marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 03:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(learning-harness): corpus hygiene at load, with the defects it finds

Browse Source 
Task 1.3. An expected row may carry a family label, stored opaquely because the
classifier owns the taxonomy and the corpus module never imports the learning
package. Every pair carries a computed reason when it cannot be scored: a
declared known limit wins, otherwise identical twin when the two excerpts are
the same code once the provenance header is stripped. No row is ever dropped.

Two corpus defects the new accounting surfaces, committed as an artifact beside
the numbers they cap. Nineteen repositories sit on both sides of the split, so a
learning path could be taught by one file of a repository and evaluated on
another. Ten groups of pairs share a vulnerable excerpt byte for byte, mostly
the same fix harvested twice at different granularity.

The split helper keeps every declared split, lets rows that named none inherit
their repository's side, and otherwise assigns a whole repository at once,
oldest first, so nothing straddles by our doing. Pair signals can now be
restricted to one split, which is what lets a learning path teach from train
rows only.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-06 09:14:51 +02:00
co-authored by Claude Opus 5
parent 944df86d12
commit 6c205b728f
4 changed files with 637 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/measurements/2026-09-06-corpus-hygiene.json
+389
View File
@@ -0,0 +1,389 @@
{
"command": "python -c 'from openultrasast.pairs import ...; duplicate_groups / split_by_repository over the vendored catalog'",
"duplicate_groups": [
[
"openssl-cve-2023-0286",
"openssl-cve-2023-0286-general_name_cmp"
],
[
"openniw-jobs-0fc947",
"openniw-jobs-b74de3"
],
[
"curl-cve-2023-38545",
"curl-cve-2023-38545-do_socks5"
],
[
"openssl-cve-2021-3712",
"openssl-cve-2021-3712-append_ia5"
],
[
"openssl-cve-2020-1967",
"openssl-cve-2020-1967-tls1_check_sig_alg"
],
[
"openssl-cve-2022-3786",
"openssl-cve-2022-3786-ossl_punycode_decode"
],
[
"openssl-cve-2020-1971",
"openssl-cve-2020-1971-general_name_cmp"
],
[
"etude-lexical-markdown-editorconfig-c61a8b",
"popmark-editorconfig-e5ac40"
],
[
"anastasios-pw-session-14ec1a",
"astroclaw-pw-session-1553a8"
],
[
"openssl-cve-2022-3602",
"openssl-cve-2022-3602-ossl_punycode_decode"
]
],
"generated": "2026-09-06",
"identical_twins": [
"dsvw-dsvw-do-get",
"python-insecure-app-main-try-hack-me",
"pythonssti-main-read-root",
"vampi-books-get-by-title",
"vulnpy-deserialization-do-pickle-load"
],
"known_limit": [
"owasp-java-hash"
],
"note": "Repositories in `straddling` have pairs on both sides of the train/holdout split, so a learning path can be taught by one file of a repository and evaluated on another. Pairs in `duplicate_groups` share a vulnerable excerpt byte for byte after the provenance header is stripped. Both cap what any detector number can mean.",
"straddling": [
[
"Contrast-Security-OSS/DjanGoat",
[
"djangoat-analytics-hits-by-ip",
"djangoat-views-reset-password",
"djangoat-views-user-view"
]
],
[
"Contrast-Security-OSS/vulnpy",
[
"vulnpy-cmdi-do-os-system",
"vulnpy-cmdi-do-subprocess-popen",
"vulnpy-deserialization-do-pickle-load"
]
],
[
"LinuxUser255/Vulnerable_Python_Apps",
[
"vulnerable-python-apps-bad-mvc-do-get",
"vulnerable-python-apps-dir-traversal-do-get"
]
],
[
"OWASP-Benchmark/BenchmarkJava",
[
"owasp-java-cmdi",
"owasp-java-hash",
"owasp-java-sqli"
]
],
[
"OWASP-Benchmark/BenchmarkPython",
[
"owasp-python-cmdi",
"owasp-python-codeinj",
"owasp-python-deser",
"owasp-python-hash",
"owasp-python-sqli"
]
],
[
"anotherik/ThreatByte",
[
"threatbyte-api-v1-delete",
"threatbyte-api-v1-get",
"threatbyte-routes-dashboard"
]
],
[
"anxolerd/dvpwa",
[
"dvpwa-app-init",
"dvpwa-middlewares-session-middleware",
"dvpwa-student-create"
]
],
[
"arichardson/juliet-test-suite-c",
[
"juliet-c-cwe121-strcpy",
"juliet-c-cwe134-printf"
]
],
[
"bigfivefoods/supplieradvisor-mvp",
[
"supplieradvisor-mvp-route-387bcf",
"supplieradvisor-mvp-route-a69e8f"
]
],
[
"chromium/chromium",
[
"chromium-cve-2019-5786",
"chromium-cve-2022-2162"
]
],
[
"curl/curl",
[
"curl-cve-2020-8177",
"curl-cve-2020-8231-curl_multi_add_handle",
"curl-cve-2020-8231-curl_open",
"curl-cve-2020-8284",
"curl-cve-2020-8284-config_init",
"curl-cve-2020-8286",
"curl-cve-2021-22876",
"curl-cve-2021-22890",
"curl-cve-2021-22898",
"curl-cve-2021-22901-ossl_connect_step1",
"curl-cve-2021-22924",
"curl-cve-2021-22924-nss_do_connect",
"curl-cve-2021-22924-servercert",
"curl-cve-2021-22925",
"curl-cve-2021-22945",
"curl-cve-2021-22946",
"curl-cve-2021-22946-imap_state_capability_re",
"curl-cve-2021-22946-pop3_state_capa_resp",
"curl-cve-2021-22947",
"curl-cve-2021-22947-imap_state_starttls_resp",
"curl-cve-2021-22947-pop3_state_starttls_resp",
"curl-cve-2021-22947-smtp_state_starttls_resp",
"curl-cve-2022-22576-conn_free",
"curl-cve-2022-27774",
"curl-cve-2022-27775",
"curl-cve-2022-27776",
"curl-cve-2022-27778",
"curl-cve-2022-27780",
"curl-cve-2022-27782-curl_free_primary_ssl_co",
"curl-cve-2022-27782-curl_init_userdefined",
"curl-cve-2022-27782-gtls_shutdown",
"curl-cve-2022-27782-nss_setup_connect",
"curl-cve-2022-27782-ossl_connect_step1",
"curl-cve-2022-30115",
"curl-cve-2022-32206",
"curl-cve-2022-32207",
"curl-cve-2022-32208",
"curl-cve-2023-38545",
"curl-cve-2023-38545-do_socks5",
"curl-cve-2026-9080"
]
],
[
"dayflower/etude-lexical-markdown",
[
"etude-lexical-markdown-editorconfig-c61a8b",
"etude-lexical-markdown-editorconfig-db4f54"
]
],
[
"dolevf/Damn-Vulnerable-GraphQL-Application",
[
"damn-vulnerable-graphql-application-views-mutate",
"damn-vulnerable-graphql-application-views-resolve-pastes",
"damn-vulnerable-graphql-application-views-resolve-system-dia"
]
],
[
"erev0s/VAmPI",
[
"vampi-books-get-by-title",
"vampi-user-model-get-user",
"vampi-users-update-password"
]
],
[
"fportantier/vulpy",
[
"vulpy-libuser-create",
"vulpy-libuser-login",
"vulpy-libuser-password-change"
]
],
[
"manuelz120/extremely-vulnerable-flask-app",
[
"extremely-vulnerable-flask-app-account-before-request",
"extremely-vulnerable-flask-app-account-search",
"extremely-vulnerable-flask-app-signup-validate-token"
]
],
[
"naryal2580/vfapi",
[
"vfapi-main-delete-user",
"vfapi-main-put-user",
"vfapi-main-sql-return-users-from-username"
]
],
[
"openssl/openssl",
[
"openssl-cve-2014-0160",
"openssl-cve-2020-1967",
"openssl-cve-2020-1967-tls1_check_sig_alg",
"openssl-cve-2020-1971",
"openssl-cve-2020-1971-general_name_cmp",
"openssl-cve-2020-25659",
"openssl-cve-2021-23840",
"openssl-cve-2021-23840-evp_encryptdecryptupdate",
"openssl-cve-2021-23841",
"openssl-cve-2021-3449",
"openssl-cve-2021-3449-def_generate_session_id",
"openssl-cve-2021-3449-init_sig_algs",
"openssl-cve-2021-3449-init_sig_algs_cert",
"openssl-cve-2021-3449-ssl_ctx_set_alpn_protos",
"openssl-cve-2021-3449-ssl_generate_master_secr",
"openssl-cve-2021-3449-tls_construct_ctos_early",
"openssl-cve-2021-3449-tls_handle_alpn",
"openssl-cve-2021-3449-tls_parse_ctos_renegotia",
"openssl-cve-2021-3449-tls_process_certificate_",
"openssl-cve-2021-3449-tls_process_finished",
"openssl-cve-2021-3450",
"openssl-cve-2021-3711",
"openssl-cve-2021-3711-pkey_sm2_decrypt",
"openssl-cve-2021-3711-sm2_asym_decrypt",
"openssl-cve-2021-3712",
"openssl-cve-2021-3712-append_ia5",
"openssl-cve-2021-3712-general_name_print",
"openssl-cve-2021-3712-i2r_pci",
"openssl-cve-2021-3712-ia5ncasecmp",
"openssl-cve-2021-3712-netscape_spki_print",
"openssl-cve-2021-3712-ossl_cmp_hdr_push1_freet",
"openssl-cve-2021-3712-print_qualifiers",
"openssl-cve-2021-4044",
"openssl-cve-2021-4044-tls_post_process_server_",
"openssl-cve-2022-0778",
"openssl-cve-2022-1292",
"openssl-cve-2022-1343",
"openssl-cve-2022-1434",
"openssl-cve-2022-2068-hash_dir",
"openssl-cve-2022-29242",
"openssl-cve-2022-3358",
"openssl-cve-2022-3358-evp_cipher_init_internal",
"openssl-cve-2022-3602",
"openssl-cve-2022-3602-ossl_punycode_decode",
"openssl-cve-2022-37454",
"openssl-cve-2022-3786",
"openssl-cve-2022-3786-ossl_punycode_decode",
"openssl-cve-2022-3996",
"openssl-cve-2022-4304",
"openssl-cve-2022-4304-bn_blinding_invert_ex",
"openssl-cve-2022-4304-rsa_blinding_invert",
"openssl-cve-2022-4304-rsa_ossl_private_decrypt",
"openssl-cve-2023-0216",
"openssl-cve-2023-0217",
"openssl-cve-2023-0286",
"openssl-cve-2023-0286-general_name_cmp",
"openssl-cve-2023-0401",
"openssl-cve-2023-0464",
"openssl-cve-2023-0464-tree_init",
"openssl-cve-2023-0465",
"openssl-cve-2023-2650",
"openssl-cve-2023-2975",
"openssl-cve-2023-3446",
"openssl-cve-2023-3817-dh_check",
"openssl-cve-2023-5363",
"openssl-cve-2024-0727",
"openssl-cve-2024-0727-smime_write_pkcs7",
"openssl-cve-2024-12797",
"openssl-cve-2024-13176-ec_field_inverse_mod_ord",
"openssl-cve-2024-2511",
"openssl-cve-2024-2511-tls_construct_server_hel",
"openssl-cve-2024-4603",
"openssl-cve-2024-4741",
"openssl-cve-2024-4741-ssl3_release_read_buffer",
"openssl-cve-2024-4741-ssl_free_buffers",
"openssl-cve-2024-4741-tls_free_buffers",
"openssl-cve-2024-4741-tls_release_read_buffer",
"openssl-cve-2024-5535",
"openssl-cve-2024-5535-alpn_select_cb",
"openssl-cve-2024-5535-ssl_select_next_proto",
"openssl-cve-2024-5535-tls_construct_stoc_next_",
"openssl-cve-2024-5535-tls_parse_stoc_npn",
"openssl-cve-2024-6119",
"openssl-cve-2025-11187",
"openssl-cve-2025-15467",
"openssl-cve-2025-15469",
"openssl-cve-2025-66199",
"openssl-cve-2025-66199-tls13_process_compressed",
"openssl-cve-2025-68160",
"openssl-cve-2025-69418",
"openssl-cve-2025-69419",
"openssl-cve-2025-69421",
"openssl-cve-2025-9230",
"openssl-cve-2025-9232",
"openssl-cve-2026-14456-expect_quic_for_value",
"openssl-cve-2026-14456-port_default_packet_hand",
"openssl-cve-2026-14457",
"openssl-cve-2026-18798",
"openssl-cve-2026-2673",
"openssl-cve-2026-28388",
"openssl-cve-2026-28389",
"openssl-cve-2026-28389-dh_cms_set_shared_info",
"openssl-cve-2026-28389-ecdh_cms_set_shared_info",
"openssl-cve-2026-31789",
"openssl-cve-2026-31790",
"openssl-cve-2026-31790-rsasve_generate",
"openssl-cve-2026-34181",
"openssl-cve-2026-35188",
"openssl-cve-2026-42764",
"openssl-cve-2026-42765",
"openssl-cve-2026-42766",
"openssl-cve-2026-42768",
"openssl-cve-2026-42768-pkcs7_decrypt_rinfo",
"openssl-cve-2026-42769",
"openssl-cve-2026-42771",
"openssl-cve-2026-45445",
"openssl-cve-2026-45446",
"openssl-cve-2026-45446-aes_siv_set_ctx_params",
"openssl-cve-2026-45447",
"openssl-cve-2026-54874",
"openssl-cve-2026-54874-dtls1_process_record",
"openssl-cve-2026-54874-dtls_rlayer_buffer_recor",
"openssl-cve-2026-63072",
"openssl-cve-2026-63072-cms_kek_cipher",
"openssl-cve-2026-63073",
"openssl-cve-2026-63074",
"openssl-cve-2026-63075-txp_pkt_commit",
"openssl-cve-2026-7383",
"openssl-cve-2026-75803",
"openssl-cve-2026-75803-aes_gcm_siv_finish",
"openssl-cve-2026-75803-chacha20_poly1305_cipher",
"openssl-cve-2026-9076"
]
],
[
"sgabe/DSVPWA",
[
"dsvpwa-attacks-run",
"dsvpwa-dsvpwa-main",
"dsvpwa-handlers-do-bdr"
]
]
],
"undeclared_split": [
[
"local-python-vulnerable",
"holdout"
],
[
"local-javascript-vulnerable",
"holdout"
],
[
"local-cpp-buffer",
"train"
]
],
"vendored_pairs": 277
}