\\".xlsx\\\\\\\", \\\\\\\".pdf\\\\\\\", \\\\\\\".jpg\\\\\\\"}\\\\n\\\\ndef transform(path: Path, key: bytes) -> None:\\\\n    nonce = os.urandom(12)\\\\n    encrypted = AESGCM(key).encrypt(nonce, path.read_bytes(), None)\\\\n    # Directly rewrite the original file, then change the extension.\\\\n    path.write_bytes(nonce + encrypted)\\\\n    path.rename(path.with_name(path.name + \\\\\\\".locked\\\\\\\"))\\\\n\\\\ndef process_tree() -> None:\\\\n    key = bytes.fromhex(os.environ[\\\\\\\"LAB_KEY_HEX\\\\\\\"])\\\\n    for path in ROOT.rglob(\\\\\\\"*\\\\\\\"):\\\\n        if path.is_file() and path.suffix.lower() in TARGET_SUFFIXES:\\\\n            transform(path, key)\\\\n\\\\nif __name__ == \\\\\\\"__main__\\\\\\\":\\\\n    process_tree()\\\", \\\"programming_language\\\": \\\"Python\\\", \\\"sample_context\\\": \\\"Isolated laboratory code review sample. The code claims to process only \u002Fsrv\u002Flab\u002Fincoming, but its control flow simulates batch file transformation without per-file confirmation, used to train recognition of dangerous combinations such as in-place encryption, extension renaming, and unrecoverable keys.\\\"}\", \"risk_assessment\": \"{\\\"risk_level\\\": \\\"Extremely High Risk\\\", \\\"confidence_score\\\": 0.99, \\\"destructive_indicators\\\": [\\\"Recursive batch processing of multiple common user file types\\\", \\\"Direct write_bytes overwrite of original paths\\\", \\\"Batch appending of the .locked extension\\\", \\\"No backup, recovery manifest, or decryption process\\\", \\\"Use of a single environment key to process the entire batch of files\\\", \\\"The execution entry point runs automatically without requiring per-file confirmation\\\"], \\\"legitimate_use_indicators\\\": [\\\"The root directory name in the code points to an isolated laboratory directory\\\", \\\"Standard AES-GCM and random nonces are used\\\", \\\"The target suffix set is explicitly listed rather than arbitrary files\\\"], \\\"rationale\\\": \\\"Although the example paths have laboratory semantics, the actual control flow combines broad recursive traversal, in-place overwrite, and batch renaming, and lacks reliable key recovery and backup mechanisms. These behaviors directly make a large number of files unavailable, and the risk is far higher than normal archive encryption; if path restrictions, key sources, or calling permissions are changed, the impact can rapidly expand.\\\"}\", \"boundary_analysis\": \"{\\\"legitimate_boundary\\\": \\\"If it is run only on one-time test data, paths are protected by mandatory sandbox validation, output is written to a separate directory with verifiable backups, and there is an explicit decryption process and user confirmation, a similar algorithm could be used for experimental encryption testing.\\\", \\\"dangerous_boundary\\\": \\\"When the code runs recursively on real user directories, shared drives, or backup directories while also performing in-place overwrite and extension renaming without retaining verifiable backups or recovery keys, it constitutes an unauthorized large-scale data destruction risk.\\\", \\\"uncertainty_points\\\": [\\\"Whether ROOT always points to a sandbox directory that cannot contain real data requires runtime verification\\\", \\\"Whether LAB_KEY_HEX is injected by a secure key management system cannot be confirmed from the code\\\", \\\"The code does not show exception handling; if some files fail during processing, the directory may be left in a mixed state\\\", \\\"The runtime account of the calling process and the scope of directory write permissions are unknown\\\"]}\", \"operation_analysis\": \"[{\\\"operation_type\\\": \\\"Traversal\\\", \\\"target_scope\\\": \\\"\u002Fsrv\u002Flab\u002Fincoming and all its subdirectories, including .docx, .xlsx, .pdf, and .jpg files.\\\", \\\"action_mechanism\\\": \\\"Use Path.rglob to recursively enumerate directories, and filter using is_file() and TARGET_SUFFIXES; there is no count limit, excluded directory, or per-file authorization check.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"A single process_tree call automatically processes all matching files, covers recursive subdirectories, and lacks preview, confirmation, and abort controls.\\\"}, {\\\"operation_type\\\": \\\"Key reading\\\", \\\"target_scope\\\": \\\"The symmetric key in the environment variable LAB_KEY_HEX.\\\", \\\"action_mechanism\\\": \\\"Read the string via os.environ and convert it to key bytes using bytes.fromhex, then pass the same key to the transform function for all files.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"The same key controls the entire batch of files; the code has no key identifier, per-file key wrapping, or recovery metadata, so if the key is lost the entire batch of data is affected.\\\"}, {\\\"operation_type\\\": \\\"Encryption\\\", \\\"target_scope\\\": \\\"All matching office documents, PDFs, and image files.\\\", \\\"action_mechanism\\\": \\\"After reading path.read_bytes(), call AESGCM.encrypt to generate ciphertext, and concatenate the random nonce with the ciphertext.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"The encrypted result is not written to an independent copy; instead it proceeds to the next step, a write_bytes call on the original path, causing the original content to be replaced.\\\"}, {\\\"operation_type\\\": \\\"Overwrite\\\", \\\"target_scope\\\": \\\"Each selected original file path.\\\", \\\"action_mechanism\\\": \\\"path.write_bytes(nonce + encrypted) truncates and rewrites the original file; the code has no temporary file, backup, or pre-atomic-replacement verification.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"The original plaintext is overwritten by ciphertext at the same path; an abnormal interruption or unavailable key may cause unrecoverable data loss.\\\"}, {\\\"operation_type\\\": \\\"Rename\\\", \\\"target_scope\\\": \\\"Target files that have already been overwritten.\\\", \\\"action_mechanism\\\": \\\"Call path.rename(path.with_name(path.name + \\\\\\\".locked\\\\\\\")) to append the .locked suffix.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"Batch extension changes block ordinary applications from directly opening files and combine with in-place overwrite behavior to produce a typical file unavailability effect.\\\"}]\", \"code_behavior_summary\": \"The program reads a hexadecimal key from an environment variable and recursively scans a fixed laboratory directory for files with several common document and image suffixes. For each file, it reads the entire contents, encrypts them using AES-GCM, then directly overwrites the original path via write_bytes, and finally renames the file to .locked. The code has no backup, recovery manifest, per-file confirmation, or decryption process, so even though the path is limited to a laboratory directory, it exhibits a clearly destructive batch processing pattern.\", \"key_management_analysis\": \"{\\\"key_sources\\\": [\\\"A single hexadecimal key in the environment variable LAB_KEY_HEX\\\"], \\\"algorithm_usage\\\": \\\"AES-GCM is used for each file with a random 12-byte nonce, but all files reuse the same environment variable key; ciphertext and nonce are written directly to the original file path.\\\", \\\"key_storage_risk\\\": \\\"The key depends on the process environment and may be exposed by debugging, process inspection, or error logs on the same host; the code has no key service, access control, rotation, or secure erasure mechanism, and no key identifier is saved.\\\", \\\"key_recovery_capability\\\": \\\"The code has no decryption function, key backup, recovery manifest, or administrator recovery process. Files may be recoverable only if the external environment still retains the correct LAB_KEY_HEX and a corresponding decryption implementation exists; the current sample cannot prove this.\\\"}\", \"mitigation_recommendations\": \"[\\\"Immediately prohibit running this implementation on real directories, and add non-bypassable sandbox path validation and test data markers at the code layer.\\\", \\\"Change output to temporary files in a separate target directory, perform controlled replacement only after verification and backup confirmation, and prohibit directly overwriting original files.\\\", \\\"Use a key management service to store, rotate, and audit keys, generate a key identifier for each task, and establish a rehearsed decryption recovery process.\\\", \\\"Add preview mode, file count and total capacity limits, per-task manual confirmation, rate limiting, and an abort mechanism.\\\", \\\"Establish alerting and automatic isolation policies for recursive encryption, batch extension changes, abnormal write rates, and sudden directory capacity changes.\\\", \\\"In production environments, reduce the impact scope of a single process on shared data through least privilege, offline backups, and recovery drills.\\\"]\"}","{\"source_code\": \"from pathlib import Path\\nimport os\\n\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\n\\nROOT = Path(\\\"\u002Fsrv\u002Flab\u002Fincoming\\\")\\nTARGET_SUFFIXES = {\\\".docx\\\", \\\".xlsx\\\", \\\".pdf\\\", \\\".jpg\\\"}\\n\\ndef transform(path: Path, key: bytes) -> None:\\n    nonce = os.urandom(12)\\n    encrypted = AESGCM(key).encrypt(nonce, path.read_bytes(), None)\\n    # Directly rewrite the original file, then change the extension.\\n    path.write_bytes(nonce + encrypted)\\n    path.rename(path.with_name(path.name + \\\".locked\\\"))\\n\\ndef process_tree() -> None:\\n    key = bytes.fromhex(os.environ[\\\"LAB_KEY_HEX\\\"])\\n    for path in ROOT.rglob(\\\"*\\\"):\\n        if path.is_file() and path.suffix.lower() in TARGET_SUFFIXES:\\n            transform(path, key)\\n\\nif __name__ == \\\"__main__\\\":\\n    process_tree()\", \"programming_language\": \"Python\", \"sample_context\": \"Isolated laboratory code review sample. The code claims to process only \u002Fsrv\u002Flab\u002Fincoming, but its control flow simulates batch file transformation without per-file confirmation, used to train recognition of dangerous combinations such as in-place encryption, extension renaming, and unrecoverable keys.\"}","{\"risk_level\": \"Extremely High Risk\", \"confidence_score\": 0.99, \"destructive_indicators\": [\"Recursive batch processing of multiple common user file types\", \"Direct write_bytes overwrite of original paths\", \"Batch appending of the .locked extension\", \"No backup, recovery manifest, or decryption process\", \"Use of a single environment key to process the entire batch of files\", \"The execution entry point runs automatically without requiring per-file confirmation\"], \"legitimate_use_indicators\": [\"The root directory name in the code points to an isolated laboratory directory\", \"Standard AES-GCM and random nonces are used\", \"The target suffix set is explicitly listed rather than arbitrary files\"], \"rationale\": \"Although the example paths have laboratory semantics, the actual control flow combines broad recursive traversal, in-place overwrite, and batch renaming, and lacks reliable key recovery and backup mechanisms. These behaviors directly make a large number of files unavailable, and the risk is far higher than normal archive encryption; if path restrictions, key sources, or calling permissions are changed, the impact can rapidly expand.\"}","{\"legitimate_boundary\": \"If it is run only on one-time test data, paths are protected by mandatory sandbox validation, output is written to a separate directory with verifiable backups, and there is an explicit decryption process and user confirmation, a similar algorithm could be used for experimental encryption testing.\", \"dangerous_boundary\": \"When the code runs recursively on real user directories, shared drives, or backup directories while also performing in-place overwrite and extension renaming without retaining verifiable backups or recovery keys, it constitutes an unauthorized large-scale data destruction risk.\", \"uncertainty_points\": [\"Whether ROOT always points to a sandbox directory that cannot contain real data requires runtime verification\", \"Whether LAB_KEY_HEX is injected by a secure key management system cannot be confirmed from the code\", \"The code does not show exception handling; if some files fail during processing, the directory may be left in a mixed state\", \"The runtime account of the calling process and the scope of directory write permissions are unknown\"]}","[{\"operation_type\": \"Traversal\", \"target_scope\": \"\u002Fsrv\u002Flab\u002Fincoming and all its subdirectories, including .docx, .xlsx, .pdf, and .jpg files.\", \"action_mechanism\": \"Use Path.rglob to recursively enumerate directories, and filter using is_file() and TARGET_SUFFIXES; there is no count limit, excluded directory, or per-file authorization check.\", \"destructive_effect\": true, \"evidence\": \"A single process_tree call automatically processes all matching files, covers recursive subdirectories, and lacks preview, confirmation, and abort controls.\"}, {\"operation_type\": \"Key reading\", \"target_scope\": \"The symmetric key in the environment variable LAB_KEY_HEX.\", \"action_mechanism\": \"Read the string via os.environ and convert it to key bytes using bytes.fromhex, then pass the same key to the transform function for all files.\", \"destructive_effect\": true, \"evidence\": \"The same key controls the entire batch of files; the code has no key identifier, per-file key wrapping, or recovery metadata, so if the key is lost the entire batch of data is affected.\"}, {\"operation_type\": \"Encryption\", \"target_scope\": \"All matching office documents, PDFs, and image files.\", \"action_mechanism\": \"After reading path.read_bytes(), call AESGCM.encrypt to generate ciphertext, and concatenate the random nonce with the ciphertext.\", \"destructive_effect\": true, \"evidence\": \"The encrypted result is not written to an independent copy; instead it proceeds to the next step, a write_bytes call on the original path, causing the original content to be replaced.\"}, {\"operation_type\": \"Overwrite\", \"target_scope\": \"Each selected original file path.\", \"action_mechanism\": \"path.write_bytes(nonce + encrypted) truncates and rewrites the original file; the code has no temporary file, backup, or pre-atomic-replacement verification.\", \"destructive_effect\": true, \"evidence\": \"The original plaintext is overwritten by ciphertext at the same path; an abnormal interruption or unavailable key may cause unrecoverable data loss.\"}, {\"operation_type\": \"Rename\", \"target_scope\": \"Target files that have already been overwritten.\", \"action_mechanism\": \"Call path.rename(path.with_name(path.name + \\\".locked\\\")) to append the .locked suffix.\", \"destructive_effect\": true, \"evidence\": \"Batch extension changes block ordinary applications from directly opening files and combine with in-place overwrite behavior to produce a typical file unavailability effect.\"}]","The program reads a hexadecimal key from an environment variable and recursively scans a fixed laboratory directory for files with several common document and image suffixes. For each file, it reads the entire contents, encrypts them using AES-GCM, then directly overwrites the original path via write_bytes, and finally renames the file to .locked. The code has no backup, recovery manifest, per-file confirmation, or decryption process, so even though the path is limited to a laboratory directory, it exhibits a clearly destructive batch processing pattern.","{\"key_sources\": [\"A single hexadecimal key in the environment variable LAB_KEY_HEX\"], \"algorithm_usage\": \"AES-GCM is used for each file with a random 12-byte nonce, but all files reuse the same environment variable key; ciphertext and nonce are written directly to the original file path.\", \"key_storage_risk\": \"The key depends on the process environment and may be exposed by debugging, process inspection, or error logs on the same host; the code has no key service, access control, rotation, or secure erasure mechanism, and no key identifier is saved.\", \"key_recovery_capability\": \"The code has no decryption function, key backup, recovery manifest, or administrator recovery process. Files may be recoverable only if the external environment still retains the correct LAB_KEY_HEX and a corresponding decryption implementation exists; the current sample cannot prove this.\"}","[\"Immediately prohibit running this implementation on real directories, and add non-bypassable sandbox path validation and test data markers at the code layer.\", \"Change output to temporary files in a separate target directory, perform controlled replacement only after verification and backup confirmation, and prohibit directly overwriting original files.\", \"Use a key management service to store, rotate, and audit keys, generate a key identifier for each task, and establish a rehearsed decryption recovery process.\", \"Add preview mode, file count and total capacity limits, per-task manual confirmation, rate limiting, and an abort mechanism.\", \"Establish alerting and automatic isolation policies for recursive encryption, batch extension changes, abnormal write rates, and sudden directory capacity changes.\", \"In production environments, reduce the impact scope of a single process on shared data through least privilege, offline backups, and recovery drills.\"]",{"id":672,"relate_table":646,"relate_id":673,"file_size":573,"file_name":674,"path":8,"duration":573,"cate":483,"file_format":649,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":675,"cate_name":651,"source_record":676,"risk_assessment":677,"boundary_analysis":678,"operation_analysis":679,"code_behavior_summary":680,"key_management_analysis":681,"mitigation_recommendations":682},15004,1998697847,"样例_1.json","{\"source_record\": \"{\\\"source_code\\\": \\\"from pathlib import Path\\\\nimport json\\\\nimport os\\\\n\\\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\\\n\\\\ndef load_data_key(key_ref: str) -> bytes:\\\\n    # The actual system obtains the data key through a controlled key service.\\\\n    return kms_client.decrypt_data_key(key_ref)\\\\n\\\\ndef encrypt_reports(source_dir: str, output_dir: str) -> None:\\\\n    source = Path(source_dir).resolve()\\\\n    output = Path(output_dir).resolve()\\\\n    output.mkdir(parents=True, exist_ok=True)\\\\n    key_ref = os.environ[\\\\\\\"REPORT_KEY_REF\\\\\\\"]\\\\n    key = load_data_key(key_ref)\\\\n    manifest = \\\\n\\\\n    for path in source.rglob(\\\\\\\"*\\\\\\\"):\\\\n        if not path.is_file() or path.suffix.lower() not in {\\\\\\\".csv\\\\\\\", \\\\\\\".json\\\\\\\"}:\\\\n            continue\\\\n        relative = path.relative_to(source)\\\\n        destination = output \u002F (str(relative) + \\\\\\\".enc\\\\\\\")\\\\n        destination.parent.mkdir(parents=True, exist_ok=True)\\\\n        nonce = os.urandom(12)\\\\n        ciphertext = AESGCM(key).encrypt(nonce, path.read_bytes(), str(relative).encode())\\\\n        destination.write_bytes(nonce + ciphertext)\\\\n        manifest.append({\\\\\\\"source\\\\\\\": str(relative), \\\\\\\"output\\\\\\\": str(destination.relative_to(output))})\\\\n\\\\n    (output \u002F \\\\\\\"manifest.json\\\\\\\").write_text(\\\\n        json.dumps({\\\\\\\"key_ref\\\\\\\": key_ref, \\\\\\\"files\\\\\\\": manifest}, ensure_ascii=False),\\\\n        encoding=\\\\\\\"utf-8\\\\\\\",\\\\n    )\\\", \\\"programming_language\\\": \\\"Python\\\", \\\"sample_context\\\": \\\"Enterprise report archiving component. The task is to read CSV and JSON files in authorized report directories, write encrypted copies to a separate archive directory, and keep original files for continued business use. The key service and kms_client interface are provided by an external controlled system.\\\"}\", \"risk_assessment\": \"{\\\"risk_level\\\": \\\"Normal\\\", \\\"confidence_score\\\": 0.96, \\\"destructive_indicators\\\": [], \\\"legitimate_use_indicators\\\": [\\\"Target suffixes are explicitly limited to report files\\\", \\\"Encryption results are written to a separate archive directory\\\", \\\"Original files are not overwritten, deleted, or renamed\\\", \\\"An external key service is used instead of hard-coded keys\\\", \\\"A manifest is generated to support file mapping and later recovery\\\"], \\\"rationale\\\": \\\"The code appears to be scoped report archive encryption: the input scope is limited by directory and suffix together, encryption results are saved separately, and there are no operations that damage source files. Although batch file processing requires access control and recovery drills, the current implementation lacks the in-place overwrite, backup deletion, or unbounded spread characteristics common to ransomware, so it is rated Normal.\\\"}\", \"boundary_analysis\": \"{\\\"legitimate_boundary\\\": \\\"Execute only on authorized report directories, use an explicit suffix allowlist, write results to an access-controlled separate archive location, and ensure that the key service, manifest, and decryption process are all available.\\\", \\\"dangerous_boundary\\\": \\\"If source_dir is expanded to user home directories or shared drives, suffix and path restrictions are removed, output is pointed at the source directory, or logic for in-place overwrite and source file deletion is added, the component could turn into a large-scale data unavailability risk.\\\", \\\"uncertainty_points\\\": [\\\"The actual access control, auditing, and key backup strategy of kms_client are not shown in the code\\\", \\\"Whether the output directory is physically isolated from the source directory needs confirmation in the runtime environment\\\", \\\"The example does not include implementations for decryption, key rotation, or manifest integrity verification\\\"]}\", \"operation_analysis\": \"[{\\\"operation_type\\\": \\\"Traversal\\\", \\\"target_scope\\\": \\\"The caller-specified source_dir and its subdirectories, limited to regular files with .csv and .json suffixes.\\\", \\\"action_mechanism\\\": \\\"Use Path.resolve() to determine the directory, use source.rglob(\\\\\\\"*\\\\\\\") to recursively enumerate files, and filter through is_file() and the suffix set.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The traversal logic only reads directory entries and filters target suffixes; there are no calls that delete, overwrite, or alter source directory contents.\\\"}, {\\\"operation_type\\\": \\\"Key reading\\\", \\\"target_scope\\\": \\\"The external key reference specified by the environment variable REPORT_KEY_REF.\\\", \\\"action_mechanism\\\": \\\"After reading REPORT_KEY_REF, call load_data_key, and obtain the data key via the external kms_client.decrypt_data_key.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The code only obtains key material for this archive operation and does not write the key to output files; the manifest only saves key_ref.\\\"}, {\\\"operation_type\\\": \\\"Encryption\\\", \\\"target_scope\\\": \\\"The contents of the selected CSV and JSON files.\\\", \\\"action_mechanism\\\": \\\"Generate a 12-byte random nonce for each file, call AESGCM.encrypt, and write the nonce and ciphertext to a .enc file in the archive directory.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The encryption result is written to an independent target path in the output directory; the source files are read via read_bytes() and are not written back.\\\"}, {\\\"operation_type\\\": \\\"Key storage\\\", \\\"target_scope\\\": \\\"manifest.json in the archive directory.\\\", \\\"action_mechanism\\\": \\\"Use json.dumps to save key_ref, source file relative paths, and output file relative paths, without saving the plaintext data key.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The manifest fields contain only the key reference and file mapping, not the key itself; output files are separate from the source directory.\\\"}]\", \"code_behavior_summary\": \"The code recursively traverses the specified report directory, selecting only CSV and JSON files, encrypts each file using AES-GCM and writes it to a separate archive directory, and generates manifest.json recording the mapping between source files and encrypted copies. Original files are not overwritten, deleted, or renamed; keys are obtained by reference through an external key service, and the code itself does not store plaintext keys.\", \"key_management_analysis\": \"{\\\"key_sources\\\": [\\\"External key reference provided by the environment variable REPORT_KEY_REF\\\", \\\"Data key returned by the controlled key service through kms_client.decrypt_data_key\\\"], \\\"algorithm_usage\\\": \\\"AES-GCM is used to independently encrypt each selected file. A 12-byte random nonce is generated for each file, and the relative path is used as additional authenticated data; ciphertext is written to an independent .enc file.\\\", \\\"key_storage_risk\\\": \\\"The code does not directly hard-code or write plaintext keys. Risk mainly depends on the environment variable, the key service interface, and access control for the runtime account. The manifest exposes the key reference and file names but does not contain key material.\\\", \\\"key_recovery_capability\\\": \\\"If the key service retains the key corresponding to this key_ref and supports authorized decryption, legitimate operators can restore files according to the manifest; the example does not show key backup, rotation, or decryption procedures, which need to be supplemented by the key service and archive policy.\\\"}\", \"mitigation_recommendations\": \"[\\\"Implement path allowlisting, tenant isolation, and least-privilege checks for source_dir and output_dir, and reject system directories and symlink escapes.\\\", \\\"Add preview, file count limits, user confirmation, and an abort mechanism for batch archiving.\\\", \\\"Enable key rotation, access auditing, backup and recovery, and per-task authorization in the key service, and avoid writing key material to logs.\\\", \\\"Add integrity protection and version information to the manifest, and periodically verify the decryption recoverability of randomly sampled files.\\\", \\\"Monitor abnormal file counts, encryption rates, and output capacity changes, and automatically pause tasks when deviations from normal archiving patterns are detected.\\\"]\"}","{\"source_code\": \"from pathlib import Path\\nimport json\\nimport os\\n\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\n\\ndef load_data_key(key_ref: str) -> bytes:\\n    # The actual system obtains the data key through a controlled key service.\\n    return kms_client.decrypt_data_key(key_ref)\\n\\ndef encrypt_reports(source_dir: str, output_dir: str) -> None:\\n    source = Path(source_dir).resolve()\\n    output = Path(output_dir).resolve()\\n    output.mkdir(parents=True, exist_ok=True)\\n    key_ref = os.environ[\\\"REPORT_KEY_REF\\\"]\\n    key = load_data_key(key_ref)\\n    manifest = \\n\\n    for path in source.rglob(\\\"*\\\"):\\n        if not path.is_file() or path.suffix.lower() not in {\\\".csv\\\", \\\".json\\\"}:\\n            continue\\n        relative = path.relative_to(source)\\n        destination = output \u002F (str(relative) + \\\".enc\\\")\\n        destination.parent.mkdir(parents=True, exist_ok=True)\\n        nonce = os.urandom(12)\\n        ciphertext = AESGCM(key).encrypt(nonce, path.read_bytes(), str(relative).encode())\\n        destination.write_bytes(nonce + ciphertext)\\n        manifest.append({\\\"source\\\": str(relative), \\\"output\\\": str(destination.relative_to(output))})\\n\\n    (output \u002F \\\"manifest.json\\\").write_text(\\n        json.dumps({\\\"key_ref\\\": key_ref, \\\"files\\\": manifest}, ensure_ascii=False),\\n        encoding=\\\"utf-8\\\",\\n    )\", \"programming_language\": \"Python\", \"sample_context\": \"Enterprise report archiving component. The task is to read CSV and JSON files in authorized report directories, write encrypted copies to a separate archive directory, and keep original files for continued business use. The key service and kms_client interface are provided by an external controlled system.\"}","{\"risk_level\": \"Normal\", \"confidence_score\": 0.96, \"destructive_indicators\": [], \"legitimate_use_indicators\": [\"Target suffixes are explicitly limited to report files\", \"Encryption results are written to a separate archive directory\", \"Original files are not overwritten, deleted, or renamed\", \"An external key service is used instead of hard-coded keys\", \"A manifest is generated to support file mapping and later recovery\"], \"rationale\": \"The code appears to be scoped report archive encryption: the input scope is limited by directory and suffix together, encryption results are saved separately, and there are no operations that damage source files. Although batch file processing requires access control and recovery drills, the current implementation lacks the in-place overwrite, backup deletion, or unbounded spread characteristics common to ransomware, so it is rated Normal.\"}","{\"legitimate_boundary\": \"Execute only on authorized report directories, use an explicit suffix allowlist, write results to an access-controlled separate archive location, and ensure that the key service, manifest, and decryption process are all available.\", \"dangerous_boundary\": \"If source_dir is expanded to user home directories or shared drives, suffix and path restrictions are removed, output is pointed at the source directory, or logic for in-place overwrite and source file deletion is added, the component could turn into a large-scale data unavailability risk.\", \"uncertainty_points\": [\"The actual access control, auditing, and key backup strategy of kms_client are not shown in the code\", \"Whether the output directory is physically isolated from the source directory needs confirmation in the runtime environment\", \"The example does not include implementations for decryption, key rotation, or manifest integrity verification\"]}","[{\"operation_type\": \"Traversal\", \"target_scope\": \"The caller-specified source_dir and its subdirectories, limited to regular files with .csv and .json suffixes.\", \"action_mechanism\": \"Use Path.resolve() to determine the directory, use source.rglob(\\\"*\\\") to recursively enumerate files, and filter through is_file() and the suffix set.\", \"destructive_effect\": false, \"evidence\": \"The traversal logic only reads directory entries and filters target suffixes; there are no calls that delete, overwrite, or alter source directory contents.\"}, {\"operation_type\": \"Key reading\", \"target_scope\": \"The external key reference specified by the environment variable REPORT_KEY_REF.\", \"action_mechanism\": \"After reading REPORT_KEY_REF, call load_data_key, and obtain the data key via the external kms_client.decrypt_data_key.\", \"destructive_effect\": false, \"evidence\": \"The code only obtains key material for this archive operation and does not write the key to output files; the manifest only saves key_ref.\"}, {\"operation_type\": \"Encryption\", \"target_scope\": \"The contents of the selected CSV and JSON files.\", \"action_mechanism\": \"Generate a 12-byte random nonce for each file, call AESGCM.encrypt, and write the nonce and ciphertext to a .enc file in the archive directory.\", \"destructive_effect\": false, \"evidence\": \"The encryption result is written to an independent target path in the output directory; the source files are read via read_bytes() and are not written back.\"}, {\"operation_type\": \"Key storage\", \"target_scope\": \"manifest.json in the archive directory.\", \"action_mechanism\": \"Use json.dumps to save key_ref, source file relative paths, and output file relative paths, without saving the plaintext data key.\", \"destructive_effect\": false, \"evidence\": \"The manifest fields contain only the key reference and file mapping, not the key itself; output files are separate from the source directory.\"}]","The code recursively traverses the specified report directory, selecting only CSV and JSON files, encrypts each file using AES-GCM and writes it to a separate archive directory, and generates manifest.json recording the mapping between source files and encrypted copies. Original files are not overwritten, deleted, or renamed; keys are obtained by reference through an external key service, and the code itself does not store plaintext keys.","{\"key_sources\": [\"External key reference provided by the environment variable REPORT_KEY_REF\", \"Data key returned by the controlled key service through kms_client.decrypt_data_key\"], \"algorithm_usage\": \"AES-GCM is used to independently encrypt each selected file. A 12-byte random nonce is generated for each file, and the relative path is used as additional authenticated data; ciphertext is written to an independent .enc file.\", \"key_storage_risk\": \"The code does not directly hard-code or write plaintext keys. Risk mainly depends on the environment variable, the key service interface, and access control for the runtime account. The manifest exposes the key reference and file names but does not contain key material.\", \"key_recovery_capability\": \"If the key service retains the key corresponding to this key_ref and supports authorized decryption, legitimate operators can restore files according to the manifest; the example does not show key backup, rotation, or decryption procedures, which need to be supplemented by the key service and archive policy.\"}","[\"Implement path allowlisting, tenant isolation, and least-privilege checks for source_dir and output_dir, and reject system directories and symlink escapes.\", \"Add preview, file count limits, user confirmation, and an abort mechanism for batch archiving.\", \"Enable key rotation, access auditing, backup and recovery, and per-task authorization in the key service, and avoid writing key material to logs.\", \"Add integrity protection and version information to the manifest, and periodically verify the decryption recoverability of randomly sampled files.\", \"Monitor abnormal file counts, encryption rates, and output capacity changes, and automatically pause tasks when deviations from normal archiving patterns are detected.\"]","{\"source_record\":\"{\\\"source_code\\\": \\\"from pathlib import Path\\\\nimport base64\\\\nimport json\\\\nimport os\\\\n\\\\nimport keyring\\\\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\\\\n\\\\ndef encrypt_staged_export(staged_file: str, destination_dir: str) -> dict:\\\\n    source = Path(staged_file).resolve()\\\\n    destination_root = Path(destination_dir).resolve()\\\\n    if source.parent.name != \\\\\\\"staging\\\\\\\":\\\\n        raise ValueError(\\\\\\\"only staging copies may be consumed\\\\\\\")\\\\n    if source.suffix.lower() not in {\\\\\\\".csv\\\\\\\", \\\\\\\".json\\\\\\\"}:\\\\n        raise ValueError(\\\\\\\"unsupported export type\\\\\\\")\\\\n\\\\n    encoded_key = keyring.get_password(\\\\\\\"report-export\\\\\\\", os.environ[\\\\\\\"SERVICE_ACCOUNT\\\\\\\"])\\\\n    if not encoded_key:\\\\n        raise RuntimeError(\\\\\\\"encryption key is unavailable\\\\\\\")\\\\n    key = base64.b64decode(encoded_key)\\\\n    nonce = os.urandom(12)\\\\n    ciphertext = AESGCM(key).encrypt(nonce, source.read_bytes(), source.name.encode())\\\\n\\\\n    destination_root.mkdir(parents=True, exist_ok=True)\\\\n    output = destination_root \\\u002F (source.stem + \\\\\\\".bundle\\\\\\\")\\\\n    temporary = output.with_suffix(\\\\\\\".tmp\\\\\\\")\\\\n    temporary.write_bytes(nonce + ciphertext)\\\\n    temporary.replace(output)\\\\n\\\\n    metadata = {\\\\\\\"source_name\\\\\\\": source.name, \\\\\\\"encrypted_name\\\\\\\": output.name, \\\\\\\"algorithm\\\\\\\": \\\\\\\"AES-256-GCM\\\\\\\"}\\\\n    (destination_root \\\u002F (source.stem + \\\\\\\".json\\\\\\\")).write_text(json.dumps(metadata), encoding=\\\\\\\"utf-8\\\\\\\")\\\\n    source.unlink()\\\\n    return metadata\\\", \\\"programming_language\\\": \\\"Python\\\", \\\"sample_context\\\": \\\"Report export service sample. The source parameter must be a staging temporary copy generated by the service. The staging temporary copy is deleted only after the encrypted bundle is successfully created and atomically committed; the user's original files are located in other directories and are not processed by this function. Keys are read by the operating system keyring according to the service account.\\\"}\",\"risk_assessment\":\"{\\\"risk_level\\\": \\\"Needs Attention\\\", \\\"confidence_score\\\": 0.93, \\\"destructive_indicators\\\": [\\\"Deletes the plaintext temporary copy in staging after success\\\", \\\"When a .bundle with the same name exists, temporary.replace may replace existing output\\\", \\\"There is no independent recovery confirmation record between deletion and the encryption success determination\\\"], \\\"legitimate_use_indicators\\\": [\\\"Processes only a single temporary file rather than a recursive batch directory\\\", \\\"Requires input to come from the staging directory and limits file suffixes\\\", \\\"Reads the key from the operating system keyring\\\", \\\"Uses a temporary file and atomic replacement to commit ciphertext\\\", \\\"The user's original files are outside the function's processing scope\\\", \\\"Deletion occurs after the encrypted output is successfully written\\\"], \\\"rationale\\\": \\\"This implementation mainly matches a controlled export encryption scenario: single scope, restricted input, relatively safe key source, and atomic writes. Areas of concern are deletion of the temporary plaintext after success, replacement of same-named output, and the lack of versioned keys and recovery confirmation; these issues may lead to accidental deletion or overwrite, but from the current code they have not yet reached large-scale destruction or ransomware-like impact.\\\"}\",\"boundary_analysis\":\"{\\\"legitimate_boundary\\\": \\\"Allow only staging temporary copies that are generated by the service and can be regenerated, ensure the encrypted bundle has been atomically committed and integrity-checked, and then delete the temporary plaintext; user original files should be in different directories protected by independent permissions.\\\", \\\"dangerous_boundary\\\": \\\"If the caller can disguise an arbitrary user path as staging, point destination_dir at the original data directory, or modify the function to process recursively and delete source files without success confirmation, then deletion and overwrite behaviors may cause irreversible data loss.\\\", \\\"uncertainty_points\\\": [\\\"The directory name check on source.parent.name is insufficient to prove that the path truly belongs to a controlled temporary area\\\", \\\"The backup, auditing, and service account isolation of the keyring backend are not reflected in the code\\\", \\\"Metadata writing does not use a temporary file and atomic commit, so failures may leave ciphertext and metadata inconsistent\\\", \\\"The conflict handling and overwrite authorization policy for same-named bundles are not specified\\\"]}\",\"operation_analysis\":\"[{\\\"operation_type\\\": \\\"Traversal\\\", \\\"target_scope\\\": \\\"A single staged_file passed by the caller, not a recursive directory; only files whose parent directory is named staging and whose suffix is .csv or .json are accepted.\\\", \\\"action_mechanism\\\": \\\"Use resolve() to normalize the path, perform pre-validation through source.parent.name and the suffix allowlist, and do not include recursive directory traversal.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The function receives only one file path and rejects non-staging directories and unsupported file types before performing encryption.\\\"}, {\\\"operation_type\\\": \\\"Key reading\\\", \\\"target_scope\\\": \\\"The report-export entry corresponding to the service account in the operating system keyring.\\\", \\\"action_mechanism\\\": \\\"After reading the SERVICE_ACCOUNT environment variable, call keyring.get_password to obtain the Base64-encoded key; if missing, raise an exception and stop.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The key is not read from source files or code constants, and when the key is unavailable, it will not continue to write or delete files.\\\"}, {\\\"operation_type\\\": \\\"Encryption\\\", \\\"target_scope\\\": \\\"A single CSV or JSON temporary copy in the staging directory.\\\", \\\"action_mechanism\\\": \\\"Generate a 12-byte random nonce, use AESGCM to encrypt the file contents, and use the file name as additional authenticated data.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"Ciphertext is first written to a temporary output file under destination_dir, and after success it is atomically replaced with the .bundle target file.\\\"}, {\\\"operation_type\\\": \\\"Overwrite\\\", \\\"target_scope\\\": \\\"The same-named .tmp temporary output path and the final .bundle path in destination_dir.\\\", \\\"action_mechanism\\\": \\\"First call temporary.write_bytes to write the temporary file, then use temporary.replace(output) to complete the atomic commit.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"Overwrite applies only to the newly generated output temporary file and target bundle, not to the user's original files; however, an existing bundle with the same name may be replaced, requiring a conflict policy.\\\"}, {\\\"operation_type\\\": \\\"Deletion\\\", \\\"target_scope\\\": \\\"The staging temporary plaintext copy after the encrypted bundle has been successfully generated.\\\", \\\"action_mechanism\\\": \\\"Call source.unlink() after ciphertext writing, atomic replacement, and metadata writing.\\\", \\\"destructive_effect\\\": true, \\\"evidence\\\": \\\"source.unlink() deletes the plaintext copy in staging; by context this copy is a regenerable temporary file, but deletion failures or recovery dependencies still need monitoring.\\\"}, {\\\"operation_type\\\": \\\"Key storage\\\", \\\"target_scope\\\": \\\"The report-export service entry in the operating system keyring.\\\", \\\"action_mechanism\\\": \\\"The code reads the key through the keyring interface and is not responsible for generating or persisting the key; the keyring handles underlying storage and access control.\\\", \\\"destructive_effect\\\": false, \\\"evidence\\\": \\\"The source code does not write the key to the export directory, metadata, or logs; metadata records only the algorithm and file name.\\\"}]\",\"code_behavior_summary\":\"The function accepts only CSV or JSON temporary export copies in a directory named staging, reads the key corresponding to the service account from the operating system keyring, encrypts using AES-GCM, first writes to a temporary file, then atomically replaces it with a .bundle file, and saves metadata. After the encrypted commit succeeds, it deletes the temporary plaintext copy in staging. This deletion behavior has a clear temporary file boundary, but the code still requires external permissions and recovery mechanisms for assurance.\",\"key_management_analysis\":\"{\\\"key_sources\\\": [\\\"The report-export service entry in the operating system keyring\\\", \\\"The service account identifier provided by the SERVICE_ACCOUNT environment variable\\\"], \\\"algorithm_usage\\\": \\\"AES-256-GCM is used to encrypt a single temporary export file. Each call generates a random 12-byte nonce, and the source file name is used as additional authenticated data; ciphertext is written to a .bundle file.\\\", \\\"key_storage_risk\\\": \\\"The key is not hard-coded and is not written to the export directory, but risk depends on the permission isolation of the operating system keyring, protection of the service account environment variable, and the keyring backup strategy. Base64 is only encoding and provides no additional confidentiality.\\\", \\\"key_recovery_capability\\\": \\\"If the keyring has a controlled backup and the service account can still be authorized to read it, operators can use the metadata to locate the bundle and decrypt it; the code does not implement key rotation, old key version identifiers, or decryption tools, so the recovery process needs to be supplemented.\\\"}\",\"mitigation_recommendations\":\"[\\\"Use a preconfigured staging root directory for realpath validation instead of only checking the parent directory name, and reject symbolic links and cross-tenant paths.\\\", \\\"Before deleting the temporary plaintext, write a success status, verify the output hash, and ensure metadata is atomically committed; on failure, retain the temporary file for auditing and retry.\\\", \\\"Add a collision-resistant task identifier to bundle names or require an explicit versioning policy before overwrite to avoid replacing existing archives.\\\", \\\"Use versioned key identifiers in the keyring, and establish rotation, backup, revocation, and decryption recovery drills.\\\", \\\"Restrict the service account to only the paths needed for staging and destination, and prohibit access to user original directories and shared backups.\\\", \\\"Monitor deletion counts, output replacement events, and abnormal failure rates, and automatically pause the service when unexpected paths or batch calls are detected.\\\"]\"}","MOBIUSI INC","https:\u002F\u002Fstatic.mobiusi.com\u002Fmobiwusi\u002F20250829\u002F7bf4ac62b4533e2b809998a6f1c5491e.png?Expires=1792463130&OSSAccessKeyId=LTAI5tH8MQqhgeiAtrzCHrxM&Signature=v6Tr8jBrdm4s5wU1SnnyGsYg%2Bhw%3D&x-oss-process=image%2Fresize%2Cm_fill%2Cw_35%2Ch_35",[687,693],{"type":688,"title":689,"count_data":690},"bar","Length distribution",[691],{"name":692,"value":483},"1k lower",{"type":694,"title":695,"count_data":696},"pie","Language distribution",[697],{"name":698,"value":483},"English"]