mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
feat(plane): increment manifests for the 46-candidate validation run (task 7)
Model deepseek-flash (declared provider extension, endpoint prices in parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned Task templates repo-facts / verify / agree, and a generator (plane/generate.py, `ousast plane workspaces --validation-set ...`) that emits per case the vulnerable-pin Workspace, a files-only inputs Workspace (recorded candidates after the recorded triage, declared sites, triage), per-case Tasks and one Run validation-46: facts -> verify a, verify b -> agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded per-pass share. A Run entry cannot add a binding or env, and Run.inputs names only task artifacts, so the case is fixed by per-case Tasks. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
1a69e50a68
commit
a35397c0ec
@@ -0,0 +1,22 @@
|
||||
# The chat model of the first increment (ai-service-plane Req 1.1, 1.4, 7.1). `deepseek` is not an ax provider;
|
||||
# the annotation declares the extension instead of hiding it in another field. `secretKey` names the Kubernetes
|
||||
# Secret and key that hold DEEPSEEK_API_KEY, the variable `tool_hunter.resolve_hunter_client()` reads; the key
|
||||
# itself is never in a manifest. Prices are `openultrasast.model.endpoint`'s for `deepseek-flash` (USD per million
|
||||
# tokens); the verify task's meter reads them from OUSAST_MODEL_PARAMS with `budget.prices_from`.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Model
|
||||
metadata:
|
||||
name: deepseek-flash
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/provider-extension: "true"
|
||||
spec:
|
||||
provider: deepseek
|
||||
model: deepseek-flash
|
||||
secretKey:
|
||||
name: deepseek
|
||||
key: DEEPSEEK_API_KEY
|
||||
parameters:
|
||||
cache_hit_per_m: 0.014
|
||||
input_per_m: 0.44
|
||||
output_per_m: 1.32
|
||||
@@ -0,0 +1,563 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
# 15 cases, 46 candidates (43 kept by the recorded triage); usd ceiling 2.02.
|
||||
apiVersion: openultrasast.io/v1alpha1
|
||||
kind: Run
|
||||
metadata:
|
||||
name: validation-46
|
||||
spec:
|
||||
tasks:
|
||||
- name: budibase-mongo-template-nosqli-facts
|
||||
task: repo-facts-budibase-mongo-template-nosqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id001
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: budibase-mongo-template-nosqli-va
|
||||
task: verify-a-budibase-mongo-template-nosqli
|
||||
inputs:
|
||||
facts: budibase-mongo-template-nosqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.06
|
||||
calls: 16
|
||||
- name: budibase-mongo-template-nosqli-vb
|
||||
task: verify-b-budibase-mongo-template-nosqli
|
||||
inputs:
|
||||
facts: budibase-mongo-template-nosqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.06
|
||||
calls: 16
|
||||
- name: budibase-mongo-template-nosqli-agree
|
||||
task: agree-budibase-mongo-template-nosqli
|
||||
inputs:
|
||||
pass_a: budibase-mongo-template-nosqli-va/units.jsonl
|
||||
pass_b: budibase-mongo-template-nosqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id001
|
||||
- name: cct-studio-server-cmdi-facts
|
||||
task: repo-facts-cct-studio-server-cmdi
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id002
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: cct-studio-server-cmdi-va
|
||||
task: verify-a-cct-studio-server-cmdi
|
||||
inputs:
|
||||
facts: cct-studio-server-cmdi-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: cct-studio-server-cmdi-vb
|
||||
task: verify-b-cct-studio-server-cmdi
|
||||
inputs:
|
||||
facts: cct-studio-server-cmdi-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: cct-studio-server-cmdi-agree
|
||||
task: agree-cct-studio-server-cmdi
|
||||
inputs:
|
||||
pass_a: cct-studio-server-cmdi-va/units.jsonl
|
||||
pass_b: cct-studio-server-cmdi-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id002
|
||||
- name: contextforge-prompt-ssti-facts
|
||||
task: repo-facts-contextforge-prompt-ssti
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id003
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: contextforge-prompt-ssti-va
|
||||
task: verify-a-contextforge-prompt-ssti
|
||||
inputs:
|
||||
facts: contextforge-prompt-ssti-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: contextforge-prompt-ssti-vb
|
||||
task: verify-b-contextforge-prompt-ssti
|
||||
inputs:
|
||||
facts: contextforge-prompt-ssti-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: contextforge-prompt-ssti-agree
|
||||
task: agree-contextforge-prompt-ssti
|
||||
inputs:
|
||||
pass_a: contextforge-prompt-ssti-va/units.jsonl
|
||||
pass_b: contextforge-prompt-ssti-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id003
|
||||
- name: froxlor-admin-ip-second-order-sqli-facts
|
||||
task: repo-facts-froxlor-admin-ip-second-order-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id004
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: froxlor-admin-ip-second-order-sqli-va
|
||||
task: verify-a-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-vb
|
||||
task: verify-b-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-agree
|
||||
task: agree-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
|
||||
pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id004
|
||||
- name: fuxa-tdengine-escape-sqli-facts
|
||||
task: repo-facts-fuxa-tdengine-escape-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id005
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: fuxa-tdengine-escape-sqli-va
|
||||
task: verify-a-fuxa-tdengine-escape-sqli
|
||||
inputs:
|
||||
facts: fuxa-tdengine-escape-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.12
|
||||
calls: 8
|
||||
- name: fuxa-tdengine-escape-sqli-vb
|
||||
task: verify-b-fuxa-tdengine-escape-sqli
|
||||
inputs:
|
||||
facts: fuxa-tdengine-escape-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.12
|
||||
calls: 8
|
||||
- name: fuxa-tdengine-escape-sqli-agree
|
||||
task: agree-fuxa-tdengine-escape-sqli
|
||||
inputs:
|
||||
pass_a: fuxa-tdengine-escape-sqli-va/units.jsonl
|
||||
pass_b: fuxa-tdengine-escape-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id005
|
||||
- name: lmdeploy-media-url-ssrf-facts
|
||||
task: repo-facts-lmdeploy-media-url-ssrf
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id006
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: lmdeploy-media-url-ssrf-va
|
||||
task: verify-a-lmdeploy-media-url-ssrf
|
||||
inputs:
|
||||
facts: lmdeploy-media-url-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: lmdeploy-media-url-ssrf-vb
|
||||
task: verify-b-lmdeploy-media-url-ssrf
|
||||
inputs:
|
||||
facts: lmdeploy-media-url-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: lmdeploy-media-url-ssrf-agree
|
||||
task: agree-lmdeploy-media-url-ssrf
|
||||
inputs:
|
||||
pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
|
||||
pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id006
|
||||
- name: medplum-external-auth-open-redirect-facts
|
||||
task: repo-facts-medplum-external-auth-open-redirect
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id007
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: medplum-external-auth-open-redirect-va
|
||||
task: verify-a-medplum-external-auth-open-redirect
|
||||
inputs:
|
||||
facts: medplum-external-auth-open-redirect-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: medplum-external-auth-open-redirect-vb
|
||||
task: verify-b-medplum-external-auth-open-redirect
|
||||
inputs:
|
||||
facts: medplum-external-auth-open-redirect-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: medplum-external-auth-open-redirect-agree
|
||||
task: agree-medplum-external-auth-open-redirect
|
||||
inputs:
|
||||
pass_a: medplum-external-auth-open-redirect-va/units.jsonl
|
||||
pass_b: medplum-external-auth-open-redirect-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id007
|
||||
- name: pgadmin-maintenance-sqli-facts
|
||||
task: repo-facts-pgadmin-maintenance-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id008
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: pgadmin-maintenance-sqli-va
|
||||
task: verify-a-pgadmin-maintenance-sqli
|
||||
inputs:
|
||||
facts: pgadmin-maintenance-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.45
|
||||
calls: 96
|
||||
- name: pgadmin-maintenance-sqli-vb
|
||||
task: verify-b-pgadmin-maintenance-sqli
|
||||
inputs:
|
||||
facts: pgadmin-maintenance-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.45
|
||||
calls: 96
|
||||
- name: pgadmin-maintenance-sqli-agree
|
||||
task: agree-pgadmin-maintenance-sqli
|
||||
inputs:
|
||||
pass_a: pgadmin-maintenance-sqli-va/units.jsonl
|
||||
pass_b: pgadmin-maintenance-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id008
|
||||
- name: qwed-sympy-eval-facts
|
||||
task: repo-facts-qwed-sympy-eval
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id009
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: qwed-sympy-eval-va
|
||||
task: verify-a-qwed-sympy-eval
|
||||
inputs:
|
||||
facts: qwed-sympy-eval-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: qwed-sympy-eval-vb
|
||||
task: verify-b-qwed-sympy-eval
|
||||
inputs:
|
||||
facts: qwed-sympy-eval-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: qwed-sympy-eval-agree
|
||||
task: agree-qwed-sympy-eval
|
||||
inputs:
|
||||
pass_a: qwed-sympy-eval-va/units.jsonl
|
||||
pass_b: qwed-sympy-eval-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id009
|
||||
- name: reactpress-findall-column-sqli-facts
|
||||
task: repo-facts-reactpress-findall-column-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id010
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: reactpress-findall-column-sqli-va
|
||||
task: verify-a-reactpress-findall-column-sqli
|
||||
inputs:
|
||||
facts: reactpress-findall-column-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: reactpress-findall-column-sqli-vb
|
||||
task: verify-b-reactpress-findall-column-sqli
|
||||
inputs:
|
||||
facts: reactpress-findall-column-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: reactpress-findall-column-sqli-agree
|
||||
task: agree-reactpress-findall-column-sqli
|
||||
inputs:
|
||||
pass_a: reactpress-findall-column-sqli-va/units.jsonl
|
||||
pass_b: reactpress-findall-column-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id010
|
||||
- name: unleash-addon-webhook-ssrf-facts
|
||||
task: repo-facts-unleash-addon-webhook-ssrf
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id011
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: unleash-addon-webhook-ssrf-va
|
||||
task: verify-a-unleash-addon-webhook-ssrf
|
||||
inputs:
|
||||
facts: unleash-addon-webhook-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: unleash-addon-webhook-ssrf-vb
|
||||
task: verify-b-unleash-addon-webhook-ssrf
|
||||
inputs:
|
||||
facts: unleash-addon-webhook-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: unleash-addon-webhook-ssrf-agree
|
||||
task: agree-unleash-addon-webhook-ssrf
|
||||
inputs:
|
||||
pass_a: unleash-addon-webhook-ssrf-va/units.jsonl
|
||||
pass_b: unleash-addon-webhook-ssrf-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id011
|
||||
- name: winml-cli-serve-cors-facts
|
||||
task: repo-facts-winml-cli-serve-cors
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id012
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: winml-cli-serve-cors-va
|
||||
task: verify-a-winml-cli-serve-cors
|
||||
inputs:
|
||||
facts: winml-cli-serve-cors-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: winml-cli-serve-cors-vb
|
||||
task: verify-b-winml-cli-serve-cors
|
||||
inputs:
|
||||
facts: winml-cli-serve-cors-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: winml-cli-serve-cors-agree
|
||||
task: agree-winml-cli-serve-cors
|
||||
inputs:
|
||||
pass_a: winml-cli-serve-cors-va/units.jsonl
|
||||
pass_b: winml-cli-serve-cors-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id012
|
||||
- name: wp-directorist-avatar-ssrf-facts
|
||||
task: repo-facts-wp-directorist-avatar-ssrf
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id013
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: wp-directorist-avatar-ssrf-va
|
||||
task: verify-a-wp-directorist-avatar-ssrf
|
||||
inputs:
|
||||
facts: wp-directorist-avatar-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: wp-directorist-avatar-ssrf-vb
|
||||
task: verify-b-wp-directorist-avatar-ssrf
|
||||
inputs:
|
||||
facts: wp-directorist-avatar-ssrf-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: wp-directorist-avatar-ssrf-agree
|
||||
task: agree-wp-directorist-avatar-ssrf
|
||||
inputs:
|
||||
pass_a: wp-directorist-avatar-ssrf-va/units.jsonl
|
||||
pass_b: wp-directorist-avatar-ssrf-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id013
|
||||
- name: wp-gopay-log-filter-sqli-facts
|
||||
task: repo-facts-wp-gopay-log-filter-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id014
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: wp-gopay-log-filter-sqli-va
|
||||
task: verify-a-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-vb
|
||||
task: verify-b-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-agree
|
||||
task: agree-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
|
||||
pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id014
|
||||
- name: wp-groundhogg-confirm-redirect-facts
|
||||
task: repo-facts-wp-groundhogg-confirm-redirect
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id015
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: wp-groundhogg-confirm-redirect-va
|
||||
task: verify-a-wp-groundhogg-confirm-redirect
|
||||
inputs:
|
||||
facts: wp-groundhogg-confirm-redirect-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.05
|
||||
calls: 8
|
||||
- name: wp-groundhogg-confirm-redirect-vb
|
||||
task: verify-b-wp-groundhogg-confirm-redirect
|
||||
inputs:
|
||||
facts: wp-groundhogg-confirm-redirect-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.05
|
||||
calls: 8
|
||||
- name: wp-groundhogg-confirm-redirect-agree
|
||||
task: agree-wp-groundhogg-confirm-redirect
|
||||
inputs:
|
||||
pass_a: wp-groundhogg-confirm-redirect-va/units.jsonl
|
||||
pass_b: wp-groundhogg-confirm-redirect-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id015
|
||||
@@ -0,0 +1,18 @@
|
||||
# agree (ai-service-plane Req 5.3, 2.1): agreement across the two verify passes, per-candidate cost and turns,
|
||||
# declared-site match. No model. This is the template the per-case Tasks of a Run are generated from (bound to the
|
||||
# case's inputs Workspace for the candidates and declared sites). The image is digest-pinned.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: agree
|
||||
atespace: default
|
||||
spec:
|
||||
image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
|
||||
command: ["agree"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: "512Mi"
|
||||
@@ -0,0 +1,19 @@
|
||||
# repo-facts (ai-service-plane Req 5.1/5.2): source only, no model. This is the template the per-case Tasks of a
|
||||
# Run are generated from (`ousast plane workspaces --validation-set ...` binds the case's pinned Workspace and its
|
||||
# inputs Workspace, and sets the paths as env). The image is digest-pinned: Agent Substrate rejects tags.
|
||||
# Heavy for the host (a full-tree scan of the case at 1 CPU / 1.5 GiB per gVisor worker): the Run serializes it.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: repo-facts
|
||||
atespace: default
|
||||
spec:
|
||||
image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
|
||||
command: ["repo-facts"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: "250m"
|
||||
memory: "512Mi"
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: "1280Mi"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,21 @@
|
||||
# verify (ai-service-plane Req 5.3, 2.1-2.3, 7.2): one batched hunt per file with the known callers from
|
||||
# repo-facts in the prompt. Bound to its Model by the `openultrasast.io/model` annotation, which the reconciler
|
||||
# strips and renders as OUSAST_MODEL / OUSAST_MODEL_PARAMS. This is the template the per-case, per-pass Tasks of a
|
||||
# Run are generated from (the pass is OUSAST_PASS=a|b in their env). The image is digest-pinned.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
|
||||
command: ["verify"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: "250m"
|
||||
memory: "384Mi"
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: "1Gi"
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: budibase-mongo-template-nosqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/integrations/mongodb.ts\",\n \"read\",\n 539\n ],\n [\n \"packages/server/src/sdk/workspace/queries/queries.ts\",\n \"enrichContext\",\n 136\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"budibase-mongo-template-nosqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"read\",\n \"line\": 539,\n \"path\": \"packages/server/src/integrations/mongodb.ts\"\n },\n {\n \"function\": \"enrichContext\",\n \"line\": 136,\n \"path\": \"packages/server/src/sdk/workspace/queries/queries.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"budibase-mongo-template-nosqli\",\n \"sites\": [\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\",\n \"packages/server/src/integrations/mongodb.ts::read\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/integrations/mongodb.ts\",\n \"read\",\n 539\n ],\n [\n \"packages/server/src/sdk/workspace/queries/queries.ts\",\n \"enrichContext\",\n 136\n ]\n ],\n \"kept\": [\n [\n \"packages/server/src/integrations/mongodb.ts\",\n \"read\",\n 539\n ],\n [\n \"packages/server/src/sdk/workspace/queries/queries.ts\",\n \"enrichContext\",\n 136\n ]\n ],\n \"triage\": {\n \"packages/server/src/integrations/mongodb.ts::read\": \"request\",\n \"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: budibase-mongo-template-nosqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=b7e63df737eede85d951aa9665b0c0778ece7ccb
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/Budibase/budibase
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: cct-studio-server-cmdi-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"cli-tool/src/sandbox-server.js\",\n \"checkAndInstallAgent\",\n 280\n ],\n [\n \"cli-tool/src/sandbox-server.js\",\n \"executeLocalTask\",\n 464\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"cct-studio-server-cmdi\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"checkAndInstallAgent\",\n \"line\": 280,\n \"path\": \"cli-tool/src/sandbox-server.js\"\n },\n {\n \"function\": \"executeLocalTask\",\n \"line\": 464,\n \"path\": \"cli-tool/src/sandbox-server.js\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"cct-studio-server-cmdi\",\n \"sites\": [\n \"cli-tool/src/sandbox-server.js::executeLocalTask\",\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"cli-tool/src/sandbox-server.js\",\n \"checkAndInstallAgent\",\n 280\n ],\n [\n \"cli-tool/src/sandbox-server.js\",\n \"executeLocalTask\",\n 464\n ]\n ],\n \"kept\": [\n [\n \"cli-tool/src/sandbox-server.js\",\n \"checkAndInstallAgent\",\n 280\n ],\n [\n \"cli-tool/src/sandbox-server.js\",\n \"executeLocalTask\",\n 464\n ]\n ],\n \"triage\": {\n \"cli-tool/src/sandbox-server.js::checkAndInstallAgent\": \"parameter\",\n \"cli-tool/src/sandbox-server.js::executeLocalTask\": \"request\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: cct-studio-server-cmdi-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=acdb5893412a81eaec9862ee24a4613bf296ab45
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/davila7/claude-code-templates
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: contextforge-prompt-ssti-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_compile_jinja_template\",\n 106\n ],\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_render_template\",\n 2892\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"contextforge-prompt-ssti\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_compile_jinja_template\",\n \"line\": 106,\n \"path\": \"mcpgateway/services/prompt_service.py\"\n },\n {\n \"function\": \"_render_template\",\n \"line\": 2892,\n \"path\": \"mcpgateway/services/prompt_service.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"contextforge-prompt-ssti\",\n \"sites\": [\n \"mcpgateway/services/prompt_service.py::_render_template\",\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_compile_jinja_template\",\n 106\n ],\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_render_template\",\n 2892\n ]\n ],\n \"kept\": [\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_compile_jinja_template\",\n 106\n ],\n [\n \"mcpgateway/services/prompt_service.py\",\n \"_render_template\",\n 2892\n ]\n ],\n \"triage\": {\n \"mcpgateway/services/prompt_service.py::_compile_jinja_template\": \"stored\",\n \"mcpgateway/services/prompt_service.py::_render_template\": \"stored\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: contextforge-prompt-ssti-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=0f8e0ad679f1fff685f486e17f642ac863c8ca9e
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/IBM/mcp-context-forge
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: froxlor-admin-ip-second-order-sqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lib/Froxlor/Api/Commands/Domains.php\",\n \"validateIpAddresses\",\n 1050\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listing\",\n 76\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listingCount\",\n 108\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"froxlor-admin-ip-second-order-sqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"validateIpAddresses\",\n \"line\": 1050,\n \"path\": \"lib/Froxlor/Api/Commands/Domains.php\"\n },\n {\n \"function\": \"listing\",\n \"line\": 76,\n \"path\": \"lib/Froxlor/Api/Commands/IpsAndPorts.php\"\n },\n {\n \"function\": \"listingCount\",\n \"line\": 108,\n \"path\": \"lib/Froxlor/Api/Commands/IpsAndPorts.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"froxlor-admin-ip-second-order-sqli\",\n \"sites\": [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\",\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lib/Froxlor/Api/Commands/Domains.php\",\n \"validateIpAddresses\",\n 1050\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listing\",\n 76\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listingCount\",\n 108\n ]\n ],\n \"kept\": [\n [\n \"lib/Froxlor/Api/Commands/Domains.php\",\n \"validateIpAddresses\",\n 1050\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listing\",\n 76\n ],\n [\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php\",\n \"listingCount\",\n 108\n ]\n ],\n \"triage\": {\n \"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses\": \"parameter\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing\": \"request\",\n \"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount\": \"request\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: froxlor-admin-ip-second-order-sqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=9bf03de643a2edee4642bfc6c94db1f05253da02
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/froxlor/froxlor
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: fuxa-tdengine-escape-sqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/runtime/storage/tdengine/index.js\",\n \"getDaqValue\",\n 89\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"fuxa-tdengine-escape-sqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"getDaqValue\",\n \"line\": 89,\n \"path\": \"server/runtime/storage/tdengine/index.js\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"fuxa-tdengine-escape-sqli\",\n \"sites\": [\n \"server/runtime/storage/tdengine/index.js::getDaqValue\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/runtime/storage/tdengine/index.js\",\n \"getDaqValue\",\n 89\n ]\n ],\n \"kept\": [\n [\n \"server/runtime/storage/tdengine/index.js\",\n \"getDaqValue\",\n 89\n ]\n ],\n \"triage\": {\n \"server/runtime/storage/tdengine/index.js::getDaqValue\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: fuxa-tdengine-escape-sqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=193a888f8e3f805325072829b1644a2c768c948b
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/frangoteam/FUXA
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: lmdeploy-media-url-ssrf-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_load_http_url\",\n \"line\": 68,\n \"path\": \"lmdeploy/vl/media/connection.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\",\n \"sites\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"kept\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"triage\": {\n \"lmdeploy/vl/media/connection.py::_load_http_url\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: lmdeploy-media-url-ssrf-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=71648d239c978452720a6d6692fe914efc8a7b94
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/InternLM/lmdeploy
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: medplum-external-auth-open-redirect-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/auth/external.ts\",\n \"externalCallbackHandler\",\n 166\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"medplum-external-auth-open-redirect\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"externalCallbackHandler\",\n \"line\": 166,\n \"path\": \"packages/server/src/auth/external.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"medplum-external-auth-open-redirect\",\n \"sites\": [\n \"packages/server/src/auth/external.ts::externalCallbackHandler\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"packages/server/src/auth/external.ts\",\n \"externalCallbackHandler\",\n 166\n ]\n ],\n \"kept\": [\n [\n \"packages/server/src/auth/external.ts\",\n \"externalCallbackHandler\",\n 166\n ]\n ],\n \"triage\": {\n \"packages/server/src/auth/external.ts::externalCallbackHandler\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: medplum-external-auth-open-redirect-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=5d4a8654b02aa67c444f96ae1eb5663c09854006
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/medplum/medplum
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,31 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: pgadmin-maintenance-sqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n\
|
||||
\ ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\
|
||||
,\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\",\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"\
|
||||
create_maintenance_job\",\n 222\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"login\",\n \"line\": 169,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"search_ldap_user\",\n \"line\": 288,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"create_restore_point\",\n \"line\": 1881,\n \"path\": \"web/pgadmin/browser/server_groups/servers/__init__.py\"\n },\n {\n \"function\": \"_check_rename_db_or_change_table_space\",\n \"line\": 808,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"_fetch_db_details\",\n \"line\": 831,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 761,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 1061,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"get_sql\"\
|
||||
,\n \"line\": 1107,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"update\",\n \"line\": 936,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 546,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\"\n },\n {\n \"function\": \"_fetch_properties\",\n \"line\": 362,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 412,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"enable_disable\",\n \"line\": 662,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"get_job_args_value\",\n \"line\": 779,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
||||
\n },\n {\n \"function\": \"run_job\",\n \"line\": 746,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 365,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 454,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"sql\",\n \"line\": 492,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 623,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 290,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\"\
|
||||
: \"delete\",\n \"line\": 394,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\": \"get_extension_details\",\n \"line\": 30,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 601,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 464,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\"\n },\n {\n \"function\": \"create_maintenance_job\",\n \"line\": 222,\n \"path\": \"web/pgadmin/tools/maintenance/__init__.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"sites\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_ctypes\",\n 651\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_encodings\",\n\
|
||||
\ 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
||||
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
||||
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"kept\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\
|
||||
,\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
||||
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
||||
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"triage\": {\n \"web/pgadmin/authenticate/ldap.py::login\": \"request\",\n \"web/pgadmin/authenticate/ldap.py::search_ldap_user\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/__init__.py::create_restore_point\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_check_rename_db_or_change_table_space\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_fetch_db_details\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_ctypes\"\
|
||||
: \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_encodings\": \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_sql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::update\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::_fetch_properties\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::enable_disable\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::get_job_args_value\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::run_job\"\
|
||||
: \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::sql\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py::get_extension_details\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py::create\"\
|
||||
: \"request\",\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\": \"request\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: pgadmin-maintenance-sqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=d112dc3b962218efc3613fa727d54f0fc5b1d527
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/pgadmin-org/pgadmin4
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: qwed-sympy-eval-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/qwed_new/core/batch.py\",\n \"_verify_item\",\n 239\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"qwed-sympy-eval\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"_verify_item\",\n \"line\": 239,\n \"path\": \"src/qwed_new/core/batch.py\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"qwed-sympy-eval\",\n \"sites\": [\n \"src/qwed_new/api/main.py::verify_math\",\n \"src/qwed_new/core/batch.py::_verify_item\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/qwed_new/core/batch.py\",\n \"_verify_item\",\n 239\n ]\n ],\n \"kept\": [\n [\n \"src/qwed_new/core/batch.py\",\n \"_verify_item\",\n 239\n ]\n ],\n \"triage\": {\n \"src/qwed_new/core/batch.py::_verify_item\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: qwed-sympy-eval-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=06801f68cbf9c9b5e54cc17f2a61cb2792da7a26
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/QWED-AI/qwed-verification
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: reactpress-findall-column-sqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"findAll\",\n \"line\": 108,\n \"path\": \"server/src/modules/article/article.service.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\",\n \"sites\": [\n \"server/src/modules/article/article.service.ts::findAll\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"kept\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"triage\": {\n \"server/src/modules/article/article.service.ts::findAll\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: reactpress-findall-column-sqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=c3dd10681b3d2b5e224f7ac647b3769557603975
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/fecommunity/reactpress
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: unleash-addon-webhook-ssrf-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/lib/addons/addon.ts\",\n \"fetchRetry\",\n 64\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"unleash-addon-webhook-ssrf\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"fetchRetry\",\n \"line\": 64,\n \"path\": \"src/lib/addons/addon.ts\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"unleash-addon-webhook-ssrf\",\n \"sites\": [\n \"src/lib/addons/addon.ts::fetchRetry\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/lib/addons/addon.ts\",\n \"fetchRetry\",\n 64\n ]\n ],\n \"kept\": [\n [\n \"src/lib/addons/addon.ts\",\n \"fetchRetry\",\n 64\n ]\n ],\n \"triage\": {\n \"src/lib/addons/addon.ts::fetchRetry\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: unleash-addon-webhook-ssrf-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=b9f3217d327f24094b4352130baa30387f85cffe
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/Unleash/unleash
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,18 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: winml-cli-serve-cors-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [],\n \"family\": \"config_secrets\",\n \"id\": \"winml-cli-serve-cors\"\n}\n"
|
||||
- path: functions.json
|
||||
content: '[]
|
||||
|
||||
'
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"config_secrets\",\n \"id\": \"winml-cli-serve-cors\",\n \"sites\": [\n \"src/winml/modelkit/serve/cli_api.py::<global>\",\n \"src/winml/modelkit/serve/app.py::create_app\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"src/winml/modelkit/serve/cli_api.py\",\n \"<global>\",\n 148\n ]\n ],\n \"kept\": [],\n \"triage\": {\n \"src/winml/modelkit/serve/cli_api.py::<global>\": \"constant\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: winml-cli-serve-cors-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=02179d185f0e3ac23518236b5ca1f61fd37ef680
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/microsoft/winml-cli
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-directorist-avatar-ssrf-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"includes/rest-api/functions.php\",\n \"directorist_rest_upload_image_from_url\",\n 115\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-directorist-avatar-ssrf\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"directorist_rest_upload_image_from_url\",\n \"line\": 115,\n \"path\": \"includes/rest-api/functions.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-directorist-avatar-ssrf\",\n \"sites\": [\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"includes/rest-api/functions.php\",\n \"directorist_rest_upload_image_from_url\",\n 115\n ]\n ],\n \"kept\": [\n [\n \"includes/rest-api/functions.php\",\n \"directorist_rest_upload_image_from_url\",\n 115\n ]\n ],\n \"triage\": {\n \"includes/rest-api/functions.php::directorist_rest_upload_image_from_url\": \"parameter\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-directorist-avatar-ssrf-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=77cfc9bc8b453f97ab7e720330706fa4ef056867
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/sovware/directorist
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-gopay-log-filter-sqli-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"admin/views/log.php\",\n \"<global>\",\n 35\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"wp-gopay-log-filter-sqli\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"<global>\",\n \"line\": 35,\n \"path\": \"admin/views/log.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"injection\",\n \"id\": \"wp-gopay-log-filter-sqli\",\n \"sites\": [\n \"admin/views/log.php::<global>\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"admin/views/log.php\",\n \"<global>\",\n 35\n ]\n ],\n \"kept\": [\n [\n \"admin/views/log.php\",\n \"<global>\",\n 35\n ]\n ],\n \"triage\": {\n \"admin/views/log.php::<global>\": \"request\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-gopay-log-filter-sqli-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=626bc8b5f8d33de6eefd921e3a05ed52ac320bcd
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/gopaycommunity/gopay-woocommerce-integration
|
||||
dir: repo
|
||||
depth: 1
|
||||
@@ -0,0 +1,16 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-groundhogg-confirm-redirect-inputs
|
||||
atespace: default
|
||||
spec:
|
||||
files:
|
||||
- path: candidates.json
|
||||
content: "{\n \"candidates\": [\n [\n \"templates/preferences.php\",\n \"<global>\",\n 904\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-groundhogg-confirm-redirect\"\n}\n"
|
||||
- path: functions.json
|
||||
content: "[\n {\n \"function\": \"<global>\",\n \"line\": 904,\n \"path\": \"templates/preferences.php\"\n }\n]\n"
|
||||
- path: case.json
|
||||
content: "{\n \"family\": \"untrusted_destination\",\n \"id\": \"wp-groundhogg-confirm-redirect\",\n \"sites\": [\n \"templates/preferences.php::<global>\"\n ]\n}\n"
|
||||
- path: triage.json
|
||||
content: "{\n \"candidates\": [\n [\n \"templates/preferences.php\",\n \"<global>\",\n 904\n ]\n ],\n \"kept\": [\n [\n \"templates/preferences.php\",\n \"<global>\",\n 904\n ]\n ],\n \"triage\": {\n \"templates/preferences.php::<global>\": \"request\"\n }\n}\n"
|
||||
@@ -0,0 +1,14 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata:
|
||||
name: wp-groundhogg-confirm-redirect-vulnerable
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/git-commits: repo=9472a1dd79d4556c40eece501a61930793f170d3
|
||||
spec:
|
||||
git:
|
||||
- name: repo
|
||||
repo: https://github.com/groundhoggwp/groundhogg
|
||||
dir: repo
|
||||
depth: 1
|
||||
Reference in New Issue
Block a user