diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00288.py b/PR_6_python/python/filtered_java/BenchmarkTest00288.py
new file mode 100644
index 0000000..4297c4e
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00288.py
@@ -0,0 +1,11 @@
+#{fact rule=os-command-injection@v1.0 defects=0}
+
+import os
+import shlex
+from somewhere import something
+
+
+# ok:dangerous-spawn-process
+os.spawnv(os.P_WAIT, "/bin/ls")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00298.py b/PR_6_python/python/filtered_java/BenchmarkTest00298.py
new file mode 100644
index 0000000..c26c17e
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00298.py
@@ -0,0 +1,21 @@
+#{fact rule=code-injection@v1.0 defects=1}
+
+import flask
+
+app = flask.Flask(__name__)
+
+
+@app.route("/error2")
+def error2(e):
+    # ruleid: dangerous-template-string
+    template = '''{  extends "layout.html"  }
+{  block body  }
+    <div class="center-content error">
+        <h1>Oops! That page doesn't exist.</h1>
+        <h3>%s</h3>
+    </div>
+{  endblock  }
+''' % (request.url)
+    return flask.render_template_string(template), 404
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00389.py b/PR_6_python/python/filtered_java/BenchmarkTest00389.py
new file mode 100644
index 0000000..3ea31ad
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00389.py
@@ -0,0 +1,12 @@
+#{fact rule=insecure-file-permissions@v1.0 defects=1}
+
+import os
+import stat
+
+def ensure_exec_perms2(file_):
+    st = os.stat(file_)
+    # ruleid:insecure-file-permissions
+    os.chmod(file_, st.st_mode | 0o111)
+    return file_
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00399.py b/PR_6_python/python/filtered_java/BenchmarkTest00399.py
new file mode 100644
index 0000000..3b166ba
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00399.py
@@ -0,0 +1,11 @@
+#{fact rule=insecure-cryptography@v1.0 defects=1}
+
+# cf. https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/examples/hashlib_new_insecure_functions.py
+
+import hashlib
+
+# ruleid:insecure-hash-function
+hashlib.new(name='md5', string='test')
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00400.py b/PR_6_python/python/filtered_java/BenchmarkTest00400.py
new file mode 100644
index 0000000..b9d929b
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00400.py
@@ -0,0 +1,11 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import OpenerDirector
+
+def test1():
+    od = OpenerDirector()
+    # ruleid: insecure-openerdirector-open-ftp
+    od.open("ftp://example.com")
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00410.py b/PR_6_python/python/filtered_java/BenchmarkTest00410.py
new file mode 100644
index 0000000..66992ce
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00410.py
@@ -0,0 +1,9 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import Request
+
+def test1():
+    # ruleid: insecure-request-object
+    Request("http://example.com")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00434.py b/PR_6_python/python/filtered_java/BenchmarkTest00434.py
new file mode 100644
index 0000000..8062ddb
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00434.py
@@ -0,0 +1,16 @@
+#{fact rule=sql-injection@v1.0 defects=0}
+
+import asyncio
+import asyncpg
+
+
+def ok8(user_input):
+    conn = await aiopg.connect(database='aiopg',
+                               user='aiopg',
+                               password='secret',
+                               host='127.0.0.1')
+    cur = await conn.cursor()
+    # ok: aiopg-sqli
+    cur.execute('SELECT * FROM John'.format())
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00441.py b/PR_6_python/python/filtered_java/BenchmarkTest00441.py
new file mode 100644
index 0000000..dcf73c3
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00441.py
@@ -0,0 +1,12 @@
+#{fact rule=cross-site-scripting@v1.0 defects=0}
+
+import asyncio
+import asyncpg
+
+
+def ok8(user_input):
+    con = await asyncpg.connect(user='postgres')
+    # ok: asyncpg-sqli
+    con.execute('SELECT * FROM John'.format())
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00451.py b/PR_6_python/python/filtered_java/BenchmarkTest00451.py
new file mode 100644
index 0000000..f78c135
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00451.py
@@ -0,0 +1,12 @@
+#{fact rule=untrusted-deserialization@v1.0 defects=1}
+
+from django.http import HttpResponse
+import datetime
+
+
+
+def current_datetime(request):
+    # ruleid:avoid-insecure-deserialization
+    return "Hey there! {}!".format(pickle.loads(b64decode(request.cookies.get('uuid'))))
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00475.py b/PR_6_python/python/filtered_java/BenchmarkTest00475.py
new file mode 100644
index 0000000..8010300
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00475.py
@@ -0,0 +1,10 @@
+#{fact rule=code-injection@v1.0 defects=0}
+
+import code
+
+
+def ok4() -> None:
+    inperpreter = code.InteractiveInterpreter()
+    inperpreter.runsource('print(123)')
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00501.py b/PR_6_python/python/filtered_java/BenchmarkTest00501.py
new file mode 100644
index 0000000..be2efe2
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00501.py
@@ -0,0 +1,31 @@
+#{fact rule=cross-site-scripting@v1.0 defects=0}
+
+# -*- coding: utf-8 -*-
+import os
+import sqlite3
+
+from flask import Flask
+from flask import redirect
+from flask import request
+from flask import session
+from jinja2 import Template
+
+app = Flask(__name__)
+
+
+@app.route("/loginpage4")
+def render_login_page4():
+    thing = "blah"
+    # the string below is now detected as a literal string after constant
+    # propagation
+    # ok:directly-returned-format-string
+    return thing + '''
+<form method="POST" style="margin: 60px auto; width: 140px;">
+    <p><input name="username" type="text" /></p>
+    <p><input name="password" type="password" /></p>
+    <p><input value="Login" type="submit" /></p>
+</form>
+    '''
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00525.py b/PR_6_python/python/filtered_java/BenchmarkTest00525.py
new file mode 100644
index 0000000..972b1f2
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00525.py
@@ -0,0 +1,18 @@
+#{fact rule=sql-injection@v1.0 defects=1}
+
+from django.db.models import (
+    CharField, Expression, Field, FloatField, Lookup, TextField, Value,
+)
+from django.db.models.expressions import CombinedExpression, Func, Subquery
+from django.db.models.functions import Cast, Coalesce
+
+
+
+
+
+# ruleid: extends-custom-expression
+class SQCount(Subquery):
+    template = "(SELECT count(*) FROM (%(subquery)s) _count)"
+    output_field = IntegerField()
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00535.py b/PR_6_python/python/filtered_java/BenchmarkTest00535.py
new file mode 100644
index 0000000..1441d11
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00535.py
@@ -0,0 +1,37 @@
+#{fact rule=os-command-injection@v1.0 defects=0}
+
+import requests
+from datetime import timedelta
+from airflow import DAG
+from airflow.operators.bash_operator import BashOperator
+from airflow.utils.dates import days_ago
+
+default_args = {
+    "owner": "airflow",
+    "depends_on_past": False,
+    "start_date": days_ago(2),
+    "email": ["airflow@example.com"],
+    "email_on_failure": False,
+    "email_on_retry": False,
+    "retries": 1,
+    "retry_delay": timedelta(minutes=5)
+}
+
+dag = DAG(
+    "tutorialex2",
+    default_args=default_args,
+    description="Tutorial DAG",
+    schedule_interval=timedelta(days=1)
+)
+
+message = requests.get("https://fakeurl.asdf/message").text
+
+
+# ok: formatted-string-bashoperator
+t5 = BashOperator(
+    task_id="safe",
+    bash_command="echo hello world!",
+    dag=dag
+)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00540.py b/PR_6_python/python/filtered_java/BenchmarkTest00540.py
new file mode 100644
index 0000000..f32eee7
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00540.py
@@ -0,0 +1,11 @@
+#{fact rule=detect-activated-debug-feature@v1.0 defects=1}
+
+import os
+import flask
+app = flask.Flask(__name__)
+
+
+# ruleid: avoid_hardcoded_config_ENV
+app.config["ENV"] = "development"
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00564.py b/PR_6_python/python/filtered_java/BenchmarkTest00564.py
new file mode 100644
index 0000000..ea84bfc
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00564.py
@@ -0,0 +1,10 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import OpenerDirector
+
+
+def test3():
+    # ruleid: insecure-openerdirector-open-ftp
+    OpenerDirector().open("ftp://example.com")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00647.py b/PR_6_python/python/filtered_java/BenchmarkTest00647.py
new file mode 100644
index 0000000..c64581d
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00647.py
@@ -0,0 +1,27 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+from django.shortcuts import render
+from django.shortcuts import render_to_response
+from django.utils.html import escape
+
+class FalsePositiveCheck499View(VulnerableTemplateView):
+    title = '(almost) Cross-Site Scripting'
+    tags = ['false-positive', 'GET', 'filtered']
+    description = 'Echo query string parameter to HTML tag attribute removing'\
+                  ' the single quotes which are present in the input.'
+    url_path = '499_check.py?text=1'
+    false_positive_check = True
+    references = ['https://github.com/andresriancho/w3af/pull/499']
+
+    def getB(self, request, *args, **kwds):
+        context = self.get_context_data()
+
+        text = request.GET['text']
+        text = text.replace('"', '')
+
+        # ruleid: raw-html-format
+        context['html'] = '<a href="http://external/abc/' + text + '">Check link href</a>'
+
+        return render(request, self.template_name, context)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00657.py b/PR_6_python/python/filtered_java/BenchmarkTest00657.py
new file mode 100644
index 0000000..ceafeac
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00657.py
@@ -0,0 +1,13 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+import urllib
+from django.db.models import Q
+from django.auth import User
+from django.http import HttpResponse, HttpResponseBadRequest
+from django.utils.translation import ugettext as _
+
+def inline_test(request):
+    # ruleid: reflected-data-httpresponsebadrequest
+    return HttpResponseBadRequest("Received {}".format(request.POST.get('message')))
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00690.py b/PR_6_python/python/filtered_java/BenchmarkTest00690.py
new file mode 100644
index 0000000..b6f9970
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00690.py
@@ -0,0 +1,19 @@
+# #{ex-fact rule=sql-injection@v1.0 defects=1}
+#
+# from django.http import HttpResponse
+#
+# class Person(models.Model):
+#     first_name = models.CharField(...)
+#     last_name = models.CharField(...)
+#     birth_date = models.DateField(...)
+#
+# ##### raw() True Positives #########
+# def get_user_age(request):
+#   # ruleid: sql-injection-using-raw
+#   user_name = request.get('user_name')
+#   user_age = Person.objects.raw('SELECT user_age FROM myapp_person where user_name = %s' % user_name)
+#   html = "<html><body>User Age %s.</body></html>" % user_age
+#   return HttpResponse(html)
+#
+#
+# #{/ex-fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00703.py b/PR_6_python/python/filtered_java/BenchmarkTest00703.py
new file mode 100644
index 0000000..90beb62
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00703.py
@@ -0,0 +1,15 @@
+#{fact rule=os-command-injection@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+@app.route("/get_param_concat", methods=["GET"])
+def get_param_concat():
+    param = flask.request.args.get("param")
+    # ruleid: os-system-injection
+    os.system("echo " + param)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00707.py b/PR_6_python/python/filtered_java/BenchmarkTest00707.py
new file mode 100644
index 0000000..67f43d0
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00707.py
@@ -0,0 +1,24 @@
+#{fact rule=os-command-injection@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+# Real world example
+@app.route('/', methods=['GET', 'POST'])
+def index():
+    if flask.request.method == 'GET':
+        return flask.render_template('index.html')
+    # check url first
+    url = flask.request.form.get('url', None)
+    if url != '':
+        md5 = hashlib.md5(url+app.config['MD5_SALT']).hexdigest()
+        fpath = join(join(app.config['MEDIA_ROOT'], 'upload'), md5+'.jpg')
+        # ruleid: os-system-injection
+        r = os.system('wget %s -O "%s"'%(url, fpath))
+        if r != 0: abort(403)
+        return flask.redirect(flask.url_for('landmark', hash=md5))
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00717.py b/PR_6_python/python/filtered_java/BenchmarkTest00717.py
new file mode 100644
index 0000000..c582011
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00717.py
@@ -0,0 +1,15 @@
+# #{ex-fact rule=sql-injection@v1.0 defects=1}
+
+# import pg8000.native as pg
+# import pg8000.dbapi
+#
+#
+# import pg8000.native as pg
+# import pg8000.dbapi
+
+# def bad5():
+#     conn = pg8000.connect(user='postgres', password='password', database='andromedabot')
+#     # ruleid: pg8000-sqli
+#     conn.executemany("SELECT name FROM users WHERE age=" + req.FormValue("age"))
+
+# #{/ex-fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00723.py b/PR_6_python/python/filtered_java/BenchmarkTest00723.py
new file mode 100644
index 0000000..d9a1754
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00723.py
@@ -0,0 +1,14 @@
+#{fact rule=sql-injection@v1.0 defects=0}
+
+import pg8000.native as pg
+import pg8000.dbapi
+
+
+def ok3(user_input):
+    conn = pg8000.connect(user='postgres', password='password', database='andromedabot')
+    query = "SELECT name FROM users WHERE age="
+    query += "3"
+    # ok: pg8000-sqli
+    conn.execute(query)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00746.py b/PR_6_python/python/filtered_java/BenchmarkTest00746.py
new file mode 100644
index 0000000..4b4b303
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00746.py
@@ -0,0 +1,14 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+@app.route("/get_param_inline", methods=["GET"])
+def get_param_inline():
+    # ruleid:raw-html-format
+    return "<a href='%s'>Click me!</a>" % flask.request.args.get("param")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00781.py b/PR_6_python/python/filtered_java/BenchmarkTest00781.py
new file mode 100644
index 0000000..852a681
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00781.py
@@ -0,0 +1,17 @@
+#{fact rule=sql-injection@v1.0 defects=1}
+
+from django.http import HttpResponse
+
+class Person(models.Model):
+    first_name = models.CharField(...)
+    last_name = models.CharField(...)
+    birth_date = models.DateField(...)
+
+def get_users(request):
+  # ruleid: sql-injection-using-raw
+  client_id = request.headers.get('client_id')
+  users = Person.objects.raw('SELECT * FROM myapp_person where client_id = %s' % client_id)
+  html = "<html><body>Users %s.</body></html>" % users
+  return HttpResponse(html)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00791.py b/PR_6_python/python/filtered_java/BenchmarkTest00791.py
new file mode 100644
index 0000000..2d6896c
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00791.py
@@ -0,0 +1,10 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import URLopener
+
+def test1():
+    od = URLopener()
+    # ruleid: insecure-urlopener-retrieve
+    od.retrieve("http://example.com")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00804.py b/PR_6_python/python/filtered_java/BenchmarkTest00804.py
new file mode 100644
index 0000000..959cb55
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00804.py
@@ -0,0 +1,11 @@
+#{fact rule=insecure-cryptography@v1.0 defects=1}
+
+import os
+from cryptography.hazmat import backends
+from cryptography.hazmat.primitives.asymmetric import ec
+
+# ruleid: insufficient-ec-key-size
+ec.generate_private_key(curve=ec.SECP192R1,
+                         backend=backends.default_backend())
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00814.py b/PR_6_python/python/filtered_java/BenchmarkTest00814.py
new file mode 100644
index 0000000..3cb3dc3
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00814.py
@@ -0,0 +1,14 @@
+#{fact rule=weak-obfuscation-of-request@v1.0 defects=1}
+
+import jwt
+
+# ruleid: jwt-python-hardcoded-secret
+secret_const = "this-is-secret"
+
+def bad1():
+    # ruleid: jwt-python-hardcoded-secret
+    encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256')
+    return encoded
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00820.py b/PR_6_python/python/filtered_java/BenchmarkTest00820.py
new file mode 100644
index 0000000..33584d6
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00820.py
@@ -0,0 +1,12 @@
+#{fact rule=code-injection@v1.0 defects=1}
+
+from logging.config import listen
+
+PORT_NUMBER = 1234
+
+def start_log():
+    # ruleid: listen-eval
+    t = listen(PORT_NUMBER)
+    t.start()
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00830.py b/PR_6_python/python/filtered_java/BenchmarkTest00830.py
new file mode 100644
index 0000000..e6d569c
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00830.py
@@ -0,0 +1,9 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import URLopener
+
+def test3():
+    # ruleid: insecure-urlopener-open
+    URLopener().open("http://example.com")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00845.py b/PR_6_python/python/filtered_java/BenchmarkTest00845.py
new file mode 100644
index 0000000..f0e9e67
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00845.py
@@ -0,0 +1,10 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import URLopener
+
+def test6(url = "ftp://example.com"):
+    od = URLopener()
+    # ruleid: insecure-urlopener-retrieve-ftp
+    od.retrieve(url)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00892.py b/PR_6_python/python/filtered_java/BenchmarkTest00892.py
new file mode 100644
index 0000000..c59612c
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00892.py
@@ -0,0 +1,66 @@
+#{fact rule=sql-injection@v1.0 defects=0}
+
+import json
+import os
+import typing as t
+
+import boto3
+import sqlalchemy
+from aws_lambda_powertools import Logger, Tracer
+from aws_lambda_powertools.utilities.typing import LambdaContext
+
+SERVICE = "lambda-connection-pooling-demo"
+logger = Logger(service=SERVICE)
+tracer = Tracer(service=SERVICE)
+
+class LambdaProxyIntegrationResponse(t.TypedDict, total=False):
+    statusCode: int
+    body: str
+    headers: t.Dict[str, t.Any]
+
+DB_USER_SECRET_NAME = os.environ.get("DB_USER_SECRET_NAME")
+DB_HOST = os.environ.get("DB_HOST")
+
+secrentsmanager = boto3.client(service_name='secretsmanager')
+get_secret_value_response = secrentsmanager.get_secret_value(SecretId=DB_USER_SECRET_NAME)
+secret = json.loads(get_secret_value_response["SecretString"])
+db_user = secret["username"]
+db_password = secret["password"]
+db_host = DB_HOST or secret["host"]
+db_port = secret["port"]
+
+url = f"mysql+pymysql://{db_user}:{db_password}@{db_host}:{db_port}/"
+engine = sqlalchemy.create_engine(
+    url,
+    connect_args={
+        "ssl": {
+            "ssl_ca": "./AmazonRootCA1.pem",
+        }
+    },
+    pool_recycle=50,
+)
+
+def handler(event, context):
+    logger.debug("connecting to db...")
+    with engine.connect() as connection:
+        try:
+            # ok: sqlalchemy-sqli
+            connection.execute("SELECT * FROM foobar WHERE id = '?'", event['id'])
+        except Exception as e:
+            logger.error("An error occured:")
+            print(e)
+            return {
+                "statusCode": 200,
+                "body": json.dumps({
+                    "state": "ERROR",
+                    "message": f"response from '{context.log_stream_name}'"
+                })
+            }
+    return {
+        "statusCode": 200,
+        "body": json.dumps({
+            "state": "SUCCESS",
+            "message": f"response from '{context.log_stream_name}'"
+        })
+    }
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00905.py b/PR_6_python/python/filtered_java/BenchmarkTest00905.py
new file mode 100644
index 0000000..d4a7b52
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00905.py
@@ -0,0 +1,15 @@
+#{fact rule=server-side-request-forgery@v1.0 defects=1}
+
+import flask
+import requests
+
+app = flask.Flask(__name__)
+
+
+@app.route("/get_param", methods=["GET"])
+def get_param():
+    param = flask.request.args.get("param")
+    # ruleid: ssrf-requests
+    requests.post(param, timeout=10)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00911.py b/PR_6_python/python/filtered_java/BenchmarkTest00911.py
new file mode 100644
index 0000000..406729a
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00911.py
@@ -0,0 +1,10 @@
+#{fact rule=os-command-injection@v1.0 defects=0}
+
+import subprocess
+import sys
+
+# ok:subprocess-shell-true
+subprocess.call("echo 'hello'", shell=True)
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00915.py b/PR_6_python/python/filtered_java/BenchmarkTest00915.py
new file mode 100644
index 0000000..306bf6d
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00915.py
@@ -0,0 +1,8 @@
+#{fact rule=code-injection@v1.0 defects=0}
+
+def handler(event, context):
+    # ok:tainted-code-exec
+    exec("x = 1; x = x + 2")
+
+   
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00921.py b/PR_6_python/python/filtered_java/BenchmarkTest00921.py
new file mode 100644
index 0000000..3e25037
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00921.py
@@ -0,0 +1,11 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+def lambda_handler(event, context):
+
+	response = {}
+
+	link1 = '<a href="http://external/abc/%s">Check link href</a>'
+  # ruleid: tainted-html-string
+	response['html1'] = link1 % event['input']
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00931.py b/PR_6_python/python/filtered_java/BenchmarkTest00931.py
new file mode 100644
index 0000000..24c48ba
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00931.py
@@ -0,0 +1,26 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+# cf. https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/examples/telnetlib.py
+
+import telnetlib
+import getpass
+
+host = sys.argv[1]
+
+username = raw_input('Username:')
+password = getpass.getpass()
+# ruleid:telnetlib
+tn = telnetlib.Telnet(host)
+
+tn.read_until("login: ")
+tn.write(username + "\n")
+if password:
+    tn.read_until("Password: ")
+    tn.write(password + "\n")
+
+tn.write("ls\n")
+tn.write("exit\n")
+
+print(tn.read_all())
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00940.py b/PR_6_python/python/filtered_java/BenchmarkTest00940.py
new file mode 100644
index 0000000..78baea7
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00940.py
@@ -0,0 +1,10 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+from flask import make_response, request
+
+def test3():
+    # ruleid: response-contains-unsanitized-input
+    x = request.args.get("x")
+    return make_response(f"found {x}")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00944.py b/PR_6_python/python/filtered_java/BenchmarkTest00944.py
new file mode 100644
index 0000000..0e2b15f
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00944.py
@@ -0,0 +1,14 @@
+#{fact rule=incorrect-authentication-exploitation@v1.0 defects=1}
+
+# cf. https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
+
+import jwt
+from jwt.exceptions import DecodeError, MissingRequiredClaimError, InvalidKeyError
+
+def insecure_verify(token):
+    # ruleid:unverified-jwt-decode
+    decoded = jwt.decode(token, verify = False)
+    print(decoded)
+    return True
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00954.py b/PR_6_python/python/filtered_java/BenchmarkTest00954.py
new file mode 100644
index 0000000..f66db56
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00954.py
@@ -0,0 +1,43 @@
+#{fact rule=ldap-authentication@v1.0 defects=1}
+
+from django.contrib import auth
+from django.contrib.auth.password_validation import validate_password
+from django.core.exceptions import PermissionDenied, ValidationError
+from django.utils.translation import gettext as _
+from django.views.decorators.csrf import csrf_protect
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from ...conf import settings
+from ...core.decorators import require_dict_data
+from ...core.mail import mail_user
+from ..bans import get_user_ban
+from ..forms.auth import AuthenticationForm, ResendActivationForm, ResetPasswordForm
+from ..serializers import AnonymousUserSerializer, AuthenticatedUserSerializer
+from ..tokens import (
+    is_password_change_token_valid,
+    make_activation_token,
+    make_password_change_token,
+)
+from .rest_permissions import UnbannedAnonOnly, UnbannedOnly
+
+User = auth.get_user_model()
+BaseUserManager = User.__class__
+
+
+class UserManager(BaseUserManager):
+    # ruleid: use-none-for-password-default
+    def create_user(self, email, password=""):
+        """
+        Creates and saves a Poster with the given email and password.
+        """
+        if not email:
+            raise ValueError('Users must have an email address')
+
+        user = self.model(email=self.normalize_email(email))
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00960.py b/PR_6_python/python/filtered_java/BenchmarkTest00960.py
new file mode 100644
index 0000000..af2f9e6
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00960.py
@@ -0,0 +1,12 @@
+#{fact rule=code-injection@v1.0 defects=0}
+
+from textwrap import dedent
+
+def safe(request):
+    # ok: user-eval
+    code = """
+    print('hello')
+    """
+    eval(dedent(code))
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00970.py b/PR_6_python/python/filtered_java/BenchmarkTest00970.py
new file mode 100644
index 0000000..88b4255
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00970.py
@@ -0,0 +1,13 @@
+#{fact rule=no-auth-over-http@v1.0 defects=1}
+
+import requests
+
+def from_import_test1(url):
+    from requests import get, post
+    # ruleid:no-auth-over-http
+    good_url = "https://www.github.com"
+    bad_url = "http://www.github.com"
+    r = get(good_url, timeout=3)
+    r = post(bad_url)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest00983.py b/PR_6_python/python/filtered_java/BenchmarkTest00983.py
new file mode 100644
index 0000000..655b6e8
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest00983.py
@@ -0,0 +1,10 @@
+#{fact rule=code-injection@v1.0 defects=1}
+
+from textwrap import dedent
+
+def fmt_unsafe_inline(request):
+    # ruleid: user-exec-format-string
+    exec("print({})".format(request.GET.get('message')))
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01006.py b/PR_6_python/python/filtered_java/BenchmarkTest01006.py
new file mode 100644
index 0000000..fccf2e8
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01006.py
@@ -0,0 +1,14 @@
+#{fact rule=server-side-request-forgery@v1.0 defects=1}
+
+
+def test_bad_5():
+    from requests import get
+    from django.shortcuts import render
+
+    def send_to_redis(request):
+        # ruleid: ssrf-injection-requests
+        bucket = request.GET["bucket"]
+        inner_response = get("http://my.redis.foo/{}".format(bucket), data=3)
+        return render({"response_code": inner_response.status_code})
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01012.py b/PR_6_python/python/filtered_java/BenchmarkTest01012.py
new file mode 100644
index 0000000..be14276
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01012.py
@@ -0,0 +1,15 @@
+#{fact rule=server-side-request-forgery@v1.0 defects=1}
+
+import flask
+import requests
+
+app = flask.Flask(__name__)
+
+
+@app.route("/get_param_percent_format", methods=["GET"])
+def get_param_percent_format():
+    param = flask.request.args.get("param")
+    # ruleid: ssrf-requests
+    requests.get("%s/id" % (param,))
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01016.py b/PR_6_python/python/filtered_java/BenchmarkTest01016.py
new file mode 100644
index 0000000..4e8ff5e
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01016.py
@@ -0,0 +1,12 @@
+#{fact rule=os-command-injection@v1.0 defects=1}
+
+import sh
+
+long = os.environ.get("LONG", "")
+
+
+# ruleid: string-concat
+sh.semgrep(f"--config {confurl}")
+
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01022.py b/PR_6_python/python/filtered_java/BenchmarkTest01022.py
new file mode 100644
index 0000000..cd49015
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01022.py
@@ -0,0 +1,9 @@
+#{fact rule=code-injection@v1.0 defects=0}
+
+def handler(event, context):
+   
+    blah2 = "import requests; r = requests.get('https://example.com')"
+    # ok:tainted-code-exec
+    eval(blah2)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01026.py b/PR_6_python/python/filtered_java/BenchmarkTest01026.py
new file mode 100644
index 0000000..31a313c
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01026.py
@@ -0,0 +1,18 @@
+#{fact rule=sql-injection@v1.0 defects=1}
+
+from django.http import HttpResponse
+
+
+class Person(models.Model):
+    first_name = models.CharField(...)
+    last_name = models.CharField(...)
+    birth_date = models.DateField(...)
+
+def get_user_age6(request):
+    query = "SELECT user_age FROM myapp_person where user_name = {}"
+    # ruleid: tainted-sql-string
+    user_age = Person.objects.raw(query.format(request.GET.get("user_name")))
+    html = "<html><body>User Age %s.</body></html>" % user_age
+    return HttpResponse(html)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01032.py b/PR_6_python/python/filtered_java/BenchmarkTest01032.py
new file mode 100644
index 0000000..c6c8547
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01032.py
@@ -0,0 +1,20 @@
+#{fact rule=server-side-request-forgery@v1.0 defects=1}
+
+from django.http import HttpResponse
+import requests
+
+class Person(models.Model):
+    first_name = models.CharField(...)
+    last_name = models.CharField(...)
+    birth_date = models.DateField(...)
+
+
+def ex5(request):
+  env = request.POST.get('env')
+  user_name = request.POST.get('user_name')
+  # ruleid: tainted-url-host
+  url = "https://{}/{}/age".format(env, user_name)
+  user_age = requests.get(url)
+  return HttpResponse(user_age)
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/BenchmarkTest01043.py b/PR_6_python/python/filtered_java/BenchmarkTest01043.py
new file mode 100644
index 0000000..607e6d6
--- /dev/null
+++ b/PR_6_python/python/filtered_java/BenchmarkTest01043.py
@@ -0,0 +1,12 @@
+#{fact rule=cross-site-scripting@v1.0 defects=0}
+
+from flask import Flask, render_template
+app = Flask(__name__)
+
+
+@app.route("no_vars")
+def no_vars():
+    # ok: unescaped-template-extension
+    return render_template("unsafe.txt")
+
+#{/fact}
diff --git a/PR_6_python/python/filtered_java/VULNERABILITY_SUMMARY.md b/PR_6_python/python/filtered_java/VULNERABILITY_SUMMARY.md
new file mode 100644
index 0000000..6b53782
--- /dev/null
+++ b/PR_6_python/python/filtered_java/VULNERABILITY_SUMMARY.md
@@ -0,0 +1,34 @@
+# Filtered Vulnerability Files Summary
+
+## Overview
+This folder contains 50 Python files filtered from the AWS Guru Python Security Benchmarks dataset, specifically selected for their relevance to the **Top 25 Most Dangerous Software Weaknesses (2023 CWE Top 25)**.
+
+## Filtering Criteria
+Files were selected based on containing patterns related to these CWE vulnerabilities:
+
+### Top 25 CWE Vulnerabilities Covered:
+- **CWE-78**: OS Command Injection (e.g., BenchmarkTest01016.py, BenchmarkTest00288.py)
+- **CWE-79**: Cross-site Scripting (XSS) (e.g., BenchmarkTest00298.py)
+- **CWE-89**: SQL Injection (e.g., BenchmarkTest00434.py)
+- **CWE-94**: Code Injection (template string vulnerabilities)
+- **CWE-276**: Incorrect Default Permissions (e.g., BenchmarkTest00389.py)
+- **CWE-918**: Server-Side Request Forgery (insecure connections)
+- And other related security vulnerabilities
+
+## File Structure
+- Total files: 50 Python test cases
+- Each file contains:
+  - `#{fact rule=...}` annotations indicating the vulnerability type
+  - `# ruleid:` comments marking vulnerable code patterns
+  - Both vulnerable and secure code examples
+
+## Usage
+These files can be used for:
+- Security testing and validation
+- Training security analysis tools
+- Educational purposes for understanding common vulnerabilities
+- Benchmarking security scanners
+
+## Source
+Filtered from: `/Prime/local_python_semgrep/semgrep_python/` and related directories
+Original dataset: AWS Guru Python Security Benchmarks
\ No newline at end of file
diff --git a/PR_6_python/python/filtered_java/filter_vulnerabilities.py b/PR_6_python/python/filtered_java/filter_vulnerabilities.py
new file mode 100644
index 0000000..1f94413
--- /dev/null
+++ b/PR_6_python/python/filtered_java/filter_vulnerabilities.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+import os
+import shutil
+import re
+from pathlib import Path
+
+# Top 25 CWE vulnerabilities mapping to common patterns
+CWE_PATTERNS = {
+    'CWE-787': ['buffer-overflow', 'out-of-bounds-write'],
+    'CWE-79': ['xss', 'cross-site-scripting', 'template-string'],
+    'CWE-89': ['sql-injection', 'sqli'],
+    'CWE-416': ['use-after-free'],
+    'CWE-78': ['os-command-injection', 'command-injection'],
+    'CWE-20': ['input-validation', 'improper-input'],
+    'CWE-125': ['out-of-bounds-read'],
+    'CWE-22': ['path-traversal', 'directory-traversal'],
+    'CWE-352': ['csrf', 'cross-site-request-forgery'],
+    'CWE-434': ['file-upload', 'unrestricted-upload'],
+    'CWE-862': ['missing-authorization', 'authorization'],
+    'CWE-476': ['null-pointer'],
+    'CWE-287': ['improper-authentication', 'authentication'],
+    'CWE-190': ['integer-overflow'],
+    'CWE-502': ['deserialization', 'pickle', 'yaml-load'],
+    'CWE-77': ['command-injection'],
+    'CWE-119': ['buffer-overflow'],
+    'CWE-798': ['hardcoded-credentials', 'hard-coded'],
+    'CWE-918': ['ssrf', 'server-side-request-forgery'],
+    'CWE-306': ['missing-authentication'],
+    'CWE-362': ['race-condition'],
+    'CWE-269': ['privilege-management'],
+    'CWE-94': ['code-injection'],
+    'CWE-863': ['incorrect-authorization'],
+    'CWE-276': ['file-permissions', 'insecure-file-permissions']
+}
+
+def is_vulnerability_related(file_path):
+    """Check if file contains vulnerability patterns"""
+    try:
+        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
+            content = f.read().lower()
+            
+        # Check for fact rule patterns
+        for cwe, patterns in CWE_PATTERNS.items():
+            for pattern in patterns:
+                if pattern in content:
+                    return True
+                    
+        # Check for ruleid patterns
+        if 'ruleid:' in content:
+            return True
+            
+        return False
+    except Exception:
+        return False
+
+def main():
+    prime_dir = Path('/Users/branedev/Documents/delete_claude_detections_gaurav/compare-for-llm/AWSGuruPythonSecurityBenchmarks/datasets/aws_guru_python_security_benchmarks/Prime')
+    output_dir = prime_dir / 'filtered_java'
+    
+    # Create output directory
+    output_dir.mkdir(exist_ok=True)
+    
+    # Find all Python files
+    py_files = list(prime_dir.rglob('*.py'))
+    print(f"Found {len(py_files)} Python files")
+    
+    # Filter vulnerability-related files
+    vuln_files = []
+    for py_file in py_files:
+        if is_vulnerability_related(py_file):
+            vuln_files.append(py_file)
+    
+    print(f"Found {len(vuln_files)} vulnerability-related files")
+    
+    # Copy first 50 files to output directory
+    copied_count = 0
+    for file_path in vuln_files[:50]:
+        try:
+            dest_path = output_dir / file_path.name
+            shutil.copy2(file_path, dest_path)
+            copied_count += 1
+            print(f"Copied: {file_path.name}")
+        except Exception as e:
+            print(f"Error copying {file_path.name}: {e}")
+    
+    print(f"\nSuccessfully copied {copied_count} files to {output_dir}")
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file