marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Browse Source 
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.
This commit is contained in:
Marius Ciepluch
2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/pairs/README.md
+7
View File
@@ -34,12 +34,19 @@ Pairs in this directory **must not** join `LANGUAGE_MANIFESTS`.
- **sast** — OWASP Benchmark Java/Python true-vs-false files and Juliet
bad-vs-good sinks (`benchmarks/pairs/sast/`). Score is Youden (TPR − FPR).
Honesty dashboard, not a CI fail.
- **vfc** — reviewed isolated functions from OpenSSL, Firefox, Chromium, and
curl (`benchmarks/pairs/vfc/`). Overlay vs inventory scoreboard. Honesty
dashboard, not a CI fail. Training labels (vuln vs fixed) are
`vfc/training/manifest.jsonl` (vuln vs fixed, one snapshot per line).
Grow with a blobless `git log --grep=CVE-202` mine plus `vfc/harvest.py`,
then `vfc/generate_catalog.py` (maintainer, not CI).
## Commands
```bash
uv run ousast pairs
uv run ousast pairs --slice github --json
uv run ousast pairs --slice vfc --json
uv run python -m openultrasast.pair_gate
```