feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/chromium-cve-2022-2162/fixed.cc

@@ -0,0 +1,44 @@
+// Provenance: chromium/chromium IsShellIntegratedExtension (fixed).
+// repo: chromium/chromium
+// commit: 22c61cfae5d1b37c773e638d342488ae11118b51
+// parent: a07d0ae0a7dc68686adca10dcf11138cb2f4ab6d
+// commit_url: https://github.com/chromium/chromium/commit/22c61cfae5d1b37c773e638d342488ae11118b51
+// cve: CVE-2022-2162
+// license: BSD-3-Clause
+// function: IsShellIntegratedExtension
+// relpath: content/browser/file_system_access/file_system_chooser.cc
+
+bool FileSystemChooser::IsShellIntegratedExtension(
+    const base::FilePath::StringType& extension) {
+  // TODO(https://crbug.com/1154757): Figure out some way to unify this with
+  // net::IsSafePortablePathComponent, with the result probably ending up in
+  // base/i18n/file_util_icu.h.
+  // - For the sake of consistency across platforms, we sanitize '.lnk' and
+  //   '.local' files on all platforms (not just Windows)
+  // - There are some extensions (i.e. '.scf') we would like to sanitize which
+  //   `net::GenerateFileName()` does not
+  base::FilePath::StringType extension_lower =
+      base::ToLowerASCII(GetLastExtension(extension));
+
+  // '.lnk' and '.scf' files may be used to execute arbitrary code (see
+  // https://nvd.nist.gov/vuln/detail/CVE-2010-2568 and
+  // https://crbug.com/1227995, respectively). '.local' files are used by
+  // Windows to determine which DLLs to load for an application. '.url' files
+  // can be used to read arbirtary files (see https://crbug.com/1307930).
+  if ((extension_lower == FILE_PATH_LITERAL("lnk")) ||
+      (extension_lower == FILE_PATH_LITERAL("local")) ||
+      (extension_lower == FILE_PATH_LITERAL("scf")) ||
+      (extension_lower == FILE_PATH_LITERAL("url"))) {
+    return true;
+  }
+
+  // Setting a file's extension to a CLSID may conceal its actual file type on
+  // some Windows versions (see https://nvd.nist.gov/vuln/detail/CVE-2004-0420).
+  if (!extension_lower.empty() &&
+      (extension_lower.front() == FILE_PATH_LITERAL('{')) &&
+      (extension_lower.back() == FILE_PATH_LITERAL('}'))) {
+    return true;
+  }
+
+  return false;
+}