marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-19 13:10:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Browse Source 
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.
This commit is contained in:
Marius Ciepluch
2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/pairs/vfc/training/README.md
+22
View File
@@ -0,0 +1,22 @@
# VFC training catalog
Each JSONL row is one isolated snapshot: **vuln** (positive) or **fixed** (negative).
```bash
python3 benchmarks/pairs/vfc/generate_catalog.py
```
`manifest.jsonl` fields: `id`, `pair`, `label` (`vuln`|`fixed`), `cve`, `year`, `cwe`, `project`, `file`, `relpath`, `license`, `commit`, `commit_url`.
The JSONL is the training index. Pair eval (`ousast pairs --slice vfc`) is the honesty dashboard, not a merge gate.
Filter 2020–2026:
```python
import json
from pathlib import Path
rows = [json.loads(line) for line in Path("benchmarks/pairs/vfc/training/manifest.jsonl").read_text().splitlines()]
recent = [row for row in rows if 2020 <= row["year"] <= 2026]
```
Do not treat this slice as a merge gate. Memory-safety pairs often LEAK after the fix; UAF/type-confusion often MISS inventory.