marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

bench(pairs): real fix-commit pairs for the short families

Browse Source 
97 advisory-fix pairs, one repository each (309 advisories examined, 212
rejected with reasons in research-2026-10-01.md): a public fix commit
distinct from its parent, the advisory-named function declared on both
sides with a changed body. Pointer pairs: materialize.py reads one file
per side from a shallow blobless fetch into the pair cache and verifies
them with the label builder's matcher (verification.json, bytes read).

learn/sources.toml lists the catalog as the advisory-fixes source. Label
snapshot: negative repository groups untrusted_destination 8->25, path
3->21, output_encoding 1->22, deserialization 0->21, access_control 0->20;
all five reach the per-family floor. Five pairs on reserved repositories
were dropped after the reserved-population guard flagged them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-01 11:51:28 +02:00
co-authored by Claude Opus 5.5
parent 658f2d5e39
commit 53c9a7cc65
8 changed files with 5081 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/measurements/2026-10-01-decision-engine-labels-advisory-fixes/advisory-fixes-spread.json
+187
View File
@@ -0,0 +1,187 @@
{
"created": "2026-10-01",
"note": "Counts only. The advisory-fix catalog (benchmarks/pairs/advisory-fixes/catalog.toml) per family: one pair = one repository group, each a real fix (fix commit != parent, the advisory-named function declared on both sides, body changed; verification.json). framework is the catalog's informational field ('none' = a library or no web framework); the label builder itself records no framework for pair rows.",
"families": {
"access_control": {
"pairs": 20,
"language": {
"go": 4,
"python": 4,
"java": 3,
"javascript/typescript": 3,
"csharp": 2,
"php": 2,
"ruby": 2
},
"framework": {
"none": 5,
"django": 3,
"aspnetcore": 2,
"rails": 2,
"echo": 1,
"hono": 1,
"jenkins": 1,
"payload": 1,
"spring": 1,
"starlette": 1,
"symfony": 1,
"winter": 1
},
"licence": {
"MIT": 8,
"Apache-2.0": 5,
"BSD-3-Clause": 4,
"AGPL-3.0": 2,
"GPL-2.0": 1
},
"split": {
"holdout": 10,
"train": 10
}
},
"deserialization": {
"pairs": 21,
"language": {
"python": 5,
"java": 4,
"php": 4,
"csharp": 3,
"ruby": 3,
"javascript/typescript": 2
},
"framework": {
"none": 12,
"typo3": 2,
"aiohttp": 1,
"asp.net": 1,
"jooby": 1,
"karaf": 1,
"laravel": 1,
"rails": 1,
"react-router": 1
},
"licence": {
"MIT": 10,
"Apache-2.0": 7,
"GPL-2.0": 1,
"GPL-3.0": 1,
"MPL-1.1": 1,
"MPL-2.0": 1
},
"split": {
"train": 11,
"holdout": 10
}
},
"output_encoding": {
"pairs": 21,
"language": {
"javascript/typescript": 4,
"php": 4,
"python": 4,
"java": 3,
"csharp": 2,
"go": 2,
"ruby": 2
},
"framework": {
"none": 10,
"django": 1,
"express": 1,
"fiber": 1,
"hono": 1,
"jenkins": 1,
"jquery": 1,
"jsf": 1,
"laravel": 1,
"rails": 1,
"silverstripe": 1,
"tornado": 1
},
"licence": {
"MIT": 13,
"Apache-2.0": 5,
"BSD-3-Clause": 3
},
"split": {
"train": 11,
"holdout": 10
}
},
"path": {
"pairs": 18,
"language": {
"java": 4,
"go": 3,
"javascript/typescript": 3,
"ruby": 3,
"php": 2,
"python": 2,
"csharp": 1
},
"framework": {
"none": 4,
"fastify": 2,
"spring": 2,
"aspnet": 1,
"express": 1,
"flask": 1,
"jenkins": 1,
"laravel": 1,
"rack": 1,
"rails": 1,
"tornado": 1,
"wicket": 1,
"yii": 1
},
"licence": {
"MIT": 11,
"Apache-2.0": 5,
"BSD-2-Clause": 1,
"BSD-3-Clause": 1
},
"split": {
"holdout": 9,
"train": 9
}
},
"untrusted_destination": {
"pairs": 17,
"language": {
"php": 4,
"python": 4,
"javascript/typescript": 3,
"go": 2,
"java": 2,
"csharp": 1,
"ruby": 1
},
"framework": {
"jenkins": 2,
"net/http": 2,
"none": 2,
"cakephp": 1,
"django": 1,
"feathers": 1,
"flask": 1,
"grav": 1,
"koa": 1,
"laravel": 1,
"nuxt": 1,
"rails": 1,
"symfony": 1,
"tornado": 1
},
"licence": {
"MIT": 13,
"Apache-2.0": 2,
"BSD-3-Clause": 2
},
"split": {
"train": 9,
"holdout": 8
}
}
},
"pairs": 97
}
benchmarks/measurements/2026-10-01-decision-engine-labels-advisory-fixes/labels.json
+507
View File
@@ -0,0 +1,507 @@
{
"assumed_benign_history": {
"accepted": 969,
"commits_scanned": 36000,
"rejected": {
"bulk change": 278,
"dependency": 2206,
"english": 4251,
"later fix touches its files": 3168,
"near_fix": 4911,
"no changed function": 50,
"no product source": 2368,
"other_language": 2,
"protocol pin": 55,
"reference": 77
},
"repositories": 28
},
"conditional_negatives": {
"assumed_benign": {
"by_language": {
"go": 18,
"javascript": 2136,
"php": 832,
"python": 1049,
"typescript": 636
},
"groups": 27,
"pushes": 969,
"rows": 4671
},
"benign_control": {
"by_language": {
"javascript": 7,
"php": 27,
"python": 23,
"typescript": 15
},
"groups": 24,
"pushes": 24,
"rows": 72
}
},
"created": "2026-10-01",
"excluded_unread": [
"candidates-v3-php.json",
"freeze-v3-php.json",
"population-v3-php.toml",
"protocol-v3.md",
"research-2026-09-30-php.md"
],
"floors": {
"per_family": 20,
"pooled": 10,
"unit": "repository groups with positive and with negative pin labels"
},
"group_merges": {
"advisory": 0,
"alias": 0,
"commit": 0
},
"groups": 202,
"note": "Label snapshot after adding the advisory-fixes source (benchmarks/pairs/advisory-fixes, 97 real fix-commit pairs, one repository each, none already named under benchmarks/ and none reserved). COUNTS ONLY, same builder and sources as 2026-10-01-decision-engine-labels plus that one source. Every new pair gave a fixed-side negative (pair_fixed_side.absent_fixed_side is unchanged at 108); groups 105 -> 202 with no merges. All five short families now reach the per-family floor of 20 negative groups. Language/framework spread of the new pairs: advisory-fixes-spread.json. Supersedes 2026-10-01-decision-engine-labels for the per-family floors.",
"pair_fixed_side": {
"absent_fixed_side": {
"by_family": {
"access_control": 13,
"config_secrets": 4,
"deserialization": 20,
"injection": 18,
"output_encoding": 16,
"path": 11,
"untrusted_destination": 26
},
"labels": 108
},
"fixed_side_moved": 0
},
"rows": 6589,
"schema": 1,
"skipped": {
"pairs: label names no function": 44,
"pairs: no fixed-side negative (fixed side is another function of the same snapshot)": 108,
"pairs: title tier (sensitivity arm)": 58,
"pairs: unscorable pair": 7,
"population: positive the fix did not change (no negative)": 22
},
"sources": [
"adjudications",
"advisory-fixes",
"assumed_benign",
"dev-php",
"pairs",
"population-v1",
"population-v2"
],
"verified_delta_labels": {
"access_control:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 32,
"positive_rows": 33
},
"access_control:repair": {
"negative_groups": 20,
"negative_rows": 20,
"positive_groups": 0,
"positive_rows": 0
},
"config_secrets:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 5,
"positive_rows": 18
},
"config_secrets:repair": {
"negative_groups": 2,
"negative_rows": 12,
"positive_groups": 0,
"positive_rows": 0
},
"deserialization:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 41,
"positive_rows": 41
},
"deserialization:repair": {
"negative_groups": 21,
"negative_rows": 21,
"positive_groups": 0,
"positive_rows": 0
},
"injection:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 42,
"positive_rows": 77
},
"injection:repair": {
"negative_groups": 33,
"negative_rows": 48,
"positive_groups": 0,
"positive_rows": 0
},
"memory:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 5,
"positive_rows": 173
},
"memory:repair": {
"negative_groups": 5,
"negative_rows": 173,
"positive_groups": 0,
"positive_rows": 0
},
"output_encoding:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 36,
"positive_rows": 77
},
"output_encoding:repair": {
"negative_groups": 22,
"negative_rows": 61,
"positive_groups": 0,
"positive_rows": 0
},
"path:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 32,
"positive_rows": 32
},
"path:repair": {
"negative_groups": 21,
"negative_rows": 21,
"positive_groups": 0,
"positive_rows": 0
},
"unknown:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 2,
"positive_rows": 2
},
"unknown:repair": {
"negative_groups": 2,
"negative_rows": 2,
"positive_groups": 0,
"positive_rows": 0
},
"untrusted_destination:introduce": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 52,
"positive_rows": 62
},
"untrusted_destination:repair": {
"negative_groups": 24,
"negative_rows": 27,
"positive_groups": 0,
"positive_rows": 0
}
},
"verified_pin_labels": {
"by_family": {
"access_control": {
"model": "per_family",
"negative_groups": 20,
"negative_rows": 20,
"positive_groups": 32,
"positive_rows": 33
},
"config_secrets": {
"model": "insufficient",
"negative_groups": 2,
"negative_rows": 13,
"positive_groups": 5,
"positive_rows": 18
},
"deserialization": {
"model": "per_family",
"negative_groups": 21,
"negative_rows": 21,
"positive_groups": 41,
"positive_rows": 41
},
"injection": {
"model": "per_family",
"negative_groups": 33,
"negative_rows": 71,
"positive_groups": 44,
"positive_rows": 81
},
"memory": {
"model": "insufficient",
"negative_groups": 5,
"negative_rows": 173,
"positive_groups": 5,
"positive_rows": 173
},
"output_encoding": {
"model": "per_family",
"negative_groups": 22,
"negative_rows": 61,
"positive_groups": 36,
"positive_rows": 77
},
"path": {
"model": "per_family",
"negative_groups": 21,
"negative_rows": 21,
"positive_groups": 33,
"positive_rows": 33
},
"unknown": {
"model": "insufficient",
"negative_groups": 2,
"negative_rows": 2,
"positive_groups": 2,
"positive_rows": 2
},
"untrusted_destination": {
"model": "per_family",
"negative_groups": 25,
"negative_rows": 43,
"positive_groups": 52,
"positive_rows": 63
}
},
"by_framework": {
"django": {
"negative_groups": 1,
"negative_rows": 2,
"positive_groups": 1,
"positive_rows": 2
},
"express": {
"negative_groups": 3,
"negative_rows": 6,
"positive_groups": 4,
"positive_rows": 12
},
"flask": {
"negative_groups": 2,
"negative_rows": 3,
"positive_groups": 2,
"positive_rows": 3
},
"httpx": {
"negative_groups": 3,
"negative_rows": 4,
"positive_groups": 3,
"positive_rows": 6
},
"lodash": {
"negative_groups": 5,
"negative_rows": 9,
"positive_groups": 6,
"positive_rows": 15
},
"node-http-clients": {
"negative_groups": 4,
"negative_rows": 8,
"positive_groups": 5,
"positive_rows": 9
},
"none": {
"negative_groups": 8,
"negative_rows": 25,
"positive_groups": 9,
"positive_rows": 36
},
"pyyaml": {
"negative_groups": 3,
"negative_rows": 5,
"positive_groups": 3,
"positive_rows": 6
},
"react": {
"negative_groups": 4,
"negative_rows": 4,
"positive_groups": 4,
"positive_rows": 5
},
"requests": {
"negative_groups": 5,
"negative_rows": 8,
"positive_groups": 5,
"positive_rows": 10
},
"sanitize-html": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 1,
"positive_rows": 1
},
"sqlalchemy": {
"negative_groups": 2,
"negative_rows": 2,
"positive_groups": 2,
"positive_rows": 3
},
"unknown": {
"negative_groups": 137,
"negative_rows": 372,
"positive_groups": 174,
"positive_rows": 443
},
"vue": {
"negative_groups": 3,
"negative_rows": 5,
"positive_groups": 4,
"positive_rows": 6
},
"wordpress": {
"negative_groups": 5,
"negative_rows": 8,
"positive_groups": 9,
"positive_rows": 13
}
},
"by_language": {
"c_cpp": {
"negative_groups": 5,
"negative_rows": 173,
"positive_groups": 5,
"positive_rows": 173
},
"csharp": {
"negative_groups": 9,
"negative_rows": 9,
"positive_groups": 9,
"positive_rows": 9
},
"go": {
"negative_groups": 11,
"negative_rows": 11,
"positive_groups": 11,
"positive_rows": 11
},
"java": {
"negative_groups": 17,
"negative_rows": 56,
"positive_groups": 17,
"positive_rows": 56
},
"javascript": {
"negative_groups": 30,
"negative_rows": 35,
"positive_groups": 27,
"positive_rows": 36
},
"php": {
"negative_groups": 25,
"negative_rows": 42,
"positive_groups": 29,
"positive_rows": 38
},
"python": {
"negative_groups": 29,
"negative_rows": 42,
"positive_groups": 78,
"positive_rows": 151
},
"ruby": {
"negative_groups": 11,
"negative_rows": 11,
"positive_groups": 11,
"positive_rows": 11
},
"typescript": {
"negative_groups": 17,
"negative_rows": 43,
"positive_groups": 17,
"positive_rows": 33
},
"unknown": {
"negative_groups": 1,
"negative_rows": 3,
"positive_groups": 1,
"positive_rows": 3
}
},
"by_source": {
"adjudications": {
"negative_groups": 15,
"negative_rows": 40,
"positive_groups": 3,
"positive_rows": 3
},
"dev-php": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 3,
"positive_rows": 3
},
"pairs": {
"negative_groups": 122,
"negative_rows": 332,
"positive_groups": 171,
"positive_rows": 440
},
"population-v1": {
"negative_groups": 11,
"negative_rows": 35,
"positive_groups": 11,
"positive_rows": 50
},
"population-v2": {
"negative_groups": 14,
"negative_rows": 18,
"positive_groups": 17,
"positive_rows": 25
}
},
"by_split": {
"dev-php": {
"negative_groups": 0,
"negative_rows": 0,
"positive_groups": 3,
"positive_rows": 3
},
"holdout": {
"negative_groups": 59,
"negative_rows": 182,
"positive_groups": 110,
"positive_rows": 236
},
"population-v1": {
"negative_groups": 11,
"negative_rows": 46,
"positive_groups": 11,
"positive_rows": 51
},
"population-v2": {
"negative_groups": 15,
"negative_rows": 47,
"positive_groups": 17,
"positive_rows": 27
},
"train": {
"negative_groups": 66,
"negative_rows": 150,
"positive_groups": 115,
"positive_rows": 204
}
},
"design_informed": {
"adjudications": {
"negative_groups": 13,
"negative_rows": 29,
"positive_groups": 2,
"positive_rows": 2
},
"population-v2": {
"negative_groups": 14,
"negative_rows": 18,
"positive_groups": 17,
"positive_rows": 25
}
},
"privileged_positives": 2
}
}
benchmarks/pairs/advisory-fixes/catalog.toml
+3116
View File
File diff suppressed because it is too large Load Diff
benchmarks/pairs/advisory-fixes/materialize.py
+249
View File
@@ -0,0 +1,249 @@
"""Materialise and verify the advisory-fix pairs (both sides of each advisory-named function at a real fix).
Each pair in ``catalog.toml`` names a public fix commit, its parent, the file and the advisory-named function. This
script reads the two versions of that one file from a shallow BLOBLESS fetch (``--filter=blob:none``, depth 2) kept in
the pair cache (``$OPENULTRASAST_PAIR_CACHE`` or ``~/.cache/openultrasast/pairs``), cuts the function out of each side
with the label builder's own matcher (``openultrasast.learn.excerpt.function_bounds``), and writes the two excerpts
where ``load_pair_catalog`` looks for a pointer pair (``<cache>/advisory-fixes/<name>/{vuln,fixed}<ext>``). Nothing is
vendored into the repository, and no scanner, rule, engine or model ever runs on these repositories.
Verification (the default, offline) re-reads the cached excerpts the way ``ousast learn labels`` does and fails a
pair unless: the fix commit differs from its parent, the function is declared on both sides, and its body (the lines
after the declaration, whitespace-normalised) differs between them. It reports the bytes it read per pair, so a pass
over an unread cache cannot look like a clean result.
PYTHONPATH=src python benchmarks/pairs/advisory-fixes/materialize.py # verify the cache (offline)
PYTHONPATH=src python benchmarks/pairs/advisory-fixes/materialize.py --fetch # fetch what is missing, verify
PYTHONPATH=src python benchmarks/pairs/advisory-fixes/materialize.py --candidate --repo o/r --commit F \
--parent P --path a/b.py --function f --language python --name o-r-f # check one candidate (research)
"""
from __future__ import annotations
import argparse
import importlib.util
import json
import re
import shutil
import subprocess
import sys
import tomllib
from pathlib import Path
from typing import Any
HERE = Path(__file__).resolve().parent
CATALOG = HERE / "catalog.toml"
SLICE = "advisory-fixes"
MIN_FREE_BYTES = 1_200_000_000 # stop before the host disk drops under 1.2 GB
MAX_REPO_KB = 150_000 # repositories over ~150 MB are skipped
_SHA = re.compile(r"[0-9a-f]{40}")
def _harvest() -> Any:
spec = importlib.util.spec_from_file_location("ousast_pair_harvest", HERE.parent / "harvest.py")
assert spec is not None and spec.loader is not None
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
return module
def cache_root() -> Path:
from openultrasast.pairs import pair_cache_dir
return pair_cache_dir() / SLICE
def _git(clone: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[bytes]:
return subprocess.run(["git", "-C", str(clone), *args], capture_output=True, check=check, timeout=600)
def _has_commit(clone: Path, sha: str) -> bool:
return _git(clone, "cat-file", "-e", f"{sha}^{{commit}}", check=False).returncode == 0
def repo_metadata(repo: str) -> dict[str, Any]:
"""Size (KB) and SPDX licence from the GitHub API through ``gh`` (metadata only)."""
out = subprocess.run(
["gh", "api", f"repos/{repo}", "--jq", "{size: .size, license: .license.spdx_id, archived: .archived}"],
capture_output=True,
text=True,
timeout=60,
)
if out.returncode != 0:
raise RuntimeError(f"gh api repos/{repo}: {out.stderr.strip()[:200]}")
return dict(json.loads(out.stdout))
def fetch(repo: str, commit: str, parent: str) -> Path:
"""A shallow blobless clone holding ``commit`` and ``parent`` (blobs arrive lazily, one per ``git show``)."""
free = shutil.disk_usage(Path.home()).free
if free < MIN_FREE_BYTES:
raise RuntimeError(f"free disk {free / 1e9:.2f} GB is under the 1.2 GB floor; stopping")
clone = cache_root() / "_clones" / repo.replace("/", "__")
if not (clone / ".git").is_dir():
clone.mkdir(parents=True, exist_ok=True)
_git(clone, "init", "-q")
_git(clone, "remote", "add", "origin", f"https://github.com/{repo}.git")
_git(clone, "config", "remote.origin.promisor", "true")
_git(clone, "config", "remote.origin.partialclonefilter", "blob:none")
_git(clone, "config", "extensions.partialClone", "origin")
for sha, depth in ((commit, "2"), (parent, "1")):
if not _has_commit(clone, sha):
_git(clone, "fetch", "-q", "--filter=blob:none", f"--depth={depth}", "origin", sha)
return clone
def show(clone: Path, sha: str, path: str) -> str:
return _git(clone, "show", f"{sha}:{path}").stdout.decode("utf-8", "replace")
def _comment(language: str) -> str:
return "#" if language in {"python", "ruby"} else "//"
def _body(lines: list[str], span: tuple[int, int]) -> str:
return re.sub(r"\s+", " ", "\n".join(lines[span[0] + 1 : span[1]])).strip()
def extract(source: str, language: str, function: str) -> tuple[list[str], tuple[int, int]] | None:
from openultrasast.learn.excerpt import LANGUAGE_ALIASES, function_bounds
lines = source.splitlines()
span = function_bounds(lines, LANGUAGE_ALIASES.get(language, language), function)
return (lines, span) if span else None
def write_side(path: Path, pair: dict[str, Any], *, side: str, sha: str, lines: list[str], span: tuple[int, int]) -> None:
mark = _comment(str(pair["language"]))
header = [
f"Provenance: {pair['repo']} {pair['function']} ({side}).",
f"repo: {pair['repo']}",
f"commit: {sha}",
f"parent: {pair['parent']}",
f"commit_url: {pair.get('commit_url', '')}",
f"cve: {pair.get('cve', '')}",
f"license: {pair.get('license', '')}",
f"function: {pair['function']}",
f"relpath: {pair['path']}",
f"upstream_start: {span[0] + 1}",
]
body = "\n".join(lines[span[0] : span[1]])
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text("\n".join(f"{mark} {line}" for line in header) + "\n" + _harvest().redact(body) + "\n", encoding="utf-8")
def excerpt_paths(pair: dict[str, Any]) -> tuple[Path, Path]:
ext = Path(str(pair["path"])).suffix or ".c"
folder = cache_root() / str(pair["name"])
return folder / f"vuln{ext}", folder / f"fixed{ext}"
def materialise(pair: dict[str, Any], *, force: bool = False) -> dict[str, Any]:
"""Fetch both sides of one pair and write its excerpts; the source bytes read are reported."""
vuln_path, fixed_path = excerpt_paths(pair)
if vuln_path.is_file() and fixed_path.is_file() and not force:
return {"name": pair["name"], "fetched": False}
commit, parent = str(pair["commit"]), str(pair["parent"])
clone = fetch(str(pair["repo"]), commit, parent)
vuln_src = show(clone, parent, str(pair["path"]))
fixed_src = show(clone, commit, str(pair.get("fix_path") or pair["path"]))
function, language = str(pair["function"]), str(pair["language"])
vuln, fixed = extract(vuln_src, language, function), extract(fixed_src, language, function)
if vuln is None or fixed is None:
missing = [side for side, got in (("vulnerable", vuln), ("fixed", fixed)) if got is None]
raise RuntimeError(f"{function} not declared on the {' and '.join(missing)} side")
write_side(vuln_path, pair, side="vuln", sha=parent, lines=vuln[0], span=vuln[1])
write_side(fixed_path, pair, side="fixed", sha=commit, lines=fixed[0], span=fixed[1])
return {"name": pair["name"], "fetched": True, "source_bytes": len(vuln_src.encode()) + len(fixed_src.encode())}
def verify(pair: dict[str, Any]) -> dict[str, Any]:
"""The label builder's check, from the cached excerpts: declared on both sides, body changed, a real fix."""
from openultrasast.learn.excerpt import LANGUAGE_ALIASES, function_bounds
result: dict[str, Any] = {"name": pair["name"], "ok": False, "bytes_read": 0}
commit, parent = str(pair.get("commit", "")), str(pair.get("parent", ""))
if not (_SHA.fullmatch(commit) and _SHA.fullmatch(parent)) or commit == parent:
result["reason"] = "fix commit must be a full SHA distinct from its parent"
return result
language = LANGUAGE_ALIASES.get(str(pair["language"]), str(pair["language"]))
spans = {}
for side, path in zip(("vuln", "fixed"), excerpt_paths(pair), strict=True):
if not path.is_file():
result["reason"] = f"{side} excerpt not materialised ({path})"
return result
text = path.read_text(encoding="utf-8")
result["bytes_read"] += len(text.encode())
lines = text.splitlines()
span = function_bounds(lines, language, str(pair["function"]))
if span is None:
result["reason"] = f"{pair['function']} is not declared on the {side} side"
return result
spans[side] = _body(lines, span)
if not spans["vuln"] or spans["vuln"] == spans["fixed"]:
result["reason"] = "function body is unchanged by the fix"
return result
result["ok"] = True
return result
def _flatten(item: dict[str, Any]) -> dict[str, Any]:
pair = dict(item)
expected = (item.get("expected") or [{}])[0]
pair.setdefault("function", expected.get("function", ""))
return pair
def main(argv: list[str] | None = None) -> int:
parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
parser.add_argument("--catalog", type=Path, default=CATALOG)
parser.add_argument("--fetch", action="store_true", help="fetch missing sides over the network, then verify")
parser.add_argument("--force", action="store_true", help="re-fetch and rewrite excerpts that exist")
parser.add_argument("--json", type=Path, help="write the per-pair report here")
parser.add_argument("--candidate", action="store_true", help="check one candidate given on the command line")
for key in ("repo", "commit", "parent", "path", "fix-path", "function", "language", "name"):
parser.add_argument(f"--{key}")
args = parser.parse_args(argv)
if args.candidate:
pair = {k: getattr(args, k.replace("-", "_")) for k in ("repo", "commit", "parent", "path", "function", "language", "name")}
pair["fix_path"] = args.fix_path
try:
meta = repo_metadata(pair["repo"])
if int(meta.get("size") or 0) > MAX_REPO_KB:
print(json.dumps({"name": pair["name"], "ok": False, "reason": f"repository is {meta['size']} KB (> 150 MB)", **meta}))
return 1
fetched = materialise(pair, force=args.force)
except (RuntimeError, subprocess.CalledProcessError, subprocess.TimeoutExpired) as exc:
detail = (
exc.stderr.decode(errors="replace")[:200] if isinstance(exc, subprocess.CalledProcessError) and exc.stderr else str(exc)
)
print(json.dumps({"name": pair["name"], "ok": False, "reason": f"fetch: {detail}"}))
return 1
report = {**verify(pair), **{k: v for k, v in fetched.items() if k != "name"}, **meta}
print(json.dumps(report))
return 0 if report["ok"] else 1
pairs = [_flatten(item) for item in tomllib.loads(args.catalog.read_text()).get("pair", [])]
rows = []
for pair in pairs:
fetched: dict[str, Any] = {}
if args.fetch:
try:
fetched = materialise(pair, force=args.force)
except (RuntimeError, subprocess.CalledProcessError, subprocess.TimeoutExpired) as exc:
fetched = {"fetch_error": str(exc)[:200]}
rows.append({**verify(pair), **{k: v for k, v in fetched.items() if k != "name"}})
failed = [row for row in rows if not row["ok"]]
for row in rows:
print(
f"{'ok ' if row['ok'] else 'FAIL'} {row['name']}: {row['bytes_read']} bytes read"
+ ("" if row["ok"] else f" -- {row['reason']}")
)
total = sum(row["bytes_read"] for row in rows)
print(f"{len(rows) - len(failed)}/{len(rows)} pairs verified; {total} excerpt bytes read")
if args.json:
args.json.write_text(json.dumps({"pairs": rows, "verified": len(rows) - len(failed), "bytes_read": total}, indent=2) + "\n")
return 1 if failed or not rows else 0
if __name__ == "__main__":
sys.exit(main())
benchmarks/pairs/advisory-fixes/research-2026-10-01.md
+429
View File
@@ -0,0 +1,429 @@
# Advisory-fix pairs: research log (2026-10-01)
Purpose: give the learned decision engine defensible negatives for the families that had none or few (repository
groups with a fixed-side negative before this: untrusted_destination 8, path 3, output_encoding 1, deserialization 0,
access_control 0; commit 658f2d5 dropped 108 invented negatives). A pair is a public fix commit for a published
advisory (CVE/GHSA), distinct from its parent, where the advisory-named function is declared on both sides and its
body changes. The positive is the function at the parent, the negative the same function at the fix.
## Method
- **Enumeration.** One lane per family worked the GitHub advisory database (`gh api /advisories?ecosystem=<eco>&cwes=<n>`)
per ecosystem (pip, npm, maven, composer, go, rubygems, nuget), newest first, with web search only to locate a fix
commit an advisory did not link. The family is the advisory's CWE through `ruleset/families.toml`.
- **Exclusions before examination.** Every repository already named under `benchmarks/` (its github.com URL or a
catalog `repo =`, collected with the reserved-population files excluded by name and never opened) and every
repository already claimed by another lane: one pair per repository across the whole catalog.
- **Metadata only.** Advisories, commits, file lists, repository size and licence came from `gh api`. The two versions of
the one vulnerable file were read through `materialize.py --candidate`: a shallow blobless fetch
(`--filter=blob:none`, depth 2) into the pair cache and `git show <sha>:<path>`. No scanner, rule, engine, plane task
or model ran on any of these repositories. Repositories over ~150 MB (`size` > 150000 KB) were rejected unread.
- **Acceptance.** The checker cuts the function on both sides with the label builder's own matcher
(`learn.excerpt.function_bounds`) and accepts only when both sides declare it and its body (lines after the
declaration, whitespace-normalised) differs. Fixes in large release/squash commits, fixes outside any function
(route tables, config, templates), functions deleted or renamed by the fix and family mismatches were rejected.
- **Reserved population.** After the catalog was written, `tests/test_independent_population.py::
test_no_reserved_repository_is_referenced_by_the_development_tree` flagged five accepted repositories (2 path,
1 deserialization, 2 access_control). They were dropped; their rows below are kept as rejections with the name and
advisory withheld, and their cache entries deleted. Two rejected rows (one output_encoding, one deserialization)
also named reserved repositories; their names and ids are withheld the same way (the lane tallies below keep their
original rejection reasons).
- **Licences.** SPDX id from the API; where the API said NOASSERTION the LICENSE file name/text was read through the API
(rack MIT, handlebars.java Apache-2.0, omnifaces Apache-2.0, og-image MIT, django-cms
BSD-3-Clause, C1 CMS MPL-1.1). Permissive licences were preferred; 7 accepted pairs are copyleft (GPL/AGPL/LGPL/MPL),
used where too few permissive candidates in a language qualified.
## Known limits
- The function matcher is the label builder's, so excerpts inherit its limits: for `htmlsanitizer-dosanitize-0ac53dc`
(C#) the span runs to the end of the class and for `zeppelin-fromjson-8368579` (Java) it takes in the next method.
Both functions' own bodies change; the label is `path::function`, unaffected.
- Multi-commit fixes use the commit before the first fix commit as `parent` (LiteDB); merge-commit fixes use the
first parent (truelayer-dotnet, weasyprint, oqtane, jellyfin and others noted in their rows).
- jellyfin's advisory (GHSA-4vx8-xhc9-qg6x) is a repository advisory not in the global database.
## Counts
| family | examined | accepted | rejected |
|---|---|---|---|
| untrusted_destination | 33 | 17 | 16 |
| path | 43 | 18 | 25 |
| output_encoding | 98 | 21 | 77 |
| deserialization | 60 | 21 | 39 |
| access_control | 75 | 20 | 55 |
| **total** | **309** | **97** | **212** |
Rejections by reason, per lane (lane tallies; the rows carry each reason):
- untrusted_destination (16): repository over 150 MB 5; family mismatch or no destination check added 3; licence
(AGPL, non-OSI, LGPL fallback unused) 3; fix commit unusable 2; claimed by another lane 2; not verified, quota met 1.
- path (25): repository over 150 MB 10; matcher cannot declare the function on a side 4; viable reserves not
needed 4; reserved repository 2; fix in a large mixed commit 2; claimed by another lane 1; family mismatch 1;
vulnerable method is a setter 1.
- output_encoding (77): fix is validation/filtering, not encoding 15; fix only in a template or non-code file 15;
repository over 150 MB 14; no fix commit 11; multi-file, release or merge-sweep commit 8; other (body unchanged,
ambiguous name, unnamed arrow) 7; copyleft skipped 5; duplicate or claimed 2.
- deserialization (39): repository over 150 MB 11; no usable fix commit 10; different flaw type 6; function deleted or
unnamed 3; referenced commit does not hold the fix 3; blocklist-only edit 2; other (proprietary licence, withdrawn,
bundled multi-advisory commit) 3; reserved repository 1.
- access_control (55): repository over 150 MB 22; fix outside any function body 7; duplicate repository 6; matcher
limit 4; release or large feature commit 3; licence 3; no single function to label 3; reserved repository 2;
anonymous route callback 2; no fix commit 2; family mismatch 2; class-level check only 1.
## Rows (one per examined advisory)
## untrusted_destination
Order: per ecosystem (pip, npm, maven, composer, go, rubygems, nuget), CWE-918 then CWE-601, newest first; only advisories whose repository was not in used-repos.txt/claims.txt and that carry a commit reference were examined.
| advisory | repo | language | framework | verdict | reason | licence | size KB |
|---|---|---|---|---|---|---|---|
| GHSA-5923-r76v-mprm | https://github.com/remram44/taguette | python | tornado | accepted | _go_to_next gains next-URL validation | BSD-3-Clause | 11345 |
| GHSA-5p9j-w2wx-qx4c | https://github.com/nitely/spirit | python | django | accepted | custom_login gains safe_redirect host check | MIT | 12295 |
| GHSA-28mg-98xm-q493 | https://github.com/archivy/archivy | python | flask | accepted | login gains same-host next check | MIT | 1212 |
| GHSA-jgmv-j7ww-jx2x | https://github.com/koajs/koa | javascript | koa | accepted | back() gains same-origin referrer check | MIT | 4006 |
| GHSA-w6x9-28jw-hq7j / GHSA-998g-7v5w-cr7g | https://github.com/magicmirrororg/magicmirror | javascript | express | rejected | family mismatch: referenced fix commit adds Socket.IO IP allow-listing (access control), not destination validation | MIT | 27595 |
| GHSA-5g86-85rp-f9hx | https://github.com/papra-hq/papra | typescript | hono | rejected | AGPL-3.0 and fix moves the guard into a new http-client helper (fix-added function); permissive alternatives available | AGPL-3.0 | 31963 |
| GHSA-ppf9-4ffw-hh4p | https://github.com/feathersjs/feathers | typescript | feathers | accepted | getRedirect gains authority-injection check on redirect param | MIT | 45420 |
| GHSA-v93c-cxj5-c398 | https://github.com/jenkinsci/google-login-plugin | java | jenkins | accepted | doCommenceLogin inverted isSafeToRedirectTo check fixed | Apache-2.0 | 131 |
| GHSA-fxr3-gvm4-m8vc | https://github.com/hs-web/hsweb-framework | java | spring | rejected | repository already claimed by another lane (path) | Apache-2.0 | 34602 |
| GHSA-whpp-xv3h-rwxf | https://github.com/spring-projects/spring-ws | java | spring | rejected | fix is a broad multi-file refactor (new sender abstraction, interceptor ordering); no single function gains the guard | Apache-2.0 | 25006 |
| GHSA-pp3c-cf6j-m3ff | https://github.com/oblac/jodd-http | java | | rejected | family mismatch: fix is CRLF/path encoding in path(), not destination validation | BSD-2-Clause | 326 |
| GHSA-4hr2-xf7w-jf76 | https://github.com/line/centraldogma | java | armeria | rejected | repo > 150 MB (153095 KB); referenced commit only touches test server and webapp 403 handling | Apache-2.0 | 153095 |
| GHSA-q7mc-fc87-v7w7 | https://github.com/openrefine/openrefine | java | | rejected | repo > 150 MB (407619 KB) | BSD-3-Clause | 407619 |
| GHSA-qjp4-4jvr-xqg3 | https://github.com/spring-ai-community/mcp-security | java | spring | rejected | advisory-referenced commit changes only README (config/docs) | Apache-2.0 | 830 |
| GHSA-wrxc-mr2w-cjpv | https://github.com/getgrav/grav | php | grav | accepted | redirect() gains leading-slash normalisation | MIT | 35084 |
| GHSA-gmxh-hjfv-qc2w | https://github.com/benjaminjonard/koillection | php | symfony | accepted | fetchWithHttpClient gains NoPrivateNetworkHttpClient | MIT | 58355 |
| GHSA-hhpq-7wg4-36jm | https://github.com/cakephp/authentication | php | cakephp | accepted | getLoginRedirect gains backslash and // rejection | MIT | 2767 |
| GHSA-7j2f-6h2r-6cqc | https://github.com/koel/koel | php | laravel | accepted | createForEpisode gains isSafeUrl guard before download | MIT | 29419 |
| GHSA-wqv2-4wpg-8hc9 | https://github.com/miniflux/v2 | go | net/http | accepted | checkLogin gains relative-path-only redirect check | Apache-2.0 | 38867 |
| GHSA-mpf7-p9x7-96r3 | https://github.com/axllent/mailpit | go | net/http | accepted | doHead gains URL validation and internal-IP blocking dialer | MIT | 4336 |
| GHSA-c4v7-xg93-qf8g | https://github.com/gogs/gogs | go | macaron | rejected | repo > 150 MB (212268 KB) | MIT | 212268 |
| GHSA-jp94-3292-c3xv | https://github.com/heartcombo/devise | ruby | rails | accepted | redirect_url gains path extraction from Referer | MIT | 5944 |
| GHSA-67m4-qxp3-j6hh | https://github.com/truelayer/truelayer-dotnet | csharp | | accepted | GetPayment gains NotAUrl check and path-append | MIT | 1707 |
| GHSA-vx6p-q4gj-x6xx | https://github.com/owen2345/camaleon-cms | ruby | rails | rejected | repository already claimed by another lane (path) | MIT | 61387 |
| GHSA-vfm5-cr22-jg3m | https://github.com/abpframework/abp | csharp | aspnetcore | rejected | repo > 150 MB (3069476 KB); LGPL-3.0 | LGPL-3.0 | 3069476 |
| GHSA-ff4q-64jc-gx98 | https://github.com/duendesoftware/identityserver | csharp | aspnetcore | rejected | non-OSI licence (Duende RPL, spdx NOASSERTION "Other"); fix spans 5 commits | NOASSERTION | 63296 |
| GHSA-2vvr-5757-qp87 | https://github.com/jenkinsci/cas-plugin | java | jenkins | accepted | determineTargetUrl gains isSafeToRedirectTo check | MIT | 273 |
| GHSA-7899-w6c4-vqc4 | https://github.com/misskey-dev/summaly | typescript | | rejected | fix only plumbs a followRedirects option through; no destination check added to a vulnerable function | MIT | 903 |
| GHSA-q8hw-4fvp-9rwv | https://github.com/nuxt-modules/og-image | typescript | nuxt | accepted | font-assets resolve() gains external-URL classification and SSRF-guarded fetch; licence file is MIT (GitHub reports NOASSERTION because of an appended woff-lib notice) | MIT | 39785 |
| GHSA-983w-rhvv-gwmv | https://github.com/kozea/weasyprint | python | | accepted | default_url_fetcher stops following redirects (redirect-based SSRF guard bypass) | BSD-3-Clause | 35995 |
| GHSA-7gwp-5pfp-969j | https://github.com/mlflow/mlflow | python | flask | rejected | repo > 150 MB (1487459 KB) | Apache-2.0 | 1487459 |
| GHSA-42fc-7w97-8vrc | https://github.com/xwiki-contrib/macro-plantuml | java | xwiki | rejected | LGPL-2.1 (GitHub licence null); held as fallback only, target met with permissive pairs | LGPL-2.1 | 2160 |
| GHSA-pm5p-7w5h-jm5q | https://github.com/alextselegidis/easyappointments | php | codeigniter | rejected | not verified: PHP quota reached (4 accepted); claim released; fix spans 4 commits | GPL-3.0 | 49915 |
## path
Order: GitHub reviewed advisories with cwes=22,23,36,73,98, per ecosystem (composer, pip, npm, go, maven, rubygems, nuget), newest first; repositories in used-repos.txt or claims.txt filtered out before examination. Every candidate was verified with materialize.py --candidate ("ok": true).
| advisory | repo | language | framework | verdict | reason | licence | size KB |
|---|---|---|---|---|---|---|---|
| GHSA-xv8g-76mx-2rxc | https://github.com/plank/laravel-mediable | php | laravel | accepted | sanitizePath gains segment normalisation | MIT | 2135 |
| GHSA-5vpg-rj7q-qpw2 | https://github.com/yiisoft/yii2 | php | yii | accepted | renderPhpFile isolates included path from extract() | BSD-3-Clause | 91537 |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| GHSA-c7r6-vx3h-w5g2 | https://github.com/SpartnerNL/Laravel-Excel | php | laravel | rejected | deferred: fix removes a raw-write branch rather than adding containment (held as reserve) | MIT | 4033 |
| GHSA-g4c3-4g96-6g4m | https://github.com/chamilo/chamilo-lms | php | | rejected | repo > 150 MB | GPL-3.0 | 1664356 |
| GHSA-c6f4-wj38-m3g3 | https://github.com/grokability/snipe-it | php | laravel | rejected | repo > 150 MB | AGPL-3.0 | 332721 |
| GHSA-hhmc-q9hp-r662 | https://github.com/codeigniter4/codeigniter4 | php | codeigniter | rejected | repo > 150 MB | MIT | 396388 |
| GHSA-7hxc-f267-h5q7 | https://github.com/craftcms/cms | php | craft | rejected | repo > 150 MB | NOASSERTION | 1077350 |
| GHSA-xjvc-pw2r-6878 | https://github.com/flarum/framework | php | flarum | rejected | repo > 150 MB | MIT | 190820 |
| GHSA-2mfj-r695-5h9r | https://github.com/Dolibarr/dolibarr | php | | rejected | repo > 150 MB | GPL-3.0 | 1748373 |
| GHSA-chm7-4vch-h8vr | https://github.com/TYPO3/typo3 | php | typo3 | rejected | repo > 150 MB | GPL-2.0 | 660207 |
| GHSA-6wh5-mw9h-5c3w | https://github.com/shopware/shopware | php | symfony | rejected | repo > 150 MB | MIT | 533542 |
| GHSA-vp2f-cqqp-478j | https://github.com/AzuraCast/AzuraCast | php | | rejected | repo > 150 MB | AGPL-3.0 | 269902 |
| GHSA-6vqf-6fhm-7rc6 | https://github.com/OpenMage/magento-lts | php | magento | rejected | repo > 150 MB | OSL-3.0 | 154085 |
| GHSA-cj54-hpcc-gj6h | https://github.com/thumbor/thumbor | python | tornado | accepted | load decodes before containment check | MIT | 55333 |
| GHSA-9jj8-v89v-xjvw | https://github.com/dgtlmoon/changedetection.io | python | flask | accepted | static_content strict sanitisation | Apache-2.0 | 48192 |
| GHSA-83w8-p2f5-377r | https://github.com/fastify/fastify-static | javascript | fastify | accepted | pumpSendToReply gains dot-dot segment rejection | MIT | 818 |
| GHSA-g84c-rxfj-3j2c | https://github.com/webpack/webpack-dev-middleware | javascript | express | accepted | getFilenameFromUrl gains containment check | MIT | 16072 |
| GHSA-2mf3-mr2r-r4vf | https://github.com/gina-io/swig | javascript | | rejected | checker: resolve (ret.resolve assignment) not declared on either side | MIT | 3310 |
| GHSA-3vfr-4gwf-qxfp | https://github.com/avwo/whistle | javascript | | rejected | fix in a large mixed feature commit | MIT | 103125 |
| GHSA-79qf-vqgc-7xx3 | https://github.com/apostrophecms/apostrophe | javascript | apostrophe | rejected | repository claimed by another lane | MIT | 52259 |
| GHSA-frvp-7c67-39w9 | https://github.com/honojs/node-server | typescript | hono | rejected | checker: serveStatic (const arrow function) not declared on either side | MIT | 654 |
| GHSA-g72f-jw3w-mgh7 | https://github.com/naorsabag/openhop | typescript | fastify | accepted | filePath gains flow-id validation | MIT | 83174 |
| GHSA-rxjr-6c9q-h67x | https://github.com/logto-io/logto | typescript | | rejected | vulnerable function is a const arrow (createStaticFileProxy); fix moves logic into new helper getSafeStaticFilePath; MPL-2.0 | MPL-2.0 | 119764 |
| GHSA-hrh2-vp3x-79xf | https://github.com/XhmikosR/decompress | javascript | | rejected | extractFile is a const arrow function (checker cannot declare it); library not web | MIT | 966 |
| GHSA-9gfj-28hw-jchp | https://github.com/knowns-dev/knowns | go | | accepted | DocStore.Get gains containment via safepath | MIT | 82181 |
| GHSA-964w-f6gj-5236 | https://github.com/goshs-labs/goshs | go | | accepted | upload gains dot-dot rejection + containment | MIT | 9952 |
| GHSA-vvp7-h4fj-m28w | https://github.com/gtsteffaniak/filebrowser | go | | accepted | subtitlesHandler gains basename + track allow-list | Apache-2.0 | 100116 |
| GHSA-3gmf-p6r4-q8m6 | https://github.com/apache/wicket | java | wicket | accepted | save gains contained target resolution | Apache-2.0 | 133763 |
| GHSA-vjmr-f5fc-vr2w | https://github.com/hs-web/hsweb-framework | java | spring | accepted | createStaticSavePath gains basename + charset check | Apache-2.0 | 34602 |
| GHSA-hrmj-8fm9-cg8x | https://github.com/jenkinsci/external-workspace-manager-plugin | java | jenkins | accepted | computeCustomPath gains dot-dot rejection (merge commit, first parent) | MIT | 2920 |
| GHSA-g29j-rwfv-h99w | https://github.com/jknack/handlebars.java | java | spring | accepted | getResource gains normalise + prefix containment (LICENSE text is Apache-2.0; gh reports NOASSERTION) | Apache-2.0 | 4451 |
| GHSA-mxw3-3hh2-x2mh | https://github.com/rack/rack | ruby | rack | accepted | check_forbidden gains separator-anchored containment (MIT-LICENSE; gh reports NOASSERTION) | MIT | 10834 |
| GHSA-pxcc-8665-phx8 | https://github.com/lsegal/yard | ruby | | accepted | check_static_cache gains dot-dot rejection + cleanpath | MIT | 9468 |
| GHSA-jw5g-f64p-6x78 | https://github.com/owen2345/camaleon-cms | ruby | rails | accepted | fetch_file gains valid_folder_path? guard | MIT | 61387 |
| GHSA-pjxv-w3qj-j8m3 | https://github.com/mguinness/elFinder.AspNet | csharp | aspnet | accepted | ExtractAsync gains GetFullPath containment | BSD-2-Clause | 1110 |
| GHSA-62mm-xwmv-crhg | https://github.com/khoj-ai/khoj | python | fastapi | rejected | not pursued: AGPL-3.0 and permissive Python pairs sufficed (home_static_files gains resolve+is_relative_to; viable reserve) | AGPL-3.0 | 117280 |
| GHSA-2xmw-f8j8-wfxc | https://github.com/ddnexus/pagy | ruby | | rejected | vulnerable method is the setter locale= (name not expressible as a pair function name) | MIT | 41635 |
| GHSA-fh2f-xfxc-q9cc | https://github.com/bablilayoub/openhole | go | | rejected | family mismatch: fix is URL/proxy path escaping, not filesystem access | MIT | 1581 |
| GHSA-vr5f-w35q-98jp | https://github.com/perses/perses | go | | rejected | not pursued: fix in list.go helper unrelated to the named project-path sink (4 lines) | Apache-2.0 | 45211 |
| GHSA-6q65-j4jw-9cg8 | https://github.com/riganti/dotvvm | csharp | dotvvm | rejected | not pursued: C# already covered; GetVersionHash debug-mode only (viable reserve) | Apache-2.0 | 65853 |
| GHSA-mvvp-gwgc-5hrp | https://github.com/trannamtrung1st/elFinder.Net.Core | csharp | aspnet | rejected | fix spread over many files/new exception types (security release commit) | Apache-2.0 | 218 |
## output_encoding
Family: output encoding (XSS CWE-79/80/83, header/CRLF injection CWE-113, improper encoding CWE-116).
Order: per ecosystem (pip, npm, maven, composer, go, rubygems, nuget), GitHub advisory API newest first,
CWE-79 first then CWE-116/113/80; composer additionally walked for 2025 (`published=2025-01-01..2025-12-31`).
Every accepted pair passed `materialize.py --candidate` ("ok": true, bytes_read > 0).
Accepted: 21; by language: {'python': 4, 'typescript': 4, 'java': 3, 'php': 4, 'go': 2, 'ruby': 2, 'csharp': 2}; by framework: {'tornado': 1, '(none)': 10, 'django': 1, 'express': 1, 'jquery': 1, 'hono': 1, 'jsf': 1, 'jenkins': 1, 'silverstripe': 1, 'laravel': 1, 'fiber': 1, 'rails': 1}
Rejected: 77
Notes:
- htmlsanitizer-dosanitize-0ac53dc: the checker's C# function matcher overshoots (excerpt ~490 lines, runs past
DoSanitize to the end of the class); the DoSanitize body itself does change. Review before use.
- omnifaces/omnifaces: gh reports NOASSERTION; LICENSE.txt is the Apache License 2.0 text.
- template-load-28cff3a (gofiber/template): Load() flips pongo2 autoescape on; mechanism recorded as other.
- htmlpublisher-plugin: advisory has no commit ref; fix commit found by searching the repo for SECURITY-3706.
| advisory | repo | language | framework | verdict | reason | licence | size KB |
|---|---|---|---|---|---|---|---|
| GHSA-pr2v-jx2c-wg9f | https://github.com/tornadoweb/tornado | python | tornado | accepted | write_error escapes reason with xhtml_escape | Apache-2.0 | 11646 |
| GHSA-r5pr-887v-m2w9 | https://github.com/bloomberg/memray | python | - | rejected | fix only changes a template file (base.html) | Apache-2.0 | - |
| GHSA-8whx-v8qq-pq64 | https://github.com/dgtlmoon/changedetection.io | python | flask | rejected | fix only changes route converter in decorator; function body unchanged | Apache-2.0 | - |
| GHSA-gqgw-jghv-mxwx | https://github.com/jazzband/tablib | python | - | accepted | export_book builds the title element via ElementTree so the dataset title is HTML-escaped | MIT | 2021 |
| GHSA-g97x-gvcm-x72h | https://github.com/lepture/mistune | python | - | accepted | render_admonition escapes class option | BSD-3-Clause | 1533 |
| GHSA-w7rv-gfp4-j9j3 | https://github.com/mixxorz/slippers | python | django | accepted | attr_string uses format_html | MIT | 1580 |
| GHSA-58cw-g322-p94v | https://github.com/lepture/mistune | python | - | rejected | duplicate repository (same fix commit as GHSA-g97x, already accepted) | BSD-3-Clause | 1533 |
| GHSA-6wxc-8mgq-w26m | https://github.com/WeblateOrg/weblate | javascript | django | rejected | fix rewrites static JS (search.js) into a new structure; spans many files, not a single function gaining escaping | GPL-3.0 | - |
| GHSA-gx2m-mcc2-r4p3 | https://github.com/WeblateOrg/wlc | python | - | rejected | skipped: GPL-3.0 licence while permissive candidates remained | GPL-3.0 | - |
| GHSA-2jp7-wwpg-3p9w | https://github.com/ether/etherpad | typescript | express | accepted | getHTMLFromAtext escapes data-* attribute values | Apache-2.0 | 52436 |
| GHSA-gcr2-9v8m-gq45 | https://github.com/dicebear/dicebear | typescript | - | accepted | addRotate xml-escapes rotate | MIT | 32762 |
| GHSA-hvqh-jw65-wcpq | https://github.com/devbridge/jQuery-Autocomplete | typescript | jquery | accepted | formatGroup encodes category via textContent | MIT | 1018 |
| GHSA-cr32-g25g-vxjj | https://github.com/showdownjs/showdown | javascript | - | rejected | fix is a large feature commit (safeMode, 21 files incl. dist bundles) | MIT | - |
| GHSA-7pw4-f3q4-r2p2 | https://github.com/withastro/astro | typescript | astro | rejected | repository over 150 MB (gh size 237090 KB) | MIT | 237090 |
| GHSA-f48w-9m4c-m7f5 | https://github.com/withastro/astro | typescript | astro | rejected | repository over 150 MB; fix is name validation, not encoding | MIT | 237090 |
| GHSA-hxh3-vqpv-xpqv | https://github.com/honojs/hono | typescript | hono | accepted | resolveChildEarly escapes plain string children | MIT | 9959 |
| GHSA-gfhx-hw2g-v5hg | https://github.com/yahoo/serialize-javascript | javascript | - | rejected | fix is a module-level regex change; function-level change does not add escaping of a single value | BSD-3-Clause | - |
| GHSA-3wgp-x9p5-c7cc | https://github.com/appium/appium | typescript | express | rejected | fix is a 35-file refactor isolating test endpoints, not an encoding change | Apache-2.0 | - |
| GHSA-8rr6-2qw5-pc7r | https://github.com/pmd/pmd | java | - | rejected | repository over 150 MB (gh size 605139 KB) | BSD-4-Clause | 605139 |
| GHSA-v3f3-rf6r-43x5 | https://github.com/jenkinsci/coverage-plugin | java | jenkins | rejected | fix is id validation in constructor, not output encoding | MIT | - |
| GHSA-hrvf-g648-rf3m | https://github.com/plantuml/plantuml | java | - | rejected | fix removes SVG export feature; no escaping added | GPL-3.0 | - |
| GHSA-cpm7-cfpx-3hvp | https://github.com/NationalSecurityAgency/emissary | java | jersey | rejected | fix filters nav links by pattern (validation), not encoding | Apache-2.0 | - |
| GHSA-fp43-vj7g-pg92 | https://github.com/omnifaces/omnifaces | java | jsf | accepted | getUpdateScript escapeJS on hash param (LICENSE.txt is Apache-2.0; gh reports NOASSERTION) | Apache-2.0 | 17380 |
| GHSA-34pm-923j-7wf8 | https://github.com/kestra-io/kestra | typescript | vue | rejected | fix only in Vue UI/markdown plugin config; Java not involved; small one-line regex change, not escaping | Apache-2.0 | - |
| GHSA-rrvf-5w4r-3x7v | https://github.com/apache/zeppelin | java | - | accepted | fromJson html-escapes package fields | Apache-2.0 | 115311 |
| GHSA-86jx-wr74-xr74 | https://github.com/apache/zeppelin | shell | - | rejected | fix is in a shell script (bin/interpreter.sh); duplicate repository | Apache-2.0 | 115311 |
| GHSA-3pxv-7cmr-fjr4 | https://github.com/apache/logging-log4j2 | java | - | rejected | repository over 150 MB (gh size 154432 KB) | Apache-2.0 | 154432 |
| GHSA-7m5c-fgwf-mwph | https://github.com/spring-projects/spring-hateoas | java | spring | rejected | no fix commit referenced; fix concerns forwarded-header link base, not value encoding | Apache-2.0 | 8118 |
| GHSA-f8h4-46xv-h7jj | https://github.com/jenkinsci/htmlpublisher-plugin | java | jenkins | accepted | publishReports attribute-escapes job name/urls (fix commit found via SECURITY-3706 commit search) | MIT | 520 |
| GHSA-w22p-4x9f-486v | https://github.com/jenkinsci/github-plugin | java | jenkins | rejected | fix only changes a groovy view and a JS file; no Java function gains escaping | MIT | - |
| GHSA-43ph-42gv-7965 | https://github.com/jenkinsci/buildgraph-view-plugin | java | jenkins | rejected | fix commit not found (no ref, commit search found none) | MIT | - |
| GHSA-vqxv-6xrh-49cp | https://github.com/OpenIdentityPlatform/OpenAM | java | - | rejected | repository over 150 MB (523119 KB); fix mostly in .ftl template | NOASSERTION | 523119 |
| GHSA-vmj7-7xmm-4349 | https://github.com/Silverpeas/Silverpeas-Core | java | - | rejected | repository over 150 MB; sonar sweep in JSPs | AGPL-3.0 | 244355 |
| GHSA-hwmc-r6mf-jh83 | https://github.com/spatie/schema-org | php | - | accepted | toScript json_encode gains JSON_HEX_TAG | MIT | 9488 |
| GHSA-7mpf-4465-7fc2 | https://github.com/wintercms/winter | php | laravel | rejected | repository already claimed by another lane | MIT | - |
| GHSA-mf2p-wjp4-99pq | https://github.com/redaxo/core | php | - | rejected | repository over 150 MB (512235 KB) | MIT | 512235 |
| GHSA-w998-qmw9-mf4m | https://github.com/redaxo/core | php | - | rejected | repository over 150 MB (512235 KB) | MIT | 512235 |
| GHSA-5h77-88j3-r659 | https://github.com/YOURLS/YOURLS | php | - | rejected | fix is hostname validation in yourls_get_domain, not encoding | MIT | - |
| GHSA-v65j-hff3-753c | https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo | php | mediawiki | rejected | fix rewrites the formatter into mustache templates, not a function gaining escaping | GPL-2.0 | 1874 |
| GHSA-vx89-p3j7-8xqc | https://github.com/statamic/cms | php | laravel | rejected | fix only changes an antlers template file | MIT | - |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| GHSA-vv3x-j2x5-36jc | https://github.com/filamentphp/filament | php | laravel | rejected | repository over 150 MB (596400 KB) | MIT | 596400 |
| GHSA-m4g4-86qc-v8w7 | https://github.com/silverstripe/silverstripe-versioned | php | silverstripe | accepted | getRestoreMessage raw2xml-escapes title/link/URLSegment | BSD-3-Clause | 1581 |
| GHSA-p9h3-gvpq-5539 | https://github.com/grokability/snipe-it | php | laravel | rejected | repository over 150 MB (332721 KB) | AGPL-3.0 | 332721 |
| GHSA-mwqm-4fw3-cjvr | https://github.com/symfony/ux | typescript | symfony | rejected | changed code is an inline arrow inside an unnamed config block; no named function to pair | MIT | 61584 |
| GHSA-ffmg-hfvg-jhg9 | https://github.com/getgrav/grav | php | - | rejected | fix is integer coercion / style validation, not encoding | MIT | 35084 |
| GHSA-3432-fmrf-7vmh | https://github.com/chrome-php/chrome | php | - | accepted | __construct json_encodes selector before JS interpolation | MIT | 668 |
| GHSA-p632-58pp-c9xg | https://github.com/moonshine-software/moonshine | php | laravel | accepted | resolvePreview escapes relation preview | MIT | 34925 |
| GHSA-6mp4-q625-mxjp | https://github.com/YOURLS/YOURLS | php | - | rejected | fix validates JSONP callback name (allow pattern), not encoding | MIT | - |
| GHSA-7j46-f57w-76pj | https://github.com/getformwork/formwork | typescript | - | rejected | merge commit of an 11-file TS refactor (innerHTML usage sweep) | MIT | - |
| GHSA-j226-63j7-qrqh | https://github.com/barryvdh/laravel-translation-manager | php | laravel | rejected | fix sanitizes locale filename in controller plus view-file escaping; primary escaping in template | MIT | - |
| GHSA-8jqm-8qm3-qgqm | https://github.com/xyproto/algernon | go | - | accepted | HTMLLink sanitizes filename text/url | BSD-3-Clause | 118399 |
| GHSA-q23m-vm9r-5745 | https://github.com/stefanprodan/podinfo | go | - | rejected | fix sets response headers (content type, CSP), no encoding of the value | Apache-2.0 | - |
| GHSA-cf57-c578-7jvv | https://github.com/TecharoHQ/anubis | go | - | rejected | fix is redirect validation, not encoding | MIT | 30939 |
| GHSA-9cwv-pxcr-hfjc | https://github.com/lf-edge/ekuiper | go | - | rejected | fix validates config key, not encoding | Apache-2.0 | 141862 |
| GHSA-3v85-fqvh-7rxf | https://github.com/lin-snow/Ech0 | go | gin | rejected | repository over 150 MB (151487 KB) and AGPL-3.0 | AGPL-3.0 | 151487 |
| GHSA-4mq2-gc4j-cmw6 | https://github.com/gofiber/template | go | fiber | accepted | Load enables pongo2 autoescape (was hard-coded off) | MIT | 2887 |
| GHSA-rqv2-m695-f8j4 | https://github.com/modelcontextprotocol/registry | go | - | rejected | fix adds URL validation (reject metacharacters), not encoding | MIT | - |
| GHSA-45q4-x4r9-8fqj | https://github.com/go-vikunja/vikunja | go | - | rejected | AGPL-3.0; fix spreads over many identically named ToMail methods (ambiguous function name) | AGPL-3.0 | 134951 |
| GHSA-mcv8-8m8x-48pg | https://github.com/gohugoio/hugo | go | - | rejected | fix reorders URL escaping vs dangerous-URL check (no new escaping of the value); same shape as goldmark | Apache-2.0 | 146470 |
| GHSA-c97m-vxhj-p7j6 | https://github.com/yuin/goldmark | go | - | rejected | fix adds a dangerous-URL filter / reorders existing escaping, not new encoding | MIT | 19839 |
| GHSA-52c5-vh7f-26fx | https://github.com/etaminstudio/prosemirror_to_html | ruby | - | accepted | render_opening_tag escapes attribute values | MIT | 58 |
| GHSA-g7xq-xv8c-h98c | https://github.com/phlex-ruby/phlex | ruby | - | rejected | fix tightens javascript: href detection (validation), not encoding | MIT | - |
| GHSA-xv9c-mjw8-79gf | https://github.com/sidekiq-cron/sidekiq-cron | ruby | sidekiq | rejected | fix only changes ERB view templates | MIT | - |
| GHSA-r8xx-8vm8-x6wj | https://github.com/resque/resque | ruby | sinatra | rejected | fix only changes an ERB view template | MIT | - |
| GHSA-5xq9-h3j2-jxvc | https://github.com/fetlife/rollout-ui | ruby | sinatra | rejected | escaping added via new helper and slim templates; no existing function body gains escaping | MIT | - |
| GHSA-97jw-64cj-jc58 | https://github.com/ViewComponent/view_component | ruby | rails | accepted | render_in escapes unsafe around_render output | MIT | 5458 |
| GHSA-cqf3-vpx7-rxhw | https://github.com/pay-rails/pay | ruby | rails | rejected | fix normalises the back param to a path in a new before_action (validation), not encoding | MIT | - |
| GHSA-x2xw-hw8g-6773 | https://github.com/alphagov/tech-docs-gem | javascript | - | rejected | merge commit; fix in bundled JS asset | MIT | - |
| GHSA-ghjv-mh6x-7q6h | https://github.com/avo-hq/avo | javascript | rails | rejected | fix in a Stimulus JS controller adding DOMPurify (dependency added) | NOASSERTION | - |
| GHSA-4f7c-pmjv-c25w | https://github.com/apache/logging-log4net | csharp | - | accepted | FormatXml masks XML-invalid chars in all attributes | Apache-2.0 | 9591 |
| GHSA-j92c-7v7g-gj3f | https://github.com/mganss/HtmlSanitizer | csharp | - | accepted | DoSanitize sanitizes template content (note: checker excerpt overshoots to ~490 lines) | MIT | 2942 |
| GHSA-hc72-vj3g-5g2g | https://github.com/SeriaWei/ZKEACMS | csharp | aspnetcore | rejected | GPL-3.0 and fix sanitizes Title/Html while advisory names ParentID; used only as fallback, not needed | GPL-3.0 | 51448 |
| GHSA-4rr6-2v9v-wcpc | https://github.com/restsharp/RestSharp | csharp | - | rejected | fix is CRLF rejection in a constructor initializer (validation), not encoding; better candidates found | Apache-2.0 | 41466 |
| GHSA-vcfc-9wcp-j623 | https://github.com/ServiceStack/ServiceStack | csharp | servicestack | rejected | repository over 150 MB (471601 KB) | NOASSERTION | 471601 |
| GHSA-93h6-wx7r-mgfp | https://github.com/serenity-is/Serenity | csharp | aspnetcore | rejected | referenced commits are a version bump and an upload extension denylist, not encoding | MIT | 141943 |
| GHSA-8x6f-956f-q43w | https://github.com/spassarop/antisamy-dotnet | csharp | - | rejected | referenced commits are tests-only and a 40-file release merge | BSD-3-Clause | - |
| GHSA-8v6j-gc74-fmpp | https://github.com/michaelschwarz/Ajax.NET-Professional | csharp | - | rejected | fix changes a constant and core.js, no function body gains encoding | MIT | - |
| GHSA-gfwx-w7gr-fvh7 | https://github.com/nltk/nltk | python | - | rejected | not pursued: fix spread over two commits; Python quota reached first | Apache-2.0 | - |
| GHSA-v87v-83h2-53w7 | https://github.com/lepture/mistune | python | - | rejected | no fix commit referenced; duplicate repository (mistune accepted via GHSA-g97x) | BSD-3-Clause | - |
| GHSA-542p-wvx7-72m4 | https://github.com/litestar-org/litestar | python | litestar | rejected | no fix commit referenced in advisory | - | - |
| GHSA-fj2m-qvh9-jq4q | https://github.com/LearningCircuit/local-deep-research | python | flask | rejected | fix spans two PRs and two commits; CWE-918 mixed in | - | - |
| GHSA-pf93-j98v-25pv | https://github.com/homeassistant-ai/ha-mcp | python | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-2gmv-2r3v-jxj2 | https://github.com/ParzivalHack/PySpector | python | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-63v4-w882-g4x2 | https://github.com/MervinPraison/PraisonAI | python | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-gx93-m64w-5m6h | https://github.com/allure-framework/allure2 | java | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-f2hp-qw27-8wfq | https://github.com/apache/storm | java | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-hw5c-xm3c-v96w | https://github.com/spring-projects/spring-webflow | java | spring | rejected | no fix commit referenced in advisory | - | - |
| GHSA-v84m-gfw5-hm2w | https://github.com/apache/syncope | java | - | rejected | no fix commit referenced in advisory | - | - |
| GHSA-fq9h-c788-fx73 | https://github.com/OpenIdentityPlatform/OpenAM | java | - | rejected | repository over 150 MB (523119 KB); only a release tag referenced | NOASSERTION | 523119 |
| GHSA-w3cp-g2pf-65wh | https://github.com/silverstripe/silverstripe-cms | php | silverstripe | rejected | escaping moved into a helper added by the fix (ListViewForm only calls it); stronger PHP candidates available | - | - |
| GHSA-gvrw-qqp5-jgc5 | https://github.com/silverstripe/silverstripe-framework | php | silverstripe | rejected | fix strips on* attributes from iframe embeds (filtering), not encoding | - | - |
| GHSA-38x5-rcv4-xf7x | https://github.com/symfony/ux | php | symfony | rejected | fix validates child component tag name (rejects), not encoding | MIT | 61584 |
| GHSA-8hgv-xc77-jmcr | https://github.com/getgrav/grav | php | - | rejected | fix is a 12-file sandbox/policy change closing four findings | MIT | 35084 |
| GHSA-8559-gwj3-q37r | https://github.com/EasyCorp/EasyAdminBundle | php | symfony | rejected | 14-file merge commit; escaping lands in twig templates and a new twig filter | - | - |
| GHSA-f7hx-fqxw-rvvj | https://github.com/PHPMailer/PHPMailer | php | - | rejected | viable (attachAll quotes attachment names) but LGPL-2.1 and permissive PHP candidates sufficed | LGPL-2.1 | 32067 |
| GHSA-3w28-36p9-w929 | https://github.com/gogs/gogs | go | - | rejected | repository over 150 MB (212268 KB) | MIT | 212268 |
| GHSA-rh3r-8pxm-hg4w | https://github.com/navidrome/navidrome | go | - | rejected | GPL-3.0; permissive Go candidates preferred (not inspected further) | GPL-3.0 | 73256 |
## deserialization
Order: GitHub advisory API `cwes=502` per ecosystem (composer, pip, maven, rubygems, nuget, npm, go), newest first, skipping repositories in used-repos.txt / claims.txt; plus one web search for npm (js-yaml). Every advisory examined is listed.
| advisory | repo | language | framework | verdict | reason | licence | size KB |
|---|---|---|---|---|---|---|---|
| GHSA-v7m3-fpcr-h7m2 | https://github.com/zumba/json-serializer | php | | accepted | unserializeObject gains @type class allow-list | MIT | 185 |
| GHSA-gwfr-jfjf-92vv | https://github.com/getgrav/grav | php | | rejected | fix bundled in multi-advisory security commit (c66dfeb/5a12f9b), FileCache signing spans several functions; deferred | MIT | 35084 |
| GHSA-w23p-wrp7-ch38 | https://github.com/pimcore/pimcore | php | symfony | rejected | repo > 150 MB (547161 KB) | NOASSERTION | 547161 |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| GHSA-2pm6-9fhx-vvg3 | https://github.com/CPS-IT/mailqueue | php | typo3 | accepted | fromFile unserialize option fixed to allowed_classes | GPL-2.0 | 1340 |
| GHSA-r33w-fg8j-9c94 | https://github.com/cesargb/laravel-magiclink | php | laravel | accepted | getActionAttribute drops legacy unserialize fallback (v2.25.1, #148) | MIT | 414 |
| GHSA-rf88-776r-rcq9 | https://github.com/saloonphp/saloon | php | | rejected | fix d418356 deletes AccessTokenAuthenticator::unserialize (function absent on fixed side) | MIT | 3417 |
| GHSA-g82f-9pw7-773w | https://github.com/concretecms/concretecms | php | concrete5 | rejected | repo > 150 MB (311501 KB) | MIT | 311501 |
| GHSA-2ff2-mx52-q8wp | https://github.com/octobercms/october | php | laravel | rejected | licence NOASSERTION (October CMS proprietary licence); SessionMaker lives in separate backend package | NOASSERTION | 80274 |
| GHSA-h29g-c9cx-c73q | https://github.com/torrentpier/torrentpier | php | | rejected | scanner-vendor report with no named function or fix commit | MIT | 42409 |
| GHSA-jr8m-x4p7-p3v5 | https://github.com/tomasnorre/crawler | php | typo3 | accepted | fetchUrlContents unserialize(header) -> json_decode | GPL-3.0 | 21616 |
| GHSA-rpj2-4hq8-938g | https://github.com/kevin1024/vcrpy | python | | accepted | deserialize yaml.load -> safe cassette loader | MIT | 1936 |
| GHSA-vqxf-v2gg-x3hc | https://github.com/docling-project/docling-core | python | | accepted | load_from_yaml FullLoader -> SafeLoader | MIT | 111592 |
| GHSA-339m-4qw5-j2g3 | https://github.com/tendenci/tendenci | python | django | rejected | repo > 150 MB (247990 KB) | NOASSERTION | 247990 |
| GHSA-jg22-mg44-37j8 | https://github.com/aio-libs/aiohttp | python | aiohttp | accepted | CookieJar.load pickle.load -> JSON / restricted unpickler | Apache-2.0 | 45467 |
| GHSA-9cfw-f3f9-7mm7 | https://github.com/agronholm/apscheduler | python | | rejected | no fix commit found (serializer files untouched since 2024) | MIT | - |
| GHSA-w8v5-vhqr-4h9v | https://github.com/grantjenks/python-diskcache | python | | rejected | no fix commit (unpatched) | Apache-2.0 | - |
| GHSA-32vr-5gcf-3pw2 | https://github.com/MervinPraison/PraisonAI | python | | rejected | advisory points to TS file agent.service.ts with JSON_SCHEMA; fix commit not identifiable | MIT | 111588 |
| GHSA-74vm-8frp-7w68 | https://github.com/WaterFutures/EPyT-Flow | python | | accepted | my_load_from_json __type__ lookup restricted to registered classes | MIT | 8484 |
| GHSA-q3g8-rjrx-59ph | https://github.com/openstack/ironic | python | | rejected | family mismatch: crafted JSON causes service crash (DoS), no object deserialization | Apache-2.0 | 65012 |
| GHSA-34wm-4hw7-qfjv | https://github.com/feast-dev/feast | python | | rejected | repo > 150 MB (302944 KB) | Apache-2.0 | 302944 |
| GHSA-c2jg-5cp7-6wc7 | https://github.com/pipecat-ai/pipecat | python | | rejected | repo > 150 MB (202165 KB) | BSD-2-Clause | 202165 |
| GHSA-fjqc-hq36-qh5p | https://github.com/langchain-ai/langgraph | python | | rejected | repo > 150 MB (529300 KB) | MIT | 529300 |
| GHSA-hg58-x52p-859c | https://github.com/datapizza-labs/datapizza-ai | python | | accepted | RedisCache.get pickle.loads -> JSON codec (e83beeb, #122) | MIT | 4552 |
| GHSA-7c5v-895v-w4q5 | https://github.com/jooby-project/jooby | java | jooby | accepted | SessionStoreImpl.strToObject ObjectInputStream -> pac4j Serializer | Apache-2.0 | 80305 |
| GHSA-jmw5-58c7-587h | https://github.com/apache/karaf-decanter | java | karaf | accepted | LoggingEventObjectInputStream gains JEP 290 allow-list filter | Apache-2.0 | 9096 |
| GHSA-f5cx-h789-j959 | https://github.com/powsybl/powsybl-core | java | | accepted | SparseMatrix.read gains ObjectInputFilter allow-list | MPL-2.0 | 76236 |
| GHSA-4hvc-qwr2-f8rv | https://github.com/redisson/redisson | java | | accepted | CustomObjectInputStream.resolveClass gains allowedClasses check | Apache-2.0 | 37067 |
| GHSA-85qj-f5wg-rwp9 | https://github.com/spring-attic/spring-statemachine | java | spring | rejected | referenced commit only adds Kryo-customizer constructors; kryo registration fix not in a single function body | Apache-2.0 | 18758 |
| GHSA-c459-2m73-67hj | https://github.com/sofastack/sofa-hessian | java | | rejected | blocklist-only: serialize.blacklist resource edited, no function change | Apache-2.0 | 736 |
| GHSA-h2wm-p2vg-6pw4 | https://github.com/rails/kredis | ruby | rails | accepted | Json#cast_value JSON.load -> JSON.parse | MIT | 363 |
| GHSA-977c-63xq-cgw3 | https://github.com/opensearch-project/opensearch-ruby | ruby | | accepted | verify_open_search YAML.load -> YAML.safe_load | Apache-2.0 | 7171 |
| GHSA-5c5f-7vfq-3732 | https://github.com/jmespath/jmespath.rb | ruby | | accepted | search JSON.load -> JSON.parse | Apache-2.0 | 283 |
| GHSA-gfhp-jgp6-838j | https://github.com/Orckestra/C1-CMS-Foundation | csharp | asp.net | accepted | CompositeSerializationBinder.BindToType tightened type allow-list (licence.txt = MPL-1.1, gh reports NOASSERTION) | MPL-1.1 | 70369 |
| GHSA-5q7q-qqw2-hjq7 | https://github.com/michaelschwarz/Ajax.NET-Professional | csharp | asp.net | rejected | referenced commit c89e39b only changes core.js / constant (XSS), no deserializer change | MIT | 491 |
| GHSA-3x49-g6rc-c284 | https://github.com/litedb-org/LiteDB (was https://github.com/mbdavid/LiteDB) | csharp | | accepted | BsonMapper.Deserialize _type assignability + type check (2-commit fix d72c677..4382ff4) | MIT | 62686 |
| GHSA-mm62-wxc8-cf7m | https://github.com/commenthol/serialize-to-js | javascript | | accepted | deserialize sanitizes input before new Function eval | MIT | 79 |
| GHSA-hw46-vg6w-88fj | https://github.com/inikulin/replicator | javascript | | rejected | fix lives in anonymous transform fromSerializable methods of an object literal; no named function on both sides | MIT | 89 |
| GHSA-vr6p-vq2p-6j74 | https://github.com/likec4/likec4 | typescript | | rejected | withdrawn advisory (dependency bump) | MIT | 241395 |
| GHSA-r399-636x-v7f6 | https://github.com/langchain-ai/langchainjs | typescript | | rejected | repo > 150 MB (703349 KB) | MIT | 703349 |
| GHSA-vc9j-fhvv-8vrf | https://github.com/LLK/scratch-vm | javascript | | rejected | repo > 150 MB (843174 KB), archived, AGPL | AGPL-3.0 | 843174 |
| GHSA-3rxj-6cgf-8cfw | https://github.com/lxsmnsyc/seroval | typescript | | rejected | referenced commit ce9408e is a version/changelog bump; code fix commit not identifiable | MIT | 4086 |
| GHSA-mv8w-475r-vwqw | https://github.com/lxsmnsyc/seroval | typescript | | rejected | no fix commit referenced; 1.5.3 tag absent | MIT | 4086 |
| GHSA-2gmp-34j9-fqjm | https://github.com/inikulin/replicator | javascript | | rejected | fix PR #19 never merged (no public fix commit) | MIT | 89 |
| GHSA-4jwp-vfvf-657p | https://github.com/mongodb/js-bson | javascript | | rejected | family mismatch: JSON parsing/serialization correctness, no fix commit referenced | Apache-2.0 | 11832 |
| GHSA-xxvw-45rp-3mj2 | https://github.com/nodeca/js-yaml | javascript | | rejected | no fix commit referenced; fix added safeLoad, load unchanged | MIT | - |
| GHSA-rp7v-4384-hfrp | https://github.com/k8sgpt-ai/k8sgpt | go | | rejected | family mismatch: prompt injection | Apache-2.0 | 29142 |
| GHSA-hcrc-79hj-m3qh | https://github.com/wazuh/wazuh | python | | rejected | repo > 150 MB (572768 KB) | NOASSERTION | 572768 |
| GHSA-33cr-m232-xqch | https://github.com/cheqd/cheqd-node | go | | rejected | family mismatch: non-deterministic JSON unmarshalling (consensus), fix in dependency ibc-go | Apache-2.0 | - |
| GHSA-rcxc-wjgw-579r | https://github.com/t2bot/matrix-media-repo | go | | rejected | family mismatch: untrusted file formats thumbnailed (CWE-434) | MIT | 122419 |
| GHSA-f5wc-c3c7-36mc | https://github.com/golang/crypto | go | | rejected | family mismatch: agent constraints dropped; not on GitHub source location | BSD-3-Clause | - |
| GHSA-9g64-r942-fvmp | https://github.com/apache/activemq-nms-openwire | csharp | | accepted | TrustedClassFilter.BindToType rejects unresolved types (AMQNET-844) | Apache-2.0 | 8190 |
| GHSA-76mw-6p95-x9x5 | https://github.com/pac4j/pac4j | java | | rejected | fix in 4.0.0 removes InternalAttributeHandler (function absent on fixed side) | Apache-2.0 | 77232 |
| GHSA-f984-3wx8-grp9 | https://github.com/xuxueli/xxl-rpc | java | | rejected | no fix commit (GHSL report, unpatched) | Apache-2.0 | 28236 |
| GHSA-ww7r-278h-48mh | https://github.com/QuantConnect/Lean | csharp | | rejected | repo > 150 MB (587662 KB) | Apache-2.0 | 587662 |
| GHSA-wq34-7f4g-953v | https://github.com/MarimerLLC/csla | csharp | | rejected | repo > 150 MB (289501 KB) | MIT | 289501 |
| GHSA-49rj-9fvp-4h2h | https://github.com/remix-run/react-router | typescript | react-router | accepted | turbo-stream unflatten hydrate drops attacker-chosen global constructor for TYPE_ERROR (5981192, #14986; follow-up bc77b32 in single-fetch.tsx) | MIT | 52291 |
| GHSA-p9x5-jp3h-96mm | https://github.com/QwikDev/qwik | typescript | qwik | rejected | no fix commit referenced; release-tag only, not identified in the commit window | MIT | 107595 |
| GHSA-9m65-766c-r333 | https://github.com/TanStack/router | typescript | tanstack | rejected | no fix commit referenced by the advisory (not pursued after target reached) | MIT | 113156 |
## access_control
Advisories examined via `gh api /advisories?ecosystem=<eco>&cwes=284,285,306,425,566,639,862,863&type=reviewed` (newest first; first page per ecosystem, then further pages for go/npm/pip/maven), plus Jellyfin repository advisories for C#. Used/claimed repositories were filtered before examination.
| advisory | repo | language | framework | verdict | reason | licence | size KB |
|---|---|---|---|---|---|---|---|
| GHSA-q4c5-2j6f-r476 | https://github.com/nautobot/nautobot | python | django | rejected | repo > 150 MB; fix removes the endpoint (no function body gains a check) | Apache-2.0 | 290947 |
| GHSA-x287-5c68-36wp | https://github.com/openwisp/openwisp-ipam | python | django | accepted | export_view gains org-scoped get_object_or_404 | BSD-3-Clause | 36425 |
| GHSA-2q2q-jr9g-v9rf | https://github.com/weblateorg/weblate | python | django | rejected | repo > 150 MB | GPL-3.0 | 5814773 |
| GHSA-2cm6-r77w-6g96 | https://github.com/mlflow/mlflow | python | flask | rejected | repo > 150 MB | Apache-2.0 | 1487459 |
| GHSA-49f7-whx5-4256 | https://github.com/topoteretes/cognee | python | fastapi | rejected | repo > 150 MB | Apache-2.0 | 259125 |
| GHSA-8qj2-c6q4-f399 | https://github.com/django-cms/django-cms | python | django | accepted | render_object_structure gains view-permission check (LICENSE file is BSD-3-Clause text; API says NOASSERTION) | BSD-3-Clause | 123368 |
| GHSA-c7c5-5j6r-q957 | https://github.com/djust-org/djust | python | djust | rejected | no fix commit referenced; fix spread over several entry points (shared chokepoint) | MIT | 64392 |
| GHSA-47w6-gwp4-w6vc | https://github.com/vantage6/vantage6 | python | flask | rejected | no fix commit referenced in advisory | Apache-2.0 | 55556 |
| GHSA-8fq9-273g-6mrg | https://github.com/avo-hq/avo | ruby | rails | rejected | fix only edits before_action list (no function body change) | NOASSERTION | 33036 |
| GHSA-c273-c6vg-4pv5 | https://github.com/publify/publify | ruby | rails | accepted | update takes id only from access-checked params[:id] | MIT | 33042 |
| GHSA-4825-p4xm-pcf2 | https://github.com/spree/spree | ruby | rails | rejected | repo > 150 MB | BSD-3-Clause | 323664 |
| GHSA-wr57-hqmp-fgvh | https://github.com/umbraco/umbraco-cms | csharp | aspnetcore | rejected | repo > 150 MB | MIT | 476443 |
| GHSA-v46j-h43h-rwrm | https://github.com/autolab/autolab | ruby | rails | rejected | fix is skip_before_action/action_auth_level declarations, body unchanged | Apache-2.0 | 11321 |
| GHSA-mqq5-j7w8-2hgh | https://github.com/alchemycms/alchemy_cms | ruby | rails | accepted | nested gains authorize! :show (fix commit found by path history; advisory lists none) | BSD-3-Clause | 45245 |
| GHSA-c43c-rf7g-5xpg | https://github.com/katello/katello | ruby | rails | rejected | repo > 150 MB | GPL-2.0 | 278197 |
| GHSA-q79h-67vx-m9xg | https://github.com/decidim/decidim | ruby | rails | rejected | repo > 150 MB | AGPL-3.0 | 325767 |
| GHSA-89vx-jh4q-vg3w | https://github.com/deepstreamio/deepstream.io | typescript | | rejected | fix only adds an entry to the rules map (data), no function body change | MIT | 11065 |
| GHSA-4qpv-39hg-f7fx | https://github.com/jhb-software/payload-plugins | typescript | payload | rejected | no licence declared in repository | none | 5748 |
| GHSA-wr5r-wqp2-x4fh | https://github.com/apostrophecms/apostrophe | javascript | apostrophe | rejected | checker resolves a different `move` declaration ("body is unchanged") | MIT | 52259 |
| GHSA-h3rm-78g3-j7cp | https://github.com/better-auth/better-auth | typescript | | rejected | repo > 150 MB | MIT | 158549 |
| GHSA-g74q-6g2f-874x | https://github.com/tinacms/tinacms | typescript | | rejected | repo > 150 MB | Apache-2.0 | 934072 |
| GHSA-jxpj-9j24-w337 | https://github.com/apolloconfig/apollo | java | spring | accepted | ReleaseController.get gains config-visibility check | Apache-2.0 | 58145 |
| GHSA-9jjc-fw8x-fmwx | https://github.com/moquette-io/moquette | java | | accepted | publishWill gains canWrite topic authorization | Apache-2.0 | 6555 |
| GHSA-mpff-xhg4-vr45 | https://github.com/jenkinsci/mcp-server-plugin | java | jenkins | accepted | getReplayScripts gains Item.EXTENDED_READ check | MIT | 734 |
| GHSA-g7c6-wxjf-8564 | https://github.com/jenkinsci/github-branch-source-plugin | java | jenkins | rejected | permission check lands in helper/signature change, not the doFill body | MIT | 3508 |
| GHSA-9v77-j4xv-34gq | https://github.com/jenkinsci/ec2-fleet-plugin | java | jenkins | rejected | family mismatch: fix adds endpoint validation (SSRF) | Apache-2.0 | 1464 |
| GHSA-hwvp-7xqv-8jx3 | https://github.com/jenkinsci/git-parameter-plugin | java | jenkins | rejected | no licence declared in repository | none | 1340 |
| GHSA-9284-fjc3-fmmj | https://github.com/sakaiproject/sakai | java | | rejected | repo > 150 MB | ECL-2.0 | 568413 |
| GHSA-xqr9-4wvv-gvch | https://github.com/openremote/openremote | java | | rejected | repo > 150 MB | NOASSERTION | 310763 |
| GHSA-2rgp-f66f-4499 | https://github.com/intranda/goobi-viewer-core | java | | rejected | repo > 150 MB | GPL-2.0 | 726110 |
| GHSA-mpmw-f6h6-3g26 | https://github.com/wintercms/winter | php | winter | rejected | fix adds guarded list and a new formExtendQuery method; no existing body changes (same repo also accepted via GHSA-3277) | MIT | 69889 |
| GHSA-3277-h8g9-qj5f | https://github.com/wintercms/winter | php | winter | accepted | getFileRecord scopes file_id lookup to the widget relation | MIT | 69889 |
| GHSA-575r-357h-fhch | https://github.com/grokability/snipe-it | php | laravel | rejected | repo > 150 MB | AGPL-3.0 | 332721 |
| GHSA-xxpx-f366-4xpq | https://github.com/craftcms/cms | php | yii | rejected | repo > 150 MB | NOASSERTION | 1077350 |
| GHSA-rm67-g9ch-vxff | https://github.com/poweradmin/poweradmin | php | | rejected | repo > 150 MB | GPL-3.0 | 520322 |
| GHSA-f97c-ph8j-8vff | https://github.com/pimcore/pimcore | php | symfony | rejected | repo > 150 MB | NOASSERTION | 547161 |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| (id withheld) | reserved repository (name withheld) | php | | rejected | the repository is reserved for the independent evaluation (reserved-population guard test) | | |
| GHSA-g2fm-8hr4-j82h | https://github.com/easycorp/easyadminbundle | php | symfony | accepted | getSymfonyControllerFqcn gains access_control re-check of the dispatched route | MIT | 50855 |
| GHSA-4227-9989-jrhx | https://github.com/perses/perses | go | echo | accepted | proxyUnsavedGlobalDatasource gains GlobalSecret read permission check | Apache-2.0 | 45211 |
| GHSA-cjgj-2fwf-4c2w | https://github.com/perses/perses | go | echo | rejected | duplicate repository (perses already accepted) | Apache-2.0 | 45211 |
| GHSA-p5vg-v7mj-f6q4 | https://github.com/frain-dev/convoy | go | | rejected | proprietary licence (Convoy licence agreement) | NOASSERTION | 88612 |
| GHSA-xcw9-qmmf-vqxj | https://github.com/amir20/dozzle | go | | rejected | repo > 150 MB | MIT | 164912 |
| GHSA-992g-9cr3-vm5x | https://github.com/hatchet-dev/hatchet | go | | rejected | repo > 150 MB | MIT | 219555 |
| GHSA-v684-q882-jgmq | https://github.com/siyuan-note/siyuan | go | | rejected | repo > 150 MB | AGPL-3.0 | 786842 |
| GHSA-5ww9-jg6q-38r7 | https://github.com/filebrowser/filebrowser | go | | accepted | resourceDeleteHandler scopes share deletion to d.user.ID (repo archived) | Apache-2.0 | 24323 |
| GHSA-qm33-p5p9-f8vg | https://github.com/juev/nebula-mesh (now https://github.com/forgekeep/nebula-mesh) | go | net/http | accepted | handleGetAuditLog gains actorIsAdmin gate | MIT | 5724 |
| GHSA-598g-h2vc-h5vg | https://github.com/juev/nebula-mesh | go | net/http | rejected | duplicate repository; referenced commit 9d8bcd7 is a later hardening, not this fix | MIT | 5724 |
| GHSA-7rx3-5wx3-5v76 | https://github.com/forgekeep/nebula-mesh | go | net/http | rejected | duplicate repository | MIT | 5724 |
| GHSA-v5m8-5455-qw2x | https://github.com/kubev2v/migration-planner | go | | accepted | GetSourceDownloadURL gains owner/org check | Apache-2.0 | 6225 |
| GHSA-65w6-pf7x-5g85 | https://github.com/delmaredigital/payload-puck | typescript | payload | accepted | createDeleteHandler passes req + overrideAccess:false | MIT | 2014 |
| GHSA-54mc-gghv-4cfj | https://github.com/smithyhq/sqladmin | python | starlette | accepted | ajax_lookup gains authentication_backend.authenticate gate | BSD-3-Clause | 6413 |
| GHSA-ccg5-9c8w-xh6v | https://github.com/smithyhq/sqladmin | python | starlette | rejected | duplicate repository | BSD-3-Clause | 6413 |
| GHSA-m98r-6667-4wq7 | https://github.com/aegra/aegra | python | fastapi | rejected | checker extracts only the multi-line signature (closing paren at column 0), reports body unchanged | Apache-2.0 | 4162 |
| GHSA-r2jv-fwfr-4j8c | https://github.com/askbot/askbot-devel | python | django | rejected | fix in a release commit (v0.12.3) | GPL-3.0 | 96228 |
| GHSA-r6ph-5fp2-3w2v | https://github.com/microcks/microcks | java | spring | rejected | fix only edits the security filter-chain route matchers (config) | Apache-2.0 | 9353 |
| GHSA-2hr5-cvwp-jr5w | https://github.com/oqtane/oqtane.framework | csharp | aspnetcore | accepted | IsAuthorized default flips from true to false (PR 4876 merge commit, first parent) | MIT | 95357 |
| GHSA-hhcw-wwxv-g95c | https://github.com/oqtane/oqtane.framework | csharp | aspnetcore | rejected | duplicate repository | MIT | 95357 |
| GHSA-c8qj-jx8j-fg2w | https://github.com/riganti/dotvvm | csharp | dotvvm | rejected | fix is in expression-bodied explicit interface members whose names duplicate the protected methods; checker resolves the unchanged declaration | Apache-2.0 | 65853 |
| GHSA-4vx8-xhc9-qg6x | https://github.com/jellyfin/jellyfin | csharp | aspnetcore | accepted | AssertCanControl gains ownership/permission check (published repository advisory, not mirrored in the global advisory DB; merge commit, first parent; GPL used because C# candidates are scarce) | GPL-2.0 | 78504 |
| GHSA-9x85-gx46-6522 | https://github.com/jellyfin/jellyfin | csharp | aspnetcore | rejected | checker cannot resolve GetPlaylistItems (generic return type); duplicate repository anyway | GPL-2.0 | 78504 |
| GHSA-c7hf-c5p5-5g6h | https://github.com/louislam/uptime-kuma | javascript | express | rejected | fix lives in anonymous router.get callbacks (no named function) | MIT | 38757 |
| GHSA-qwc3-h9mg-4582 | https://github.com/parse-community/parse-dashboard | javascript | express | rejected | vulnerable handler is an anonymous app.post callback (named only by the fix) | NOASSERTION (BSD-style licence agreement) | 24994 |
| GHSA-j3w7-9qc3-g96p | https://github.com/kottster/kottster | typescript | | rejected | fix in a large feature commit (table views, role renames) | Apache-2.0 | 5312 |
| GHSA-67gq-6q8c-qqh6 | https://github.com/steipete/summarize | typescript | | rejected | family mismatch: browser-extension tool-call confirmation, not web access control | MIT | 59052 |
| GHSA-xvf4-ch4q-2m24 | https://github.com/withstudiocms/studiocms | typescript | astro | rejected | repo > 150 MB | MIT | 798260 |
| GHSA-qmjj-p7m9-wjrv | https://github.com/actualbudget/actual | typescript | express | rejected | repo > 150 MB | MIT | 602797 |
| GHSA-ggpm-9qfx-mhwg | https://github.com/evershopcommerce/evershop | typescript | | rejected | fix in a dev->main release merge commit | GPL-3.0 | 48140 |
| GHSA-4cmx-hrq9-c23p | https://github.com/moscajs/aedes | javascript | | accepted | finish() gains authorizePublish before publishing the Last Will | MIT | 1477 |
| GHSA-382c-vx95-w3p5 | https://github.com/jsonbored/gittensory | typescript | hono | accepted | getContributorProfile gains requireContributorAccess (AGPL used: few permissive TS candidates qualified) | AGPL-3.0 | 68042 |
| GHSA-hvrp-rf83-w775 | https://github.com/modelcontextprotocol/python-sdk | python | | rejected | fix spread across new scoping module and deprecations; no single guarded handler body | MIT | 16583 |
| GHSA-pxvw-4w88-6x95 | https://github.com/9001/copyparty | python | | rejected | fix renames canonical() and adds new share-fenced variants (function replaced, not guarded) | MIT | 9894 |
| GHSA-7j9p-67mm-5g87 | https://github.com/openedx/xblock-lti-consumer | python | django | accepted | publish_grade_on_score_update gains resource_link_id scope check (AGPL used to reach target) | AGPL-3.0 | 2028 |
| GHSA-9pm8-vwc5-w2hm | https://github.com/fatfreecrm/fat_free_crm | ruby | rails | rejected | check added as class-level load_and_authorize_resource; destroy body only loses the find | MIT | 21601 |
benchmarks/pairs/advisory-fixes/verification.json
+491
View File
@@ -0,0 +1,491 @@
{
"pairs": [
{
"name": "grav-redirect-2eae104",
"ok": true,
"bytes_read": 3496
},
{
"name": "cas-plugin-determinetargeturl-8ac536a",
"ok": true,
"bytes_read": 3368
},
{
"name": "spirit-custom-login-8f32f89",
"ok": true,
"bytes_read": 1749
},
{
"name": "archivy-login-2d8cb29",
"ok": true,
"bytes_read": 2273
},
{
"name": "google-login-plugin-docommencelogin-532d714",
"ok": true,
"bytes_read": 2790
},
{
"name": "truelayer-dotnet-getpayment-75e436e",
"ok": true,
"bytes_read": 2335
},
{
"name": "koa-back-422c551",
"ok": true,
"bytes_read": 1916
},
{
"name": "miniflux-checklogin-76df99f",
"ok": true,
"bytes_read": 5899
},
{
"name": "taguette-go-to-next-67de2d2",
"ok": true,
"bytes_read": 1163
},
{
"name": "weasyprint-default-url-fetcher-b6a14f0",
"ok": true,
"bytes_read": 2240
},
{
"name": "feathers-getredirect-ee19a0a",
"ok": true,
"bytes_read": 2305
},
{
"name": "mailpit-dohead-10ad4df",
"ok": true,
"bytes_read": 3086
},
{
"name": "devise-redirect-url-025fe21",
"ok": true,
"bytes_read": 1463
},
{
"name": "koel-createforepisode-8708f07",
"ok": true,
"bytes_read": 1867
},
{
"name": "authentication-getloginredirect-1c1e29c",
"ok": true,
"bytes_read": 3975
},
{
"name": "og-image-resolve-243cac2",
"ok": true,
"bytes_read": 3634
},
{
"name": "koillection-fetchwithhttpclient-4d445e2",
"ok": true,
"bytes_read": 2383
},
{
"name": "elfinderaspnet-extractasync-675049b",
"ok": true,
"bytes_read": 6621
},
{
"name": "hsweb-framework-createstaticsavepath-8009845",
"ok": true,
"bytes_read": 3682
},
{
"name": "changedetectionio-static-content-9d38b45",
"ok": true,
"bytes_read": 11606
},
{
"name": "rack-check-forbidden-75c5745",
"ok": true,
"bytes_read": 1659
},
{
"name": "camaleon-cms-fetch-file-f54a77e",
"ok": true,
"bytes_read": 1497
},
{
"name": "wicket-save-7247098",
"ok": true,
"bytes_read": 2030
},
{
"name": "yii2-renderphpfile-109878b",
"ok": true,
"bytes_read": 4027
},
{
"name": "yard-check-static-cache-f78c19f",
"ok": true,
"bytes_read": 1844
},
{
"name": "thumbor-load-3b986d1",
"ok": true,
"bytes_read": 3659
},
{
"name": "filebrowser-subtitleshandler-f3f4bbe",
"ok": true,
"bytes_read": 6180
},
{
"name": "laravel-mediable-sanitizepath-6d1e7fb",
"ok": true,
"bytes_read": 2128
},
{
"name": "external-workspace-manager-plugin-computecustompath-2fccbbd",
"ok": true,
"bytes_read": 3066
},
{
"name": "openhop-filepath-c8190fb",
"ok": true,
"bytes_read": 1049
},
{
"name": "handlebarsjava-getresource-61f4342",
"ok": true,
"bytes_read": 2946
},
{
"name": "fastify-static-pumpsendtoreply-db4276f",
"ok": true,
"bytes_read": 14100
},
{
"name": "goshs-upload-f3ef599",
"ok": true,
"bytes_read": 8431
},
{
"name": "knowns-get-09c5a96",
"ok": true,
"bytes_read": 4453
},
{
"name": "webpack-dev-middleware-getfilenamefromurl-13344e7",
"ok": true,
"bytes_read": 6586
},
{
"name": "template-load-28cff3a",
"ok": true,
"bytes_read": 5799
},
{
"name": "zeppelin-fromjson-8368579",
"ok": true,
"bytes_read": 1869
},
{
"name": "moonshine-resolvepreview-f108f4e",
"ok": true,
"bytes_read": 2705
},
{
"name": "chrome-construct-34b2b8d",
"ok": true,
"bytes_read": 1244
},
{
"name": "prosemirror-to-html-render-opening-tag-4d59f94",
"ok": true,
"bytes_read": 2004
},
{
"name": "algernon-htmllink-cd88320",
"ok": true,
"bytes_read": 1524
},
{
"name": "tornado-write-error-9c163ae",
"ok": true,
"bytes_read": 3094
},
{
"name": "htmlsanitizer-dosanitize-0ac53dc",
"ok": true,
"bytes_read": 35736
},
{
"name": "logging-log4net-formatxml-42a77cb",
"ok": true,
"bytes_read": 9153
},
{
"name": "mistune-render-admonition-a3cb6e5",
"ok": true,
"bytes_read": 1394
},
{
"name": "slippers-attr-string-16cc4ef",
"ok": true,
"bytes_read": 2209
},
{
"name": "schema-org-toscript-be389b4",
"ok": true,
"bytes_read": 1252
},
{
"name": "htmlpublisher-plugin-publishreports-1034d47",
"ok": true,
"bytes_read": 18179
},
{
"name": "jquery-autocomplete-formatgroup-63ff096",
"ok": true,
"bytes_read": 1257
},
{
"name": "view-component-render-in-48e5fd2",
"ok": true,
"bytes_read": 6953
},
{
"name": "etherpad-gethtmlfromatext-86c56cf",
"ok": true,
"bytes_read": 3857
},
{
"name": "silverstripe-versioned-getrestoremessage-6e30a2c",
"ok": true,
"bytes_read": 6474
},
{
"name": "dicebear-addrotate-922946d",
"ok": true,
"bytes_read": 1368
},
{
"name": "omnifaces-getupdatescript-c43eef0",
"ok": true,
"bytes_read": 1491
},
{
"name": "tablib-export-book-b0ff39f",
"ok": true,
"bytes_read": 1683
},
{
"name": "hono-resolvechildearly-2b8ed40",
"ok": true,
"bytes_read": 3041
},
{
"name": "serialize-to-js-deserialize-1cd4339",
"ok": true,
"bytes_read": 1158
},
{
"name": "jmespath-rb-search-e884128",
"ok": true,
"bytes_read": 1554
},
{
"name": "opensearch-ruby-verify-open-search-d74a98b",
"ok": true,
"bytes_read": 2402
},
{
"name": "c1-cms-foundation-bindtotype-af856ab",
"ok": true,
"bytes_read": 2368
},
{
"name": "litedb-deserialize-4382ff4",
"ok": true,
"bytes_read": 11509
},
{
"name": "kredis-cast-value-d576b7a",
"ok": true,
"bytes_read": 928
},
{
"name": "redisson-resolveclass-fe6a257",
"ok": true,
"bytes_read": 1832
},
{
"name": "activemq-nms-openwire-bindtotype-8944c41",
"ok": true,
"bytes_read": 2649
},
{
"name": "jooby-strtoobject-3e13562",
"ok": true,
"bytes_read": 2061
},
{
"name": "powsybl-core-read-8ed16ce",
"ok": true,
"bytes_read": 2386
},
{
"name": "docling-core-load-from-yaml-3e8d628",
"ok": true,
"bytes_read": 1989
},
{
"name": "karaf-decanter-loggingeventobjectinputstream-9d7058d",
"ok": true,
"bytes_read": 1807
},
{
"name": "mailqueue-fromfile-0f7a137",
"ok": true,
"bytes_read": 1889
},
{
"name": "epyt-flow-my-load-from-json-3fff915",
"ok": true,
"bytes_read": 2443
},
{
"name": "laravel-magiclink-getactionattribute-19fa820",
"ok": true,
"bytes_read": 1556
},
{
"name": "json-serializer-unserializeobject-bf26227",
"ok": true,
"bytes_read": 6764
},
{
"name": "aiohttp-load-dcf40f3",
"ok": true,
"bytes_read": 1923
},
{
"name": "datapizza-ai-get-e83beeb",
"ok": true,
"bytes_read": 1549
},
{
"name": "react-router-hydrate-5981192",
"ok": true,
"bytes_read": 12741
},
{
"name": "vcrpy-deserialize-045acb1",
"ok": true,
"bytes_read": 998
},
{
"name": "crawler-fetchurlcontents-be7dbe7",
"ok": true,
"bytes_read": 4607
},
{
"name": "aedes-finish-ffbc170",
"ok": true,
"bytes_read": 2269
},
{
"name": "publify-update-c0aba87",
"ok": true,
"bytes_read": 2413
},
{
"name": "xblock-lti-consumer-publish-grade-on-score-update-252f94b",
"ok": true,
"bytes_read": 6984
},
{
"name": "oqtaneframework-isauthorized-e83399a",
"ok": true,
"bytes_read": 1500
},
{
"name": "apollo-get-362735d",
"ok": true,
"bytes_read": 1826
},
{
"name": "payload-puck-createdeletehandler-9148201",
"ok": true,
"bytes_read": 2861
},
{
"name": "sqladmin-ajax-lookup-b0d3a19",
"ok": true,
"bytes_read": 2514
},
{
"name": "nebula-mesh-handlegetauditlog-8baaace",
"ok": true,
"bytes_read": 2578
},
{
"name": "gittensory-getcontributorprofile-811ef5f",
"ok": true,
"bytes_read": 2415
},
{
"name": "filebrowser-resourcedeletehandler-0231b7e",
"ok": true,
"bytes_read": 3010
},
{
"name": "winter-getfilerecord-9cb0ae5",
"ok": true,
"bytes_read": 1894
},
{
"name": "migration-planner-getsourcedownloadurl-ec47a33",
"ok": true,
"bytes_read": 2759
},
{
"name": "mcp-server-plugin-getreplayscripts-ffe5ae7",
"ok": true,
"bytes_read": 3796
},
{
"name": "openwisp-ipam-export-view-04a2ef9",
"ok": true,
"bytes_read": 1596
},
{
"name": "alchemy-cms-nested-8417a2e",
"ok": true,
"bytes_read": 2057
},
{
"name": "django-cms-render-object-structure-9c82abf",
"ok": true,
"bytes_read": 3771
},
{
"name": "perses-proxyunsavedglobaldatasource-2368c9e",
"ok": true,
"bytes_read": 2158
},
{
"name": "moquette-publishwill-e23df01",
"ok": true,
"bytes_read": 2894
},
{
"name": "easyadminbundle-getsymfonycontrollerfqcn-03be45c",
"ok": true,
"bytes_read": 4391
},
{
"name": "jellyfin-assertcancontrol-420d44f",
"ok": true,
"bytes_read": 2462
}
],
"verified": 97,
"bytes_read": 367053
}