2026-09-05 09:27:22 +02:00
|
|
|
# vfc-js pair slice. Reviewed isolated functions with provenance.
|
|
|
|
|
# Honesty dashboard — not the local 100% CI gate.
|
|
|
|
|
# Do not add these names to LANGUAGE_MANIFESTS.
|
|
|
|
|
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "angular-http-server-1-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "Apache-2.0"
|
|
|
|
|
repo = "simonh1000/angular-http-server"
|
|
|
|
|
cve = ""
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
commit = "8bafc9577161469f5dea01e0b98ea9c525d063e9"
|
|
|
|
|
parent = "d171a771a92e4685b24fb77cb894a7b7b8024c5c"
|
|
|
|
|
commit_url = "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9"
|
|
|
|
|
vuln = "angular-http-server-1-0-0/vuln.js"
|
|
|
|
|
fixed = "angular-http-server-1-0-0/fixed.js"
|
|
|
|
|
relpath = "angular-http-server.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
class = "path traversal"
|
|
|
|
|
path = "angular-http-server.js"
|
|
|
|
|
function = "requestListener"
|
|
|
|
|
mechanism = "path_join_user_input"
|
|
|
|
|
sink = "path"
|
|
|
|
|
evidence = "SecBench.js path-traversal sink angular-http-server.js:16:29 fixed upstream in 8bafc9577161"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "apex-publish-static-files-2-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "vincentmorneau/apex-publish-static-files"
|
|
|
|
|
cve = "CVE-2018-16462"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "2209af8f2b65c24aa55ab757e0e05b958c16f063"
|
|
|
|
|
parent = "8d28fe8a9a49e5ff3f61e239293b5646528e2915"
|
|
|
|
|
commit_url = "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063"
|
|
|
|
|
vuln = "apex-publish-static-files-2-0-0/vuln.js"
|
|
|
|
|
fixed = "apex-publish-static-files-2-0-0/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "publish"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink index.js:54:25 fixed upstream in 2209af8f2b65"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "bestzip-2-1-6"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "nfriedly/node-bestzip"
|
|
|
|
|
cve = "CVE-2020-7730"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
|
|
|
|
|
parent = "fcea252e52b6078eff6caf5531bd32c53fccb59f"
|
|
|
|
|
commit_url = "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
|
|
|
|
|
vuln = "bestzip-2-1-6/vuln.js"
|
|
|
|
|
fixed = "bestzip-2-1-6/fixed.js"
|
|
|
|
|
relpath = "lib/bestzip.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2020"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "lib/bestzip.js"
|
|
|
|
|
function = "nativeZip"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/bestzip.js:27:27 fixed upstream in 45d4a901478c"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "clamscan-1-2-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "kylefarris/clamscan"
|
|
|
|
|
cve = "CVE-2020-7613"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
|
|
|
|
|
parent = "d474da7b89c0d3397cd681e79c7bcc592bff144b"
|
|
|
|
|
commit_url = "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
|
|
|
|
|
vuln = "clamscan-1-2-0/vuln.js"
|
|
|
|
|
fixed = "clamscan-1-2-0/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2020"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "local_scan"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink index.js:495:36 fixed upstream in 5f557c970817"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "diskusage-ng-0-2-6"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "iximiuz/node-diskusage-ng"
|
|
|
|
|
cve = "CVE-2020-7631"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "48e7e093486b528f0c81ec699573e0e4a431b8d3"
|
|
|
|
|
parent = "53c505506553c83861d1bd67823d6a382d3a5a43"
|
|
|
|
|
commit_url = "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3"
|
|
|
|
|
vuln = "diskusage-ng-0-2-6/vuln.js"
|
|
|
|
|
fixed = "diskusage-ng-0-2-6/fixed.js"
|
|
|
|
|
relpath = "lib/posix.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2020"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "lib/posix.js"
|
|
|
|
|
function = "diskusage"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/posix.js:11:5 fixed upstream in 48e7e093486b"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "dns-sync-0-1-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "skoranga/node-dns-sync"
|
|
|
|
|
cve = "CVE-2014-9682"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "d9abaae384b198db1095735ad9c1c73d7b890a0d"
|
|
|
|
|
parent = "b748fe77a87749d95876028eda8e759109be4c73"
|
|
|
|
|
commit_url = "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d"
|
|
|
|
|
vuln = "dns-sync-0-1-0/vuln.js"
|
|
|
|
|
fixed = "dns-sync-0-1-0/fixed.js"
|
|
|
|
|
relpath = "lib/dns-sync.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2014"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "lib/dns-sync.js"
|
|
|
|
|
function = "resolve"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/dns-sync.js:21:26 fixed upstream in d9abaae384b1"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "glance-3-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "jarofghosts/glance"
|
|
|
|
|
cve = "CVE-2018-3715"
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
commit = "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
|
|
|
|
|
parent = "7e69a5539236386e747fb240ae87ea65ed64bb2c"
|
|
|
|
|
commit_url = "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
|
|
|
|
|
vuln = "glance-3-0-0/vuln.js"
|
|
|
|
|
fixed = "glance-3-0-0/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
class = "path traversal"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "Glance$serveRequest"
|
|
|
|
|
mechanism = "path_join_user_input"
|
|
|
|
|
evidence = "SecBench.js path-traversal sink index.js:81:14 fixed upstream in 8cfd88e44ebd"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "hot-formula-parser-3-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "handsontable/formula-parser"
|
|
|
|
|
cve = "CVE-2020-6836"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "396b089738d4bf30eb570a4fe6a188affa95cd5e"
|
|
|
|
|
parent = "944136096f44ff4ffd4ba0bcef30970ca4702fce"
|
|
|
|
|
commit_url = "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e"
|
|
|
|
|
vuln = "hot-formula-parser-3-0-0/vuln.js"
|
|
|
|
|
fixed = "hot-formula-parser-3-0-0/fixed.js"
|
|
|
|
|
relpath = "src/grammar-parser/grammar-parser.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2019"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "src/grammar-parser/grammar-parser.js"
|
|
|
|
|
function = "performAction"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/grammar-parser/grammar-parser.js:258:31 fixed upstream in 396b089738d4"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "libnmap-0-4-11"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "jas-/node-libnmap"
|
|
|
|
|
cve = "CVE-2018-16461"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "c235b24b0342e12a5dbf502f89daabe95883b6c8"
|
|
|
|
|
parent = "49b72239b144ab7ffdf673b62e18bfd0760948f6"
|
|
|
|
|
commit_url = "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8"
|
|
|
|
|
vuln = "libnmap-0-4-11/vuln.js"
|
|
|
|
|
fixed = "libnmap-0-4-11/fixed.js"
|
|
|
|
|
relpath = "lib/classes/tools.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "lib/classes/tools.js"
|
|
|
|
|
function = "block"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/classes/tools.js:114:25 fixed upstream in c235b24b0342"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "pdf-image-1-0-5"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "roest01/node-pdf-image"
|
|
|
|
|
cve = "CVE-2018-3757"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "54679496a89738443917608c2bbe2f6e5dd20e83"
|
|
|
|
|
parent = "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff"
|
|
|
|
|
commit_url = "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83"
|
|
|
|
|
vuln = "pdf-image-1-0-5/vuln.js"
|
|
|
|
|
fixed = "pdf-image-1-0-5/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "getInfo"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink index.js:43:7 fixed upstream in 54679496a897"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "pidusage-1-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "soyuka/pidusage"
|
|
|
|
|
cve = "CVE-2017-16034"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
|
|
|
|
|
parent = "e3660d8a8e5e61afad9b02af67356a1e239d6bde"
|
|
|
|
|
commit_url = "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
|
|
|
|
|
vuln = "pidusage-1-0-0/vuln.js"
|
|
|
|
|
fixed = "pidusage-1-0-0/fixed.js"
|
|
|
|
|
relpath = "lib/stats.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2017"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "lib/stats.js"
|
|
|
|
|
function = "ps"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink lib/stats.js:108:5 fixed upstream in b70eca15f7ca"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "portprocesses-1-0-4"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "rrainn/PortProcesses"
|
|
|
|
|
cve = "CVE-2021-23348"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "86811216c9b97b01b5722f879f8c88a7aa4214e1"
|
|
|
|
|
parent = "fffceb09aff7180afbd0bd172e820404b33c8299"
|
|
|
|
|
commit_url = "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1"
|
|
|
|
|
vuln = "portprocesses-1-0-4/vuln.js"
|
|
|
|
|
fixed = "portprocesses-1-0-4/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2021"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "listProcessesOnPort"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink exec.js:5:3 fixed upstream in 86811216c9b9"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "serve-here-js-1-1-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "ChristoPy/serve-here.js"
|
|
|
|
|
cve = "CVE-2019-5444"
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
commit = "cefb51d03290b6a88dd13143ab2de31b8cf57c39"
|
|
|
|
|
parent = "ad077637bf7a9fe0dee3262f011aed19a45ce92c"
|
|
|
|
|
commit_url = "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39"
|
|
|
|
|
vuln = "serve-here-js-1-1-0/vuln.js"
|
|
|
|
|
fixed = "serve-here-js-1-1-0/fixed.js"
|
|
|
|
|
relpath = "source/response.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2019"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-22"
|
|
|
|
|
class = "path traversal"
|
|
|
|
|
path = "source/response.js"
|
|
|
|
|
function = "ConfigureFilePath"
|
|
|
|
|
mechanism = "path_join_user_input"
|
|
|
|
|
evidence = "SecBench.js path-traversal sink source/server.js:27:15 fixed upstream in cefb51d03290"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "static-eval-1-1-1"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "browserify/static-eval"
|
|
|
|
|
cve = ""
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
commit = "32f8efd072625e267aa7237d2daff35738c50d2a"
|
|
|
|
|
parent = "5bba7905b0e797460b8f6c2e38ff6869146faab3"
|
|
|
|
|
commit_url = "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a"
|
|
|
|
|
vuln = "static-eval-1-1-1/vuln.js"
|
|
|
|
|
fixed = "static-eval-1-1-1/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2019"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
class = "code injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "walk"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "eval"
|
|
|
|
|
evidence = "SecBench.js code-injection sink index.js:118:20 fixed upstream in 32f8efd07262"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "thenify-3-3-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "thenables/thenify"
|
|
|
|
|
cve = "CVE-2020-7677"
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
commit = "0d94a24eb933bc835d568f3009f4d269c4c4c17a"
|
|
|
|
|
parent = "aa21cfb64f47238c764d258d0faf7366a8487e36"
|
|
|
|
|
commit_url = "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a"
|
|
|
|
|
vuln = "thenify-3-3-0/vuln.js"
|
|
|
|
|
fixed = "thenify-3-3-0/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2020"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
class = "code injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "thenify"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "eval"
|
|
|
|
|
evidence = "SecBench.js code-injection sink index.js:17:10 fixed upstream in 0d94a24eb933"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "underscore-1-13-0-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "jashkenas/underscore"
|
|
|
|
|
cve = "CVE-2021-23358"
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
commit = "4c73526d43838ad6ab43a6134728776632adeb66"
|
|
|
|
|
parent = "ef646ccbbbd971e82719c83fc69f56a5585b3a01"
|
|
|
|
|
commit_url = "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66"
|
|
|
|
|
vuln = "underscore-1-13-0-0/vuln.js"
|
|
|
|
|
fixed = "underscore-1-13-0-0/fixed.js"
|
|
|
|
|
relpath = "modules/template.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "train"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2021"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-94"
|
|
|
|
|
class = "code injection"
|
|
|
|
|
path = "modules/template.js"
|
|
|
|
|
function = "template"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "eval"
|
|
|
|
|
evidence = "SecBench.js code-injection sink modules/template.js:71:14 fixed upstream in 4c73526d4383"
|
|
|
|
|
|
|
|
|
|
[[pair]]
|
|
|
|
|
name = "whereis-0-4-0"
|
|
|
|
|
slice = "vfc-js"
|
|
|
|
|
language = "javascript"
|
|
|
|
|
origin = "secbench.js"
|
|
|
|
|
license = "MIT"
|
|
|
|
|
repo = "vvo/node-whereis"
|
|
|
|
|
cve = "CVE-2018-3772"
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
commit = "0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
|
|
|
|
|
parent = "b8b642b1163baa37f15ed49b4064dcbdb6e1876c"
|
|
|
|
|
commit_url = "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
|
|
|
|
|
vuln = "whereis-0-4-0/vuln.js"
|
|
|
|
|
fixed = "whereis-0-4-0/fixed.js"
|
|
|
|
|
relpath = "index.js"
|
|
|
|
|
min_recall = 1.0
|
|
|
|
|
fix_policy = "silent"
|
|
|
|
|
provenance = "human"
|
|
|
|
|
split = "holdout"
|
2026-09-05 09:55:18 +02:00
|
|
|
review_tier = "advisory"
|
2026-09-06 13:15:20 +02:00
|
|
|
fix_date = "2018"
|
2026-09-05 09:27:22 +02:00
|
|
|
|
|
|
|
|
[[pair.expected]]
|
|
|
|
|
cwe = "CWE-78"
|
|
|
|
|
class = "command injection"
|
|
|
|
|
path = "index.js"
|
|
|
|
|
function = "whereis"
|
|
|
|
|
mechanism = "source_reaches_sink"
|
|
|
|
|
sink = "exec"
|
|
|
|
|
evidence = "SecBench.js command-injection sink index.js:4:6 fixed upstream in 0f64e3780235"
|
