feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
2026-10-16 11:49:28 +00:00 · 2026-09-04 13:57:33 +02:00
parent 32aa92191a
commit 1ae41eea19
76 changed files with 6538 additions and 29 deletions
@@ -0,0 +1,27 @@
+package cn.hutool.core.util;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.util.Enumeration;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+
+/**
+ * Excerpt of hutool ZipUtil.unzip after CVE-2018-17297 (Zip Slip / CWE-22).
+ * https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e
+ */
+public class ZipUtil {
+    public static File unzip(File zipFile, File outFile, Charset charset) throws Exception {
+        ZipFile zipFileObj = new ZipFile(zipFile, charset);
+        Enumeration<? extends ZipEntry> em = zipFileObj.entries();
+        while (em.hasMoreElements()) {
+            ZipEntry zipEntry = em.nextElement();
+            File outItemFile = FileUtil.file(outFile, zipEntry.getName());
+            if (zipEntry.isDirectory()) {
+                outItemFile.mkdirs();
+            }
+        }
+        zipFileObj.close();
+        return outFile;
+    }
+}
@@ -0,0 +1,28 @@
+package cn.hutool.core.util;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.util.Enumeration;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+
+/**
+ * Excerpt of hutool ZipUtil.unzip before CVE-2018-17297 (Zip Slip / CWE-22).
+ * https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e
+ * parent fd77bb8718648f69a587046b735488a80123cc26
+ */
+public class ZipUtil {
+    public static File unzip(File zipFile, File outFile, Charset charset) throws Exception {
+        ZipFile zipFileObj = new ZipFile(zipFile, charset);
+        Enumeration<? extends ZipEntry> em = zipFileObj.entries();
+        while (em.hasMoreElements()) {
+            ZipEntry zipEntry = em.nextElement();
+            File outItemFile = new File(outFile, zipEntry.getName());
+            if (zipEntry.isDirectory()) {
+                outItemFile.mkdirs();
+            }
+        }
+        zipFileObj.close();
+        return outFile;
+    }
+}
@@ -0,0 +1,6 @@
+// Fixed counterpart of the node-serialize CVE-2017-5941 eval pattern (CWE-95).
+function parsePayload(obj) {
+  return JSON.parse(obj);
+}
+
+module.exports = { parsePayload };
@@ -0,0 +1,7 @@
+// Pattern from npm node-serialize CVE-2017-5941 (CWE-95): unserialize via eval.
+// Public advisory: https://nvd.nist.gov/vuln/detail/CVE-2017-5941
+function parsePayload(obj) {
+  return eval("(" + obj + ")");
+}
+
+module.exports = { parsePayload };
@@ -0,0 +1,10 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/Internet-of-People/titania-os/commit/9b7805119938343fcac9dc929d8882f1d97cf14a
+# file vuedj/configtitania/views.py function add_user
+import crypt
+import subprocess
+
+
+def add_user(username, password):
+    encPass = crypt.crypt(password, "22")
+    subprocess.call(["useradd", "-G", "docker,wheel", "-p", encPass, username])
@@ -0,0 +1,10 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/Internet-of-People/titania-os/commit/9b7805119938343fcac9dc929d8882f1d97cf14a
+# file vuedj/configtitania/views.py function add_user
+import crypt
+import os
+
+
+def add_user(username, password):
+    encPass = crypt.crypt(password, "22")
+    os.system("useradd -G docker,wheel -p " + encPass + " " + username)
@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee
+# file mobly/controllers/android_device_lib/adb.py function _exec_cmd
+import logging
+import subprocess
+
+
+class AdbError(Exception):
+    def __init__(self, **kwargs):
+        super().__init__(kwargs)
+
+
+class Adb:
+    def _exec_cmd(self, args, shell):
+        """Executes adb commands."""
+        proc = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=shell)
+        (out, err) = proc.communicate()
+        ret = proc.returncode
+        logging.debug("cmd: %s, stdout: %s, stderr: %s, ret: %s", args, out, err, ret)
+        if ret == 0:
+            return out
+        raise AdbError(cmd=args, stdout=out, stderr=err, ret_code=ret)
@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee
+# file mobly/controllers/android_device_lib/adb.py function _exec_cmd
+import logging
+import subprocess
+
+
+class AdbError(Exception):
+    def __init__(self, **kwargs):
+        super().__init__(kwargs)
+
+
+class Adb:
+    def _exec_cmd(self, cmd):
+        """Executes adb commands in a new shell."""
+        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+        (out, err) = proc.communicate()
+        ret = proc.returncode
+        logging.debug("cmd: %s, stdout: %s, stderr: %s, ret: %s", cmd, out, err, ret)
+        if ret == 0:
+            return out
+        raise AdbError(cmd=cmd, stdout=out, stderr=err, ret_code=ret)
@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-89 function pair from
+# https://github.com/russ-lewis/ttt_-_python_cgi/commit/6096f43fd4b2d91211eec4614b7960c0816900da
+# file cgi/common.py function build_board
+
+
+def build_board(conn, game, size):
+    board = []
+    for i in range(size):
+        board.append([""] * size)
+
+    cursor = conn.cursor()
+    cursor.execute("SELECT x,y,letter FROM moves WHERE gameID = %d;", (game,))
+
+    counts = {"X": 0, "O": 0}
+    for move in cursor.fetchall():
+        (x, y, letter) = move
+        x = int(x)
+        y = int(y)
+        board[x][y] = letter
+        counts[letter] += 1
+    cursor.close()
+    return (board, counts)
@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-89 function pair from
+# https://github.com/russ-lewis/ttt_-_python_cgi/commit/6096f43fd4b2d91211eec4614b7960c0816900da
+# file cgi/common.py function build_board
+
+
+def build_board(conn, game, size):
+    board = []
+    for i in range(size):
+        board.append([""] * size)
+
+    cursor = conn.cursor()
+    cursor.execute("SELECT x,y,letter FROM moves WHERE gameID = %d;" % game)
+
+    counts = {"X": 0, "O": 0}
+    for move in cursor.fetchall():
+        (x, y, letter) = move
+        x = int(x)
+        y = int(y)
+        board[x][y] = letter
+        counts[letter] += 1
+    cursor.close()
+    return (board, counts)
@@ -0,0 +1,14 @@
+# Provenance: SVEN train CWE-89 function pair from
+# https://github.com/pukkapies/urop2019/commit/3ca2e2c291d2d5fe262d20a8e0520bdfb622432b
+# file modules/query_lastfm.py function tag_num_to_tag
+
+
+class QueryStore:
+    def tag_num_to_tag(self, tag_num):
+        """Returns tag given tag_num."""
+        q = "SELECT tag FROM tags WHERE rowid = ?"
+        self.query(q, tag_num)
+        return self.c.fetchone()[0]
+
+    def query(self, q, *args):
+        return q
@@ -0,0 +1,14 @@
+# Provenance: SVEN train CWE-89 function pair from
+# https://github.com/pukkapies/urop2019/commit/3ca2e2c291d2d5fe262d20a8e0520bdfb622432b
+# file modules/query_lastfm.py function tag_num_to_tag
+
+
+class QueryStore:
+    def tag_num_to_tag(self, tag_num):
+        """Returns tag given tag_num."""
+        q = "SELECT tag FROM tags WHERE rowid = '" + str(tag_num) + "'"
+        self.query(q)
+        return self.c.fetchone()[0]
+
+    def query(self, q):
+        return q