mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
fix(corpus): advisory-pair repo-overlap -- remove real pilot leaks, skip vendored trees
test_no_pair_repeats_a_repository_the_benchmarks_already_name failed: advisory-fix catalog repos also appeared elsewhere under benchmarks/. Root cause split two ways: 1. Genuine leak: 16 catalog repos are also subjects in benchmarks/search/private/ pilot.json (a real private pilot population). Removed those 16 pairs from the three catalogs and their verification.json rows (totals recomputed, catalog == verification preserved). 2. Spurious: the overlap scan greped ~49k vendored files under benchmarks/search/private/runs/*/checkout/node_modules/, so any catalog repo a vendored dependency's README names collided. Added a narrow vendored-tree skip (node_modules/vendor) to the scan rather than deleting labelled pairs over a dependency mention. Implemented from Codex's first pass (gpt-6.1-sol), then gated and corrected: Codex removed 20 pairs; 4 of those (backstage/backstage, koajs/koa, beaugunderson/ ip-address, cakephp/cakephp) were driven only by vendored/non-population mentions and are kept. Also excluded advisory-fixes-spread.json (catalog-derived report) and research-2026-09-26.md (selection write-up) as non-population. tests/test_advisory_fix_pairs.py + tests/test_learn_labels.py: 53 passed. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
60ffff0168
commit
9a3250f6c5
@@ -139,38 +139,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-28mg-98xm-q493: login redirects to next only when is_safe_redirect_url (same host, http/https) holds"
|
||||
|
||||
[[pair]]
|
||||
name = "google-login-plugin-docommencelogin-532d714"
|
||||
slice = "advisory-fixes"
|
||||
language = "java"
|
||||
framework = "jenkins"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "jenkinsci/google-login-plugin"
|
||||
cve = "CVE-2022-46683 GHSA-v93c-cxj5-c398"
|
||||
cwe = "CWE-601"
|
||||
commit = "532d714943ff8ae8dc862427d39a4b78b7f6a375"
|
||||
parent = "6b616f7709037a9bde1ee1646b18811a45e0b1fd"
|
||||
commit_url = "https://github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
mode = "name"
|
||||
relpath = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2022-12-05"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open_redirect"
|
||||
path = "src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java"
|
||||
function = "doCommenceLogin"
|
||||
mechanism = "validation_strength"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-v93c-cxj5-c398: doCommenceLogin used from/Referer only when Util.isSafeToRedirectTo was FALSE (inverted); fix routes through a correct safe-redirect check"
|
||||
|
||||
[[pair]]
|
||||
name = "truelayer-dotnet-getpayment-75e436e"
|
||||
slice = "advisory-fixes"
|
||||
@@ -459,38 +427,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-7j2f-6h2r-6cqc: createForEpisode refuses to Http::sink()->get() an episode enclosure URL unless Network::isSafeUrl (public host, http/https)"
|
||||
|
||||
[[pair]]
|
||||
name = "authentication-getloginredirect-1c1e29c"
|
||||
slice = "advisory-fixes"
|
||||
language = "php"
|
||||
framework = "cakephp"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "cakephp/authentication"
|
||||
cve = "CVE-2026-55590 GHSA-hhpq-7wg4-36jm"
|
||||
cwe = "CWE-601"
|
||||
commit = "1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
|
||||
parent = "3f7cb4a7a0313139d5d3ce2bdd7854c19bae2491"
|
||||
commit_url = "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/AuthenticationService.php"
|
||||
mode = "name"
|
||||
relpath = "src/AuthenticationService.php"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-06-24"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open_redirect"
|
||||
path = "src/AuthenticationService.php"
|
||||
function = "getLoginRedirect"
|
||||
mechanism = "validation_strength"
|
||||
family = "untrusted_destination"
|
||||
evidence = "GHSA-hhpq-7wg4-36jm: getLoginRedirect normalises backslashes to slashes and rejects values starting with // before the host/scheme check"
|
||||
|
||||
[[pair]]
|
||||
name = "og-image-resolve-243cac2"
|
||||
slice = "advisory-fixes"
|
||||
@@ -1707,38 +1643,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-gcr2-9v8m-gq45: addRotate XML-escapes the rotate option before interpolating it into the SVG transform attribute"
|
||||
|
||||
[[pair]]
|
||||
name = "omnifaces-getupdatescript-c43eef0"
|
||||
slice = "advisory-fixes"
|
||||
language = "java"
|
||||
framework = "jsf"
|
||||
origin = "github-advisory"
|
||||
license = "Apache-2.0"
|
||||
repo = "omnifaces/omnifaces"
|
||||
cve = "GHSA-fp43-vj7g-pg92"
|
||||
cwe = "CWE-79"
|
||||
commit = "c43eef01174a4dc09cec44eff553ff6284150af7"
|
||||
parent = "6e43429276dc558887bfa5f6ae6e04d90983b951"
|
||||
commit_url = "https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
mode = "name"
|
||||
relpath = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-07-23"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/main/java/org/omnifaces/component/input/HashParam.java"
|
||||
function = "getUpdateScript"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-fp43-vj7g-pg92: getUpdateScript JS-escapes the request-derived hash param name and value with escapeJS before formatting them into the ajax callback script"
|
||||
|
||||
[[pair]]
|
||||
name = "tablib-export-book-b0ff39f"
|
||||
slice = "advisory-fixes"
|
||||
@@ -1771,38 +1675,6 @@ mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-gqgw-jghv-mxwx: export_book stops interpolating the dataset title raw into the HTML heading and serialises it through an ElementTree element, which escapes it"
|
||||
|
||||
[[pair]]
|
||||
name = "hono-resolvechildearly-2b8ed40"
|
||||
slice = "advisory-fixes"
|
||||
language = "typescript"
|
||||
framework = "hono"
|
||||
origin = "github-advisory"
|
||||
license = "MIT"
|
||||
repo = "honojs/hono"
|
||||
cve = "CVE-2026-93981 GHSA-hxh3-vqpv-xpqv"
|
||||
cwe = "CWE-79"
|
||||
commit = "2b8ed402cdab6dfc5e829b480806dcd8db94161e"
|
||||
parent = "cac0c4d3fe29aca4e426031067cbbb3b9131e30c"
|
||||
commit_url = "https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e"
|
||||
vendored = false
|
||||
host = "github"
|
||||
path = "src/jsx/components.ts"
|
||||
mode = "name"
|
||||
relpath = "src/jsx/components.ts"
|
||||
provenance = "human"
|
||||
split = "train"
|
||||
review_tier = "advisory"
|
||||
fix_date = "2026-09-04"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-79"
|
||||
class = "xss"
|
||||
path = "src/jsx/components.ts"
|
||||
function = "resolveChildEarly"
|
||||
mechanism = "source_reaches_sink"
|
||||
family = "output_encoding"
|
||||
evidence = "GHSA-hxh3-vqpv-xpqv: resolveChildEarly stops returning plain string children as already-escaped HTML and routes them through renderChildren, which escapes them"
|
||||
|
||||
[[pair]]
|
||||
name = "serialize-to-js-deserialize-1cd4339"
|
||||
slice = "advisory-fixes"
|
||||
|
||||
@@ -20,11 +20,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 2273
|
||||
},
|
||||
{
|
||||
"name": "google-login-plugin-docommencelogin-532d714",
|
||||
"ok": true,
|
||||
"bytes_read": 2790
|
||||
},
|
||||
{
|
||||
"name": "truelayer-dotnet-getpayment-75e436e",
|
||||
"ok": true,
|
||||
@@ -70,11 +65,6 @@
|
||||
"ok": true,
|
||||
"bytes_read": 1867
|
||||
},
|
||||
{
|
||||
"name": "authentication-getloginredirect-1c1e29c",
|
||||
"ok": true,
|
||||
"bytes_read": 3975
|
||||
},
|
||||
{
|
||||
"name": "og-image-resolve-243cac2",
|
||||
"ok": true,
|
||||
@@ -265,21 +255,11 @@
|
||||
"ok": true,
|
||||
"bytes_read": 1368
|
||||
},
|
||||
{
|
||||
"name": "omnifaces-getupdatescript-c43eef0",
|
||||
"ok": true,
|
||||
"bytes_read": 1491
|
||||
},
|
||||
{
|
||||
"name": "tablib-export-book-b0ff39f",
|
||||
"ok": true,
|
||||
"bytes_read": 1683
|
||||
},
|
||||
{
|
||||
"name": "hono-resolvechildearly-2b8ed40",
|
||||
"ok": true,
|
||||
"bytes_read": 3041
|
||||
},
|
||||
{
|
||||
"name": "serialize-to-js-deserialize-1cd4339",
|
||||
"ok": true,
|
||||
@@ -486,6 +466,6 @@
|
||||
"bytes_read": 2462
|
||||
}
|
||||
],
|
||||
"verified": 97,
|
||||
"bytes_read": 367053
|
||||
"verified": 93,
|
||||
"bytes_read": 355756
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user