mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
fix(corpus): advisory-pair repo-overlap -- remove real pilot leaks, skip vendored trees
test_no_pair_repeats_a_repository_the_benchmarks_already_name failed: advisory-fix catalog repos also appeared elsewhere under benchmarks/. Root cause split two ways: 1. Genuine leak: 16 catalog repos are also subjects in benchmarks/search/private/ pilot.json (a real private pilot population). Removed those 16 pairs from the three catalogs and their verification.json rows (totals recomputed, catalog == verification preserved). 2. Spurious: the overlap scan greped ~49k vendored files under benchmarks/search/private/runs/*/checkout/node_modules/, so any catalog repo a vendored dependency's README names collided. Added a narrow vendored-tree skip (node_modules/vendor) to the scan rather than deleting labelled pairs over a dependency mention. Implemented from Codex's first pass (gpt-6.1-sol), then gated and corrected: Codex removed 20 pairs; 4 of those (backstage/backstage, koajs/koa, beaugunderson/ ip-address, cakephp/cakephp) were driven only by vendored/non-population mentions and are kept. Also excluded advisory-fixes-spread.json (catalog-derived report) and research-2026-09-26.md (selection write-up) as non-population. tests/test_advisory_fix_pairs.py + tests/test_learn_labels.py: 53 passed. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
60ffff0168
commit
9a3250f6c5
@@ -1460,42 +1460,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-2w86-xfrc-g85r: Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator"
|
||||
|
||||
[[pair]]
|
||||
name = "typeorm-handler-41d1c62"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-03"
|
||||
language = "typescript"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "typeorm/typeorm"
|
||||
cve = "CVE-2026-73651 GHSA-2rp8-mm9q-fp49"
|
||||
cwe = "CWE-94"
|
||||
ecosystem = "npm"
|
||||
published_at = "2026-07-21T21:59:23Z"
|
||||
post_cutoff = true
|
||||
commit = "41d1c62fe49f99c3ca916d4d986f61ee9f45d519"
|
||||
parent = "8a51b756bf31c885da1e1d92cb17d94819c7040a"
|
||||
commit_url = "https://github.com/typeorm/typeorm/commit/41d1c62fe49f99c3ca916d4d986f61ee9f45d519"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/commands/MigrationGenerateCommand.ts"
|
||||
mode = "name"
|
||||
relpath = "src/commands/MigrationGenerateCommand.ts"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-07-13"
|
||||
fix_lines = { in_function = 8, in_file = 20, source_total = 22 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-94"
|
||||
class = "code-injection"
|
||||
path = "src/commands/MigrationGenerateCommand.ts"
|
||||
function = "handler"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-2rp8-mm9q-fp49: TypeORM: migration:generate template-literal code injection"
|
||||
|
||||
[[pair]]
|
||||
name = "velocity-js-isblockedpathkey-f8e47a6"
|
||||
slice = "advisory-fixes"
|
||||
@@ -1604,42 +1568,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-9473-5f9j-94wq: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props"
|
||||
|
||||
[[pair]]
|
||||
name = "gitpython-option-candidates-96a888f"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-03"
|
||||
language = "python"
|
||||
origin = "github-advisory"
|
||||
license = "BSD-3-Clause"
|
||||
repo = "gitpython-developers/gitpython"
|
||||
cve = "CVE-2026-76220 GHSA-wvpp-8hx9-p66j"
|
||||
cwe = "CWE-88"
|
||||
ecosystem = "pip"
|
||||
published_at = "2026-08-07T15:49:07Z"
|
||||
post_cutoff = true
|
||||
commit = "96a888f4d782cb2f80452148e48e60ce4af6d541"
|
||||
parent = "a495ccd3b547ccd60b2187215823b72a9c0188bf"
|
||||
commit_url = "https://github.com/gitpython-developers/gitpython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "git/cmd.py"
|
||||
mode = "name"
|
||||
relpath = "git/cmd.py"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-08-04"
|
||||
fix_lines = { in_function = 13, in_file = 10, source_total = 12 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-88"
|
||||
class = "argument-injection"
|
||||
path = "git/cmd.py"
|
||||
function = "_option_candidates"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-wvpp-8hx9-p66j: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution"
|
||||
|
||||
[[pair]]
|
||||
name = "mermaid-addnamespace-12d472c"
|
||||
slice = "advisory-fixes"
|
||||
@@ -2540,42 +2468,6 @@ mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-m9mq-7m7q-xc6p: browse-mcp has an arbitrary file write via unconfined download and state paths"
|
||||
|
||||
[[pair]]
|
||||
name = "notebooklm-mcp-makeslug-13828d9"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-03"
|
||||
language = "typescript"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "roomi-fields/notebooklm-mcp"
|
||||
cve = "CVE-2026-61647 GHSA-jjhp-8crj-mppq"
|
||||
cwe = "CWE-22"
|
||||
ecosystem = "npm"
|
||||
published_at = "2026-09-22T14:43:26Z"
|
||||
post_cutoff = true
|
||||
commit = "13828d9ff3933839ce14c1797d3b20a6bb7694a6"
|
||||
parent = "50f74d6bec799687066a25355894077577683231"
|
||||
commit_url = "https://github.com/roomi-fields/notebooklm-mcp/commit/13828d9ff3933839ce14c1797d3b20a6bb7694a6"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/utils/vault-writer.ts"
|
||||
mode = "name"
|
||||
relpath = "src/utils/vault-writer.ts"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-06-20"
|
||||
fix_lines = { in_function = 10, in_file = 45, source_total = 54 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path-traversal"
|
||||
path = "src/utils/vault-writer.ts"
|
||||
function = "makeSlug"
|
||||
mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory"
|
||||
|
||||
[[pair]]
|
||||
name = "langchain-nvidia-url-to-b64-string-b483c7c"
|
||||
slice = "advisory-fixes"
|
||||
@@ -3008,42 +2900,6 @@ mechanism = "validation_strength"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-fp4x-ggrf-wmc6: H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation"
|
||||
|
||||
[[pair]]
|
||||
name = "axios-setproxy-fb3befb"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-03"
|
||||
language = "javascript"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "axios/axios"
|
||||
cve = "CVE-2025-62718 GHSA-3p68-rc4w-qgx5"
|
||||
cwe = "CWE-441"
|
||||
ecosystem = "npm"
|
||||
published_at = "2026-04-09T17:32:19Z"
|
||||
post_cutoff = false
|
||||
commit = "fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
|
||||
parent = "8023035109c9de959ca47a64658dd97258d5eca7"
|
||||
commit_url = "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "lib/adapters/http.js"
|
||||
mode = "name"
|
||||
relpath = "lib/adapters/http.js"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-04-06"
|
||||
fix_lines = { in_function = 4, in_file = 4, source_total = 111 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-441"
|
||||
class = "ssrf"
|
||||
path = "lib/adapters/http.js"
|
||||
function = "setProxy"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-3p68-rc4w-qgx5: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF"
|
||||
|
||||
[[pair]]
|
||||
name = "rembg-s-command-07ad0d4"
|
||||
slice = "advisory-fixes"
|
||||
|
||||
@@ -200,11 +200,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2607
|
||||
},
|
||||
{
|
||||
"name": "typeorm-handler-41d1c62",
|
||||
"ok": true,
|
||||
"bytes_read": 11977
|
||||
},
|
||||
{
|
||||
"name": "velocity-js-isblockedpathkey-f8e47a6",
|
||||
"ok": true,
|
||||
@@ -220,11 +215,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 6805
|
||||
},
|
||||
{
|
||||
"name": "gitpython-option-candidates-96a888f",
|
||||
"ok": true,
|
||||
"bytes_read": 3421
|
||||
},
|
||||
{
|
||||
"name": "mermaid-addnamespace-12d472c",
|
||||
"ok": true,
|
||||
@@ -350,11 +340,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 5302
|
||||
},
|
||||
{
|
||||
"name": "notebooklm-mcp-makeslug-13828d9",
|
||||
"ok": true,
|
||||
"bytes_read": 2103
|
||||
},
|
||||
{
|
||||
"name": "langchain-nvidia-url-to-b64-string-b483c7c",
|
||||
"ok": true,
|
||||
@@ -415,11 +400,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2750
|
||||
},
|
||||
{
|
||||
"name": "axios-setproxy-fb3befb",
|
||||
"ok": true,
|
||||
"bytes_read": 4403
|
||||
},
|
||||
{
|
||||
"name": "rembg-s-command-07ad0d4",
|
||||
"ok": true,
|
||||
@@ -491,6 +471,6 @@
|
||||
"bytes_read": 3385
|
||||
}
|
||||
],
|
||||
"verified": 98,
|
||||
"bytes_read": 526134
|
||||
"verified": 94,
|
||||
"bytes_read": 504230
|
||||
}
|
||||
|
||||
@@ -1352,42 +1352,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-3mpg-q26j-83j5: Command injection in yiisoft/yii2-gii"
|
||||
|
||||
[[pair]]
|
||||
name = "contao-tablelookupwizard-preparewhere-a5e723a"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "php"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "terminal42/contao-tablelookupwizard"
|
||||
cve = "GHSA-7fpj-wc8v-9cgc"
|
||||
cwe = "CWE-89"
|
||||
ecosystem = "composer"
|
||||
published_at = "2024-05-30T13:12:13Z"
|
||||
post_cutoff = false
|
||||
commit = "a5e723a28f110b7df8ffc4175cef9b061d3cc717"
|
||||
parent = "ae6c82f10b0f1e87226079ebaa78ac630b05279a"
|
||||
commit_url = "https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "TableLookupWizard.php"
|
||||
mode = "name"
|
||||
relpath = "TableLookupWizard.php"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2022-02-04"
|
||||
fix_lines = { in_function = 4, in_file = 2, source_total = 4 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-89"
|
||||
class = "sqli"
|
||||
path = "TableLookupWizard.php"
|
||||
function = "prepareWhere"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "injection"
|
||||
evidence = "GHSA-7fpj-wc8v-9cgc: Duplicate Advisory: terminal42/contao-tablelookupwizard possible SQL injection in widget field value"
|
||||
|
||||
[[pair]]
|
||||
name = "spring-module-core-getschema-d374a5f"
|
||||
slice = "advisory-fixes"
|
||||
@@ -3512,42 +3476,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-rrj2-ph5q-jxw2: jquery-validation vulnerable to Cross-site Scripting"
|
||||
|
||||
[[pair]]
|
||||
name = "email-ext-plugin-rendertemplate-7b2bd25"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "java"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "jenkinsci/email-ext-plugin"
|
||||
cve = "CVE-2023-25764 GHSA-p2fr-mq9m-6w6p"
|
||||
cwe = "CWE-79"
|
||||
ecosystem = "maven"
|
||||
published_at = "2023-02-15T15:30:41Z"
|
||||
post_cutoff = false
|
||||
commit = "7b2bd251aa0193d009d85b713362d965dab262d0"
|
||||
parent = "f715c42d186f363f64b64a6a6ed76ed241e702c9"
|
||||
commit_url = "https://github.com/jenkinsci/email-ext-plugin/commit/7b2bd251aa0193d009d85b713362d965dab262d0"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
|
||||
mode = "name"
|
||||
relpath = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2023-02-08"
|
||||
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java"
|
||||
function = "renderTemplate"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin"
|
||||
|
||||
[[pair]]
|
||||
name = "archiva-checkparamchars-d62e81c"
|
||||
slice = "advisory-fixes"
|
||||
@@ -5096,42 +5024,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-3843-rr4g-m8jq: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)"
|
||||
|
||||
[[pair]]
|
||||
name = "graby-cleanupxss-0295d82"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "php"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "j0k3r/graby"
|
||||
cve = "GHSA-3h6j-9x8m-rg3g"
|
||||
cwe = "CWE-79"
|
||||
ecosystem = "composer"
|
||||
published_at = "2026-03-31T23:12:36Z"
|
||||
post_cutoff = false
|
||||
commit = "0295d828822f7a59c5751a8199973a4f965a99b0"
|
||||
parent = "5c5870bd0e8b03c9ea3e7c056d013cd9e4ab2f9a"
|
||||
commit_url = "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/Graby.php"
|
||||
mode = "name"
|
||||
relpath = "src/Graby.php"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-03-27"
|
||||
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/Graby.php"
|
||||
function = "cleanupXss"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-3h6j-9x8m-rg3g: Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config"
|
||||
|
||||
[[pair]]
|
||||
name = "unhead-getstreamkey-64b5ac0"
|
||||
slice = "advisory-fixes"
|
||||
@@ -5384,42 +5276,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable"
|
||||
|
||||
[[pair]]
|
||||
name = "marimo-inject-service-worker-fdd55c8"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "python"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "marimo-team/marimo"
|
||||
cve = "CVE-2026-54386 GHSA-8m59-7xv8-735h"
|
||||
cwe = "CWE-79"
|
||||
ecosystem = "pip"
|
||||
published_at = "2026-06-18T00:32:36Z"
|
||||
post_cutoff = true
|
||||
commit = "fdd55c8cf6260ae23bb411dc9d9269def5cf75d6"
|
||||
parent = "dc35cdfecf4f9b918d9c40faa92e2ad0d71501c4"
|
||||
commit_url = "https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "marimo/_server/api/endpoints/assets.py"
|
||||
mode = "name"
|
||||
relpath = "marimo/_server/api/endpoints/assets.py"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-06-04"
|
||||
fix_lines = { in_function = 2, in_file = 6, source_total = 7 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "marimo/_server/api/endpoints/assets.py"
|
||||
function = "_inject_service_worker"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-8m59-7xv8-735h: marimo contains a reflected cross-site scripting vulnerability in the notebook page"
|
||||
|
||||
[[pair]]
|
||||
name = "jupyterlab-git-diffheader-c6d37b8"
|
||||
slice = "advisory-fixes"
|
||||
@@ -5564,42 +5420,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-3753-m2x2-q623: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer"
|
||||
|
||||
[[pair]]
|
||||
name = "twig-validatename-3d19a2e"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "php"
|
||||
origin = "github-advisory"
|
||||
license = "BSD-3-Clause"
|
||||
repo = "fabpot/twig"
|
||||
cve = "GHSA-7cvr-xhm5-x998"
|
||||
cwe = "CWE-22"
|
||||
ecosystem = "composer"
|
||||
published_at = "2024-05-30T13:42:49Z"
|
||||
post_cutoff = false
|
||||
commit = "3d19a2eed53570776af313593aaeb5ad62cf4980"
|
||||
parent = "481abb83323f4dcabadc9292b0e9f104df0719de"
|
||||
commit_url = "https://github.com/fabpot/twig/commit/3d19a2eed53570776af313593aaeb5ad62cf4980"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "lib/Twig/Loader/Filesystem.php"
|
||||
mode = "name"
|
||||
relpath = "lib/Twig/Loader/Filesystem.php"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2013-04-08"
|
||||
fix_lines = { in_function = 1, in_file = 1, source_total = 1 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path-traversal"
|
||||
path = "lib/Twig/Loader/Filesystem.php"
|
||||
function = "validateName"
|
||||
mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-7cvr-xhm5-x998: Twig Path Traversal vulnerability in the filesystem loader"
|
||||
|
||||
[[pair]]
|
||||
name = "bazingajstranslationbundle-getlocales-7accee9"
|
||||
slice = "advisory-fixes"
|
||||
@@ -6284,42 +6104,6 @@ mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-gv7f-w92j-383q: DreamFactory has a directory traversal"
|
||||
|
||||
[[pair]]
|
||||
name = "simile-butterfly-getresource-537f64b"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "java"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "openrefine/simile-butterfly"
|
||||
cve = "CVE-2024-47883 GHSA-3p8v-w8mr-m3x8"
|
||||
cwe = "CWE-22"
|
||||
ecosystem = "maven"
|
||||
published_at = "2024-10-24T18:16:43Z"
|
||||
post_cutoff = false
|
||||
commit = "537f64bfa72746f8b21d4bda461fad843435319c"
|
||||
parent = "2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e"
|
||||
commit_url = "https://github.com/openrefine/simile-butterfly/commit/537f64bfa72746f8b21d4bda461fad843435319c"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
|
||||
mode = "name"
|
||||
relpath = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2024-10-19"
|
||||
fix_lines = { in_function = 12, in_file = 13, source_total = 18 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path-traversal"
|
||||
path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java"
|
||||
function = "getResource"
|
||||
mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-3p8v-w8mr-m3x8: Butterfly has path/URL confusion in resource handling leading to multiple weaknesses"
|
||||
|
||||
[[pair]]
|
||||
name = "oak-send-4b2f27e"
|
||||
slice = "advisory-fixes"
|
||||
@@ -8084,42 +7868,6 @@ mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-78v8-vpjp-cjqh: PDM wheel installation leads to Path Traversal via overridden write_to_fs"
|
||||
|
||||
[[pair]]
|
||||
name = "xiaomusic-music-file-88404da"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "python"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "hanxi/xiaomusic"
|
||||
cve = "CVE-2026-10108 GHSA-5j8p-5rrj-8wjg"
|
||||
cwe = "CWE-22"
|
||||
ecosystem = "pip"
|
||||
published_at = "2026-05-29T18:31:35Z"
|
||||
post_cutoff = false
|
||||
commit = "88404da7a283f2c0a796a4cd16bbb6e6aa1f4722"
|
||||
parent = "c6679a69e4295a7e508f5ec157b60c5ac5b8a041"
|
||||
commit_url = "https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "xiaomusic/api/routers/file.py"
|
||||
mode = "name"
|
||||
relpath = "xiaomusic/api/routers/file.py"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-05-26"
|
||||
fix_lines = { in_function = 4, in_file = 3, source_total = 6 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path-traversal"
|
||||
path = "xiaomusic/api/routers/file.py"
|
||||
function = "music_file"
|
||||
mechanism = "path_join_user_input"
|
||||
family = "path"
|
||||
evidence = "GHSA-5j8p-5rrj-8wjg: xiaomusic contains an unauthenticated path traversal vulnerability"
|
||||
|
||||
[[pair]]
|
||||
name = "serializer-decode-0943a06"
|
||||
slice = "advisory-fixes"
|
||||
@@ -8480,42 +8228,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-3ppr-72x5-x67q: XML external entity vulnerability on agents in Jenkins MSTest Plugin "
|
||||
|
||||
[[pair]]
|
||||
name = "request-redirect-c5bcf21"
|
||||
slice = "advisory-fixes"
|
||||
batch = "2026-10-04"
|
||||
language = "javascript"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "cypress-io/request"
|
||||
cve = "CVE-2023-28155 GHSA-p8p7-x288-28g6"
|
||||
cwe = "CWE-918"
|
||||
ecosystem = "npm"
|
||||
published_at = "2023-03-16T15:30:19Z"
|
||||
post_cutoff = false
|
||||
commit = "c5bcf21d40fb61feaff21a0e5a2b3934a440024f"
|
||||
parent = "0664780557c95610eafeedff6067bacac6783705"
|
||||
commit_url = "https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "lib/redirect.js"
|
||||
mode = "name"
|
||||
relpath = "lib/redirect.js"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2023-08-08"
|
||||
fix_lines = { in_function = 4, in_file = 5, source_total = 6 }
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "ssrf"
|
||||
path = "lib/redirect.js"
|
||||
function = "Redirect"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request"
|
||||
|
||||
[[pair]]
|
||||
name = "drill-xmlreader-0e88b7a"
|
||||
slice = "advisory-fixes"
|
||||
|
||||
@@ -185,11 +185,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 1699
|
||||
},
|
||||
{
|
||||
"name": "contao-tablelookupwizard-preparewhere-a5e723a",
|
||||
"ok": true,
|
||||
"bytes_read": 3698
|
||||
},
|
||||
{
|
||||
"name": "spring-module-core-getschema-d374a5f",
|
||||
"ok": true,
|
||||
@@ -485,11 +480,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 77807
|
||||
},
|
||||
{
|
||||
"name": "email-ext-plugin-rendertemplate-7b2bd25",
|
||||
"ok": true,
|
||||
"bytes_read": 3416
|
||||
},
|
||||
{
|
||||
"name": "archiva-checkparamchars-d62e81c",
|
||||
"ok": true,
|
||||
@@ -705,11 +695,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2205
|
||||
},
|
||||
{
|
||||
"name": "graby-cleanupxss-0295d82",
|
||||
"ok": true,
|
||||
"bytes_read": 1678
|
||||
},
|
||||
{
|
||||
"name": "unhead-getstreamkey-64b5ac0",
|
||||
"ok": true,
|
||||
@@ -745,11 +730,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 3716
|
||||
},
|
||||
{
|
||||
"name": "marimo-inject-service-worker-fdd55c8",
|
||||
"ok": true,
|
||||
"bytes_read": 5331
|
||||
},
|
||||
{
|
||||
"name": "jupyterlab-git-diffheader-c6d37b8",
|
||||
"ok": true,
|
||||
@@ -770,11 +750,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2858
|
||||
},
|
||||
{
|
||||
"name": "twig-validatename-3d19a2e",
|
||||
"ok": true,
|
||||
"bytes_read": 1956
|
||||
},
|
||||
{
|
||||
"name": "bazingajstranslationbundle-getlocales-7accee9",
|
||||
"ok": true,
|
||||
@@ -870,11 +845,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2927
|
||||
},
|
||||
{
|
||||
"name": "simile-butterfly-getresource-537f64b",
|
||||
"ok": true,
|
||||
"bytes_read": 3893
|
||||
},
|
||||
{
|
||||
"name": "oak-send-4b2f27e",
|
||||
"ok": true,
|
||||
@@ -1120,11 +1090,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 3554
|
||||
},
|
||||
{
|
||||
"name": "xiaomusic-music-file-88404da",
|
||||
"ok": true,
|
||||
"bytes_read": 5275
|
||||
},
|
||||
{
|
||||
"name": "serializer-decode-0943a06",
|
||||
"ok": true,
|
||||
@@ -1175,11 +1140,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 3652
|
||||
},
|
||||
{
|
||||
"name": "request-redirect-c5bcf21",
|
||||
"ok": true,
|
||||
"bytes_read": 5438
|
||||
},
|
||||
{
|
||||
"name": "drill-xmlreader-0e88b7a",
|
||||
"ok": true,
|
||||
@@ -1256,6 +1216,6 @@
|
||||
"bytes_read": 4668
|
||||
}
|
||||
],
|
||||
"verified": 251,
|
||||
"bytes_read": 1297516
|
||||
"verified": 243,
|
||||
"bytes_read": 1266831
|
||||
}
|
||||
|
||||
@@ -139,38 +139,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-28mg-98xm-q493: login redirects to next only when is_safe_redirect_url (same host, http/https) holds"
|
||||
|
||||
[[pair]]
|
||||
name = "google-login-plugin-docommencelogin-532d714"
|
||||
slice = "advisory-fixes"
|
||||
language = "java"
|
||||
framework = "jenkins"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "jenkinsci/google-login-plugin"
|
||||
cve = "CVE-2022-46683 GHSA-v93c-cxj5-c398"
|
||||
cwe = "CWE-601"
|
||||
commit = "532d714943ff8ae8dc862427d39a4b78b7f6a375"
|
||||
parent = "6b616f7709037a9bde1ee1646b18811a45e0b1fd"
|
||||
commit_url = "https://github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
mode = "name"
|
||||
relpath = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2022-12-05"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open_redirect"
|
||||
path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
function = "doCommenceLogin"
|
||||
mechanism = "validation_strength"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-v93c-cxj5-c398: doCommenceLogin used from/Referer only when Util.isSafeToRedirectTo was FALSE (inverted); fix routes through a correct safe-redirect check"
|
||||
|
||||
[[pair]]
|
||||
name = "truelayer-dotnet-getpayment-75e436e"
|
||||
slice = "advisory-fixes"
|
||||
@@ -459,38 +427,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-7j2f-6h2r-6cqc: createForEpisode refuses to Http::sink()->get() an episode enclosure URL unless Network::isSafeUrl (public host, http/https)"
|
||||
|
||||
[[pair]]
|
||||
name = "authentication-getloginredirect-1c1e29c"
|
||||
slice = "advisory-fixes"
|
||||
language = "php"
|
||||
framework = "cakephp"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "cakephp/authentication"
|
||||
cve = "CVE-2026-55590 GHSA-hhpq-7wg4-36jm"
|
||||
cwe = "CWE-601"
|
||||
commit = "1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
|
||||
parent = "3f7cb4a7a0313139d5d3ce2bdd7854c19bae2491"
|
||||
commit_url = "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/AuthenticationService.php"
|
||||
mode = "name"
|
||||
relpath = "src/AuthenticationService.php"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-06-24"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open_redirect"
|
||||
path = "src/AuthenticationService.php"
|
||||
function = "getLoginRedirect"
|
||||
mechanism = "validation_strength"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-hhpq-7wg4-36jm: getLoginRedirect normalises backslashes to slashes and rejects values starting with // before the host/scheme check"
|
||||
|
||||
[[pair]]
|
||||
name = "og-image-resolve-243cac2"
|
||||
slice = "advisory-fixes"
|
||||
@@ -1707,38 +1643,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-gcr2-9v8m-gq45: addRotate XML-escapes the rotate option before interpolating it into the SVG transform attribute"
|
||||
|
||||
[[pair]]
|
||||
name = "omnifaces-getupdatescript-c43eef0"
|
||||
slice = "advisory-fixes"
|
||||
language = "java"
|
||||
framework = "jsf"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "omnifaces/omnifaces"
|
||||
cve = "GHSA-fp43-vj7g-pg92"
|
||||
cwe = "CWE-79"
|
||||
commit = "c43eef01174a4dc09cec44eff553ff6284150af7"
|
||||
parent = "6e43429276dc558887bfa5f6ae6e04d90983b951"
|
||||
commit_url = "https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
mode = "name"
|
||||
relpath = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-07-23"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
function = "getUpdateScript"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-fp43-vj7g-pg92: getUpdateScript JS-escapes the request-derived hash param name and value with escapeJS before formatting them into the ajax callback script"
|
||||
|
||||
[[pair]]
|
||||
name = "tablib-export-book-b0ff39f"
|
||||
slice = "advisory-fixes"
|
||||
@@ -1771,38 +1675,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-gqgw-jghv-mxwx: export_book stops interpolating the dataset title raw into the HTML heading and serialises it through an ElementTree element, which escapes it"
|
||||
|
||||
[[pair]]
|
||||
name = "hono-resolvechildearly-2b8ed40"
|
||||
slice = "advisory-fixes"
|
||||
language = "typescript"
|
||||
framework = "hono"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "honojs/hono"
|
||||
cve = "CVE-2026-93981 GHSA-hxh3-vqpv-xpqv"
|
||||
cwe = "CWE-79"
|
||||
commit = "2b8ed402cdab6dfc5e829b480806dcd8db94161e"
|
||||
parent = "cac0c4d3fe29aca4e426031067cbbb3b9131e30c"
|
||||
commit_url = "https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/jsx/components.ts"
|
||||
mode = "name"
|
||||
relpath = "src/jsx/components.ts"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-09-04"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/jsx/components.ts"
|
||||
function = "resolveChildEarly"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-hxh3-vqpv-xpqv: resolveChildEarly stops returning plain string children as already-escaped HTML and routes them through renderChildren, which escapes them"
|
||||
|
||||
[[pair]]
|
||||
name = "serialize-to-js-deserialize-1cd4339"
|
||||
slice = "advisory-fixes"
|
||||
|
||||
@@ -20,11 +20,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2273
|
||||
},
|
||||
{
|
||||
"name": "google-login-plugin-docommencelogin-532d714",
|
||||
"ok": true,
|
||||
"bytes_read": 2790
|
||||
},
|
||||
{
|
||||
"name": "truelayer-dotnet-getpayment-75e436e",
|
||||
"ok": true,
|
||||
@@ -70,11 +65,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 1867
|
||||
},
|
||||
{
|
||||
"name": "authentication-getloginredirect-1c1e29c",
|
||||
"ok": true,
|
||||
"bytes_read": 3975
|
||||
},
|
||||
{
|
||||
"name": "og-image-resolve-243cac2",
|
||||
"ok": true,
|
||||
@@ -265,21 +255,11 @@
|
||||
"ok": true,
|
||||
"bytes_read": 1368
|
||||
},
|
||||
{
|
||||
"name": "omnifaces-getupdatescript-c43eef0",
|
||||
"ok": true,
|
||||
"bytes_read": 1491
|
||||
},
|
||||
{
|
||||
"name": "tablib-export-book-b0ff39f",
|
||||
"ok": true,
|
||||
"bytes_read": 1683
|
||||
},
|
||||
{
|
||||
"name": "hono-resolvechildearly-2b8ed40",
|
||||
"ok": true,
|
||||
"bytes_read": 3041
|
||||
},
|
||||
{
|
||||
"name": "serialize-to-js-deserialize-1cd4339",
|
||||
"ok": true,
|
||||
@@ -486,6 +466,6 @@
|
||||
"bytes_read": 2462
|
||||
}
|
||||
],
|
||||
"verified": 97,
|
||||
"bytes_read": 367053
|
||||
"verified": 93,
|
||||
"bytes_read": 355756
|
||||
}
|
||||
|
||||
@@ -141,6 +141,16 @@ reason = "v3 selection research; never opened"
|
||||
file = "protocol-v3.md"
|
||||
reason = "v3 protocol; never opened"
|
||||
|
||||
# Counts derived from the advisory-fix catalog, not an independent labelled population.
|
||||
[[excluded]]
|
||||
file = "advisory-fixes-spread.json"
|
||||
reason = "advisory-fix catalog spread report; never opened"
|
||||
|
||||
# Selection write-up: rejected-candidate mentions are narrative, not labelled cases.
|
||||
[[excluded]]
|
||||
file = "research-2026-09-26.md"
|
||||
reason = "v2 selection research write-up; never opened"
|
||||
|
||||
# Repository aliases: forks and renames that are one repository group. Groups sharing an advisory id (CVE/GHSA) or
|
||||
# a fix commit are merged automatically; list here only what those cannot see.
|
||||
# [[alias]]
|
||||
|
||||
@@ -93,6 +93,13 @@ def test_no_pair_repeats_a_repository_the_benchmarks_already_name(source_id: str
|
||||
ours = {repo_name(item["repo"]) for item in _raw(folder)}
|
||||
elsewhere: set[str] = set()
|
||||
for path in (ROOT / "benchmarks").rglob("*"):
|
||||
# A vendored dependency tree is not the benchmarks NAMING a repository as a population member: it is a
|
||||
# checked-out application's own `node_modules`, where any dependency's README or package.json mentions
|
||||
# its upstream repo. benchmarks/search/private/runs/*/checkout/ carries ~49k such files, so grepping
|
||||
# them deletes a labelled advisory pair the moment a vendored dep happens to name its repo -- corpus
|
||||
# loss masquerading as hygiene. Skip vendored trees; the leak guard is about our own populations.
|
||||
if "node_modules" in path.parts or "vendor" in path.parts:
|
||||
continue
|
||||
if not path.is_file() or folder in path.parents or path.name in excluded or path.suffix in {".pyc", ".bin", ".gz", ".jsonl"}:
|
||||
continue
|
||||
try:
|
||||
|
||||
Reference in New Issue
Block a user