feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3. - mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites. - vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only because the LLM-generated repositories carry no license (escalated). - vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0), SecBench.js itself is not vendored (no license); sinks derived on 13/17. - agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus REVIEW.md; the loaded catalog stays empty until a human reviews them. - datasets.toml and README document every slice and its review status. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-10-21 05:59:29 +00:00 · 2026-09-05 10:45:42 +02:00
parent c3e841003c
commit 8ab4207618
182 changed files with 31299 additions and 0 deletions
@@ -0,0 +1,43 @@
+# Provenance: erev0s/VAmPI get_user (fixed).
+# repo: erev0s/VAmPI
+# commit: 1713b54b601ad29582581eeda4b31fceb1319874
+# parent: 1713b54b601ad29582581eeda4b31fceb1319874
+# commit_url: https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72
+# cve: 
+# license: MIT
+# function: get_user
+# relpath: models/user_model.py
+# provenance: human
+# mechanism: source_reaches_sink
+
+def register_user():
+    request_data = request.get_json()
+    # check if user already exists
+    user = User.query.filter_by(username=request_data.get('username')).first()
+    if not user:
+        try:
+            # validate the data are in the correct form
+            jsonschema.validate(request_data, register_user_schema)
+            if vuln and 'admin' in request_data:  # User is possible to define if she/he wants to be an admin !!
+                if request_data['admin']:
+                    admin = True
+                else:
+                    admin = False
+                user = User(username=request_data['username'], password=request_data['password'],
+                            email=request_data['email'], admin=admin)
+            else:
+                user = User(username=request_data['username'], password=request_data['password'],
+                            email=request_data['email'])
+            db.session.add(user)
+            db.session.commit()
+
+            responseObject = {
+                'status': 'success',
+                'message': 'Successfully registered. Login to receive an auth token.'
+            }
+
+            return Response(json.dumps(responseObject), 200, mimetype="application/json")
+        except jsonschema.exceptions.ValidationError as exc:
+            return Response(error_message_helper(exc.message), 400, mimetype="application/json")
+    else:
+        return Response(error_message_helper("User already exists. Please Log in."), 200, mimetype="application/json")
@@ -0,0 +1,24 @@
+# Provenance: erev0s/VAmPI get_user (vuln).
+# repo: erev0s/VAmPI
+# commit: 1713b54b601ad29582581eeda4b31fceb1319874
+# parent: 1713b54b601ad29582581eeda4b31fceb1319874
+# commit_url: https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72
+# cve: 
+# license: MIT
+# function: get_user
+# relpath: models/user_model.py
+# provenance: human
+# mechanism: source_reaches_sink
+
+    def get_user(username):
+        if vuln:  # SQLi Injection
+            user_query = f"SELECT * FROM users WHERE username = '{username}'"
+            query = db.session.execute(text(user_query))
+            ret = query.fetchone()
+            if ret:
+                fin_query = '{"username": "%s", "email": "%s"}' % (ret[1], ret[3])
+            else:
+                fin_query = None
+        else:
+            fin_query = User.query.filter_by(username=username).first()
+        return fin_query