Five documents per repository convention.
01-CONCEPTS.md opens with the Equifax debunk, because leading with a correction
is the strongest available demonstration that this repo checks its claims.
CVE-2017-5638 is OGNL expression injection, NVD CWE-755, CISA KEV CWE-20. Four
primary sources opened and text-searched (GAO-18-559, House Oversight, Equifax's
own release, the DOJ indictment) and "deserialization" appears in none of them.
The ASF published the correction 2017-09-14 and it lost to a three-day timing
coincidence with CVE-2017-9805. The twelve-item wrong-claims table closes the
chapter.
Honest impact numbers only: 69 of 1,653 CISA KEV entries are CWE-502, seventh
most common, 34.8% with known ransomware use against a 20.1% baseline. No
aggregate dollar figure, because none is credible.
Every transcript in the track was produced by execution, not recall. That
included discovering that ERB#def_method does not prepend its wrapper, it
inserts before the first non-comment line, so the payload's leading "#" is
forging the magic encoding comment a real compiled template carries. The first
draft described the wrapping wrong and the container corrected it.
README: the scanner figures were pre-taxonomy-fix and stale. Re-measured on
ruby:4.0-slim today: 124 ungated to 28 reachable, 142 unanalysable, not
119/29/135. Test and gate counts moved to 268 and 79, both measured rather
than carried forward.
fd54dfcc4a