mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
feat(plane): scoring parity with the reference -- sites, ranges, triage cost
agree matched declared sites through benchmarks/independent/evaluate.py, which the runner image does not carry, so site matching would have been "not assessed". The generator now resolves the fix's old-side ranges (evaluate.hunks, line for line) into case.json, with the declared sites in the set and the reference's cost, and agree.matches_declared reproduces matches_v2; a parity test runs both over the recorded outputs of the 15 validation cases (200 probes, identical verdicts) and agree on those outputs returns the reference's 16 of 20 and $0.022. agree reports cost_per_candidate (plane spend) and cost_per_candidate_with_recorded_triage; Requirement 6.2 is judged on the latter (design.md). --runner-image re-pins the templates from ops/ax/up.sh's pin file; the committed manifests are regenerated at the current digest. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
ac296ee3a4
commit
56b1717246
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,7 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"read\",\n \"line\": 539,\n \"path\": \"packages/server/src/integrations/mongodb.ts\"\n },\n {\n \"function\": \"enrichContext\",\n \"line\": 136,\n \"path\": \"packages/server/src/sdk/workspace/queries/queries.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"budibase-mongo-template-nosqli\",\n \"sites\": [\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\",\n \"packages/server/src/integrations/mongodb.ts::read\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 2,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.003638,\n \"recorded_usd\": 0.0767\n },\n \"family\": \"injection\",\n \"id\": \"budibase-mongo-template-nosqli\",\n \"ranges\": {\n \"packages/server/src/api/routes/tests/queries/rest.spec.ts\": [\n [\n 580,\n 580\n ]\n ],\n \"packages/server/src/sdk/workspace/queries/queries.ts\": [\n [\n 2,\n 3\n ],\n [\n 15,\n 15\n ],\n [\n 120,\n 125\n ],\n [\n 136,\n 136\n ],\n [\n 138,\n 140\n ]\n ],\n \"packages/string-templates/src/index.ts\": [\n [\n 276,\n 276\n ]\n ],\n \"packages/string-templates/test/basic.spec.ts\": [\n [\n 10,\n 10\n ],\n [\n 128,\n 128\n ]\n ]\n },\n \"ranges_basis\"\
|
||||
: \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\",\n \"packages/server/src/integrations/mongodb.ts::read\"\n ],\n \"sites_in_set\": [\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\",\n \"packages/server/src/integrations/mongodb.ts::read\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/integrations/mongodb.ts\",\n \"read\",\n 539\n ],\n [\n \"packages/server/src/sdk/workspace/queries/queries.ts\",\n \"enrichContext\",\n 136\n ]\n ],\n \"kept\": [\n [\n \"packages/server/src/integrations/mongodb.ts\",\n \"read\",\n 539\n ],\n [\n \"packages/server/src/sdk/workspace/queries/queries.ts\",\n \"enrichContext\",\n 136\n ]\n ],\n \"triage\": {\n \"packages/server/src/integrations/mongodb.ts::read\": \"request\",\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,7 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"checkAndInstallAgent\",\n \"line\": 280,\n \"path\": \"cli-tool/src/sandbox-server.js\"\n },\n {\n \"function\": \"executeLocalTask\",\n \"line\": 464,\n \"path\": \"cli-tool/src/sandbox-server.js\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"cct-studio-server-cmdi\",\n \"sites\": [\n \"cli-tool/src/sandbox-server.js::executeLocalTask\",\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 2,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.003055,\n \"recorded_usd\": 0.0242\n },\n \"family\": \"injection\",\n \"id\": \"cct-studio-server-cmdi\",\n \"ranges\": {\n \"CHANGELOG.md\": [\n [\n 7,\n 7\n ]\n ],\n \"cli-tool/package.json\": [\n [\n 3,\n 3\n ]\n ],\n \"cli-tool/src/sandbox-server.js\": [\n [\n 11,\n 11\n ],\n [\n 50,\n 50\n ],\n [\n 52,\n 52\n ],\n [\n 54,\n 54\n ],\n [\n 202,\n 202\n ],\n [\n 209,\n 209\n ],\n [\n 212,\n 214\n ],\n [\n 216,\n 217\n ],\n [\n 278,\n 278\n ],\n [\n 280,\n 280\n ],\n [\n 282,\n 283\n ],\n [\n 463,\n 464\n ],\n [\n 471,\n \
|
||||
\ 471\n ],\n [\n 561,\n 562\n ]\n ],\n \"package.json\": [\n [\n 3,\n 3\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"cli-tool/src/sandbox-server.js::executeLocalTask\",\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\"\n ],\n \"sites_in_set\": [\n \"cli-tool/src/sandbox-server.js::executeLocalTask\",\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"cli-tool/src/sandbox-server.js\",\n \"checkAndInstallAgent\",\n 280\n ],\n [\n \"cli-tool/src/sandbox-server.js\",\n \"executeLocalTask\",\n 464\n ]\n ],\n \"kept\": [\n [\n \"cli-tool/src/sandbox-server.js\",\n \"checkAndInstallAgent\",\n 280\n ],\n [\n \"cli-tool/src/sandbox-server.js\",\n \"executeLocalTask\",\n 464\n ]\n ],\n \"triage\": {\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\": \"parameter\",\n \"cli-tool/src/sandbox-server.js::executeLocalTask\": \"request\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,16 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_compile_jinja_template\",\n \"line\": 106,\n \"path\": \"mcpgateway/services/prompt_service.py\"\n },\n {\n \"function\": \"_render_template\",\n \"line\": 2892,\n \"path\": \"mcpgateway/services/prompt_service.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"contextforge-prompt-ssti\",\n \"sites\": [\n \"mcpgateway/services/prompt_service.py::_render_template\",\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 2,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.004212,\n \"recorded_usd\": 0.0511\n },\n \"family\": \"injection\",\n \"id\": \"contextforge-prompt-ssti\",\n \"ranges\": {\n \".env.example\": [\n [\n 164,\n 166\n ]\n ],\n \".secrets.baseline\": [\n [\n 6,\n 6\n ],\n [\n 95,\n 95\n ],\n [\n 103,\n 103\n ],\n [\n 111,\n 111\n ],\n [\n 119,\n 119\n ],\n [\n 127,\n 127\n ],\n [\n 135,\n 135\n ],\n [\n 143,\n 143\n ],\n [\n 151,\n 151\n ],\n [\n 159,\n 159\n ],\n [\n 167,\n 167\n ],\n [\n 175,\n 175\n ],\n [\n 183,\n 183\n ],\n [\n 253,\n 253\n ],\n [\n 261,\n 261\n\
|
||||
\ ],\n [\n 269,\n 269\n ],\n [\n 277,\n 277\n ],\n [\n 285,\n 285\n ],\n [\n 293,\n 293\n ],\n [\n 301,\n 301\n ],\n [\n 309,\n 309\n ],\n [\n 4215,\n 4215\n ],\n [\n 4865,\n 4865\n ],\n [\n 4873,\n 4873\n ],\n [\n 5195,\n 5195\n ],\n [\n 5957,\n 5957\n ],\n [\n 8393,\n 8393\n ],\n [\n 8401,\n 8401\n ],\n [\n 8409,\n 8409\n ],\n [\n 8759,\n 8759\n ],\n [\n 8767,\n 8767\n ],\n [\n 8775,\n 8775\n ],\n [\n 8783,\n 8783\n ],\n [\n 8791,\n 8791\n ],\n [\n 8799,\n 8799\n ],\n [\n 8807,\n 8807\n ],\n [\n 8815,\n 8815\n ],\n [\n 8823,\n 8823\n ],\n [\n 8831,\n 8831\n ],\n [\n 8839,\n 8839\n ],\n [\n 8847,\n 8847\n ],\n [\n 8855,\n 8855\n ],\n [\n 8863,\n 8863\n ],\n [\n 9237,\n 9237\n ],\n [\n 9245,\n\
|
||||
\ 9245\n ],\n [\n 9253,\n 9253\n ],\n [\n 9263,\n 9263\n ]\n ],\n \"CHANGELOG.md\": [\n [\n 4,\n 4\n ]\n ],\n \"README.md\": [\n [\n 751,\n 751\n ],\n [\n 761,\n 761\n ]\n ],\n \"SECURITY.md\": [\n [\n 276,\n 276\n ],\n [\n 374,\n 374\n ]\n ],\n \"crates/mcp_runtime/tests/runtime.rs\": [\n [\n 1647,\n 1647\n ]\n ],\n \"docs/docs/architecture/security-features.md\": [\n [\n 120,\n 120\n ]\n ],\n \"docs/docs/manage/securing.md\": [\n [\n 428,\n 428\n ],\n [\n 440,\n 440\n ]\n ],\n \"mcpgateway/admin.py\": [\n [\n 132,\n 132\n ],\n [\n 13075,\n 13075\n ],\n [\n 13196,\n 13196\n ]\n ],\n \"mcpgateway/config.py\": [\n [\n 93,\n 93\n ],\n [\n 1738,\n 1738\n ],\n [\n 1755,\n 1755\n ]\n ],\n \"mcpgateway/main.py\": [\n [\n 156,\n 156\n ],\n [\n 1820,\n 1823\n ],\n [\n 2426,\n\
|
||||
\ 2426\n ],\n [\n 6362,\n 6362\n ],\n [\n 6559,\n 6559\n ]\n ],\n \"mcpgateway/services/content_security.py\": [\n [\n 16,\n 16\n ],\n [\n 48,\n 48\n ],\n [\n 171,\n 171\n ],\n [\n 192,\n 192\n ],\n [\n 194,\n 194\n ],\n [\n 201,\n 201\n ],\n [\n 204,\n 204\n ],\n [\n 333,\n 333\n ],\n [\n 335,\n 335\n ],\n [\n 345,\n 347\n ],\n [\n 351,\n 352\n ],\n [\n 357,\n 357\n ],\n [\n 360,\n 360\n ],\n [\n 362,\n 363\n ]\n ],\n \"mcpgateway/services/metrics.py\": [\n [\n 111,\n 111\n ],\n [\n 121,\n 127\n ],\n [\n 130,\n 131\n ]\n ],\n \"mcpgateway/services/prompt_service.py\": [\n [\n 27,\n 27\n ],\n [\n 53,\n 53\n ],\n [\n 77,\n 77\n ],\n [\n 80,\n 80\n ],\n [\n 82,\n 82\n ],\n [\n 84,\n 84\n ],\n [\n 88,\n 88\n ],\n [\n\
|
||||
\ 730,\n 730\n ],\n [\n 767,\n 768\n ],\n [\n 951,\n 951\n ],\n [\n 1014,\n 1014\n ],\n [\n 1101,\n 1102\n ],\n [\n 1228,\n 1228\n ],\n [\n 1275,\n 1275\n ],\n [\n 2169,\n 2169\n ],\n [\n 2276,\n 2276\n ],\n [\n 2278,\n 2278\n ],\n [\n 2446,\n 2446\n ],\n [\n 2889,\n 2889\n ]\n ],\n \"mcpgateway/services/resource_service.py\": [\n [\n 67,\n 67\n ],\n [\n 460,\n 463\n ],\n [\n 529,\n 533\n ],\n [\n 535,\n 535\n ],\n [\n 537,\n 537\n ],\n [\n 685,\n 685\n ],\n [\n 700,\n 700\n ],\n [\n 714,\n 714\n ],\n [\n 838,\n 844\n ],\n [\n 847,\n 847\n ],\n [\n 852,\n 852\n ],\n [\n 872,\n 872\n ],\n [\n 893,\n 893\n ],\n [\n 922,\n 922\n ],\n [\n 2893,\n 2896\n ],\n [\n 2983,\n 2984\n ],\n [\n 2987,\n 3017\n \
|
||||
\ ],\n [\n 3018,\n 3018\n ],\n [\n 3029,\n 3029\n ],\n [\n 3037,\n 3037\n ],\n [\n 3204,\n 3204\n ]\n ],\n \"mcpgateway/services/tool_service.py\": [\n [\n 64,\n 74\n ],\n [\n 79,\n 79\n ],\n [\n 949,\n 949\n ],\n [\n 1873,\n 1873\n ],\n [\n 2310,\n 2310\n ],\n [\n 5961,\n 5961\n ]\n ],\n \"tests/e2e/test_admin_apis.py\": [\n [\n 29,\n 29\n ],\n [\n 36,\n 38\n ],\n [\n 116,\n 116\n ],\n [\n 125,\n 127\n ],\n [\n 149,\n 149\n ],\n [\n 151,\n 151\n ],\n [\n 690,\n 690\n ]\n ],\n \"tests/e2e/test_main_apis.py\": [\n [\n 48,\n 48\n ],\n [\n 55,\n 55\n ],\n [\n 58,\n 58\n ],\n [\n 63,\n 63\n ],\n [\n 980,\n 980\n ],\n [\n 1021,\n 1021\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ]\n ],\n \"tests/unit/mcpgateway/services/test_content_security.py\"\
|
||||
: [\n [\n 5,\n 7\n ],\n [\n 13,\n 13\n ],\n [\n 15,\n 22\n ],\n [\n 49,\n 49\n ],\n [\n 209,\n 209\n ],\n [\n 306,\n 306\n ],\n [\n 323,\n 323\n ],\n [\n 334,\n 336\n ],\n [\n 338,\n 339\n ],\n [\n 342,\n 342\n ],\n [\n 344,\n 345\n ],\n [\n 348,\n 348\n ],\n [\n 363,\n 363\n ],\n [\n 365,\n 365\n ],\n [\n 368,\n 368\n ],\n [\n 373,\n 373\n ],\n [\n 389,\n 389\n ],\n [\n 401,\n 402\n ],\n [\n 404,\n 405\n ],\n [\n 408,\n 408\n ],\n [\n 410,\n 411\n ],\n [\n 414,\n 414\n ],\n [\n 422,\n 422\n ],\n [\n 434,\n 473\n ],\n [\n 479,\n 479\n ],\n [\n 504,\n 504\n ],\n [\n 516,\n 516\n ],\n [\n 526,\n 526\n ],\n [\n 537,\n 537\n ],\n [\n 548,\n 548\n ],\n [\n 582,\n 582\n ],\n [\n \
|
||||
\ 614,\n 614\n ]\n ],\n \"tests/unit/mcpgateway/services/test_prompt_service.py\": [\n [\n 33,\n 39\n ],\n [\n 378,\n 378\n ],\n [\n 382,\n 385\n ],\n [\n 387,\n 387\n ],\n [\n 1178,\n 1178\n ],\n [\n 1963,\n 1963\n ],\n [\n 1967,\n 1967\n ],\n [\n 1972,\n 1972\n ],\n [\n 1984,\n 1989\n ],\n [\n 1991,\n 1992\n ]\n ],\n \"tests/unit/mcpgateway/services/test_resource_service.py\": [\n [\n 31,\n 35\n ],\n [\n 2309,\n 2333\n ],\n [\n 2413,\n 2414\n ],\n [\n 2551,\n 2552\n ],\n [\n 2555,\n 2556\n ],\n [\n 2560,\n 2560\n ],\n [\n 2565,\n 2566\n ],\n [\n 2570,\n 2570\n ],\n [\n 2572,\n 2574\n ],\n [\n 2577,\n 2578\n ],\n [\n 2587,\n 2588\n ],\n [\n 2593,\n 2593\n ],\n [\n 2595,\n 2595\n ],\n [\n 2598,\n 2599\n ],\n [\n 2603,\n 2606\n \
|
||||
\ ],\n [\n 2608,\n 2608\n ],\n [\n 2610,\n 2612\n ],\n [\n 2614,\n 2615\n ],\n [\n 2618,\n 2619\n ],\n [\n 2622,\n 2622\n ],\n [\n 2637,\n 2638\n ],\n [\n 2642,\n 2642\n ],\n [\n 2644,\n 2645\n ],\n [\n 2724,\n 2753\n ]\n ],\n \"tests/unit/mcpgateway/services/test_row_level_locking.py\": [\n [\n 14,\n 14\n ],\n [\n 16,\n 16\n ],\n [\n 19,\n 24\n ],\n [\n 26,\n 26\n ],\n [\n 77,\n 77\n ],\n [\n 82,\n 82\n ],\n [\n 143,\n 143\n ],\n [\n 442,\n 442\n ],\n [\n 509,\n 509\n ],\n [\n 510,\n 510\n ],\n [\n 515,\n 515\n ],\n [\n 516,\n 516\n ],\n [\n 521,\n 521\n ]\n ],\n \"tests/unit/mcpgateway/test_admin.py\": [\n [\n 281,\n 285\n ],\n [\n 2523,\n 2523\n ],\n [\n 2590,\n 2628\n ],\n [\n 2935,\n 2970\n ]\n ],\n \"tests/unit/mcpgateway/test_main.py\"\
|
||||
: [\n [\n 37,\n 49\n ],\n [\n 487,\n 487\n ],\n [\n 490,\n 490\n ],\n [\n 521,\n 521\n ],\n [\n 524,\n 524\n ],\n [\n 764,\n 764\n ],\n [\n 787,\n 787\n ],\n [\n 1198,\n 1198\n ],\n [\n 1208,\n 1208\n ],\n [\n 1211,\n 1211\n ],\n [\n 1414,\n 1414\n ],\n [\n 1416,\n 1416\n ],\n [\n 1420,\n 1420\n ],\n [\n 1432,\n 1432\n ],\n [\n 1441,\n 1441\n ],\n [\n 2407,\n 2407\n ],\n [\n 2476,\n 2476\n ]\n ],\n \"tests/unit/mcpgateway/test_main_error_handlers.py\": [\n [\n 12,\n 13\n ],\n [\n 18,\n 20\n ],\n [\n 21,\n 21\n ],\n [\n 22,\n 22\n ],\n [\n 26,\n 33\n ],\n [\n 44,\n 45\n ],\n [\n 577,\n 577\n ],\n [\n 600,\n 600\n ],\n [\n 607,\n 607\n ],\n [\n 612,\n 612\n ],\n [\n 618,\n 618\n ]\n ]\n },\n \"ranges_basis\"\
|
||||
: \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"mcpgateway/services/prompt_service.py::_render_template\",\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\"\n ],\n \"sites_in_set\": [\n \"mcpgateway/services/prompt_service.py::_render_template\",\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_compile_jinja_template\",\n 106\n ],\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_render_template\",\n 2892\n ]\n ],\n \"kept\": [\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_compile_jinja_template\",\n 106\n ],\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_render_template\",\n 2892\n ]\n ],\n \"triage\": {\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\": \"stored\",\n \"mcpgateway/services/prompt_service.py::_render_template\": \"stored\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,7 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"validateIpAddresses\",\n \"line\": 1050,\n \"path\": \"lib/Froxlor/Api/Commands/Domains.php\"\n },\n {\n \"function\": \"listing\",\n \"line\": 76,\n \"path\": \"lib/Froxlor/Api/Commands/IpsAndPorts.php\"\n },\n {\n \"function\": \"listingCount\",\n \"line\": 108,\n \"path\": \"lib/Froxlor/Api/Commands/IpsAndPorts.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"froxlor-admin-ip-second-order-sqli\",\n \"sites\": [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\",\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 3,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.007758,\n \"recorded_usd\": 0.0873\n },\n \"family\": \"injection\",\n \"id\": \"froxlor-admin-ip-second-order-sqli\",\n \"ranges\": {\n \"lib/Froxlor/Api/Commands/Admins.php\": [\n [\n 273,\n 273\n ],\n [\n 358,\n 358\n ],\n [\n 619,\n 619\n ],\n [\n 729,\n 729\n ]\n ],\n \"lib/Froxlor/Api/Commands/Domains.php\": [\n [\n 1016,\n 1016\n ]\n ],\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\": [\n [\n 72,\n 72\n ],\n [\n 104,\n 104\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\"\
|
||||
,\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\",\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\"\n ],\n \"sites_in_set\": [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\",\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lib/Froxlor/Api/Commands/Domains.php\",\n \"validateIpAddresses\",\n 1050\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listing\",\n 76\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listingCount\",\n 108\n ]\n ],\n \"kept\": [\n [\n \"lib/Froxlor/Api/Commands/Domains.php\",\n \"validateIpAddresses\",\n 1050\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listing\",\n 76\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listingCount\",\n 108\n ]\n ],\n \"triage\": {\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\": \"parameter\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\": \"request\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\": \"request\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,6 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"getDaqValue\",\n \"line\": 89,\n \"path\": \"server/runtime/storage/tdengine/index.js\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"fuxa-tdengine-escape-sqli\",\n \"sites\": [\n \"server/runtime/storage/tdengine/index.js::getDaqValue\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.000833,\n \"recorded_usd\": 0.1527\n },\n \"family\": \"injection\",\n \"id\": \"fuxa-tdengine-escape-sqli\",\n \"ranges\": {\n \"server/runtime/storage/tdengine/index.js\": [\n [\n 11,\n 11\n ],\n [\n 121,\n 121\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"server/runtime/storage/tdengine/index.js::getDaqValue\"\n ],\n \"sites_in_set\": [\n \"server/runtime/storage/tdengine/index.js::getDaqValue\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/runtime/storage/tdengine/index.js\",\n \"getDaqValue\",\n 89\n ]\n ],\n \"kept\": [\n [\n \"server/runtime/storage/tdengine/index.js\",\n \"getDaqValue\",\n 89\n ]\n ],\n \"triage\": {\n \"server/runtime/storage/tdengine/index.js::getDaqValue\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,9 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_load_http_url\",\n \"line\": 68,\n \"path\": \"lmdeploy/vl/media/connection.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\",\n \"sites\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.000768,\n \"recorded_usd\": 0.0249\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\",\n \"ranges\": {\n \"docs/en/multi_modal/multimodal_inputs.md\": [\n [\n 395,\n 395\n ]\n ],\n \"docs/zh_cn/multi_modal/multimodal_inputs.md\": [\n [\n 394,\n 394\n ]\n ],\n \"lmdeploy/api.py\": [\n [\n 21,\n 21\n ],\n [\n 45,\n 45\n ],\n [\n 78,\n 78\n ]\n ],\n \"lmdeploy/cli/serve.py\": [\n [\n 77,\n 77\n ],\n [\n 325,\n 325\n ],\n [\n 358,\n 358\n ]\n ],\n \"lmdeploy/pipeline.py\": [\n [\n 42,\n 42\n ],\n [\n 53,\n 53\n ],\n [\n 84,\n 84\n\
|
||||
\ ],\n [\n 89,\n 89\n ],\n [\n 115,\n 115\n ],\n [\n 165,\n 165\n ],\n [\n 204,\n 204\n ]\n ],\n \"lmdeploy/serve/core/async_engine.py\": [\n [\n 116,\n 116\n ],\n [\n 125,\n 125\n ]\n ],\n \"lmdeploy/serve/core/vl_async_engine.py\": [\n [\n 20,\n 20\n ],\n [\n 46,\n 46\n ],\n [\n 52,\n 52\n ]\n ],\n \"lmdeploy/serve/openai/api_server.py\": [\n [\n 1528,\n 1528\n ],\n [\n 1580,\n 1580\n ],\n [\n 1620,\n 1620\n ]\n ],\n \"lmdeploy/serve/processors/multimodal.py\": [\n [\n 40,\n 40\n ],\n [\n 47,\n 47\n ],\n [\n 52,\n 52\n ],\n [\n 106,\n 107\n ],\n [\n 156,\n 156\n ],\n [\n 163,\n 163\n ],\n [\n 167,\n 167\n ],\n [\n 170,\n 170\n ],\n [\n 180,\n 180\n ],\n [\n 192,\n 192\n ],\n [\n 269,\n 269\n ],\n [\n 282,\n 282\n ],\n [\n 313,\n\
|
||||
\ 313\n ],\n [\n 315,\n 316\n ],\n [\n 329,\n 329\n ],\n [\n 403,\n 403\n ]\n ],\n \"lmdeploy/vl/media/connection.py\": [\n [\n 7,\n 7\n ],\n [\n 10,\n 10\n ],\n [\n 28,\n 28\n ],\n [\n 34,\n 34\n ],\n [\n 54,\n 54\n ],\n [\n 56,\n 59\n ],\n [\n 67,\n 69\n ],\n [\n 71,\n 71\n ],\n [\n 95,\n 95\n ],\n [\n 100,\n 100\n ]\n ],\n \"tests/test_lmdeploy/test_content_merge.py\": [\n [\n 12,\n 12\n ],\n [\n 245,\n 245\n ],\n [\n 307,\n 307\n ],\n [\n 335,\n 335\n ],\n [\n 340,\n 340\n ],\n [\n 385,\n 385\n ],\n [\n 407,\n 407\n ],\n [\n 415,\n 415\n ]\n ],\n \"tests/test_lmdeploy/test_vl/test_safe_url.py\": [\n [\n 43,\n 44\n ],\n [\n 47,\n 47\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case,\
|
||||
\ 'old')\",\n \"sites\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ],\n \"sites_in_set\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"kept\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"triage\": {\n \"lmdeploy/vl/media/connection.py::_load_http_url\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,8 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"externalCallbackHandler\",\n \"line\": 166,\n \"path\": \"packages/server/src/auth/external.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"medplum-external-auth-open-redirect\",\n \"sites\": [\n \"packages/server/src/auth/external.ts::externalCallbackHandler\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.001509,\n \"recorded_usd\": 0.0228\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"medplum-external-auth-open-redirect\",\n \"ranges\": {\n \"packages/definitions/src/fhir/r4/profiles-medplum.json\": [\n [\n 890,\n 904\n ],\n [\n 1080,\n 1080\n ]\n ],\n \"packages/docs/static/data/medplumDefinitions/clientapplication.json\": [\n [\n 308,\n 308\n ],\n [\n 315,\n 315\n ],\n [\n 317,\n 317\n ],\n [\n 319,\n 319\n ],\n [\n 324,\n 324\n ],\n [\n 331,\n 331\n ],\n [\n 333,\n 333\n ],\n [\n 335,\n 335\n ],\n [\n 340,\n 340\n ],\n [\n 344,\n 344\n ],\n\
|
||||
\ [\n 347,\n 347\n ],\n [\n 348,\n 348\n ],\n [\n 351,\n 351\n ],\n [\n 450,\n 450\n ]\n ],\n \"packages/docs/static/data/medplumDefinitions/smartapplaunch.json\": [\n [\n 206,\n 206\n ]\n ],\n \"packages/fhirtypes/dist/ClientApplication.d.ts\": [\n [\n 137,\n 141\n ],\n [\n 154,\n 154\n ],\n [\n 191,\n 191\n ],\n [\n 195,\n 195\n ],\n [\n 197,\n 197\n ],\n [\n 200,\n 200\n ],\n [\n 202,\n 202\n ],\n [\n 205,\n 205\n ],\n [\n 207,\n 207\n ],\n [\n 211,\n 211\n ],\n [\n 213,\n 213\n ],\n [\n 216,\n 216\n ],\n [\n 218,\n 218\n ],\n [\n 221,\n 221\n ],\n [\n 223,\n 223\n ]\n ],\n \"packages/server/src/auth/external.test.ts\": [\n [\n 410,\n 410\n ]\n ],\n \"packages/server/src/auth/external.ts\": [\n [\n 13,\n 13\n ],\n [\n 18,\n 18\n ],\n [\n 124,\n\
|
||||
\ 133\n ],\n [\n 139,\n 139\n ],\n [\n 283,\n 283\n ]\n ],\n \"packages/server/src/oauth/clients.ts\": [\n [\n 69,\n 69\n ],\n [\n 76,\n 76\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"packages/server/src/auth/external.ts::externalCallbackHandler\"\n ],\n \"sites_in_set\": [\n \"packages/server/src/auth/external.ts::externalCallbackHandler\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/auth/external.ts\",\n \"externalCallbackHandler\",\n 166\n ]\n ],\n \"kept\": [\n [\n \"packages/server/src/auth/external.ts\",\n \"externalCallbackHandler\",\n 166\n ]\n ],\n \"triage\": {\n \"packages/server/src/auth/external.ts::externalCallbackHandler\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -17,7 +17,8 @@ spec:
|
||||
\n },\n {\n \"function\": \"run_job\",\n \"line\": 746,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 365,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 454,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"sql\",\n \"line\": 492,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 623,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 290,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\"\
|
||||
: \"delete\",\n \"line\": 394,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\": \"get_extension_details\",\n \"line\": 30,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 601,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 464,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\"\n },\n {\n \"function\": \"create_maintenance_job\",\n \"line\": 222,\n \"path\": \"web/pgadmin/tools/maintenance/__init__.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"sites\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 27,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.048665,\n \"recorded_usd\": 0.3949\n },\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"ranges\": {\n \"web/pgadmin/tools/maintenance/__init__.py\": [\n [\n 12,\n 12\n ],\n [\n 150,\n 150\n ],\n [\n 171,\n 171\n ]\n ],\n \"web/pgadmin/tools/maintenance/templates/maintenance/sql/command.sql\": [\n [\n 16,\n 16\n ]\n ],\n \"web/pgadmin/tools/maintenance/tests/test_maintenance_create_job_unit_test.py\": [\n [\n 562,\n 562\n ],\n [\n 647,\n 647\n ],\n [\n 714,\n 714\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case,\
|
||||
\ 'old')\",\n \"sites\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ],\n \"sites_in_set\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_ctypes\",\n 651\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_encodings\",\n\
|
||||
\ 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,7 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_verify_item\",\n \"line\": 239,\n \"path\": \"src/qwed_new/core/batch.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"qwed-sympy-eval\",\n \"sites\": [\n \"src/qwed_new/api/main.py::verify_math\",\n \"src/qwed_new/core/batch.py::_verify_item\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.00149,\n \"recorded_usd\": 0.022\n },\n \"family\": \"injection\",\n \"id\": \"qwed-sympy-eval\",\n \"ranges\": {\n \"src/qwed_new/api/main.py\": [\n [\n 460,\n 460\n ],\n [\n 475,\n 476\n ],\n [\n 504,\n 504\n ]\n ],\n \"src/qwed_new/core/batch.py\": [\n [\n 223,\n 223\n ],\n [\n 229,\n 230\n ],\n [\n 239,\n 239\n ],\n [\n 0,\n 0\n ]\n ],\n \"src/qwed_new/core/validator.py\": [\n [\n 13,\n 13\n ],\n [\n 64,\n 64\n ]\n ],\n \"src/qwed_new/core/verifier.py\": [\n [\n 21,\n 21\n ],\n [\n 123,\n 123\n ],\n [\n 200,\n 201\n ],\n [\n 284,\n 286\n\
|
||||
\ ],\n [\n 331,\n 333\n ],\n [\n 337,\n 338\n ],\n [\n 388,\n 390\n ],\n [\n 398,\n 398\n ],\n [\n 0,\n 0\n ]\n ],\n \"tests/test_api_exceptions.py\": [\n [\n 34,\n 34\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"src/qwed_new/api/main.py::verify_math\",\n \"src/qwed_new/core/batch.py::_verify_item\"\n ],\n \"sites_in_set\": [\n \"src/qwed_new/core/batch.py::_verify_item\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/qwed_new/core/batch.py\",\n \"_verify_item\",\n 239\n ]\n ],\n \"kept\": [\n [\n \"src/qwed_new/core/batch.py\",\n \"_verify_item\",\n 239\n ]\n ],\n \"triage\": {\n \"src/qwed_new/core/batch.py::_verify_item\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,8 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"findAll\",\n \"line\": 108,\n \"path\": \"server/src/modules/article/article.service.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\",\n \"sites\": [\n \"server/src/modules/article/article.service.ts::findAll\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.002177,\n \"recorded_usd\": 0.0193\n },\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\",\n \"ranges\": {\n \"server/src/modules/article/article.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 106,\n 110\n ],\n [\n 307,\n 308\n ]\n ],\n \"server/src/modules/comment/comment.controller.ts\": [\n [\n 20,\n 20\n ]\n ],\n \"server/src/modules/comment/comment.service.ts\": [\n [\n 5,\n 5\n ],\n [\n 6,\n 6\n ],\n [\n 45,\n 45\n ],\n [\n 103,\n 107\n ]\n ],\n \"server/src/modules/file/file.service.ts\": [\n [\n 7,\n 7\n ],\n [\n 49,\n 49\n ],\n [\n 75,\n\
|
||||
\ 79\n ]\n ],\n \"server/src/modules/knowledge/knowledge.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 137,\n 141\n ]\n ],\n \"server/src/modules/page/page.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 49,\n 53\n ]\n ],\n \"server/src/starter.ts\": [\n [\n 22,\n 22\n ],\n [\n 34,\n 34\n ],\n [\n 39,\n 39\n ],\n [\n 43,\n 43\n ],\n [\n 49,\n 49\n ],\n [\n 51,\n 51\n ],\n [\n 54,\n 54\n ],\n [\n 71,\n 71\n ],\n [\n 76,\n 76\n ],\n [\n 80,\n 80\n ],\n [\n 82,\n 82\n ],\n [\n 85,\n 85\n ],\n [\n 90,\n 90\n ],\n [\n 103,\n 103\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"server/src/modules/article/article.service.ts::findAll\"\n ],\n \"sites_in_set\"\
|
||||
: [\n \"server/src/modules/article/article.service.ts::findAll\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"kept\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"triage\": {\n \"server/src/modules/article/article.service.ts::findAll\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,9 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"fetchRetry\",\n \"line\": 64,\n \"path\": \"src/lib/addons/addon.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"unleash-addon-webhook-ssrf\",\n \"sites\": [\n \"src/lib/addons/addon.ts::fetchRetry\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.000514,\n \"recorded_usd\": 0.0293\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"unleash-addon-webhook-ssrf\",\n \"ranges\": {\n \"src/lib/__snapshots__/create-config.test.ts.snap\": [\n [\n 16,\n 16\n ]\n ],\n \"src/lib/addons/addon.ts\": [\n [\n 1,\n 1\n ],\n [\n 10,\n 10\n ],\n [\n 24,\n 24\n ],\n [\n 31,\n 31\n ],\n [\n 34,\n 34\n ],\n [\n 60,\n 60\n ],\n [\n 64,\n 65\n ],\n [\n 66,\n 66\n ],\n [\n 68,\n 68\n ],\n [\n 70,\n 70\n ],\n [\n 72,\n 72\n ],\n [\n 74,\n 75\n ],\n [\n 77,\n 77\n ],\n [\n 98,\n 98\n\
|
||||
\ ]\n ],\n \"src/lib/addons/datadog-definition.ts\": [\n [\n 31,\n 31\n ]\n ],\n \"src/lib/addons/datadog.test.ts\": [\n [\n 29,\n 29\n ]\n ],\n \"src/lib/addons/new-relic.test.ts\": [\n [\n 192,\n 192\n ]\n ],\n \"src/lib/addons/new-relic.ts\": [\n [\n 127,\n 127\n ]\n ],\n \"src/lib/addons/slack.test.ts\": [\n [\n 303,\n 304\n ]\n ],\n \"src/lib/addons/teams-workflow.test.ts\": [\n [\n 173,\n 173\n ]\n ],\n \"src/lib/addons/teams-workflow.ts\": [\n [\n 137,\n 137\n ]\n ],\n \"src/lib/addons/teams.test.ts\": [\n [\n 253,\n 253\n ]\n ],\n \"src/lib/addons/teams.ts\": [\n [\n 119,\n 119\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ]\n ],\n \"src/lib/create-config.ts\": [\n [\n 589,\n 589\n ],\n [\n 862,\n 862\n ]\n ],\n \"src/lib/features/metrics/integrations/integration-metrics.ts\": [\n [\n 15,\n 15\n ],\n [\n 44,\n 44\n\
|
||||
\ ]\n ],\n \"src/lib/services/addon-service.test.ts\": [\n [\n 55,\n 55\n ],\n [\n 64,\n 64\n ],\n [\n 160,\n 160\n ],\n [\n 194,\n 194\n ],\n [\n 242,\n 242\n ],\n [\n 305,\n 305\n ],\n [\n 354,\n 354\n ],\n [\n 392,\n 392\n ],\n [\n 429,\n 429\n ],\n [\n 494,\n 494\n ]\n ],\n \"src/lib/services/addon-service.ts\": [\n [\n 33,\n 33\n ],\n [\n 60,\n 60\n ],\n [\n 70,\n 70\n ],\n [\n 73,\n 73\n ],\n [\n 85,\n 85\n ],\n [\n 94,\n 94\n ],\n [\n 239,\n 239\n ],\n [\n 273,\n 273\n ],\n [\n 362,\n 362\n ]\n ],\n \"src/lib/types/model.ts\": [\n [\n 474,\n 474\n ]\n ],\n \"src/lib/types/option.ts\": [\n [\n 189,\n 189\n ],\n [\n 320,\n 320\n ]\n ],\n \"src/test/e2e/api/admin/addon.e2e.test.ts\": [\n [\n 19,\n 19\n ]\n ],\n \"src/test/e2e/services/addon-service.e2e.test.ts\"\
|
||||
: [\n [\n 25,\n 25\n ],\n [\n 41,\n 41\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"src/lib/addons/addon.ts::fetchRetry\"\n ],\n \"sites_in_set\": [\n \"src/lib/addons/addon.ts::fetchRetry\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/lib/addons/addon.ts\",\n \"fetchRetry\",\n 64\n ]\n ],\n \"kept\": [\n [\n \"src/lib/addons/addon.ts\",\n \"fetchRetry\",\n 64\n ]\n ],\n \"triage\": {\n \"src/lib/addons/addon.ts::fetchRetry\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -13,6 +13,8 @@ spec:
|
||||
|
||||
'
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"config_secrets\",\n \"id\": \"winml-cli-serve-cors\",\n \"sites\": [\n \"src/winml/modelkit/serve/cli_api.py::<global>\",\n \"src/winml/modelkit/serve/app.py::create_app\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.0021,\n \"recorded_usd\": 0.0021\n },\n \"family\": \"config_secrets\",\n \"id\": \"winml-cli-serve-cors\",\n \"ranges\": {\n \".github/workflows/modelkit-ci.yml\": [\n [\n 38,\n 38\n ],\n [\n 53,\n 53\n ]\n ],\n \"src/winml/modelkit/commands/serve.py\": [\n [\n 137,\n 137\n ],\n [\n 174,\n 174\n ]\n ],\n \"src/winml/modelkit/loader/_autoconfig.py\": [\n [\n 156,\n 156\n ]\n ],\n \"src/winml/modelkit/loader/hf.py\": [\n [\n 204,\n 204\n ],\n [\n 206,\n 206\n ],\n [\n 0,\n 0\n ]\n ],\n \"src/winml/modelkit/serve/app.py\": [\n [\n 36,\n 37\n ],\n [\n 43,\n 43\n ],\n\
|
||||
\ [\n 216,\n 216\n ],\n [\n 218,\n 222\n ],\n [\n 289,\n 289\n ],\n [\n 322,\n 322\n ],\n [\n 369,\n 369\n ],\n [\n 374,\n 374\n ],\n [\n 376,\n 376\n ],\n [\n 379,\n 379\n ],\n [\n 382,\n 382\n ],\n [\n 393,\n 393\n ]\n ],\n \"src/winml/modelkit/serve/cli_api.py\": [\n [\n 33,\n 33\n ],\n [\n 39,\n 39\n ],\n [\n 147,\n 147\n ],\n [\n 149,\n 153\n ],\n [\n 180,\n 180\n ],\n [\n 251,\n 251\n ],\n [\n 293,\n 293\n ],\n [\n 365,\n 369\n ]\n ],\n \"src/winml/modelkit/serve/manager.py\": [\n [\n 52,\n 52\n ],\n [\n 57,\n 57\n ],\n [\n 113,\n 113\n ],\n [\n 251,\n 251\n ],\n [\n 262,\n 262\n ],\n [\n 439,\n 439\n ],\n [\n 452,\n 452\n ]\n ],\n \"src/winml/modelkit/serve/static/index.html\": [\n [\n 5,\n 5\n ],\n [\n 300,\n\
|
||||
\ 300\n ],\n [\n 920,\n 920\n ],\n [\n 945,\n 945\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"src/winml/modelkit/serve/cli_api.py::<global>\",\n \"src/winml/modelkit/serve/app.py::create_app\"\n ],\n \"sites_in_set\": [\n \"src/winml/modelkit/serve/cli_api.py::<global>\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/winml/modelkit/serve/cli_api.py\",\n \"<global>\",\n 148\n ]\n ],\n \"kept\": [],\n \"triage\": {\n \"src/winml/modelkit/serve/cli_api.py::<global>\": \"constant\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,7 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"directorist_rest_upload_image_from_url\",\n \"line\": 115,\n \"path\": \"includes/rest-api/functions.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-directorist-avatar-ssrf\",\n \"sites\": [\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.002616,\n \"recorded_usd\": 0.0352\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-directorist-avatar-ssrf\",\n \"ranges\": {\n \"config.php\": [\n [\n 4,\n 4\n ]\n ],\n \"directorist-base.php\": [\n [\n 6,\n 6\n ]\n ],\n \"includes/rest-api/Version1/class-orders-controller.php\": [\n [\n 84,\n 84\n ]\n ],\n \"includes/rest-api/Version1/class-users-controller.php\": [\n [\n 587,\n 589\n ],\n [\n 598,\n 598\n ],\n [\n 600,\n 601\n ],\n [\n 632,\n 632\n ]\n ],\n \"includes/rest-api/Version1/class-users-favorites-controller.php\": [\n [\n 131,\n 131\n ]\n ],\n \"includes/rest-api/functions.php\"\
|
||||
: [\n [\n 105,\n 105\n ],\n [\n 114,\n 114\n ],\n [\n 115,\n 115\n ],\n [\n 181,\n 181\n ]\n ],\n \"readme.txt\": [\n [\n 8,\n 8\n ],\n [\n 302,\n 302\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\"\n ],\n \"sites_in_set\": [\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"includes/rest-api/functions.php\",\n \"directorist_rest_upload_image_from_url\",\n 115\n ]\n ],\n \"kept\": [\n [\n \"includes/rest-api/functions.php\",\n \"directorist_rest_upload_image_from_url\",\n 115\n ]\n ],\n \"triage\": {\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\": \"parameter\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,6 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"<global>\",\n \"line\": 35,\n \"path\": \"admin/views/log.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"wp-gopay-log-filter-sqli\",\n \"sites\": [\n \"admin/views/log.php::<global>\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.001375,\n \"recorded_usd\": 0.0113\n },\n \"family\": \"injection\",\n \"id\": \"wp-gopay-log-filter-sqli\",\n \"ranges\": {\n \"admin/views/log.php\": [\n [\n 12,\n 13\n ],\n [\n 15,\n 15\n ],\n [\n 17,\n 22\n ],\n [\n 30,\n 30\n ],\n [\n 36,\n 41\n ],\n [\n 104,\n 104\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"admin/views/log.php::<global>\"\n ],\n \"sites_in_set\": [\n \"admin/views/log.php::<global>\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"admin/views/log.php\",\n \"<global>\",\n 35\n ]\n ],\n \"kept\": [\n [\n \"admin/views/log.php\",\n \"<global>\",\n 35\n ]\n ],\n \"triage\": {\n \"admin/views/log.php::<global>\": \"request\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
@@ -11,6 +11,6 @@ spec:
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"<global>\",\n \"line\": 904,\n \"path\": \"templates/preferences.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-groundhogg-confirm-redirect\",\n \"sites\": [\n \"templates/preferences.php::<global>\"\n ]\n}\n"
|
||||
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.006524,\n \"recorded_usd\": 0.0585\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-groundhogg-confirm-redirect\",\n \"ranges\": {\n \"templates/preferences.php\": [\n [\n 904,\n 904\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"templates/preferences.php::<global>\"\n ],\n \"sites_in_set\": [\n \"templates/preferences.php::<global>\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"templates/preferences.php\",\n \"<global>\",\n 904\n ]\n ],\n \"kept\": [\n [\n \"templates/preferences.php\",\n \"<global>\",\n 904\n ]\n ],\n \"triage\": {\n \"templates/preferences.php::<global>\": \"request\"\n }\n}\n"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
|
||||
Reference in New Issue
Block a user