Open_Ultra_SAST/plane/runs/validation-46.yaml

# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
# 15 cases, 46 candidates (43 kept by the recorded triage); usd ceiling 2.02.
apiVersion: openultrasast.io/v1alpha1
kind: Run
metadata:
  name: validation-46
spec:
  tasks:
  - name: budibase-mongo-template-nosqli-facts
    task: repo-facts-budibase-mongo-template-nosqli
    outputs:
    - facts.json
    budget: &id001
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: budibase-mongo-template-nosqli-va
    task: verify-a-budibase-mongo-template-nosqli
    inputs:
      facts: budibase-mongo-template-nosqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.06
      calls: 16
  - name: budibase-mongo-template-nosqli-vb
    task: verify-b-budibase-mongo-template-nosqli
    inputs:
      facts: budibase-mongo-template-nosqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.06
      calls: 16
  - name: budibase-mongo-template-nosqli-agree
    task: agree-budibase-mongo-template-nosqli
    inputs:
      pass_a: budibase-mongo-template-nosqli-va/units.jsonl
      pass_b: budibase-mongo-template-nosqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id001
  - name: cct-studio-server-cmdi-facts
    task: repo-facts-cct-studio-server-cmdi
    outputs:
    - facts.json
    budget: &id002
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: cct-studio-server-cmdi-va
    task: verify-a-cct-studio-server-cmdi
    inputs:
      facts: cct-studio-server-cmdi-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.04
      calls: 8
  - name: cct-studio-server-cmdi-vb
    task: verify-b-cct-studio-server-cmdi
    inputs:
      facts: cct-studio-server-cmdi-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.04
      calls: 8
  - name: cct-studio-server-cmdi-agree
    task: agree-cct-studio-server-cmdi
    inputs:
      pass_a: cct-studio-server-cmdi-va/units.jsonl
      pass_b: cct-studio-server-cmdi-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id002
  - name: contextforge-prompt-ssti-facts
    task: repo-facts-contextforge-prompt-ssti
    outputs:
    - facts.json
    budget: &id003
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: contextforge-prompt-ssti-va
    task: verify-a-contextforge-prompt-ssti
    inputs:
      facts: contextforge-prompt-ssti-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.04
      calls: 8
  - name: contextforge-prompt-ssti-vb
    task: verify-b-contextforge-prompt-ssti
    inputs:
      facts: contextforge-prompt-ssti-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.04
      calls: 8
  - name: contextforge-prompt-ssti-agree
    task: agree-contextforge-prompt-ssti
    inputs:
      pass_a: contextforge-prompt-ssti-va/units.jsonl
      pass_b: contextforge-prompt-ssti-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id003
  - name: froxlor-admin-ip-second-order-sqli-facts
    task: repo-facts-froxlor-admin-ip-second-order-sqli
    outputs:
    - facts.json
    budget: &id004
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: froxlor-admin-ip-second-order-sqli-va
    task: verify-a-froxlor-admin-ip-second-order-sqli
    inputs:
      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.07
      calls: 16
  - name: froxlor-admin-ip-second-order-sqli-vb
    task: verify-b-froxlor-admin-ip-second-order-sqli
    inputs:
      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.07
      calls: 16
  - name: froxlor-admin-ip-second-order-sqli-agree
    task: agree-froxlor-admin-ip-second-order-sqli
    inputs:
      pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
      pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id004
  - name: fuxa-tdengine-escape-sqli-facts
    task: repo-facts-fuxa-tdengine-escape-sqli
    outputs:
    - facts.json
    budget: &id005
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: fuxa-tdengine-escape-sqli-va
    task: verify-a-fuxa-tdengine-escape-sqli
    inputs:
      facts: fuxa-tdengine-escape-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.12
      calls: 8
  - name: fuxa-tdengine-escape-sqli-vb
    task: verify-b-fuxa-tdengine-escape-sqli
    inputs:
      facts: fuxa-tdengine-escape-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.12
      calls: 8
  - name: fuxa-tdengine-escape-sqli-agree
    task: agree-fuxa-tdengine-escape-sqli
    inputs:
      pass_a: fuxa-tdengine-escape-sqli-va/units.jsonl
      pass_b: fuxa-tdengine-escape-sqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id005
  - name: lmdeploy-media-url-ssrf-facts
    task: repo-facts-lmdeploy-media-url-ssrf
    outputs:
    - facts.json
    budget: &id006
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: lmdeploy-media-url-ssrf-va
    task: verify-a-lmdeploy-media-url-ssrf
    inputs:
      facts: lmdeploy-media-url-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: lmdeploy-media-url-ssrf-vb
    task: verify-b-lmdeploy-media-url-ssrf
    inputs:
      facts: lmdeploy-media-url-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: lmdeploy-media-url-ssrf-agree
    task: agree-lmdeploy-media-url-ssrf
    inputs:
      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id006
  - name: medplum-external-auth-open-redirect-facts
    task: repo-facts-medplum-external-auth-open-redirect
    outputs:
    - facts.json
    budget: &id007
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: medplum-external-auth-open-redirect-va
    task: verify-a-medplum-external-auth-open-redirect
    inputs:
      facts: medplum-external-auth-open-redirect-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: medplum-external-auth-open-redirect-vb
    task: verify-b-medplum-external-auth-open-redirect
    inputs:
      facts: medplum-external-auth-open-redirect-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: medplum-external-auth-open-redirect-agree
    task: agree-medplum-external-auth-open-redirect
    inputs:
      pass_a: medplum-external-auth-open-redirect-va/units.jsonl
      pass_b: medplum-external-auth-open-redirect-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id007
  - name: pgadmin-maintenance-sqli-facts
    task: repo-facts-pgadmin-maintenance-sqli
    outputs:
    - facts.json
    budget: &id008
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: pgadmin-maintenance-sqli-va
    task: verify-a-pgadmin-maintenance-sqli
    inputs:
      facts: pgadmin-maintenance-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.45
      calls: 96
  - name: pgadmin-maintenance-sqli-vb
    task: verify-b-pgadmin-maintenance-sqli
    inputs:
      facts: pgadmin-maintenance-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.45
      calls: 96
  - name: pgadmin-maintenance-sqli-agree
    task: agree-pgadmin-maintenance-sqli
    inputs:
      pass_a: pgadmin-maintenance-sqli-va/units.jsonl
      pass_b: pgadmin-maintenance-sqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id008
  - name: qwed-sympy-eval-facts
    task: repo-facts-qwed-sympy-eval
    outputs:
    - facts.json
    budget: &id009
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: qwed-sympy-eval-va
    task: verify-a-qwed-sympy-eval
    inputs:
      facts: qwed-sympy-eval-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: qwed-sympy-eval-vb
    task: verify-b-qwed-sympy-eval
    inputs:
      facts: qwed-sympy-eval-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: qwed-sympy-eval-agree
    task: agree-qwed-sympy-eval
    inputs:
      pass_a: qwed-sympy-eval-va/units.jsonl
      pass_b: qwed-sympy-eval-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id009
  - name: reactpress-findall-column-sqli-facts
    task: repo-facts-reactpress-findall-column-sqli
    outputs:
    - facts.json
    budget: &id010
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: reactpress-findall-column-sqli-va
    task: verify-a-reactpress-findall-column-sqli
    inputs:
      facts: reactpress-findall-column-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: reactpress-findall-column-sqli-vb
    task: verify-b-reactpress-findall-column-sqli
    inputs:
      facts: reactpress-findall-column-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: reactpress-findall-column-sqli-agree
    task: agree-reactpress-findall-column-sqli
    inputs:
      pass_a: reactpress-findall-column-sqli-va/units.jsonl
      pass_b: reactpress-findall-column-sqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id010
  - name: unleash-addon-webhook-ssrf-facts
    task: repo-facts-unleash-addon-webhook-ssrf
    outputs:
    - facts.json
    budget: &id011
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: unleash-addon-webhook-ssrf-va
    task: verify-a-unleash-addon-webhook-ssrf
    inputs:
      facts: unleash-addon-webhook-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.03
      calls: 8
  - name: unleash-addon-webhook-ssrf-vb
    task: verify-b-unleash-addon-webhook-ssrf
    inputs:
      facts: unleash-addon-webhook-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.03
      calls: 8
  - name: unleash-addon-webhook-ssrf-agree
    task: agree-unleash-addon-webhook-ssrf
    inputs:
      pass_a: unleash-addon-webhook-ssrf-va/units.jsonl
      pass_b: unleash-addon-webhook-ssrf-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id011
  - name: winml-cli-serve-cors-facts
    task: repo-facts-winml-cli-serve-cors
    outputs:
    - facts.json
    budget: &id012
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: winml-cli-serve-cors-va
    task: verify-a-winml-cli-serve-cors
    inputs:
      facts: winml-cli-serve-cors-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: winml-cli-serve-cors-vb
    task: verify-b-winml-cli-serve-cors
    inputs:
      facts: winml-cli-serve-cors-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: winml-cli-serve-cors-agree
    task: agree-winml-cli-serve-cors
    inputs:
      pass_a: winml-cli-serve-cors-va/units.jsonl
      pass_b: winml-cli-serve-cors-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id012
  - name: wp-directorist-avatar-ssrf-facts
    task: repo-facts-wp-directorist-avatar-ssrf
    outputs:
    - facts.json
    budget: &id013
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: wp-directorist-avatar-ssrf-va
    task: verify-a-wp-directorist-avatar-ssrf
    inputs:
      facts: wp-directorist-avatar-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.03
      calls: 8
  - name: wp-directorist-avatar-ssrf-vb
    task: verify-b-wp-directorist-avatar-ssrf
    inputs:
      facts: wp-directorist-avatar-ssrf-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.03
      calls: 8
  - name: wp-directorist-avatar-ssrf-agree
    task: agree-wp-directorist-avatar-ssrf
    inputs:
      pass_a: wp-directorist-avatar-ssrf-va/units.jsonl
      pass_b: wp-directorist-avatar-ssrf-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id013
  - name: wp-gopay-log-filter-sqli-facts
    task: repo-facts-wp-gopay-log-filter-sqli
    outputs:
    - facts.json
    budget: &id014
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: wp-gopay-log-filter-sqli-va
    task: verify-a-wp-gopay-log-filter-sqli
    inputs:
      facts: wp-gopay-log-filter-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: wp-gopay-log-filter-sqli-vb
    task: verify-b-wp-gopay-log-filter-sqli
    inputs:
      facts: wp-gopay-log-filter-sqli-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.02
      calls: 8
  - name: wp-gopay-log-filter-sqli-agree
    task: agree-wp-gopay-log-filter-sqli
    inputs:
      pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
      pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id014
  - name: wp-groundhogg-confirm-redirect-facts
    task: repo-facts-wp-groundhogg-confirm-redirect
    outputs:
    - facts.json
    budget: &id015
      usd: 0
      calls: 0
    serialize: repo-facts
  - name: wp-groundhogg-confirm-redirect-va
    task: verify-a-wp-groundhogg-confirm-redirect
    inputs:
      facts: wp-groundhogg-confirm-redirect-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.05
      calls: 8
  - name: wp-groundhogg-confirm-redirect-vb
    task: verify-b-wp-groundhogg-confirm-redirect
    inputs:
      facts: wp-groundhogg-confirm-redirect-facts/facts.json
    outputs:
    - units.jsonl
    - summary.json
    budget:
      usd: 0.05
      calls: 8
  - name: wp-groundhogg-confirm-redirect-agree
    task: agree-wp-groundhogg-confirm-redirect
    inputs:
      pass_a: wp-groundhogg-confirm-redirect-va/units.jsonl
      pass_b: wp-groundhogg-confirm-redirect-vb/units.jsonl
    outputs:
    - agreed.json
    - disputed.json
    budget: *id015