{
  "schemaVersion": 1,
  "evaluation": {
    "id": "jq",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "jq selected the expected two records, preserved filter-looking --arg text as data and returned distinct nonzero results for an empty selection and malformed JSON.",
    "identity": {
      "version": "jq-1.8.2",
      "target": "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-windows-amd64.exe",
      "integrity": "SHA-256 a6fc67fedaf9128a3309a1e2ebb8b986aeccf70122ee46d2cb4849e423f0c627 of the downloaded executable. Recorded to identify the tested artifact; no independent signature or provenance audit was performed."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps use UTC.",
      "Fresh per-tool home, config, cache and temporary directories. Child environments used allowlisted OS/runtime paths without inherited account credentials. Only synthetic local files were used.",
      "Configuration isolation is a test control, not an operating-system sandbox."
    ],
    "checks": [
      {
        "id": "jq-version",
        "name": "Pinned binary version",
        "method": "Command argument array: [\"jq\", \"--version\"].",
        "expected": "Print jq-1.8.2.",
        "observed": "Exit 0. jq-1.8.2",
        "outcome": "pass"
      },
      {
        "id": "jq-filter",
        "name": "Select records and fields",
        "method": "Create items.json containing [{\"id\":1,\"owner\":\"Ada\",\"status\":\"open\"},{\"id\":2,\"owner\":\"Bo\",\"status\":\"closed\"},{\"id\":3,\"owner\":\"Cy\",\"status\":\"open\"}]. Command argument array: [\"jq\", \"-c\", \"[.[] | select(.status == \\\"open\\\") | {id,owner}]\", \"items.json\"].",
        "expected": "Return the two open records with id and owner only.",
        "observed": "Exit 0. [{\"id\":1,\"owner\":\"Ada\"},{\"id\":3,\"owner\":\"Cy\"}]",
        "outcome": "pass"
      },
      {
        "id": "jq-argument-data",
        "name": "Keep filter-looking input as data",
        "method": "Command argument array: [\"jq\", \"-n\", \"--arg\", \"value\", \"x\\\" | error(\\\"injected\\\") | \\\"\", \"{value:$value}\"].",
        "expected": "Preserve the --arg value literally without evaluating its embedded filter syntax.",
        "observed": "Exit 0. {\n  \"value\": \"x\\\" | error(\\\"injected\\\") | \\\"\"\n}",
        "outcome": "pass"
      },
      {
        "id": "jq-no-match",
        "name": "Signal an empty result",
        "method": "Create items.json containing [{\"id\":1,\"owner\":\"Ada\",\"status\":\"open\"},{\"id\":2,\"owner\":\"Bo\",\"status\":\"closed\"},{\"id\":3,\"owner\":\"Cy\",\"status\":\"open\"}]. Command argument array: [\"jq\", \"-e\", \".[] | select(.id == 99)\", \"items.json\"].",
        "expected": "Return exit 4 with no selected values.",
        "observed": "Exit 4. Standard output and standard error were empty.",
        "outcome": "pass"
      },
      {
        "id": "jq-invalid-json",
        "name": "Reject malformed JSON",
        "method": "Create bad.json with the exact bytes {\"unfinished\": and no closing value. Command argument array: [\"jq\", \".\", \"bad.json\"].",
        "expected": "Return a parse error and nonzero exit.",
        "observed": "Exit 5. jq: parse error: Unfinished JSON term at EOF at line 1, column 14",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Argument binding kept this value out of filter code",
        "basis": "observed",
        "severity": "informational",
        "detail": "The string containing quotes and error(\"injected\") was returned literally through --arg, with exit 0. This single case supports using a fixed filter with bound values; it is not an exhaustive injection test.",
        "practicalAdvice": "Use --arg for strings and --argjson for already validated JSON instead of concatenating data into filter source."
      },
      {
        "title": "Exit status needs deliberate handling",
        "basis": "observed",
        "severity": "low",
        "detail": "The -e selection with no result returned 4, while malformed JSON returned 5 with a parse error. Ignoring these statuses can let empty or invalid data continue through automation.",
        "practicalAdvice": "Check the exit status before downstream actions, and define what an empty result means for the task."
      }
    ],
    "caveats": [
      "The tested filters only read synthetic files or command arguments and wrote standard output.",
      "The fixture demonstrates specific filter and exit behavior; it does not validate all input schemas or shells."
    ],
    "notTested": [
      "Large or adversarial JSON, parser fuzzing, performance and every shell quoting or filter-injection case.",
      "Production API schemas, confidential datasets and downstream commands that consume generated output."
    ],
    "sources": [
      {
        "label": "jq manual and argument handling",
        "url": "https://jqlang.org/manual/"
      },
      {
        "label": "Official downloads",
        "url": "https://jqlang.org/download/"
      },
      {
        "label": "jq repository",
        "url": "https://github.com/jqlang/jq"
      },
      {
        "label": "License and third-party notices",
        "url": "https://github.com/jqlang/jq/blob/master/COPYING"
      }
    ],
    "reportUrl": "/interface-evaluations/jq.json"
  }
}