From b1c5f36076b7a8c46fbf3b28660a4072e229ad5e Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:55:18 +0200 Subject: [PATCH] feat(pair-corpus-honesty): review tiers on every pair, agent-vfc loads at tier title Tasks 8.1, 7.1 (tests) and the re-scoped 5.3. - pairs.py: review_tier in {seeded, advisory, title, reviewed} with per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/ github advisory, agent-vfc title); reviewer = "pending" means title, a named reviewer means reviewed, reviewed without a reviewer is rejected; per_tier metrics in the payload; select_tier and GATING_TIERS for the improve loop. - catalog_gen.py: stamps review_tier (and reviewer) on every generated row and training manifest row; title rows enter catalog.toml; the catalog-candidates.toml queue is retired; precedence matches the loader. - agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the honest unreviewed baseline); local rows name their reviewer. - Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1 catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- benchmarks/pairs/README.md | 16 +- benchmarks/pairs/agent-vfc/README.md | 3 +- benchmarks/pairs/agent-vfc/REVIEW.md | 2 +- .../agent-vfc/capgo-app-hono-4dadd2/fixed.ts | 2 +- .../agent-vfc/capgo-app-hono-4dadd2/vuln.ts | 2 +- .../pairs/agent-vfc/catalog-candidates.toml | 819 ----------------- benchmarks/pairs/agent-vfc/catalog.toml | 843 ++++++++++++++++++ .../pairs/agent-vfc/training/manifest.jsonl | 58 ++ .../workers-research-utils-209444/fixed.ts | 2 +- .../workers-research-utils-209444/vuln.ts | 2 +- benchmarks/pairs/catalog.toml | 6 + benchmarks/pairs/catalog_gen.py | 53 +- benchmarks/pairs/vfc-js/catalog.toml | 17 + .../pairs/vfc-js/training/manifest.jsonl | 68 +- benchmarks/pairs/vibe-py/catalog.toml | 35 + .../pairs/vibe-py/training/manifest.jsonl | 140 +-- src/openultrasast/pairs.py | 55 +- tests/test_pair_corpus.py | 80 +- 18 files changed, 1236 insertions(+), 967 deletions(-) delete mode 100644 benchmarks/pairs/agent-vfc/catalog-candidates.toml diff --git a/benchmarks/pairs/README.md b/benchmarks/pairs/README.md index 3ca7897..aacea87 100644 --- a/benchmarks/pairs/README.md +++ b/benchmarks/pairs/README.md @@ -53,9 +53,19 @@ Pairs in this directory **must not** join `LANGUAGE_MANIFESTS`. vendored. Honesty dashboard. - **agent-vfc** — security-fix commits carrying an AI agent co-author trailer or generation marker, in JavaScript, TypeScript, or Python - (`benchmarks/pairs/agent-vfc/`). `provenance = "agent"`. Rows enter - `catalog.toml` only after a human sets `reviewer` in `recipes.toml`; until - then they sit in `catalog-candidates.toml`, which is never loaded. Honesty dashboard. + (`benchmarks/pairs/agent-vfc/`). `provenance = "agent"`. Rows with + `reviewer = "pending"` load at `review_tier = "title"` (the review queue) and + never gate the improve loop (task 8.2); a human sets `reviewer` to promote a row to `reviewed`. Honesty dashboard. + +## Review tiers + +Every pair carries `review_tier` (Req 9): `seeded` (ground truth reviewed by the +upstream benchmark), `advisory` (public CVE or GHSA with a fix commit), `title` +(mechanism inferred from a commit message, unreviewed), `reviewed` (a named +`reviewer` in this repository; the loader rejects `reviewed` without one). +Defaults per slice: local `reviewed`, vibe-py `seeded`, sast/vfc/vfc-js/github +`advisory`, agent-vfc `title`. `pairs --json` reports `per_tier`; `evolve.evaluate_profiles` scores only `seeded` +and `reviewed` pairs, so `advisory` and `title` pairs never gate the improve loop (task 8.2). ## Labels, profiles, and mechanisms diff --git a/benchmarks/pairs/agent-vfc/README.md b/benchmarks/pairs/agent-vfc/README.md index 4487749..43b6ac4 100644 --- a/benchmarks/pairs/agent-vfc/README.md +++ b/benchmarks/pairs/agent-vfc/README.md @@ -6,7 +6,8 @@ Security-fix commits carrying an AI coding agent co-author trailer or generation ## Review checklist (Req 5.3) -A recipe with `reviewer = "pending"` is a candidate, not a label. Before setting `reviewer`: +A recipe with `reviewer = "pending"` loads at `review_tier = "title"`: scored and reported by `pairs`; the improve loop's +profile gate uses only `seeded` and `reviewed` pairs (Req 9.3, task 8.2). Setting `reviewer` to your name promotes it to `reviewed`. Before doing so: 1. The parent excerpt really contains the vulnerability the title claims (not a refactor). 2. One mechanism from `benchmarks/pairs/mechanisms.toml` explains it; adjust `mechanism` and `cwe`. diff --git a/benchmarks/pairs/agent-vfc/REVIEW.md b/benchmarks/pairs/agent-vfc/REVIEW.md index f72861e..804cc02 100644 --- a/benchmarks/pairs/agent-vfc/REVIEW.md +++ b/benchmarks/pairs/agent-vfc/REVIEW.md @@ -1,6 +1,6 @@ # agent-vfc candidate review sheet -Set `reviewer = ""` in `recipes.toml` for each row you confirm (and fix `mechanism`/`cwe` if the title-based guess is wrong), then run `python benchmarks/pairs/catalog_gen.py --slice agent-vfc`. Rows without a reviewer stay in `catalog-candidates.toml` and are never scored. +Set `reviewer = ""` in `recipes.toml` for each row you confirm (and fix `mechanism`/`cwe` if the title-based guess is wrong), then run `python benchmarks/pairs/catalog_gen.py --slice agent-vfc`. Rows with `reviewer = "pending"` load at `review_tier = "title"`: they are scored and reported by `pairs --slice agent-vfc`, and never gate the improve loop (Req 9.3/9.4); a named reviewer promotes a row to `reviewed`. | # | name | mechanism (guess) | cwe | language | commit | title | |---|------|-------------------|-----|----------|--------|-------| diff --git a/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/fixed.ts b/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/fixed.ts index 7445b2a..80b188d 100644 --- a/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/fixed.ts +++ b/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/fixed.ts @@ -5,7 +5,7 @@ // commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59 // cve: // license: AGPL-3.0 -// function: next +// function: createHono // relpath: supabase/functions/_backend/utils/hono.ts // provenance: agent // mechanism: permissive_default diff --git a/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/vuln.ts b/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/vuln.ts index bc40328..8707dd5 100644 --- a/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/vuln.ts +++ b/benchmarks/pairs/agent-vfc/capgo-app-hono-4dadd2/vuln.ts @@ -5,7 +5,7 @@ // commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59 // cve: // license: AGPL-3.0 -// function: next +// function: createHono // relpath: supabase/functions/_backend/utils/hono.ts // provenance: agent // mechanism: permissive_default diff --git a/benchmarks/pairs/agent-vfc/catalog-candidates.toml b/benchmarks/pairs/agent-vfc/catalog-candidates.toml deleted file mode 100644 index d2649ab..0000000 --- a/benchmarks/pairs/agent-vfc/catalog-candidates.toml +++ /dev/null @@ -1,819 +0,0 @@ -# CANDIDATES awaiting human review (reviewer = "pending"). Not loaded by load_pair_catalog. -# Set `reviewer` in recipes.toml after confirming vulnerability, mechanism, and license; then regenerate. - -# agent-vfc pair slice. Reviewed isolated functions with provenance. -# Honesty dashboard — not the local 100% CI gate. -# Do not add these names to LANGUAGE_MANIFESTS. -# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml. - -[[pair]] -name = "anastasios-pw-session-14ec1a" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "Anas329796/Anastasios" -cve = "" -cwe = "CWE-918" -commit = "14ec1ac50f9e4e255d875236d30129c6207401d4" -parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb" -commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4" -vuln = "anastasios-pw-session-14ec1a/vuln.ts" -fixed = "anastasios-pw-session-14ec1a/fixed.ts" -relpath = "extensions/browser/src/browser/pw-session.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-918" -class = "server-side request forgery" -path = "extensions/browser/src/browser/pw-session.ts" -function = "isTopLevelNavigationRequest" -mechanism = "source_reaches_sink" -evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" - -[[pair]] -name = "astroclaw-pw-session-1553a8" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "P1R4N351/astroclaw" -cve = "" -cwe = "CWE-918" -commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b" -parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4" -commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b" -vuln = "astroclaw-pw-session-1553a8/vuln.ts" -fixed = "astroclaw-pw-session-1553a8/fixed.ts" -relpath = "extensions/browser/src/browser/pw-session.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-918" -class = "server-side request forgery" -path = "extensions/browser/src/browser/pw-session.ts" -function = "isTopLevelNavigationRequest" -mechanism = "source_reaches_sink" -evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" - -[[pair]] -name = "capgo-app-hono-4dadd2" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "AGPL-3.0" -repo = "Cap-go/capgo.app" -cve = "" -cwe = "CWE-16" -commit = "4dadd2580d02213d227a331eee0232aa59859b59" -parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899" -commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59" -vuln = "capgo-app-hono-4dadd2/vuln.ts" -fixed = "capgo-app-hono-4dadd2/fixed.ts" -relpath = "supabase/functions/_backend/utils/hono.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "supabase/functions/_backend/utils/hono.ts" -function = "next" -mechanism = "permissive_default" -evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)" - -[[pair]] -name = "dnf-plugin-anyrepo-config-26d19a" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "Apache-2.0" -repo = "jfut/dnf-plugin-anyrepo" -cve = "" -cwe = "CWE-22" -commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0" -parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a" -commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0" -vuln = "dnf-plugin-anyrepo-config-26d19a/vuln.py" -fixed = "dnf-plugin-anyrepo-config-26d19a/fixed.py" -relpath = "dnf_plugin_anyrepo/config.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-22" -class = "path traversal" -path = "dnf_plugin_anyrepo/config.py" -function = "validate_repo_name" -mechanism = "path_join_user_input" -evidence = "fix(config): prevent path traversal in repository names" - -[[pair]] -name = "edutrace-page-ee7ba2" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "Apache-2.0" -repo = "jardimdesoftware/edutrace" -cve = "" -cwe = "CWE-1321" -commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739" -parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd" -commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739" -vuln = "edutrace-page-ee7ba2/vuln.tsx" -fixed = "edutrace-page-ee7ba2/fixed.tsx" -relpath = "front/src/app/editar-anamnese/page.tsx" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "front/src/app/editar-anamnese/page.tsx" -function = "handleInputChange" -mechanism = "prototype_pollution" -evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado" - -[[pair]] -name = "etude-lexical-markdown-editorconfig-c61a8b" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "dayflower/etude-lexical-markdown" -cve = "" -cwe = "CWE-1321" -commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed" -parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5" -commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed" -vuln = "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts" -fixed = "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts" -relpath = "src/config/editorConfig.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "src/config/editorConfig.ts" -function = "deepMergeInto" -mechanism = "prototype_pollution" -evidence = "fix: guard deepMergeInto against prototype pollution" - -[[pair]] -name = "etude-lexical-markdown-editorconfig-db4f54" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "dayflower/etude-lexical-markdown" -cve = "" -cwe = "CWE-1321" -commit = "db4f54b1ab80ad596de6425e84f90aa781c49999" -parent = "1c865815d05b072f4973388c3ac66b6696d9efde" -commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999" -vuln = "etude-lexical-markdown-editorconfig-db4f54/vuln.ts" -fixed = "etude-lexical-markdown-editorconfig-db4f54/fixed.ts" -relpath = "src/config/editorConfig.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "src/config/editorConfig.ts" -function = "deepMergeInto" -mechanism = "prototype_pollution" -evidence = "fix: make prototype pollution guard recognizable by CodeQL" - -[[pair]] -name = "lensops-kubernetesmanagement-fe4910" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "amitknigam84/lensops" -cve = "" -cwe = "CWE-862" -commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84" -parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748" -commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84" -vuln = "lensops-kubernetesmanagement-fe4910/vuln.tsx" -fixed = "lensops-kubernetesmanagement-fe4910/fixed.tsx" -relpath = "components/KubernetesManagement.tsx" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-862" -class = "missing authorization" -path = "components/KubernetesManagement.tsx" -function = "setErrorMessage" -mechanism = "missing_auth_guard" -evidence = "Fix missing auth header on namespaces API call" - -[[pair]] -name = "market-cap-route-4f8ae9" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "navaneethbv/market-cap" -cve = "" -cwe = "CWE-601" -commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6" -parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602" -commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6" -vuln = "market-cap-route-4f8ae9/vuln.ts" -fixed = "market-cap-route-4f8ae9/fixed.ts" -relpath = "app/auth/confirm/route.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-601" -class = "open redirect" -path = "app/auth/confirm/route.ts" -function = "GET" -mechanism = "source_reaches_sink" -evidence = "Fix open redirects on the auth next param" - -[[pair]] -name = "melodix-playerprovider-089931" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "alexshao3/melodix" -cve = "" -cwe = "CWE-16" -commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13" -parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7" -commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13" -vuln = "melodix-playerprovider-089931/vuln.tsx" -fixed = "melodix-playerprovider-089931/fixed.tsx" -relpath = "apps/miniapp/src/components/PlayerProvider.tsx" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "apps/miniapp/src/components/PlayerProvider.tsx" -function = "PlayerProvider" -mechanism = "permissive_default" -evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors" - -[[pair]] -name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "handielson/Mercado-do-vale-news" -cve = "" -cwe = "CWE-16" -commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598" -parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc" -commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598" -vuln = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts" -fixed = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts" -relpath = "services/catalogMetadataService.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "services/catalogMetadataService.ts" -function = "fetchMetadata" -mechanism = "permissive_default" -evidence = "fix(catalog): avoid metadata cors preflight" - -[[pair]] -name = "money-track-category-icons-4d4a5b" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "andrebubniak/money-track" -cve = "" -cwe = "CWE-1321" -commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0" -parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2" -commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0" -vuln = "money-track-category-icons-4d4a5b/vuln.ts" -fixed = "money-track-category-icons-4d4a5b/fixed.ts" -relpath = "src/lib/category-icons.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "src/lib/category-icons.ts" -function = "isCategoryIcon" -mechanism = "prototype_pollution" -evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard" - -[[pair]] -name = "nestjs-filter-normalizer-aa0e60" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "DavideCarvalho/nestjs-filter" -cve = "" -cwe = "CWE-1321" -commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8" -parent = "d899b40d3466f2ffbe9f01c4d49267412401f078" -commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8" -vuln = "nestjs-filter-normalizer-aa0e60/vuln.ts" -fixed = "nestjs-filter-normalizer-aa0e60/fixed.ts" -relpath = "packages/core/src/input/normalizer.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "packages/core/src/input/normalizer.ts" -function = "normalizeInput" -mechanism = "prototype_pollution" -evidence = "fix(core): add prototype pollution guard to normalizeInput" - -[[pair]] -name = "new-erp-final-app-6e9644" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "Apache-2.0" -repo = "Sachin-Salgar/NEW_ERP_FINAL" -cve = "" -cwe = "CWE-16" -commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59" -parent = "08976c5d7a07b0663669b875b4507446199f85d7" -commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59" -vuln = "new-erp-final-app-6e9644/vuln.ts" -fixed = "new-erp-final-app-6e9644/fixed.ts" -relpath = "src/presentation/http/app.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "src/presentation/http/app.ts" -function = "origin" -mechanism = "permissive_default" -evidence = "fix: allow patch requests through cors" - -[[pair]] -name = "nimestream-route-d17f53" -slice = "agent-vfc" -language = "javascript" -origin = "github-agent-trailer" -license = "MIT" -repo = "Irnhakim/nimestream" -cve = "" -cwe = "CWE-918" -commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43" -parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0" -commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43" -vuln = "nimestream-route-d17f53/vuln.js" -fixed = "nimestream-route-d17f53/fixed.js" -relpath = "app/api/img/route.js" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-918" -class = "server-side request forgery" -path = "app/api/img/route.js" -function = "GET" -mechanism = "source_reaches_sink" -evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API" - -[[pair]] -name = "openniw-jobs-0fc947" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "MIT" -repo = "HHHHHejia/openniw" -cve = "" -cwe = "CWE-639" -commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10" -parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc" -commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10" -vuln = "openniw-jobs-0fc947/vuln.py" -fixed = "openniw-jobs-0fc947/fixed.py" -relpath = "backend/app/routers/jobs.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-639" -class = "insecure direct object reference" -path = "backend/app/routers/jobs.py" -function = "get_job" -mechanism = "identity_from_request_body" -evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership" - -[[pair]] -name = "openniw-jobs-b74de3" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "MIT" -repo = "ziyuzuo/openniw" -cve = "" -cwe = "CWE-639" -commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68" -parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e" -commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68" -vuln = "openniw-jobs-b74de3/vuln.py" -fixed = "openniw-jobs-b74de3/fixed.py" -relpath = "backend/app/routers/jobs.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-639" -class = "insecure direct object reference" -path = "backend/app/routers/jobs.py" -function = "get_job" -mechanism = "identity_from_request_body" -evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership" - -[[pair]] -name = "overleaf-with-claude-exportscontroller-3980b9" -slice = "agent-vfc" -language = "javascript" -origin = "github-agent-trailer" -license = "AGPL-3.0" -repo = "ZUENS2020/overleaf-with-claude" -cve = "" -cwe = "CWE-639" -commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431" -parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed" -commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431" -vuln = "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs" -fixed = "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs" -relpath = "services/web/app/src/Features/Exports/ExportsController.mjs" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-639" -class = "insecure direct object reference" -path = "services/web/app/src/Features/Exports/ExportsController.mjs" -function = "exportProject" -mechanism = "identity_from_request_body" -evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)" - -[[pair]] -name = "popmark-editorconfig-e5ac40" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "dayflower/popmark" -cve = "" -cwe = "CWE-1321" -commit = "e5ac407cef37c37178d440541ede301c838640fb" -parent = "31d1ac79b4cfa3118597348e79800a6561115149" -commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb" -vuln = "popmark-editorconfig-e5ac40/vuln.ts" -fixed = "popmark-editorconfig-e5ac40/fixed.ts" -relpath = "src/lexical-markdown/config/editorConfig.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "src/lexical-markdown/config/editorConfig.ts" -function = "deepMergeInto" -mechanism = "prototype_pollution" -evidence = "fix: guard deepMergeInto against prototype pollution" - -[[pair]] -name = "rag-pipeline-utils-config-handler-76e5f0" -slice = "agent-vfc" -language = "javascript" -origin = "github-agent-trailer" -license = "MIT" -repo = "DevilsDev/rag-pipeline-utils" -cve = "" -cwe = "CWE-1321" -commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7" -parent = "ba587867118f703632ff2dc63c4feb8ad6793420" -commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7" -vuln = "rag-pipeline-utils-config-handler-76e5f0/vuln.js" -fixed = "rag-pipeline-utils-config-handler-76e5f0/fixed.js" -relpath = "src/cli/handlers/config-handler.js" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-1321" -class = "prototype pollution" -path = "src/cli/handlers/config-handler.js" -function = "handleConfigSet" -mechanism = "prototype_pollution" -evidence = "fix(security): prevent prototype pollution in config-handler" - -[[pair]] -name = "registry-proxy-worker-426847" -slice = "agent-vfc" -language = "javascript" -origin = "github-agent-trailer" -license = "MIT" -repo = "agents-repo/registry-proxy" -cve = "" -cwe = "CWE-16" -commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8" -parent = "6d5937972510cdb5ebca30607b538fdc2e280094" -commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8" -vuln = "registry-proxy-worker-426847/vuln.js" -fixed = "registry-proxy-worker-426847/fixed.js" -relpath = "src/worker.js" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "src/worker.js" -function = "buildUpstreamRequest" -mechanism = "permissive_default" -evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)" - -[[pair]] -name = "supplieradvisor-mvp-route-387bcf" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "bigfivefoods/supplieradvisor-mvp" -cve = "" -cwe = "CWE-639" -commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8" -parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b" -commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8" -vuln = "supplieradvisor-mvp-route-387bcf/vuln.ts" -fixed = "supplieradvisor-mvp-route-387bcf/fixed.ts" -relpath = "app/api/customers/claims/route.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-639" -class = "insecure direct object reference" -path = "app/api/customers/claims/route.ts" -function = "PATCH" -mechanism = "identity_from_request_body" -evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)" - -[[pair]] -name = "supplieradvisor-mvp-route-a69e8f" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "bigfivefoods/supplieradvisor-mvp" -cve = "" -cwe = "CWE-639" -commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1" -parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c" -commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1" -vuln = "supplieradvisor-mvp-route-a69e8f/vuln.ts" -fixed = "supplieradvisor-mvp-route-a69e8f/fixed.ts" -relpath = "app/api/customers/opportunities/route.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-639" -class = "insecure direct object reference" -path = "app/api/customers/opportunities/route.ts" -function = "GET" -mechanism = "identity_from_request_body" -evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)" - -[[pair]] -name = "tools-cli-tools-a96bc0" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "MIT" -repo = "D-sorganization/Tools" -cve = "" -cwe = "CWE-78" -commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a" -parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864" -commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a" -vuln = "tools-cli-tools-a96bc0/vuln.py" -fixed = "tools-cli-tools-a96bc0/fixed.py" -relpath = "src/shared/python/ai/tools/cli_tools.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-78" -class = "command injection" -path = "src/shared/python/ai/tools/cli_tools.py" -function = "_is_command_allowed" -mechanism = "source_reaches_sink" -evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)" - -[[pair]] -name = "trackly-cli-path-diagnostics-1c1aed" -slice = "agent-vfc" -language = "javascript" -origin = "github-agent-trailer" -license = "MIT" -repo = "trackly-app/trackly-cli" -cve = "" -cwe = "CWE-22" -commit = "1c1aed89b07edb04051830c8f086e02b65e961c6" -parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60" -commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6" -vuln = "trackly-cli-path-diagnostics-1c1aed/vuln.js" -fixed = "trackly-cli-path-diagnostics-1c1aed/fixed.js" -relpath = "lib/path-diagnostics.js" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-22" -class = "path traversal" -path = "lib/path-diagnostics.js" -function = "inspectExistingAncestor" -mechanism = "path_join_user_input" -evidence = "fix(apply): report blocked path traversal" - -[[pair]] -name = "upstreamdrift-local-server-c3a078" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "MIT" -repo = "D-sorganization/UpstreamDrift" -cve = "" -cwe = "CWE-22" -commit = "c3a0787080489b30e2ed0abfac03b51e45da184b" -parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc" -commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b" -vuln = "upstreamdrift-local-server-c3a078/vuln.py" -fixed = "upstreamdrift-local-server-c3a078/fixed.py" -relpath = "src/api/local_server.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-22" -class = "path traversal" -path = "src/api/local_server.py" -function = "_find_logo_file" -mechanism = "path_join_user_input" -evidence = "fix(api): harden local server path traversal (#2805) (#2839)" - -[[pair]] -name = "waggledance-swarm-ssrf-host-guard-9a4548" -slice = "agent-vfc" -language = "python" -origin = "github-agent-trailer" -license = "Apache-2.0" -repo = "Ahkeratmehilaiset/waggledance-swarm" -cve = "" -cwe = "CWE-918" -commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b" -parent = "934b939f1cca5259eaf807db3319eb97b90d8d80" -commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b" -vuln = "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py" -fixed = "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py" -relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-918" -class = "server-side request forgery" -path = "waggledance/core/v3_13_0/ssrf_host_guard.py" -function = "normalize_allowed_hosts" -mechanism = "source_reaches_sink" -evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)" - -[[pair]] -name = "workers-research-utils-209444" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "G4brym/workers-research" -cve = "" -cwe = "CWE-89" -commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e" -parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4" -commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e" -vuln = "workers-research-utils-209444/vuln.ts" -fixed = "workers-research-utils-209444/fixed.ts" -relpath = "src/utils.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "holdout" - -[[pair.expected]] -cwe = "CWE-89" -class = "sql injection" -path = "src/utils.ts" -function = "formatDuration" -mechanism = "source_reaches_sink" -evidence = "Fix SQL injection in search by using parameterized queries (#41)" - -[[pair]] -name = "zoonk-origin-bfbf67" -slice = "agent-vfc" -language = "typescript" -origin = "github-agent-trailer" -license = "MIT" -repo = "zoonk/zoonk" -cve = "" -cwe = "CWE-16" -commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31" -parent = "2604269350bff51f58572c133b45010cb0976a5a" -commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31" -vuln = "zoonk-origin-bfbf67/vuln.ts" -fixed = "zoonk-origin-bfbf67/fixed.ts" -relpath = "packages/utils/src/origin.ts" -min_recall = 1.0 -fix_policy = "silent" -provenance = "agent" -split = "train" - -[[pair.expected]] -cwe = "CWE-16" -class = "permissive default" -path = "packages/utils/src/origin.ts" -function = "getAllowedHosts" -mechanism = "permissive_default" -evidence = "fix(api): allow staging cors from previews (#1559)" diff --git a/benchmarks/pairs/agent-vfc/catalog.toml b/benchmarks/pairs/agent-vfc/catalog.toml index 25c3a47..5e7717b 100644 --- a/benchmarks/pairs/agent-vfc/catalog.toml +++ b/benchmarks/pairs/agent-vfc/catalog.toml @@ -2,3 +2,846 @@ # Honesty dashboard — not the local 100% CI gate. # Do not add these names to LANGUAGE_MANIFESTS. # Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml. + +[[pair]] +name = "anastasios-pw-session-14ec1a" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "Anas329796/Anastasios" +cve = "" +cwe = "CWE-918" +commit = "14ec1ac50f9e4e255d875236d30129c6207401d4" +parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb" +commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4" +vuln = "anastasios-pw-session-14ec1a/vuln.ts" +fixed = "anastasios-pw-session-14ec1a/fixed.ts" +relpath = "extensions/browser/src/browser/pw-session.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-918" +class = "server-side request forgery" +path = "extensions/browser/src/browser/pw-session.ts" +function = "isTopLevelNavigationRequest" +mechanism = "source_reaches_sink" +evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" + +[[pair]] +name = "astroclaw-pw-session-1553a8" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "P1R4N351/astroclaw" +cve = "" +cwe = "CWE-918" +commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b" +parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4" +commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b" +vuln = "astroclaw-pw-session-1553a8/vuln.ts" +fixed = "astroclaw-pw-session-1553a8/fixed.ts" +relpath = "extensions/browser/src/browser/pw-session.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-918" +class = "server-side request forgery" +path = "extensions/browser/src/browser/pw-session.ts" +function = "isTopLevelNavigationRequest" +mechanism = "source_reaches_sink" +evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" + +[[pair]] +name = "capgo-app-hono-4dadd2" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "AGPL-3.0" +repo = "Cap-go/capgo.app" +cve = "" +cwe = "CWE-16" +commit = "4dadd2580d02213d227a331eee0232aa59859b59" +parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899" +commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59" +vuln = "capgo-app-hono-4dadd2/vuln.ts" +fixed = "capgo-app-hono-4dadd2/fixed.ts" +relpath = "supabase/functions/_backend/utils/hono.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "supabase/functions/_backend/utils/hono.ts" +function = "createHono" +mechanism = "permissive_default" +evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)" + +[[pair]] +name = "dnf-plugin-anyrepo-config-26d19a" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "Apache-2.0" +repo = "jfut/dnf-plugin-anyrepo" +cve = "" +cwe = "CWE-22" +commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0" +parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a" +commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0" +vuln = "dnf-plugin-anyrepo-config-26d19a/vuln.py" +fixed = "dnf-plugin-anyrepo-config-26d19a/fixed.py" +relpath = "dnf_plugin_anyrepo/config.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "dnf_plugin_anyrepo/config.py" +function = "validate_repo_name" +mechanism = "path_join_user_input" +evidence = "fix(config): prevent path traversal in repository names" + +[[pair]] +name = "edutrace-page-ee7ba2" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "Apache-2.0" +repo = "jardimdesoftware/edutrace" +cve = "" +cwe = "CWE-1321" +commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739" +parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd" +commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739" +vuln = "edutrace-page-ee7ba2/vuln.tsx" +fixed = "edutrace-page-ee7ba2/fixed.tsx" +relpath = "front/src/app/editar-anamnese/page.tsx" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "front/src/app/editar-anamnese/page.tsx" +function = "handleInputChange" +mechanism = "prototype_pollution" +evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado" + +[[pair]] +name = "etude-lexical-markdown-editorconfig-c61a8b" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "dayflower/etude-lexical-markdown" +cve = "" +cwe = "CWE-1321" +commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed" +parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5" +commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed" +vuln = "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts" +fixed = "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts" +relpath = "src/config/editorConfig.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "src/config/editorConfig.ts" +function = "deepMergeInto" +mechanism = "prototype_pollution" +evidence = "fix: guard deepMergeInto against prototype pollution" + +[[pair]] +name = "etude-lexical-markdown-editorconfig-db4f54" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "dayflower/etude-lexical-markdown" +cve = "" +cwe = "CWE-1321" +commit = "db4f54b1ab80ad596de6425e84f90aa781c49999" +parent = "1c865815d05b072f4973388c3ac66b6696d9efde" +commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999" +vuln = "etude-lexical-markdown-editorconfig-db4f54/vuln.ts" +fixed = "etude-lexical-markdown-editorconfig-db4f54/fixed.ts" +relpath = "src/config/editorConfig.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "src/config/editorConfig.ts" +function = "deepMergeInto" +mechanism = "prototype_pollution" +evidence = "fix: make prototype pollution guard recognizable by CodeQL" + +[[pair]] +name = "lensops-kubernetesmanagement-fe4910" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "amitknigam84/lensops" +cve = "" +cwe = "CWE-862" +commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84" +parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748" +commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84" +vuln = "lensops-kubernetesmanagement-fe4910/vuln.tsx" +fixed = "lensops-kubernetesmanagement-fe4910/fixed.tsx" +relpath = "components/KubernetesManagement.tsx" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-862" +class = "missing authorization" +path = "components/KubernetesManagement.tsx" +function = "setErrorMessage" +mechanism = "missing_auth_guard" +evidence = "Fix missing auth header on namespaces API call" + +[[pair]] +name = "market-cap-route-4f8ae9" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "navaneethbv/market-cap" +cve = "" +cwe = "CWE-601" +commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6" +parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602" +commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6" +vuln = "market-cap-route-4f8ae9/vuln.ts" +fixed = "market-cap-route-4f8ae9/fixed.ts" +relpath = "app/auth/confirm/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "app/auth/confirm/route.ts" +function = "GET" +mechanism = "source_reaches_sink" +evidence = "Fix open redirects on the auth next param" + +[[pair]] +name = "melodix-playerprovider-089931" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "alexshao3/melodix" +cve = "" +cwe = "CWE-16" +commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13" +parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7" +commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13" +vuln = "melodix-playerprovider-089931/vuln.tsx" +fixed = "melodix-playerprovider-089931/fixed.tsx" +relpath = "apps/miniapp/src/components/PlayerProvider.tsx" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "apps/miniapp/src/components/PlayerProvider.tsx" +function = "PlayerProvider" +mechanism = "permissive_default" +evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors" + +[[pair]] +name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "handielson/Mercado-do-vale-news" +cve = "" +cwe = "CWE-16" +commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598" +parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc" +commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598" +vuln = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts" +fixed = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts" +relpath = "services/catalogMetadataService.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "services/catalogMetadataService.ts" +function = "fetchMetadata" +mechanism = "permissive_default" +evidence = "fix(catalog): avoid metadata cors preflight" + +[[pair]] +name = "money-track-category-icons-4d4a5b" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "andrebubniak/money-track" +cve = "" +cwe = "CWE-1321" +commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0" +parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2" +commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0" +vuln = "money-track-category-icons-4d4a5b/vuln.ts" +fixed = "money-track-category-icons-4d4a5b/fixed.ts" +relpath = "src/lib/category-icons.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "src/lib/category-icons.ts" +function = "isCategoryIcon" +mechanism = "prototype_pollution" +evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard" + +[[pair]] +name = "nestjs-filter-normalizer-aa0e60" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "DavideCarvalho/nestjs-filter" +cve = "" +cwe = "CWE-1321" +commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8" +parent = "d899b40d3466f2ffbe9f01c4d49267412401f078" +commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8" +vuln = "nestjs-filter-normalizer-aa0e60/vuln.ts" +fixed = "nestjs-filter-normalizer-aa0e60/fixed.ts" +relpath = "packages/core/src/input/normalizer.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "packages/core/src/input/normalizer.ts" +function = "normalizeInput" +mechanism = "prototype_pollution" +evidence = "fix(core): add prototype pollution guard to normalizeInput" + +[[pair]] +name = "new-erp-final-app-6e9644" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "Apache-2.0" +repo = "Sachin-Salgar/NEW_ERP_FINAL" +cve = "" +cwe = "CWE-16" +commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59" +parent = "08976c5d7a07b0663669b875b4507446199f85d7" +commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59" +vuln = "new-erp-final-app-6e9644/vuln.ts" +fixed = "new-erp-final-app-6e9644/fixed.ts" +relpath = "src/presentation/http/app.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "src/presentation/http/app.ts" +function = "origin" +mechanism = "permissive_default" +evidence = "fix: allow patch requests through cors" + +[[pair]] +name = "nimestream-route-d17f53" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "MIT" +repo = "Irnhakim/nimestream" +cve = "" +cwe = "CWE-918" +commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43" +parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0" +commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43" +vuln = "nimestream-route-d17f53/vuln.js" +fixed = "nimestream-route-d17f53/fixed.js" +relpath = "app/api/img/route.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-918" +class = "server-side request forgery" +path = "app/api/img/route.js" +function = "GET" +mechanism = "source_reaches_sink" +evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API" + +[[pair]] +name = "openniw-jobs-0fc947" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "MIT" +repo = "HHHHHejia/openniw" +cve = "" +cwe = "CWE-639" +commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10" +parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc" +commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10" +vuln = "openniw-jobs-0fc947/vuln.py" +fixed = "openniw-jobs-0fc947/fixed.py" +relpath = "backend/app/routers/jobs.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "backend/app/routers/jobs.py" +function = "get_job" +mechanism = "identity_from_request_body" +evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership" + +[[pair]] +name = "openniw-jobs-b74de3" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "MIT" +repo = "ziyuzuo/openniw" +cve = "" +cwe = "CWE-639" +commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68" +parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e" +commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68" +vuln = "openniw-jobs-b74de3/vuln.py" +fixed = "openniw-jobs-b74de3/fixed.py" +relpath = "backend/app/routers/jobs.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "backend/app/routers/jobs.py" +function = "get_job" +mechanism = "identity_from_request_body" +evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership" + +[[pair]] +name = "overleaf-with-claude-exportscontroller-3980b9" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "AGPL-3.0" +repo = "ZUENS2020/overleaf-with-claude" +cve = "" +cwe = "CWE-639" +commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431" +parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed" +commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431" +vuln = "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs" +fixed = "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs" +relpath = "services/web/app/src/Features/Exports/ExportsController.mjs" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "services/web/app/src/Features/Exports/ExportsController.mjs" +function = "exportProject" +mechanism = "identity_from_request_body" +evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)" + +[[pair]] +name = "popmark-editorconfig-e5ac40" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "dayflower/popmark" +cve = "" +cwe = "CWE-1321" +commit = "e5ac407cef37c37178d440541ede301c838640fb" +parent = "31d1ac79b4cfa3118597348e79800a6561115149" +commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb" +vuln = "popmark-editorconfig-e5ac40/vuln.ts" +fixed = "popmark-editorconfig-e5ac40/fixed.ts" +relpath = "src/lexical-markdown/config/editorConfig.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "src/lexical-markdown/config/editorConfig.ts" +function = "deepMergeInto" +mechanism = "prototype_pollution" +evidence = "fix: guard deepMergeInto against prototype pollution" + +[[pair]] +name = "rag-pipeline-utils-config-handler-76e5f0" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "MIT" +repo = "DevilsDev/rag-pipeline-utils" +cve = "" +cwe = "CWE-1321" +commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7" +parent = "ba587867118f703632ff2dc63c4feb8ad6793420" +commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7" +vuln = "rag-pipeline-utils-config-handler-76e5f0/vuln.js" +fixed = "rag-pipeline-utils-config-handler-76e5f0/fixed.js" +relpath = "src/cli/handlers/config-handler.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-1321" +class = "prototype pollution" +path = "src/cli/handlers/config-handler.js" +function = "handleConfigSet" +mechanism = "prototype_pollution" +sink = "path" +evidence = "fix(security): prevent prototype pollution in config-handler" + +[[pair]] +name = "registry-proxy-worker-426847" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "MIT" +repo = "agents-repo/registry-proxy" +cve = "" +cwe = "CWE-16" +commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8" +parent = "6d5937972510cdb5ebca30607b538fdc2e280094" +commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8" +vuln = "registry-proxy-worker-426847/vuln.js" +fixed = "registry-proxy-worker-426847/fixed.js" +relpath = "src/worker.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "src/worker.js" +function = "buildUpstreamRequest" +mechanism = "permissive_default" +evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)" + +[[pair]] +name = "supplieradvisor-mvp-route-387bcf" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "bigfivefoods/supplieradvisor-mvp" +cve = "" +cwe = "CWE-639" +commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8" +parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b" +commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8" +vuln = "supplieradvisor-mvp-route-387bcf/vuln.ts" +fixed = "supplieradvisor-mvp-route-387bcf/fixed.ts" +relpath = "app/api/customers/claims/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "app/api/customers/claims/route.ts" +function = "PATCH" +mechanism = "identity_from_request_body" +evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)" + +[[pair]] +name = "supplieradvisor-mvp-route-a69e8f" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "bigfivefoods/supplieradvisor-mvp" +cve = "" +cwe = "CWE-639" +commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1" +parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c" +commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1" +vuln = "supplieradvisor-mvp-route-a69e8f/vuln.ts" +fixed = "supplieradvisor-mvp-route-a69e8f/fixed.ts" +relpath = "app/api/customers/opportunities/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "app/api/customers/opportunities/route.ts" +function = "GET" +mechanism = "identity_from_request_body" +sink = "path" +evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)" + +[[pair]] +name = "tools-cli-tools-a96bc0" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "MIT" +repo = "D-sorganization/Tools" +cve = "" +cwe = "CWE-78" +commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a" +parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864" +commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a" +vuln = "tools-cli-tools-a96bc0/vuln.py" +fixed = "tools-cli-tools-a96bc0/fixed.py" +relpath = "src/shared/python/ai/tools/cli_tools.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-78" +class = "command injection" +path = "src/shared/python/ai/tools/cli_tools.py" +function = "_is_command_allowed" +mechanism = "source_reaches_sink" +evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)" + +[[pair]] +name = "trackly-cli-path-diagnostics-1c1aed" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "MIT" +repo = "trackly-app/trackly-cli" +cve = "" +cwe = "CWE-22" +commit = "1c1aed89b07edb04051830c8f086e02b65e961c6" +parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60" +commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6" +vuln = "trackly-cli-path-diagnostics-1c1aed/vuln.js" +fixed = "trackly-cli-path-diagnostics-1c1aed/fixed.js" +relpath = "lib/path-diagnostics.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "lib/path-diagnostics.js" +function = "inspectExistingAncestor" +mechanism = "path_join_user_input" +evidence = "fix(apply): report blocked path traversal" + +[[pair]] +name = "upstreamdrift-local-server-c3a078" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "MIT" +repo = "D-sorganization/UpstreamDrift" +cve = "" +cwe = "CWE-22" +commit = "c3a0787080489b30e2ed0abfac03b51e45da184b" +parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc" +commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b" +vuln = "upstreamdrift-local-server-c3a078/vuln.py" +fixed = "upstreamdrift-local-server-c3a078/fixed.py" +relpath = "src/api/local_server.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "src/api/local_server.py" +function = "_find_logo_file" +mechanism = "path_join_user_input" +evidence = "fix(api): harden local server path traversal (#2805) (#2839)" + +[[pair]] +name = "waggledance-swarm-ssrf-host-guard-9a4548" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "Apache-2.0" +repo = "Ahkeratmehilaiset/waggledance-swarm" +cve = "" +cwe = "CWE-918" +commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b" +parent = "934b939f1cca5259eaf807db3319eb97b90d8d80" +commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b" +vuln = "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py" +fixed = "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py" +relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-918" +class = "server-side request forgery" +path = "waggledance/core/v3_13_0/ssrf_host_guard.py" +function = "normalize_allowed_hosts" +mechanism = "source_reaches_sink" +evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)" + +[[pair]] +name = "workers-research-utils-209444" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "G4brym/workers-research" +cve = "" +cwe = "CWE-89" +commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e" +parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4" +commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e" +vuln = "workers-research-utils-209444/vuln.ts" +fixed = "workers-research-utils-209444/fixed.ts" +relpath = "src/utils.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-89" +class = "sql injection" +path = "src/utils.ts" +function = "normalizeDomain" +mechanism = "source_reaches_sink" +evidence = "Fix SQL injection in search by using parameterized queries (#41)" + +[[pair]] +name = "zoonk-origin-bfbf67" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "MIT" +repo = "zoonk/zoonk" +cve = "" +cwe = "CWE-16" +commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31" +parent = "2604269350bff51f58572c133b45010cb0976a5a" +commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31" +vuln = "zoonk-origin-bfbf67/vuln.ts" +fixed = "zoonk-origin-bfbf67/fixed.ts" +relpath = "packages/utils/src/origin.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "packages/utils/src/origin.ts" +function = "getAllowedHosts" +mechanism = "permissive_default" +evidence = "fix(api): allow staging cors from previews (#1559)" diff --git a/benchmarks/pairs/agent-vfc/training/manifest.jsonl b/benchmarks/pairs/agent-vfc/training/manifest.jsonl index e69de29..68ffc22 100644 --- a/benchmarks/pairs/agent-vfc/training/manifest.jsonl +++ b/benchmarks/pairs/agent-vfc/training/manifest.jsonl @@ -0,0 +1,58 @@ +{"class": "server-side request forgery", "commit": "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb", "commit_url": "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4", "cve": "", "cwe": "CWE-918", "file": "anastasios-pw-session-14ec1a/vuln.ts", "function": "isTopLevelNavigationRequest", "id": "anastasios-pw-session-14ec1a:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "anastasios-pw-session-14ec1a", "project": "Anastasios", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "Anas329796/Anastasios", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "server-side request forgery", "commit": "14ec1ac50f9e4e255d875236d30129c6207401d4", "commit_url": "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4", "cve": "", "cwe": "CWE-918", "file": "anastasios-pw-session-14ec1a/fixed.ts", "function": "isTopLevelNavigationRequest", "id": "anastasios-pw-session-14ec1a:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "anastasios-pw-session-14ec1a", "project": "Anastasios", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "Anas329796/Anastasios", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "server-side request forgery", "commit": "d3eed2dc01328f21dd404477bb28e2740fa371a4", "commit_url": "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "cve": "", "cwe": "CWE-918", "file": "astroclaw-pw-session-1553a8/vuln.ts", "function": "isTopLevelNavigationRequest", "id": "astroclaw-pw-session-1553a8:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "astroclaw-pw-session-1553a8", "project": "astroclaw", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "P1R4N351/astroclaw", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "server-side request forgery", "commit": "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "commit_url": "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "cve": "", "cwe": "CWE-918", "file": "astroclaw-pw-session-1553a8/fixed.ts", "function": "isTopLevelNavigationRequest", "id": "astroclaw-pw-session-1553a8:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "astroclaw-pw-session-1553a8", "project": "astroclaw", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "P1R4N351/astroclaw", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "8c0ac7e233946abd8dc26581b871e9fcd0928899", "commit_url": "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59", "cve": "", "cwe": "CWE-16", "file": "capgo-app-hono-4dadd2/vuln.ts", "function": "createHono", "id": "capgo-app-hono-4dadd2:vuln", "label": "vuln", "license": "AGPL-3.0", "mechanism": "permissive_default", "pair": "capgo-app-hono-4dadd2", "project": "capgo.app", "provenance": "agent", "relpath": "supabase/functions/_backend/utils/hono.ts", "repo": "Cap-go/capgo.app", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "4dadd2580d02213d227a331eee0232aa59859b59", "commit_url": "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59", "cve": "", "cwe": "CWE-16", "file": "capgo-app-hono-4dadd2/fixed.ts", "function": "createHono", "id": "capgo-app-hono-4dadd2:fixed", "label": "fixed", "license": "AGPL-3.0", "mechanism": "permissive_default", "pair": "capgo-app-hono-4dadd2", "project": "capgo.app", "provenance": "agent", "relpath": "supabase/functions/_backend/utils/hono.ts", "repo": "Cap-go/capgo.app", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "path traversal", "commit": "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a", "commit_url": "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "cve": "", "cwe": "CWE-22", "file": "dnf-plugin-anyrepo-config-26d19a/vuln.py", "function": "validate_repo_name", "id": "dnf-plugin-anyrepo-config-26d19a:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "dnf-plugin-anyrepo-config-26d19a", "project": "dnf-plugin-anyrepo", "provenance": "agent", "relpath": "dnf_plugin_anyrepo/config.py", "repo": "jfut/dnf-plugin-anyrepo", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "path traversal", "commit": "26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "commit_url": "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "cve": "", "cwe": "CWE-22", "file": "dnf-plugin-anyrepo-config-26d19a/fixed.py", "function": "validate_repo_name", "id": "dnf-plugin-anyrepo-config-26d19a:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "dnf-plugin-anyrepo-config-26d19a", "project": "dnf-plugin-anyrepo", "provenance": "agent", "relpath": "dnf_plugin_anyrepo/config.py", "repo": "jfut/dnf-plugin-anyrepo", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd", "commit_url": "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "cve": "", "cwe": "CWE-1321", "file": "edutrace-page-ee7ba2/vuln.tsx", "function": "handleInputChange", "id": "edutrace-page-ee7ba2:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "prototype_pollution", "pair": "edutrace-page-ee7ba2", "project": "edutrace", "provenance": "agent", "relpath": "front/src/app/editar-anamnese/page.tsx", "repo": "jardimdesoftware/edutrace", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "commit_url": "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "cve": "", "cwe": "CWE-1321", "file": "edutrace-page-ee7ba2/fixed.tsx", "function": "handleInputChange", "id": "edutrace-page-ee7ba2:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "prototype_pollution", "pair": "edutrace-page-ee7ba2", "project": "edutrace", "provenance": "agent", "relpath": "front/src/app/editar-anamnese/page.tsx", "repo": "jardimdesoftware/edutrace", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "0a2184f59e79a04b1365cd49200026e8f2ffdbd5", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-c61a8b:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-c61a8b", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-c61a8b:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-c61a8b", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "1c865815d05b072f4973388c3ac66b6696d9efde", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-db4f54/vuln.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-db4f54:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-db4f54", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "db4f54b1ab80ad596de6425e84f90aa781c49999", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-db4f54/fixed.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-db4f54:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-db4f54", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "missing authorization", "commit": "9b87ecc3a44a7fe2a5185cca1fe52441647d5748", "commit_url": "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "cve": "", "cwe": "CWE-862", "file": "lensops-kubernetesmanagement-fe4910/vuln.tsx", "function": "setErrorMessage", "id": "lensops-kubernetesmanagement-fe4910:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "lensops-kubernetesmanagement-fe4910", "project": "lensops", "provenance": "agent", "relpath": "components/KubernetesManagement.tsx", "repo": "amitknigam84/lensops", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "missing authorization", "commit": "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "commit_url": "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "cve": "", "cwe": "CWE-862", "file": "lensops-kubernetesmanagement-fe4910/fixed.tsx", "function": "setErrorMessage", "id": "lensops-kubernetesmanagement-fe4910:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "lensops-kubernetesmanagement-fe4910", "project": "lensops", "provenance": "agent", "relpath": "components/KubernetesManagement.tsx", "repo": "amitknigam84/lensops", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "open redirect", "commit": "fec6f024ce72c9c47b61cbac6ce7a35cb2280602", "commit_url": "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "cve": "", "cwe": "CWE-601", "file": "market-cap-route-4f8ae9/vuln.ts", "function": "GET", "id": "market-cap-route-4f8ae9:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "market-cap-route-4f8ae9", "project": "market-cap", "provenance": "agent", "relpath": "app/auth/confirm/route.ts", "repo": "navaneethbv/market-cap", "review_tier": "title", "split": "train", "year": 2026} +{"class": "open redirect", "commit": "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "commit_url": "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "cve": "", "cwe": "CWE-601", "file": "market-cap-route-4f8ae9/fixed.ts", "function": "GET", "id": "market-cap-route-4f8ae9:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "market-cap-route-4f8ae9", "project": "market-cap", "provenance": "agent", "relpath": "app/auth/confirm/route.ts", "repo": "navaneethbv/market-cap", "review_tier": "title", "split": "train", "year": 2026} +{"class": "permissive default", "commit": "c074fc7413338aefcbea3170ef4d3ba486a8a4b7", "commit_url": "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13", "cve": "", "cwe": "CWE-16", "file": "melodix-playerprovider-089931/vuln.tsx", "function": "PlayerProvider", "id": "melodix-playerprovider-089931:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "melodix-playerprovider-089931", "project": "melodix", "provenance": "agent", "relpath": "apps/miniapp/src/components/PlayerProvider.tsx", "repo": "alexshao3/melodix", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "089931ef71ea1e5b7586520baf1a5498e2f05b13", "commit_url": "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13", "cve": "", "cwe": "CWE-16", "file": "melodix-playerprovider-089931/fixed.tsx", "function": "PlayerProvider", "id": "melodix-playerprovider-089931:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "melodix-playerprovider-089931", "project": "melodix", "provenance": "agent", "relpath": "apps/miniapp/src/components/PlayerProvider.tsx", "repo": "alexshao3/melodix", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "70ca282b819ac1d60f4b5e665d224b1043ff1ccc", "commit_url": "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598", "cve": "", "cwe": "CWE-16", "file": "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts", "function": "fetchMetadata", "id": "mercado-do-vale-news-catalogmetadataservice-9b5fcf:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", "project": "Mercado-do-vale-news", "provenance": "agent", "relpath": "services/catalogMetadataService.ts", "repo": "handielson/Mercado-do-vale-news", "review_tier": "title", "split": "train", "year": 2026} +{"class": "permissive default", "commit": "9b5fcf2dae41e56f5f97952266f2d6ba59598598", "commit_url": "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598", "cve": "", "cwe": "CWE-16", "file": "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts", "function": "fetchMetadata", "id": "mercado-do-vale-news-catalogmetadataservice-9b5fcf:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", "project": "Mercado-do-vale-news", "provenance": "agent", "relpath": "services/catalogMetadataService.ts", "repo": "handielson/Mercado-do-vale-news", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "add96df6d6a6b61506635c23dbacf6c6cfe24dc2", "commit_url": "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "cve": "", "cwe": "CWE-1321", "file": "money-track-category-icons-4d4a5b/vuln.ts", "function": "isCategoryIcon", "id": "money-track-category-icons-4d4a5b:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "money-track-category-icons-4d4a5b", "project": "money-track", "provenance": "agent", "relpath": "src/lib/category-icons.ts", "repo": "andrebubniak/money-track", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "commit_url": "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "cve": "", "cwe": "CWE-1321", "file": "money-track-category-icons-4d4a5b/fixed.ts", "function": "isCategoryIcon", "id": "money-track-category-icons-4d4a5b:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "money-track-category-icons-4d4a5b", "project": "money-track", "provenance": "agent", "relpath": "src/lib/category-icons.ts", "repo": "andrebubniak/money-track", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "d899b40d3466f2ffbe9f01c4d49267412401f078", "commit_url": "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8", "cve": "", "cwe": "CWE-1321", "file": "nestjs-filter-normalizer-aa0e60/vuln.ts", "function": "normalizeInput", "id": "nestjs-filter-normalizer-aa0e60:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "nestjs-filter-normalizer-aa0e60", "project": "nestjs-filter", "provenance": "agent", "relpath": "packages/core/src/input/normalizer.ts", "repo": "DavideCarvalho/nestjs-filter", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "aa0e600d05997ea3d77538ea1c2db427c439f2e8", "commit_url": "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8", "cve": "", "cwe": "CWE-1321", "file": "nestjs-filter-normalizer-aa0e60/fixed.ts", "function": "normalizeInput", "id": "nestjs-filter-normalizer-aa0e60:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "nestjs-filter-normalizer-aa0e60", "project": "nestjs-filter", "provenance": "agent", "relpath": "packages/core/src/input/normalizer.ts", "repo": "DavideCarvalho/nestjs-filter", "review_tier": "title", "split": "train", "year": 2026} +{"class": "permissive default", "commit": "08976c5d7a07b0663669b875b4507446199f85d7", "commit_url": "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59", "cve": "", "cwe": "CWE-16", "file": "new-erp-final-app-6e9644/vuln.ts", "function": "origin", "id": "new-erp-final-app-6e9644:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "permissive_default", "pair": "new-erp-final-app-6e9644", "project": "NEW_ERP_FINAL", "provenance": "agent", "relpath": "src/presentation/http/app.ts", "repo": "Sachin-Salgar/NEW_ERP_FINAL", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "6e9644c81ce3fb356669157182a5ef09a70c4b59", "commit_url": "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59", "cve": "", "cwe": "CWE-16", "file": "new-erp-final-app-6e9644/fixed.ts", "function": "origin", "id": "new-erp-final-app-6e9644:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "permissive_default", "pair": "new-erp-final-app-6e9644", "project": "NEW_ERP_FINAL", "provenance": "agent", "relpath": "src/presentation/http/app.ts", "repo": "Sachin-Salgar/NEW_ERP_FINAL", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "server-side request forgery", "commit": "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0", "commit_url": "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43", "cve": "", "cwe": "CWE-918", "file": "nimestream-route-d17f53/vuln.js", "function": "GET", "id": "nimestream-route-d17f53:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "nimestream-route-d17f53", "project": "nimestream", "provenance": "agent", "relpath": "app/api/img/route.js", "repo": "Irnhakim/nimestream", "review_tier": "title", "split": "train", "year": 2026} +{"class": "server-side request forgery", "commit": "d17f535bf3012041b056ff3aa991ff6cfa198e43", "commit_url": "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43", "cve": "", "cwe": "CWE-918", "file": "nimestream-route-d17f53/fixed.js", "function": "GET", "id": "nimestream-route-d17f53:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "nimestream-route-d17f53", "project": "nimestream", "provenance": "agent", "relpath": "app/api/img/route.js", "repo": "Irnhakim/nimestream", "review_tier": "title", "split": "train", "year": 2026} +{"class": "insecure direct object reference", "commit": "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc", "commit_url": "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-0fc947/vuln.py", "function": "get_job", "id": "openniw-jobs-0fc947:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-0fc947", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "HHHHHejia/openniw", "review_tier": "title", "split": "train", "year": 2026} +{"class": "insecure direct object reference", "commit": "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "commit_url": "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-0fc947/fixed.py", "function": "get_job", "id": "openniw-jobs-0fc947:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-0fc947", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "HHHHHejia/openniw", "review_tier": "title", "split": "train", "year": 2026} +{"class": "insecure direct object reference", "commit": "98a0c392ba96cd2c4aa746dd6fc2b183f385225e", "commit_url": "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-b74de3/vuln.py", "function": "get_job", "id": "openniw-jobs-b74de3:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-b74de3", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "ziyuzuo/openniw", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "insecure direct object reference", "commit": "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "commit_url": "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-b74de3/fixed.py", "function": "get_job", "id": "openniw-jobs-b74de3:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-b74de3", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "ziyuzuo/openniw", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "insecure direct object reference", "commit": "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed", "commit_url": "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431", "cve": "", "cwe": "CWE-639", "file": "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs", "function": "exportProject", "id": "overleaf-with-claude-exportscontroller-3980b9:vuln", "label": "vuln", "license": "AGPL-3.0", "mechanism": "identity_from_request_body", "pair": "overleaf-with-claude-exportscontroller-3980b9", "project": "overleaf-with-claude", "provenance": "agent", "relpath": "services/web/app/src/Features/Exports/ExportsController.mjs", "repo": "ZUENS2020/overleaf-with-claude", "review_tier": "title", "split": "train", "year": 2026} +{"class": "insecure direct object reference", "commit": "3980b9e5806defb63e45ae2696e6c1899f3a8431", "commit_url": "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431", "cve": "", "cwe": "CWE-639", "file": "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs", "function": "exportProject", "id": "overleaf-with-claude-exportscontroller-3980b9:fixed", "label": "fixed", "license": "AGPL-3.0", "mechanism": "identity_from_request_body", "pair": "overleaf-with-claude-exportscontroller-3980b9", "project": "overleaf-with-claude", "provenance": "agent", "relpath": "services/web/app/src/Features/Exports/ExportsController.mjs", "repo": "ZUENS2020/overleaf-with-claude", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "31d1ac79b4cfa3118597348e79800a6561115149", "commit_url": "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb", "cve": "", "cwe": "CWE-1321", "file": "popmark-editorconfig-e5ac40/vuln.ts", "function": "deepMergeInto", "id": "popmark-editorconfig-e5ac40:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "popmark-editorconfig-e5ac40", "project": "popmark", "provenance": "agent", "relpath": "src/lexical-markdown/config/editorConfig.ts", "repo": "dayflower/popmark", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "e5ac407cef37c37178d440541ede301c838640fb", "commit_url": "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb", "cve": "", "cwe": "CWE-1321", "file": "popmark-editorconfig-e5ac40/fixed.ts", "function": "deepMergeInto", "id": "popmark-editorconfig-e5ac40:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "popmark-editorconfig-e5ac40", "project": "popmark", "provenance": "agent", "relpath": "src/lexical-markdown/config/editorConfig.ts", "repo": "dayflower/popmark", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "prototype pollution", "commit": "ba587867118f703632ff2dc63c4feb8ad6793420", "commit_url": "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7", "cve": "", "cwe": "CWE-1321", "file": "rag-pipeline-utils-config-handler-76e5f0/vuln.js", "function": "handleConfigSet", "id": "rag-pipeline-utils-config-handler-76e5f0:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "rag-pipeline-utils-config-handler-76e5f0", "project": "rag-pipeline-utils", "provenance": "agent", "relpath": "src/cli/handlers/config-handler.js", "repo": "DevilsDev/rag-pipeline-utils", "review_tier": "title", "split": "train", "year": 2026} +{"class": "prototype pollution", "commit": "76e5f0a94d6803d0e463d26a61cedb7da90857a7", "commit_url": "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7", "cve": "", "cwe": "CWE-1321", "file": "rag-pipeline-utils-config-handler-76e5f0/fixed.js", "function": "handleConfigSet", "id": "rag-pipeline-utils-config-handler-76e5f0:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "rag-pipeline-utils-config-handler-76e5f0", "project": "rag-pipeline-utils", "provenance": "agent", "relpath": "src/cli/handlers/config-handler.js", "repo": "DevilsDev/rag-pipeline-utils", "review_tier": "title", "split": "train", "year": 2026} +{"class": "permissive default", "commit": "6d5937972510cdb5ebca30607b538fdc2e280094", "commit_url": "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "cve": "", "cwe": "CWE-16", "file": "registry-proxy-worker-426847/vuln.js", "function": "buildUpstreamRequest", "id": "registry-proxy-worker-426847:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "registry-proxy-worker-426847", "project": "registry-proxy", "provenance": "agent", "relpath": "src/worker.js", "repo": "agents-repo/registry-proxy", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "commit_url": "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "cve": "", "cwe": "CWE-16", "file": "registry-proxy-worker-426847/fixed.js", "function": "buildUpstreamRequest", "id": "registry-proxy-worker-426847:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "registry-proxy-worker-426847", "project": "registry-proxy", "provenance": "agent", "relpath": "src/worker.js", "repo": "agents-repo/registry-proxy", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "insecure direct object reference", "commit": "a7a9bc260d649ea2e582c07435bfd7d93100647b", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-387bcf/vuln.ts", "function": "PATCH", "id": "supplieradvisor-mvp-route-387bcf:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-387bcf", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/claims/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "insecure direct object reference", "commit": "387bcf40e984a2ee1832ab7beabf0284c5b627d8", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-387bcf/fixed.ts", "function": "PATCH", "id": "supplieradvisor-mvp-route-387bcf:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-387bcf", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/claims/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "insecure direct object reference", "commit": "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-a69e8f/vuln.ts", "function": "GET", "id": "supplieradvisor-mvp-route-a69e8f:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-a69e8f", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/opportunities/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "train", "year": 2026} +{"class": "insecure direct object reference", "commit": "a69e8f27c0f4d402573d16f0612b51155bbc46e1", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-a69e8f/fixed.ts", "function": "GET", "id": "supplieradvisor-mvp-route-a69e8f:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-a69e8f", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/opportunities/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "train", "year": 2026} +{"class": "command injection", "commit": "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864", "commit_url": "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a", "cve": "", "cwe": "CWE-78", "file": "tools-cli-tools-a96bc0/vuln.py", "function": "_is_command_allowed", "id": "tools-cli-tools-a96bc0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "tools-cli-tools-a96bc0", "project": "Tools", "provenance": "agent", "relpath": "src/shared/python/ai/tools/cli_tools.py", "repo": "D-sorganization/Tools", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "command injection", "commit": "a96bc0502a3dcdac303e4f0152508886e5c35c0a", "commit_url": "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a", "cve": "", "cwe": "CWE-78", "file": "tools-cli-tools-a96bc0/fixed.py", "function": "_is_command_allowed", "id": "tools-cli-tools-a96bc0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "tools-cli-tools-a96bc0", "project": "Tools", "provenance": "agent", "relpath": "src/shared/python/ai/tools/cli_tools.py", "repo": "D-sorganization/Tools", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "path traversal", "commit": "8d240ad8d7fc114c8f941ad956a2fdf32391ff60", "commit_url": "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6", "cve": "", "cwe": "CWE-22", "file": "trackly-cli-path-diagnostics-1c1aed/vuln.js", "function": "inspectExistingAncestor", "id": "trackly-cli-path-diagnostics-1c1aed:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "trackly-cli-path-diagnostics-1c1aed", "project": "trackly-cli", "provenance": "agent", "relpath": "lib/path-diagnostics.js", "repo": "trackly-app/trackly-cli", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "path traversal", "commit": "1c1aed89b07edb04051830c8f086e02b65e961c6", "commit_url": "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6", "cve": "", "cwe": "CWE-22", "file": "trackly-cli-path-diagnostics-1c1aed/fixed.js", "function": "inspectExistingAncestor", "id": "trackly-cli-path-diagnostics-1c1aed:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "trackly-cli-path-diagnostics-1c1aed", "project": "trackly-cli", "provenance": "agent", "relpath": "lib/path-diagnostics.js", "repo": "trackly-app/trackly-cli", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "path traversal", "commit": "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc", "commit_url": "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b", "cve": "", "cwe": "CWE-22", "file": "upstreamdrift-local-server-c3a078/vuln.py", "function": "_find_logo_file", "id": "upstreamdrift-local-server-c3a078:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "upstreamdrift-local-server-c3a078", "project": "UpstreamDrift", "provenance": "agent", "relpath": "src/api/local_server.py", "repo": "D-sorganization/UpstreamDrift", "review_tier": "title", "split": "train", "year": 2026} +{"class": "path traversal", "commit": "c3a0787080489b30e2ed0abfac03b51e45da184b", "commit_url": "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b", "cve": "", "cwe": "CWE-22", "file": "upstreamdrift-local-server-c3a078/fixed.py", "function": "_find_logo_file", "id": "upstreamdrift-local-server-c3a078:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "upstreamdrift-local-server-c3a078", "project": "UpstreamDrift", "provenance": "agent", "relpath": "src/api/local_server.py", "repo": "D-sorganization/UpstreamDrift", "review_tier": "title", "split": "train", "year": 2026} +{"class": "server-side request forgery", "commit": "934b939f1cca5259eaf807db3319eb97b90d8d80", "commit_url": "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b", "cve": "", "cwe": "CWE-918", "file": "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py", "function": "normalize_allowed_hosts", "id": "waggledance-swarm-ssrf-host-guard-9a4548:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "source_reaches_sink", "pair": "waggledance-swarm-ssrf-host-guard-9a4548", "project": "waggledance-swarm", "provenance": "agent", "relpath": "waggledance/core/v3_13_0/ssrf_host_guard.py", "repo": "Ahkeratmehilaiset/waggledance-swarm", "review_tier": "title", "split": "train", "year": 2026} +{"class": "server-side request forgery", "commit": "9a454843aa35332ff2eb3106023eee0c4b5e444b", "commit_url": "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b", "cve": "", "cwe": "CWE-918", "file": "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py", "function": "normalize_allowed_hosts", "id": "waggledance-swarm-ssrf-host-guard-9a4548:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "source_reaches_sink", "pair": "waggledance-swarm-ssrf-host-guard-9a4548", "project": "waggledance-swarm", "provenance": "agent", "relpath": "waggledance/core/v3_13_0/ssrf_host_guard.py", "repo": "Ahkeratmehilaiset/waggledance-swarm", "review_tier": "title", "split": "train", "year": 2026} +{"class": "sql injection", "commit": "eab923ad3099c01b002fbd6be7cf994614bbdee4", "commit_url": "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e", "cve": "", "cwe": "CWE-89", "file": "workers-research-utils-209444/vuln.ts", "function": "normalizeDomain", "id": "workers-research-utils-209444:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "workers-research-utils-209444", "project": "workers-research", "provenance": "agent", "relpath": "src/utils.ts", "repo": "G4brym/workers-research", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "sql injection", "commit": "209444eb61cc564c2d6b43267256f85fe3e5e30e", "commit_url": "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e", "cve": "", "cwe": "CWE-89", "file": "workers-research-utils-209444/fixed.ts", "function": "normalizeDomain", "id": "workers-research-utils-209444:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "workers-research-utils-209444", "project": "workers-research", "provenance": "agent", "relpath": "src/utils.ts", "repo": "G4brym/workers-research", "review_tier": "title", "split": "holdout", "year": 2026} +{"class": "permissive default", "commit": "2604269350bff51f58572c133b45010cb0976a5a", "commit_url": "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31", "cve": "", "cwe": "CWE-16", "file": "zoonk-origin-bfbf67/vuln.ts", "function": "getAllowedHosts", "id": "zoonk-origin-bfbf67:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "zoonk-origin-bfbf67", "project": "zoonk", "provenance": "agent", "relpath": "packages/utils/src/origin.ts", "repo": "zoonk/zoonk", "review_tier": "title", "split": "train", "year": 2026} +{"class": "permissive default", "commit": "bfbf670ccb41d63c407d32c51bd26e626a174f31", "commit_url": "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31", "cve": "", "cwe": "CWE-16", "file": "zoonk-origin-bfbf67/fixed.ts", "function": "getAllowedHosts", "id": "zoonk-origin-bfbf67:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "zoonk-origin-bfbf67", "project": "zoonk", "provenance": "agent", "relpath": "packages/utils/src/origin.ts", "repo": "zoonk/zoonk", "review_tier": "title", "split": "train", "year": 2026} diff --git a/benchmarks/pairs/agent-vfc/workers-research-utils-209444/fixed.ts b/benchmarks/pairs/agent-vfc/workers-research-utils-209444/fixed.ts index abe9a13..1c1ab40 100644 --- a/benchmarks/pairs/agent-vfc/workers-research-utils-209444/fixed.ts +++ b/benchmarks/pairs/agent-vfc/workers-research-utils-209444/fixed.ts @@ -5,7 +5,7 @@ // commit_url: https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e // cve: // license: MIT -// function: formatDuration +// function: normalizeDomain // relpath: src/utils.ts // provenance: agent // mechanism: source_reaches_sink diff --git a/benchmarks/pairs/agent-vfc/workers-research-utils-209444/vuln.ts b/benchmarks/pairs/agent-vfc/workers-research-utils-209444/vuln.ts index 9b70bb8..dfdc2a3 100644 --- a/benchmarks/pairs/agent-vfc/workers-research-utils-209444/vuln.ts +++ b/benchmarks/pairs/agent-vfc/workers-research-utils-209444/vuln.ts @@ -5,7 +5,7 @@ // commit_url: https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e // cve: // license: MIT -// function: formatDuration +// function: normalizeDomain // relpath: src/utils.ts // provenance: agent // mechanism: source_reaches_sink diff --git a/benchmarks/pairs/catalog.toml b/benchmarks/pairs/catalog.toml index 1c91f18..30d0ec0 100644 --- a/benchmarks/pairs/catalog.toml +++ b/benchmarks/pairs/catalog.toml @@ -8,6 +8,8 @@ slice = "local" language = "python" origin = "in-tree-fixture" license = "in-tree" +review_tier = "reviewed" +reviewer = "Marius Ciepluch" vuln = "../fixtures/python-vulnerable/app.py" fixed = "../fixtures/python-vulnerable/safe.py" relpath = "app.py" @@ -21,6 +23,8 @@ slice = "local" language = "javascript" origin = "in-tree-fixture" license = "in-tree" +review_tier = "reviewed" +reviewer = "Marius Ciepluch" vuln = "../fixtures/javascript-vulnerable/src/app.js" fixed = "../fixtures/javascript-vulnerable/src/safe.js" relpath = "src/app.js" @@ -34,6 +38,8 @@ slice = "local" language = "c_cpp" origin = "in-tree-fixture" license = "in-tree" +review_tier = "reviewed" +reviewer = "Marius Ciepluch" vuln = "../fixtures/cpp-damn-vulnerable/src/buffer.cpp" fixed = "../fixtures/cpp-damn-vulnerable/src/safe.cpp" relpath = "src/buffer.cpp" diff --git a/benchmarks/pairs/catalog_gen.py b/benchmarks/pairs/catalog_gen.py index ececf8a..b600a6d 100644 --- a/benchmarks/pairs/catalog_gen.py +++ b/benchmarks/pairs/catalog_gen.py @@ -72,7 +72,11 @@ def catalog_text(slice_name: str, recipes: list[dict[str, object]]) -> str: 'fix_policy = "silent"', f'provenance = "{_q(recipe.get("provenance", "human"))}"', f'split = "{_q(recipe.get("split", "train"))}"', + f'review_tier = "{_review_tier(slice_name, recipe)}"', ] + reviewer = str(recipe.get("reviewer", "") or "") + if reviewer and reviewer.lower() != "pending": + lines.append(f'reviewer = "{_q(reviewer)}"') if recipe.get("known_limit"): lines.append(f'known_limit = "{_q(recipe["known_limit"])}"') lines += [ @@ -95,7 +99,22 @@ def catalog_text(slice_name: str, recipes: list[dict[str, object]]) -> str: return "\n".join(lines) -def training_rows(recipes: list[dict[str, object]]) -> list[dict[str, object]]: +_DEFAULT_TIER = {"vibe-py": "seeded", "vfc-js": "advisory", "agent-vfc": "title", "vfc": "advisory", "sast": "advisory"} + + +def _review_tier(slice_name: str, recipe: dict[str, object]) -> str: + """Req 9, same precedence as the loader: explicit `review_tier`, else `reviewer` (pending -> title, a name -> reviewed), else the slice default.""" + if recipe.get("review_tier"): + return str(recipe["review_tier"]) + reviewer = str(recipe.get("reviewer", "") or "") + if reviewer.lower() == "pending": + return "title" + if reviewer: + return "reviewed" + return _DEFAULT_TIER.get(slice_name, "advisory") + + +def training_rows(slice_name: str, recipes: list[dict[str, object]]) -> list[dict[str, object]]: rows: list[dict[str, object]] = [] for recipe in recipes: vuln, fixed = excerpt_rel(recipe) @@ -112,6 +131,7 @@ def training_rows(recipes: list[dict[str, object]]) -> list[dict[str, object]]: "mechanism": recipe.get("mechanism", "other"), "provenance": recipe.get("provenance", "human"), "split": recipe.get("split", "train"), + "review_tier": _review_tier(slice_name, recipe), "relpath": recipe.get("relpath", recipe.get("path", "")), "commit_url": recipe.get("commit_url", ""), } @@ -331,7 +351,6 @@ def generate(slice_name: str, *, prune: bool = False) -> tuple[Path, int]: slice_root = ROOT / slice_name loaded = [dict(item) for item in tomllib.loads((slice_root / "recipes.toml").read_text()).get("recipe", [])] recipes: list[dict[str, object]] = [] - pending: list[dict[str, object]] = [] for recipe in loaded: vuln, fixed = excerpt_rel(recipe) if (slice_root / vuln).is_file() and (slice_root / fixed).is_file(): @@ -343,38 +362,26 @@ def generate(slice_name: str, *, prune: bool = False) -> tuple[Path, int]: recipe["function"] = derived _stamp_function(slice_root / vuln, derived) _stamp_function(slice_root / fixed, derived) - if str(recipe.get("reviewer", "")).lower() == "pending": - pending.append(recipe) - continue - recipes.append(recipe) + recipes.append(recipe) # `reviewer = "pending"` rows load at tier `title` (Req 9.4); no separate queue file else: print(f"skip {recipe['name']}: excerpt missing (harvest failed or not fetched)") catalog = slice_root / "catalog.toml" catalog.write_text(catalog_text(slice_name, recipes), encoding="utf-8") candidates = slice_root / "catalog-candidates.toml" if prune: - if not recipes and not pending: + if not recipes: raise SystemExit(f"refusing --prune for {slice_name}: no recipe derived a label, nothing would survive") - keep = {str(r["name"]) for r in recipes} | {str(r["name"]) for r in pending} + keep = {str(r["name"]) for r in recipes} for entry in sorted(slice_root.iterdir()): if entry.is_dir() and entry.name not in keep and entry.name not in {"training", "__pycache__"}: shutil.rmtree(entry) - print(f"pruned {entry.name}: excerpt not in the catalog or the candidates") - if pending: - # Unreviewed rows never enter the loaded catalog (Req 5.3); they wait here for a reviewer. - candidates.write_text( - '# CANDIDATES awaiting human review (reviewer = "pending"). Not loaded by load_pair_catalog.\n' - "# Set `reviewer` in recipes.toml after confirming vulnerability, mechanism, and license; then regenerate.\n\n" - + catalog_text(slice_name, pending), - encoding="utf-8", - ) - print(f"{len(pending)} rows await review -> {candidates}") - elif candidates.exists(): - candidates.unlink() + print(f"pruned {entry.name}: excerpt not in the catalog") + if candidates.exists(): + candidates.unlink() # retired by Req 9: the `title` tier is the review queue training = slice_root / "training" / "manifest.jsonl" training.parent.mkdir(parents=True, exist_ok=True) with training.open("w", encoding="utf-8") as handle: - for row in training_rows(recipes): + for row in training_rows(slice_name, recipes): handle.write(json.dumps(row, sort_keys=True) + "\n") return catalog, len(recipes) @@ -382,9 +389,7 @@ def generate(slice_name: str, *, prune: bool = False) -> tuple[Path, int]: def main(argv: list[str] | None = None) -> int: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--slice", default="vfc") - parser.add_argument( - "--prune", action="store_true", help="delete excerpt directories that ended up neither in the catalog nor among the candidates" - ) + parser.add_argument("--prune", action="store_true", help="delete excerpt directories that ended up outside the catalog") args = parser.parse_args(argv) catalog, count = generate(args.slice, prune=args.prune) print(f"wrote {catalog} ({count} pairs)") diff --git a/benchmarks/pairs/vfc-js/catalog.toml b/benchmarks/pairs/vfc-js/catalog.toml index 146063d..c71227a 100644 --- a/benchmarks/pairs/vfc-js/catalog.toml +++ b/benchmarks/pairs/vfc-js/catalog.toml @@ -22,6 +22,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-22" @@ -51,6 +52,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -80,6 +82,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -109,6 +112,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -138,6 +142,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -167,6 +172,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -196,6 +202,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-22" @@ -224,6 +231,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -252,6 +260,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -280,6 +289,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -309,6 +319,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -338,6 +349,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" @@ -367,6 +379,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-22" @@ -395,6 +408,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-94" @@ -424,6 +438,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-94" @@ -453,6 +468,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-94" @@ -482,6 +498,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "advisory" [[pair.expected]] cwe = "CWE-78" diff --git a/benchmarks/pairs/vfc-js/training/manifest.jsonl b/benchmarks/pairs/vfc-js/training/manifest.jsonl index 8118d91..e785ff8 100644 --- a/benchmarks/pairs/vfc-js/training/manifest.jsonl +++ b/benchmarks/pairs/vfc-js/training/manifest.jsonl @@ -1,34 +1,34 @@ -{"class": "path traversal", "commit": "d171a771a92e4685b24fb77cb894a7b7b8024c5c", "commit_url": "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9", "cve": "", "cwe": "CWE-22", "file": "angular-http-server-1-0-0/vuln.js", "function": "requestListener", "id": "angular-http-server-1-0-0:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "angular-http-server-1-0-0", "project": "angular-http-server", "provenance": "human", "relpath": "angular-http-server.js", "repo": "simonh1000/angular-http-server", "split": "train", "year": 2018} -{"class": "path traversal", "commit": "8bafc9577161469f5dea01e0b98ea9c525d063e9", "commit_url": "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9", "cve": "", "cwe": "CWE-22", "file": "angular-http-server-1-0-0/fixed.js", "function": "requestListener", "id": "angular-http-server-1-0-0:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "angular-http-server-1-0-0", "project": "angular-http-server", "provenance": "human", "relpath": "angular-http-server.js", "repo": "simonh1000/angular-http-server", "split": "train", "year": 2018} -{"class": "command injection", "commit": "8d28fe8a9a49e5ff3f61e239293b5646528e2915", "commit_url": "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063", "cve": "CVE-2018-16462", "cwe": "CWE-78", "file": "apex-publish-static-files-2-0-0/vuln.js", "function": "publish", "id": "apex-publish-static-files-2-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "apex-publish-static-files-2-0-0", "project": "apex-publish-static-files", "provenance": "human", "relpath": "index.js", "repo": "vincentmorneau/apex-publish-static-files", "split": "holdout", "year": 2018} -{"class": "command injection", "commit": "2209af8f2b65c24aa55ab757e0e05b958c16f063", "commit_url": "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063", "cve": "CVE-2018-16462", "cwe": "CWE-78", "file": "apex-publish-static-files-2-0-0/fixed.js", "function": "publish", "id": "apex-publish-static-files-2-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "apex-publish-static-files-2-0-0", "project": "apex-publish-static-files", "provenance": "human", "relpath": "index.js", "repo": "vincentmorneau/apex-publish-static-files", "split": "holdout", "year": 2018} -{"class": "command injection", "commit": "fcea252e52b6078eff6caf5531bd32c53fccb59f", "commit_url": "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "cve": "CVE-2020-7730", "cwe": "CWE-78", "file": "bestzip-2-1-6/vuln.js", "function": "nativeZip", "id": "bestzip-2-1-6:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "bestzip-2-1-6", "project": "bestzip", "provenance": "human", "relpath": "lib/bestzip.js", "repo": "nfriedly/node-bestzip", "split": "holdout", "year": 2020} -{"class": "command injection", "commit": "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "commit_url": "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "cve": "CVE-2020-7730", "cwe": "CWE-78", "file": "bestzip-2-1-6/fixed.js", "function": "nativeZip", "id": "bestzip-2-1-6:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "bestzip-2-1-6", "project": "bestzip", "provenance": "human", "relpath": "lib/bestzip.js", "repo": "nfriedly/node-bestzip", "split": "holdout", "year": 2020} -{"class": "command injection", "commit": "d474da7b89c0d3397cd681e79c7bcc592bff144b", "commit_url": "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "cve": "CVE-2020-7613", "cwe": "CWE-78", "file": "clamscan-1-2-0/vuln.js", "function": "local_scan", "id": "clamscan-1-2-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "clamscan-1-2-0", "project": "clamscan", "provenance": "human", "relpath": "index.js", "repo": "kylefarris/clamscan", "split": "train", "year": 2020} -{"class": "command injection", "commit": "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "commit_url": "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "cve": "CVE-2020-7613", "cwe": "CWE-78", "file": "clamscan-1-2-0/fixed.js", "function": "local_scan", "id": "clamscan-1-2-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "clamscan-1-2-0", "project": "clamscan", "provenance": "human", "relpath": "index.js", "repo": "kylefarris/clamscan", "split": "train", "year": 2020} -{"class": "command injection", "commit": "53c505506553c83861d1bd67823d6a382d3a5a43", "commit_url": "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3", "cve": "CVE-2020-7631", "cwe": "CWE-78", "file": "diskusage-ng-0-2-6/vuln.js", "function": "diskusage", "id": "diskusage-ng-0-2-6:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "diskusage-ng-0-2-6", "project": "diskusage-ng", "provenance": "human", "relpath": "lib/posix.js", "repo": "iximiuz/node-diskusage-ng", "split": "holdout", "year": 2020} -{"class": "command injection", "commit": "48e7e093486b528f0c81ec699573e0e4a431b8d3", "commit_url": "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3", "cve": "CVE-2020-7631", "cwe": "CWE-78", "file": "diskusage-ng-0-2-6/fixed.js", "function": "diskusage", "id": "diskusage-ng-0-2-6:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "diskusage-ng-0-2-6", "project": "diskusage-ng", "provenance": "human", "relpath": "lib/posix.js", "repo": "iximiuz/node-diskusage-ng", "split": "holdout", "year": 2020} -{"class": "command injection", "commit": "b748fe77a87749d95876028eda8e759109be4c73", "commit_url": "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d", "cve": "CVE-2014-9682", "cwe": "CWE-78", "file": "dns-sync-0-1-0/vuln.js", "function": "resolve", "id": "dns-sync-0-1-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dns-sync-0-1-0", "project": "dns-sync", "provenance": "human", "relpath": "lib/dns-sync.js", "repo": "skoranga/node-dns-sync", "split": "train", "year": 2014} -{"class": "command injection", "commit": "d9abaae384b198db1095735ad9c1c73d7b890a0d", "commit_url": "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d", "cve": "CVE-2014-9682", "cwe": "CWE-78", "file": "dns-sync-0-1-0/fixed.js", "function": "resolve", "id": "dns-sync-0-1-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dns-sync-0-1-0", "project": "dns-sync", "provenance": "human", "relpath": "lib/dns-sync.js", "repo": "skoranga/node-dns-sync", "split": "train", "year": 2014} -{"class": "path traversal", "commit": "7e69a5539236386e747fb240ae87ea65ed64bb2c", "commit_url": "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "cve": "CVE-2018-3715", "cwe": "CWE-22", "file": "glance-3-0-0/vuln.js", "function": "Glance$serveRequest", "id": "glance-3-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "glance-3-0-0", "project": "glance", "provenance": "human", "relpath": "index.js", "repo": "jarofghosts/glance", "split": "train", "year": 2018} -{"class": "path traversal", "commit": "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "commit_url": "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "cve": "CVE-2018-3715", "cwe": "CWE-22", "file": "glance-3-0-0/fixed.js", "function": "Glance$serveRequest", "id": "glance-3-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "glance-3-0-0", "project": "glance", "provenance": "human", "relpath": "index.js", "repo": "jarofghosts/glance", "split": "train", "year": 2018} -{"class": "command injection", "commit": "944136096f44ff4ffd4ba0bcef30970ca4702fce", "commit_url": "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e", "cve": "CVE-2020-6836", "cwe": "CWE-78", "file": "hot-formula-parser-3-0-0/vuln.js", "function": "performAction", "id": "hot-formula-parser-3-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "hot-formula-parser-3-0-0", "project": "hot-formula-parser", "provenance": "human", "relpath": "src/grammar-parser/grammar-parser.js", "repo": "handsontable/formula-parser", "split": "train", "year": 2019} -{"class": "command injection", "commit": "396b089738d4bf30eb570a4fe6a188affa95cd5e", "commit_url": "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e", "cve": "CVE-2020-6836", "cwe": "CWE-78", "file": "hot-formula-parser-3-0-0/fixed.js", "function": "performAction", "id": "hot-formula-parser-3-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "hot-formula-parser-3-0-0", "project": "hot-formula-parser", "provenance": "human", "relpath": "src/grammar-parser/grammar-parser.js", "repo": "handsontable/formula-parser", "split": "train", "year": 2019} -{"class": "command injection", "commit": "49b72239b144ab7ffdf673b62e18bfd0760948f6", "commit_url": "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8", "cve": "CVE-2018-16461", "cwe": "CWE-78", "file": "libnmap-0-4-11/vuln.js", "function": "block", "id": "libnmap-0-4-11:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "libnmap-0-4-11", "project": "libnmap", "provenance": "human", "relpath": "lib/classes/tools.js", "repo": "jas-/node-libnmap", "split": "train", "year": 2018} -{"class": "command injection", "commit": "c235b24b0342e12a5dbf502f89daabe95883b6c8", "commit_url": "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8", "cve": "CVE-2018-16461", "cwe": "CWE-78", "file": "libnmap-0-4-11/fixed.js", "function": "block", "id": "libnmap-0-4-11:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "libnmap-0-4-11", "project": "libnmap", "provenance": "human", "relpath": "lib/classes/tools.js", "repo": "jas-/node-libnmap", "split": "train", "year": 2018} -{"class": "command injection", "commit": "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff", "commit_url": "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83", "cve": "CVE-2018-3757", "cwe": "CWE-78", "file": "pdf-image-1-0-5/vuln.js", "function": "getInfo", "id": "pdf-image-1-0-5:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pdf-image-1-0-5", "project": "pdf-image", "provenance": "human", "relpath": "index.js", "repo": "roest01/node-pdf-image", "split": "train", "year": 2018} -{"class": "command injection", "commit": "54679496a89738443917608c2bbe2f6e5dd20e83", "commit_url": "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83", "cve": "CVE-2018-3757", "cwe": "CWE-78", "file": "pdf-image-1-0-5/fixed.js", "function": "getInfo", "id": "pdf-image-1-0-5:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pdf-image-1-0-5", "project": "pdf-image", "provenance": "human", "relpath": "index.js", "repo": "roest01/node-pdf-image", "split": "train", "year": 2018} -{"class": "command injection", "commit": "e3660d8a8e5e61afad9b02af67356a1e239d6bde", "commit_url": "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "cve": "CVE-2017-16034", "cwe": "CWE-78", "file": "pidusage-1-0-0/vuln.js", "function": "ps", "id": "pidusage-1-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pidusage-1-0-0", "project": "pidusage", "provenance": "human", "relpath": "lib/stats.js", "repo": "soyuka/pidusage", "split": "holdout", "year": 2017} -{"class": "command injection", "commit": "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "commit_url": "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "cve": "CVE-2017-16034", "cwe": "CWE-78", "file": "pidusage-1-0-0/fixed.js", "function": "ps", "id": "pidusage-1-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pidusage-1-0-0", "project": "pidusage", "provenance": "human", "relpath": "lib/stats.js", "repo": "soyuka/pidusage", "split": "holdout", "year": 2017} -{"class": "command injection", "commit": "fffceb09aff7180afbd0bd172e820404b33c8299", "commit_url": "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1", "cve": "CVE-2021-23348", "cwe": "CWE-78", "file": "portprocesses-1-0-4/vuln.js", "function": "listProcessesOnPort", "id": "portprocesses-1-0-4:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "portprocesses-1-0-4", "project": "portprocesses", "provenance": "human", "relpath": "index.js", "repo": "rrainn/PortProcesses", "split": "train", "year": 2021} -{"class": "command injection", "commit": "86811216c9b97b01b5722f879f8c88a7aa4214e1", "commit_url": "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1", "cve": "CVE-2021-23348", "cwe": "CWE-78", "file": "portprocesses-1-0-4/fixed.js", "function": "listProcessesOnPort", "id": "portprocesses-1-0-4:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "portprocesses-1-0-4", "project": "portprocesses", "provenance": "human", "relpath": "index.js", "repo": "rrainn/PortProcesses", "split": "train", "year": 2021} -{"class": "path traversal", "commit": "ad077637bf7a9fe0dee3262f011aed19a45ce92c", "commit_url": "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39", "cve": "CVE-2019-5444", "cwe": "CWE-22", "file": "serve-here-js-1-1-0/vuln.js", "function": "ConfigureFilePath", "id": "serve-here-js-1-1-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "serve-here-js-1-1-0", "project": "serve-here.js", "provenance": "human", "relpath": "source/response.js", "repo": "ChristoPy/serve-here.js", "split": "holdout", "year": 2019} -{"class": "path traversal", "commit": "cefb51d03290b6a88dd13143ab2de31b8cf57c39", "commit_url": "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39", "cve": "CVE-2019-5444", "cwe": "CWE-22", "file": "serve-here-js-1-1-0/fixed.js", "function": "ConfigureFilePath", "id": "serve-here-js-1-1-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "serve-here-js-1-1-0", "project": "serve-here.js", "provenance": "human", "relpath": "source/response.js", "repo": "ChristoPy/serve-here.js", "split": "holdout", "year": 2019} -{"class": "code injection", "commit": "5bba7905b0e797460b8f6c2e38ff6869146faab3", "commit_url": "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a", "cve": "", "cwe": "CWE-94", "file": "static-eval-1-1-1/vuln.js", "function": "walk", "id": "static-eval-1-1-1:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "static-eval-1-1-1", "project": "static-eval", "provenance": "human", "relpath": "index.js", "repo": "browserify/static-eval", "split": "train", "year": 2019} -{"class": "code injection", "commit": "32f8efd072625e267aa7237d2daff35738c50d2a", "commit_url": "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a", "cve": "", "cwe": "CWE-94", "file": "static-eval-1-1-1/fixed.js", "function": "walk", "id": "static-eval-1-1-1:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "static-eval-1-1-1", "project": "static-eval", "provenance": "human", "relpath": "index.js", "repo": "browserify/static-eval", "split": "train", "year": 2019} -{"class": "code injection", "commit": "aa21cfb64f47238c764d258d0faf7366a8487e36", "commit_url": "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a", "cve": "CVE-2020-7677", "cwe": "CWE-94", "file": "thenify-3-3-0/vuln.js", "function": "thenify", "id": "thenify-3-3-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "thenify-3-3-0", "project": "thenify", "provenance": "human", "relpath": "index.js", "repo": "thenables/thenify", "split": "holdout", "year": 2020} -{"class": "code injection", "commit": "0d94a24eb933bc835d568f3009f4d269c4c4c17a", "commit_url": "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a", "cve": "CVE-2020-7677", "cwe": "CWE-94", "file": "thenify-3-3-0/fixed.js", "function": "thenify", "id": "thenify-3-3-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "thenify-3-3-0", "project": "thenify", "provenance": "human", "relpath": "index.js", "repo": "thenables/thenify", "split": "holdout", "year": 2020} -{"class": "code injection", "commit": "ef646ccbbbd971e82719c83fc69f56a5585b3a01", "commit_url": "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66", "cve": "CVE-2021-23358", "cwe": "CWE-94", "file": "underscore-1-13-0-0/vuln.js", "function": "template", "id": "underscore-1-13-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "underscore-1-13-0-0", "project": "underscore", "provenance": "human", "relpath": "modules/template.js", "repo": "jashkenas/underscore", "split": "train", "year": 2021} -{"class": "code injection", "commit": "4c73526d43838ad6ab43a6134728776632adeb66", "commit_url": "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66", "cve": "CVE-2021-23358", "cwe": "CWE-94", "file": "underscore-1-13-0-0/fixed.js", "function": "template", "id": "underscore-1-13-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "underscore-1-13-0-0", "project": "underscore", "provenance": "human", "relpath": "modules/template.js", "repo": "jashkenas/underscore", "split": "train", "year": 2021} -{"class": "command injection", "commit": "b8b642b1163baa37f15ed49b4064dcbdb6e1876c", "commit_url": "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "cve": "CVE-2018-3772", "cwe": "CWE-78", "file": "whereis-0-4-0/vuln.js", "function": "whereis", "id": "whereis-0-4-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "whereis-0-4-0", "project": "whereis", "provenance": "human", "relpath": "index.js", "repo": "vvo/node-whereis", "split": "holdout", "year": 2018} -{"class": "command injection", "commit": "0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "commit_url": "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "cve": "CVE-2018-3772", "cwe": "CWE-78", "file": "whereis-0-4-0/fixed.js", "function": "whereis", "id": "whereis-0-4-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "whereis-0-4-0", "project": "whereis", "provenance": "human", "relpath": "index.js", "repo": "vvo/node-whereis", "split": "holdout", "year": 2018} +{"class": "path traversal", "commit": "d171a771a92e4685b24fb77cb894a7b7b8024c5c", "commit_url": "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9", "cve": "", "cwe": "CWE-22", "file": "angular-http-server-1-0-0/vuln.js", "function": "requestListener", "id": "angular-http-server-1-0-0:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "angular-http-server-1-0-0", "project": "angular-http-server", "provenance": "human", "relpath": "angular-http-server.js", "repo": "simonh1000/angular-http-server", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "path traversal", "commit": "8bafc9577161469f5dea01e0b98ea9c525d063e9", "commit_url": "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9", "cve": "", "cwe": "CWE-22", "file": "angular-http-server-1-0-0/fixed.js", "function": "requestListener", "id": "angular-http-server-1-0-0:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "angular-http-server-1-0-0", "project": "angular-http-server", "provenance": "human", "relpath": "angular-http-server.js", "repo": "simonh1000/angular-http-server", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "8d28fe8a9a49e5ff3f61e239293b5646528e2915", "commit_url": "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063", "cve": "CVE-2018-16462", "cwe": "CWE-78", "file": "apex-publish-static-files-2-0-0/vuln.js", "function": "publish", "id": "apex-publish-static-files-2-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "apex-publish-static-files-2-0-0", "project": "apex-publish-static-files", "provenance": "human", "relpath": "index.js", "repo": "vincentmorneau/apex-publish-static-files", "review_tier": "advisory", "split": "holdout", "year": 2018} +{"class": "command injection", "commit": "2209af8f2b65c24aa55ab757e0e05b958c16f063", "commit_url": "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063", "cve": "CVE-2018-16462", "cwe": "CWE-78", "file": "apex-publish-static-files-2-0-0/fixed.js", "function": "publish", "id": "apex-publish-static-files-2-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "apex-publish-static-files-2-0-0", "project": "apex-publish-static-files", "provenance": "human", "relpath": "index.js", "repo": "vincentmorneau/apex-publish-static-files", "review_tier": "advisory", "split": "holdout", "year": 2018} +{"class": "command injection", "commit": "fcea252e52b6078eff6caf5531bd32c53fccb59f", "commit_url": "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "cve": "CVE-2020-7730", "cwe": "CWE-78", "file": "bestzip-2-1-6/vuln.js", "function": "nativeZip", "id": "bestzip-2-1-6:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "bestzip-2-1-6", "project": "bestzip", "provenance": "human", "relpath": "lib/bestzip.js", "repo": "nfriedly/node-bestzip", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "command injection", "commit": "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "commit_url": "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", "cve": "CVE-2020-7730", "cwe": "CWE-78", "file": "bestzip-2-1-6/fixed.js", "function": "nativeZip", "id": "bestzip-2-1-6:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "bestzip-2-1-6", "project": "bestzip", "provenance": "human", "relpath": "lib/bestzip.js", "repo": "nfriedly/node-bestzip", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "command injection", "commit": "d474da7b89c0d3397cd681e79c7bcc592bff144b", "commit_url": "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "cve": "CVE-2020-7613", "cwe": "CWE-78", "file": "clamscan-1-2-0/vuln.js", "function": "local_scan", "id": "clamscan-1-2-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "clamscan-1-2-0", "project": "clamscan", "provenance": "human", "relpath": "index.js", "repo": "kylefarris/clamscan", "review_tier": "advisory", "split": "train", "year": 2020} +{"class": "command injection", "commit": "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "commit_url": "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", "cve": "CVE-2020-7613", "cwe": "CWE-78", "file": "clamscan-1-2-0/fixed.js", "function": "local_scan", "id": "clamscan-1-2-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "clamscan-1-2-0", "project": "clamscan", "provenance": "human", "relpath": "index.js", "repo": "kylefarris/clamscan", "review_tier": "advisory", "split": "train", "year": 2020} +{"class": "command injection", "commit": "53c505506553c83861d1bd67823d6a382d3a5a43", "commit_url": "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3", "cve": "CVE-2020-7631", "cwe": "CWE-78", "file": "diskusage-ng-0-2-6/vuln.js", "function": "diskusage", "id": "diskusage-ng-0-2-6:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "diskusage-ng-0-2-6", "project": "diskusage-ng", "provenance": "human", "relpath": "lib/posix.js", "repo": "iximiuz/node-diskusage-ng", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "command injection", "commit": "48e7e093486b528f0c81ec699573e0e4a431b8d3", "commit_url": "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3", "cve": "CVE-2020-7631", "cwe": "CWE-78", "file": "diskusage-ng-0-2-6/fixed.js", "function": "diskusage", "id": "diskusage-ng-0-2-6:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "diskusage-ng-0-2-6", "project": "diskusage-ng", "provenance": "human", "relpath": "lib/posix.js", "repo": "iximiuz/node-diskusage-ng", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "command injection", "commit": "b748fe77a87749d95876028eda8e759109be4c73", "commit_url": "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d", "cve": "CVE-2014-9682", "cwe": "CWE-78", "file": "dns-sync-0-1-0/vuln.js", "function": "resolve", "id": "dns-sync-0-1-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dns-sync-0-1-0", "project": "dns-sync", "provenance": "human", "relpath": "lib/dns-sync.js", "repo": "skoranga/node-dns-sync", "review_tier": "advisory", "split": "train", "year": 2014} +{"class": "command injection", "commit": "d9abaae384b198db1095735ad9c1c73d7b890a0d", "commit_url": "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d", "cve": "CVE-2014-9682", "cwe": "CWE-78", "file": "dns-sync-0-1-0/fixed.js", "function": "resolve", "id": "dns-sync-0-1-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dns-sync-0-1-0", "project": "dns-sync", "provenance": "human", "relpath": "lib/dns-sync.js", "repo": "skoranga/node-dns-sync", "review_tier": "advisory", "split": "train", "year": 2014} +{"class": "path traversal", "commit": "7e69a5539236386e747fb240ae87ea65ed64bb2c", "commit_url": "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "cve": "CVE-2018-3715", "cwe": "CWE-22", "file": "glance-3-0-0/vuln.js", "function": "Glance$serveRequest", "id": "glance-3-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "glance-3-0-0", "project": "glance", "provenance": "human", "relpath": "index.js", "repo": "jarofghosts/glance", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "path traversal", "commit": "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "commit_url": "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", "cve": "CVE-2018-3715", "cwe": "CWE-22", "file": "glance-3-0-0/fixed.js", "function": "Glance$serveRequest", "id": "glance-3-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "glance-3-0-0", "project": "glance", "provenance": "human", "relpath": "index.js", "repo": "jarofghosts/glance", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "944136096f44ff4ffd4ba0bcef30970ca4702fce", "commit_url": "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e", "cve": "CVE-2020-6836", "cwe": "CWE-78", "file": "hot-formula-parser-3-0-0/vuln.js", "function": "performAction", "id": "hot-formula-parser-3-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "hot-formula-parser-3-0-0", "project": "hot-formula-parser", "provenance": "human", "relpath": "src/grammar-parser/grammar-parser.js", "repo": "handsontable/formula-parser", "review_tier": "advisory", "split": "train", "year": 2019} +{"class": "command injection", "commit": "396b089738d4bf30eb570a4fe6a188affa95cd5e", "commit_url": "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e", "cve": "CVE-2020-6836", "cwe": "CWE-78", "file": "hot-formula-parser-3-0-0/fixed.js", "function": "performAction", "id": "hot-formula-parser-3-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "hot-formula-parser-3-0-0", "project": "hot-formula-parser", "provenance": "human", "relpath": "src/grammar-parser/grammar-parser.js", "repo": "handsontable/formula-parser", "review_tier": "advisory", "split": "train", "year": 2019} +{"class": "command injection", "commit": "49b72239b144ab7ffdf673b62e18bfd0760948f6", "commit_url": "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8", "cve": "CVE-2018-16461", "cwe": "CWE-78", "file": "libnmap-0-4-11/vuln.js", "function": "block", "id": "libnmap-0-4-11:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "libnmap-0-4-11", "project": "libnmap", "provenance": "human", "relpath": "lib/classes/tools.js", "repo": "jas-/node-libnmap", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "c235b24b0342e12a5dbf502f89daabe95883b6c8", "commit_url": "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8", "cve": "CVE-2018-16461", "cwe": "CWE-78", "file": "libnmap-0-4-11/fixed.js", "function": "block", "id": "libnmap-0-4-11:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "libnmap-0-4-11", "project": "libnmap", "provenance": "human", "relpath": "lib/classes/tools.js", "repo": "jas-/node-libnmap", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff", "commit_url": "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83", "cve": "CVE-2018-3757", "cwe": "CWE-78", "file": "pdf-image-1-0-5/vuln.js", "function": "getInfo", "id": "pdf-image-1-0-5:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pdf-image-1-0-5", "project": "pdf-image", "provenance": "human", "relpath": "index.js", "repo": "roest01/node-pdf-image", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "54679496a89738443917608c2bbe2f6e5dd20e83", "commit_url": "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83", "cve": "CVE-2018-3757", "cwe": "CWE-78", "file": "pdf-image-1-0-5/fixed.js", "function": "getInfo", "id": "pdf-image-1-0-5:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pdf-image-1-0-5", "project": "pdf-image", "provenance": "human", "relpath": "index.js", "repo": "roest01/node-pdf-image", "review_tier": "advisory", "split": "train", "year": 2018} +{"class": "command injection", "commit": "e3660d8a8e5e61afad9b02af67356a1e239d6bde", "commit_url": "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "cve": "CVE-2017-16034", "cwe": "CWE-78", "file": "pidusage-1-0-0/vuln.js", "function": "ps", "id": "pidusage-1-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pidusage-1-0-0", "project": "pidusage", "provenance": "human", "relpath": "lib/stats.js", "repo": "soyuka/pidusage", "review_tier": "advisory", "split": "holdout", "year": 2017} +{"class": "command injection", "commit": "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "commit_url": "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", "cve": "CVE-2017-16034", "cwe": "CWE-78", "file": "pidusage-1-0-0/fixed.js", "function": "ps", "id": "pidusage-1-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pidusage-1-0-0", "project": "pidusage", "provenance": "human", "relpath": "lib/stats.js", "repo": "soyuka/pidusage", "review_tier": "advisory", "split": "holdout", "year": 2017} +{"class": "command injection", "commit": "fffceb09aff7180afbd0bd172e820404b33c8299", "commit_url": "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1", "cve": "CVE-2021-23348", "cwe": "CWE-78", "file": "portprocesses-1-0-4/vuln.js", "function": "listProcessesOnPort", "id": "portprocesses-1-0-4:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "portprocesses-1-0-4", "project": "portprocesses", "provenance": "human", "relpath": "index.js", "repo": "rrainn/PortProcesses", "review_tier": "advisory", "split": "train", "year": 2021} +{"class": "command injection", "commit": "86811216c9b97b01b5722f879f8c88a7aa4214e1", "commit_url": "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1", "cve": "CVE-2021-23348", "cwe": "CWE-78", "file": "portprocesses-1-0-4/fixed.js", "function": "listProcessesOnPort", "id": "portprocesses-1-0-4:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "portprocesses-1-0-4", "project": "portprocesses", "provenance": "human", "relpath": "index.js", "repo": "rrainn/PortProcesses", "review_tier": "advisory", "split": "train", "year": 2021} +{"class": "path traversal", "commit": "ad077637bf7a9fe0dee3262f011aed19a45ce92c", "commit_url": "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39", "cve": "CVE-2019-5444", "cwe": "CWE-22", "file": "serve-here-js-1-1-0/vuln.js", "function": "ConfigureFilePath", "id": "serve-here-js-1-1-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "serve-here-js-1-1-0", "project": "serve-here.js", "provenance": "human", "relpath": "source/response.js", "repo": "ChristoPy/serve-here.js", "review_tier": "advisory", "split": "holdout", "year": 2019} +{"class": "path traversal", "commit": "cefb51d03290b6a88dd13143ab2de31b8cf57c39", "commit_url": "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39", "cve": "CVE-2019-5444", "cwe": "CWE-22", "file": "serve-here-js-1-1-0/fixed.js", "function": "ConfigureFilePath", "id": "serve-here-js-1-1-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "serve-here-js-1-1-0", "project": "serve-here.js", "provenance": "human", "relpath": "source/response.js", "repo": "ChristoPy/serve-here.js", "review_tier": "advisory", "split": "holdout", "year": 2019} +{"class": "code injection", "commit": "5bba7905b0e797460b8f6c2e38ff6869146faab3", "commit_url": "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a", "cve": "", "cwe": "CWE-94", "file": "static-eval-1-1-1/vuln.js", "function": "walk", "id": "static-eval-1-1-1:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "static-eval-1-1-1", "project": "static-eval", "provenance": "human", "relpath": "index.js", "repo": "browserify/static-eval", "review_tier": "advisory", "split": "train", "year": 2019} +{"class": "code injection", "commit": "32f8efd072625e267aa7237d2daff35738c50d2a", "commit_url": "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a", "cve": "", "cwe": "CWE-94", "file": "static-eval-1-1-1/fixed.js", "function": "walk", "id": "static-eval-1-1-1:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "static-eval-1-1-1", "project": "static-eval", "provenance": "human", "relpath": "index.js", "repo": "browserify/static-eval", "review_tier": "advisory", "split": "train", "year": 2019} +{"class": "code injection", "commit": "aa21cfb64f47238c764d258d0faf7366a8487e36", "commit_url": "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a", "cve": "CVE-2020-7677", "cwe": "CWE-94", "file": "thenify-3-3-0/vuln.js", "function": "thenify", "id": "thenify-3-3-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "thenify-3-3-0", "project": "thenify", "provenance": "human", "relpath": "index.js", "repo": "thenables/thenify", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "code injection", "commit": "0d94a24eb933bc835d568f3009f4d269c4c4c17a", "commit_url": "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a", "cve": "CVE-2020-7677", "cwe": "CWE-94", "file": "thenify-3-3-0/fixed.js", "function": "thenify", "id": "thenify-3-3-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "thenify-3-3-0", "project": "thenify", "provenance": "human", "relpath": "index.js", "repo": "thenables/thenify", "review_tier": "advisory", "split": "holdout", "year": 2020} +{"class": "code injection", "commit": "ef646ccbbbd971e82719c83fc69f56a5585b3a01", "commit_url": "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66", "cve": "CVE-2021-23358", "cwe": "CWE-94", "file": "underscore-1-13-0-0/vuln.js", "function": "template", "id": "underscore-1-13-0-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "underscore-1-13-0-0", "project": "underscore", "provenance": "human", "relpath": "modules/template.js", "repo": "jashkenas/underscore", "review_tier": "advisory", "split": "train", "year": 2021} +{"class": "code injection", "commit": "4c73526d43838ad6ab43a6134728776632adeb66", "commit_url": "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66", "cve": "CVE-2021-23358", "cwe": "CWE-94", "file": "underscore-1-13-0-0/fixed.js", "function": "template", "id": "underscore-1-13-0-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "underscore-1-13-0-0", "project": "underscore", "provenance": "human", "relpath": "modules/template.js", "repo": "jashkenas/underscore", "review_tier": "advisory", "split": "train", "year": 2021} +{"class": "command injection", "commit": "b8b642b1163baa37f15ed49b4064dcbdb6e1876c", "commit_url": "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "cve": "CVE-2018-3772", "cwe": "CWE-78", "file": "whereis-0-4-0/vuln.js", "function": "whereis", "id": "whereis-0-4-0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "whereis-0-4-0", "project": "whereis", "provenance": "human", "relpath": "index.js", "repo": "vvo/node-whereis", "review_tier": "advisory", "split": "holdout", "year": 2018} +{"class": "command injection", "commit": "0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "commit_url": "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b", "cve": "CVE-2018-3772", "cwe": "CWE-78", "file": "whereis-0-4-0/fixed.js", "function": "whereis", "id": "whereis-0-4-0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "whereis-0-4-0", "project": "whereis", "provenance": "human", "relpath": "index.js", "repo": "vvo/node-whereis", "review_tier": "advisory", "split": "holdout", "year": 2018} diff --git a/benchmarks/pairs/vibe-py/catalog.toml b/benchmarks/pairs/vibe-py/catalog.toml index 48fb39e..5d06b1d 100644 --- a/benchmarks/pairs/vibe-py/catalog.toml +++ b/benchmarks/pairs/vibe-py/catalog.toml @@ -22,6 +22,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-78" @@ -50,6 +51,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -78,6 +80,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-78" @@ -106,6 +109,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -134,6 +138,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-502" @@ -162,6 +167,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -190,6 +196,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -218,6 +225,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-326" @@ -246,6 +254,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-78" @@ -274,6 +283,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -302,6 +312,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-16" @@ -330,6 +341,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-1004" @@ -358,6 +370,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -386,6 +399,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-502" @@ -414,6 +428,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -442,6 +457,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -470,6 +486,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-1336" @@ -498,6 +515,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-79" @@ -526,6 +544,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-862" @@ -554,6 +573,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-639" @@ -582,6 +602,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -610,6 +631,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-639" @@ -638,6 +660,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -666,6 +689,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-639" @@ -694,6 +718,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -722,6 +747,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -750,6 +776,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -778,6 +805,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-79" @@ -806,6 +834,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-22" @@ -834,6 +863,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-78" @@ -862,6 +892,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-78" @@ -890,6 +921,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-502" @@ -918,6 +950,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -946,6 +979,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "train" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" @@ -974,6 +1008,7 @@ min_recall = 1.0 fix_policy = "silent" provenance = "human" split = "holdout" +review_tier = "seeded" [[pair.expected]] cwe = "CWE-89" diff --git a/benchmarks/pairs/vibe-py/training/manifest.jsonl b/benchmarks/pairs/vibe-py/training/manifest.jsonl index f45416b..f0f38e8 100644 --- a/benchmarks/pairs/vibe-py/training/manifest.jsonl +++ b/benchmarks/pairs/vibe-py/training/manifest.jsonl @@ -1,70 +1,70 @@ -{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/vuln.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/fixed.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/vuln.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/fixed.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "holdout", "year": 2026} -{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/vuln.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/fixed.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/vuln.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/fixed.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "holdout", "year": 2026} -{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/vuln.py", "function": "reset_password", "id": "djangoat-views-reset-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "train", "year": 2026} -{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/fixed.py", "function": "reset_password", "id": "djangoat-views-reset-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/vuln.py", "function": "user_view", "id": "djangoat-views-user-view:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/fixed.py", "function": "user_view", "id": "djangoat-views-user-view:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/vuln.py", "function": "run", "id": "dsvpwa-attacks-run:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/fixed.py", "function": "run", "id": "dsvpwa-attacks-run:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "split": "train", "year": 2026} -{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/vuln.py", "function": "main", "id": "dsvpwa-dsvpwa-main:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "split": "holdout", "year": 2026} -{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/fixed.py", "function": "main", "id": "dsvpwa-dsvpwa-main:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "split": "holdout", "year": 2026} -{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/vuln.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/fixed.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/vuln.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:vuln", "label": "vuln", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/fixed.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:fixed", "label": "fixed", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "split": "holdout", "year": 2026} -{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/vuln.py", "function": "init", "id": "dvpwa-app-init:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "split": "train", "year": 2026} -{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/fixed.py", "function": "init", "id": "dvpwa-app-init:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "split": "train", "year": 2026} -{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/vuln.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "split": "holdout", "year": 2026} -{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/fixed.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/vuln.py", "function": "create", "id": "dvpwa-student-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/fixed.py", "function": "create", "id": "dvpwa-student-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "split": "train", "year": 2026} -{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/vuln.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "holdout", "year": 2026} -{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/fixed.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/vuln.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/fixed.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/vuln.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/fixed.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "split": "holdout", "year": 2026} -{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/vuln.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "split": "train", "year": 2026} -{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/fixed.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "split": "train", "year": 2026} -{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/vuln.py", "function": "read_root", "id": "pythonssti-main-read-root:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "split": "holdout", "year": 2026} -{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/fixed.py", "function": "read_root", "id": "pythonssti-main-read-root:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "split": "holdout", "year": 2026} -{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/vuln.py", "function": "delete", "id": "threatbyte-api-v1-delete:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "split": "train", "year": 2026} -{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/fixed.py", "function": "delete", "id": "threatbyte-api-v1-delete:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "split": "train", "year": 2026} -{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/vuln.py", "function": "get", "id": "threatbyte-api-v1-get:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "split": "holdout", "year": 2026} -{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/fixed.py", "function": "get", "id": "threatbyte-api-v1-get:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/vuln.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/fixed.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "split": "train", "year": 2026} -{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/vuln.py", "function": "get_by_title", "id": "vampi-books-get-by-title:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "split": "holdout", "year": 2026} -{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/fixed.py", "function": "get_by_title", "id": "vampi-books-get-by-title:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/vuln.py", "function": "get_user", "id": "vampi-user-model-get-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/fixed.py", "function": "get_user", "id": "vampi-user-model-get-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "split": "train", "year": 2026} -{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/vuln.py", "function": "update_password", "id": "vampi-users-update-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "split": "holdout", "year": 2026} -{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/fixed.py", "function": "update_password", "id": "vampi-users-update-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/vuln.py", "function": "delete_user", "id": "vfapi-main-delete-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/fixed.py", "function": "delete_user", "id": "vfapi-main-delete-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/vuln.py", "function": "put_user", "id": "vfapi-main-put-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/fixed.py", "function": "put_user", "id": "vfapi-main-put-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/vuln.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/fixed.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "split": "train", "year": 2026} -{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "split": "holdout", "year": 2026} -{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "split": "holdout", "year": 2026} -{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "split": "train", "year": 2026} -{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/vuln.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/fixed.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "train", "year": 2026} -{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/vuln.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "holdout", "year": 2026} -{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/fixed.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "holdout", "year": 2026} -{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/vuln.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "train", "year": 2026} -{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/fixed.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/vuln.py", "function": "create", "id": "vulpy-libuser-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/fixed.py", "function": "create", "id": "vulpy-libuser-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/vuln.py", "function": "login", "id": "vulpy-libuser-login:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/fixed.py", "function": "login", "id": "vulpy-libuser-login:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "train", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/vuln.py", "function": "password_change", "id": "vulpy-libuser-password-change:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "holdout", "year": 2026} -{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/fixed.py", "function": "password_change", "id": "vulpy-libuser-password-change:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "split": "holdout", "year": 2026} +{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/vuln.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/fixed.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/vuln.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/fixed.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/vuln.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/fixed.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/vuln.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/fixed.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/vuln.py", "function": "reset_password", "id": "djangoat-views-reset-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/fixed.py", "function": "reset_password", "id": "djangoat-views-reset-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/vuln.py", "function": "user_view", "id": "djangoat-views-user-view:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/fixed.py", "function": "user_view", "id": "djangoat-views-user-view:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/vuln.py", "function": "run", "id": "dsvpwa-attacks-run:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/fixed.py", "function": "run", "id": "dsvpwa-attacks-run:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/vuln.py", "function": "main", "id": "dsvpwa-dsvpwa-main:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/fixed.py", "function": "main", "id": "dsvpwa-dsvpwa-main:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/vuln.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/fixed.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/vuln.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:vuln", "label": "vuln", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/fixed.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:fixed", "label": "fixed", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/vuln.py", "function": "init", "id": "dvpwa-app-init:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/fixed.py", "function": "init", "id": "dvpwa-app-init:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/vuln.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/fixed.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/vuln.py", "function": "create", "id": "dvpwa-student-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/fixed.py", "function": "create", "id": "dvpwa-student-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/vuln.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/fixed.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/vuln.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/fixed.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/vuln.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/fixed.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/vuln.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/fixed.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/vuln.py", "function": "read_root", "id": "pythonssti-main-read-root:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/fixed.py", "function": "read_root", "id": "pythonssti-main-read-root:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/vuln.py", "function": "delete", "id": "threatbyte-api-v1-delete:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/fixed.py", "function": "delete", "id": "threatbyte-api-v1-delete:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/vuln.py", "function": "get", "id": "threatbyte-api-v1-get:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/fixed.py", "function": "get", "id": "threatbyte-api-v1-get:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/vuln.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/fixed.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/vuln.py", "function": "get_by_title", "id": "vampi-books-get-by-title:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/fixed.py", "function": "get_by_title", "id": "vampi-books-get-by-title:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/vuln.py", "function": "get_user", "id": "vampi-user-model-get-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/fixed.py", "function": "get_user", "id": "vampi-user-model-get-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/vuln.py", "function": "update_password", "id": "vampi-users-update-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/fixed.py", "function": "update_password", "id": "vampi-users-update-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/vuln.py", "function": "delete_user", "id": "vfapi-main-delete-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/fixed.py", "function": "delete_user", "id": "vfapi-main-delete-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/vuln.py", "function": "put_user", "id": "vfapi-main-put-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/fixed.py", "function": "put_user", "id": "vfapi-main-put-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/vuln.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/fixed.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/vuln.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/fixed.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/vuln.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/fixed.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/vuln.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/fixed.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/vuln.py", "function": "create", "id": "vulpy-libuser-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/fixed.py", "function": "create", "id": "vulpy-libuser-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/vuln.py", "function": "login", "id": "vulpy-libuser-login:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/fixed.py", "function": "login", "id": "vulpy-libuser-login:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "train", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/vuln.py", "function": "password_change", "id": "vulpy-libuser-password-change:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026} +{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/fixed.py", "function": "password_change", "id": "vulpy-libuser-password-change:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026} diff --git a/src/openultrasast/pairs.py b/src/openultrasast/pairs.py index ed33113..6aa7297 100644 --- a/src/openultrasast/pairs.py +++ b/src/openultrasast/pairs.py @@ -16,7 +16,7 @@ from __future__ import annotations import shutil import tempfile import tomllib -from collections.abc import Callable, Mapping, Sequence +from collections.abc import Callable, Iterable, Mapping, Sequence from dataclasses import asdict, dataclass, field, replace from functools import lru_cache from pathlib import Path @@ -55,6 +55,18 @@ FunctionRanges = dict[str, tuple[tuple[str, int, int], ...]] SLICE_NAMES = ("all", "local", "github", "sast", "vfc", "vibe-py", "vfc-js", "agent-vfc") PROVENANCES = frozenset({"human", "agent", "mixed", "synthetic"}) SPLITS = frozenset({"train", "holdout"}) +# Req 9: how a label was established. Only seeded and reviewed pairs steer the improve loop. +REVIEW_TIERS = frozenset({"seeded", "advisory", "title", "reviewed"}) +GATING_TIERS = frozenset({"seeded", "reviewed"}) +_DEFAULT_TIER = { + "local": "reviewed", + "github": "advisory", + "sast": "advisory", + "vfc": "advisory", + "vibe-py": "seeded", + "vfc-js": "advisory", + "agent-vfc": "title", +} _DEFAULT_PROVENANCE = {"sast": "synthetic", "local": "human", "github": "human", "vfc": "human"} _MANIFEST_MECHANISM = "source_reaches_sink" # cheat-sheet fixtures referenced via expected_from @@ -85,6 +97,8 @@ class PairCase: provenance: str = "human" split: str = "train" known_limit: str | None = None + review_tier: str = "advisory" + reviewer: str = "" @dataclass(frozen=True) @@ -117,6 +131,7 @@ class PairOutcome: unadjudicated_fixed: int = 0 detection_kinds: tuple[str, ...] = () unresolved_labels: int = 0 # expected rows whose function names no range on the vulnerable side + review_tier: str = "advisory" @dataclass(frozen=True) @@ -143,6 +158,7 @@ class PairEvalResult: signals: tuple[dict[str, object], ...] scorers: dict[str, dict[str, PairCorpusMetrics]] = field(default_factory=dict) per_profile: dict[str, PairCorpusMetrics] = field(default_factory=dict) + per_tier: dict[str, PairCorpusMetrics] = field(default_factory=dict) per_mechanism: dict[str, PairCorpusMetrics] = field(default_factory=dict) achievable: dict[str, PairCorpusMetrics] = field(default_factory=dict) known_limit: tuple[str, ...] = () @@ -205,6 +221,7 @@ def _load_catalog_file(path: Path) -> tuple[PairCase, ...]: if split not in SPLITS: raise CatalogError(f"pair {name}: unknown split {split!r}; expected train or holdout") known_limit = item.get("known_limit") + review_tier, reviewer = _review_tier(item, slice_name, name) cases.append( PairCase( name=name, @@ -225,11 +242,33 @@ def _load_catalog_file(path: Path) -> tuple[PairCase, ...]: provenance=provenance, split=split, known_limit=str(known_limit) if known_limit else None, + review_tier=review_tier, + reviewer=reviewer, ) ) return tuple(cases) +def _review_tier(item: dict[str, object], slice_name: str, name: str) -> tuple[str, str]: + """Tier from the row, else from ``reviewer`` (pending -> title, a name -> reviewed), else the slice default.""" + reviewer = str(item.get("reviewer", "") or "") + pending = reviewer.lower() == "pending" + explicit = item.get("review_tier") + if explicit is not None: + tier = str(explicit) + elif pending: + tier = "title" + elif reviewer: + tier = "reviewed" + else: + tier = _DEFAULT_TIER.get(slice_name, "advisory") + if tier not in REVIEW_TIERS: + raise CatalogError(f"pair {name}: unknown review_tier {tier!r}; expected one of {sorted(REVIEW_TIERS)}") + if tier == "reviewed" and (not reviewer or pending): + raise CatalogError(f"pair {name}: review_tier reviewed requires a named reviewer") + return tier, "" if pending else reviewer + + def evaluate_pair(case: PairCase, *, hunter: HunterScan | None = None, ruleset: tuple[PatternRule, ...] | None = None) -> PairOutcome: with tempfile.TemporaryDirectory(prefix="ousast-pair-") as scratch: vuln_root = _materialize(Path(scratch) / "vuln", case.vuln_file, case.relpath) @@ -279,6 +318,10 @@ def evaluate_catalog( profile: _metrics(tuple(item for item in outcomes if item.provenance == profile)) for profile in sorted({item.provenance for item in outcomes}) }, + per_tier={ + tier: _metrics(tuple(item for item in outcomes if item.review_tier == tier)) + for tier in sorted({item.review_tier for item in outcomes}) + }, per_mechanism={mechanism: _metrics(tuple(items)) for mechanism, items in sorted(per_mechanism.items())}, achievable={ slice_name: _metrics(tuple(item for item in achievable_outcomes if item.slice == slice_name)) @@ -317,6 +360,12 @@ def select_slice(cases: Sequence[PairCase], slice_name: str | None) -> tuple[Pai return tuple(case for case in cases if case.slice == slice_name) +def select_tier(cases: Sequence[PairCase], tiers: Iterable[str]) -> tuple[PairCase, ...]: + """Pairs whose review tier is in ``tiers`` (the improve loop passes GATING_TIERS).""" + wanted = frozenset(tiers) + return tuple(case for case in cases if case.review_tier in wanted) + + def select_profile(cases: Sequence[PairCase], profile: str | None) -> tuple[PairCase, ...]: if not profile or profile == "all": return tuple(cases) @@ -339,6 +388,7 @@ def result_payload(result: PairEvalResult) -> dict[str, object]: slice_name: {scorer: asdict(metrics) for scorer, metrics in inner.items()} for slice_name, inner in result.scorers.items() }, "per_profile": {name: asdict(metrics) for name, metrics in result.per_profile.items()}, + "per_tier": {name: asdict(metrics) for name, metrics in result.per_tier.items()}, "per_mechanism": {name: asdict(metrics) for name, metrics in result.per_mechanism.items()}, "achievable": {name: asdict(metrics) for name, metrics in result.achievable.items()}, "known_limit": list(result.known_limit), @@ -587,6 +637,7 @@ def _inventory_outcome( commit_url=case.commit_url, cve=case.cve, provenance=case.provenance, + review_tier=case.review_tier, mechanisms=_mechanisms(case), known_limit=case.known_limit, split=case.split, @@ -647,6 +698,7 @@ def _evaluate_overlay_pair(case: PairCase, vuln_root: Path, fix_root: Path, rule commit_url=case.commit_url, cve=case.cve, provenance=case.provenance, + review_tier=case.review_tier, mechanisms=_mechanisms(case), known_limit=case.known_limit, split=case.split, @@ -702,6 +754,7 @@ def _evaluate_hunter_pair(case: PairCase, vuln_root: Path, fix_root: Path, hunte commit_url=case.commit_url, cve=case.cve, provenance=case.provenance, + review_tier=case.review_tier, mechanisms=_mechanisms(case), known_limit=case.known_limit, split=case.split, diff --git a/tests/test_pair_corpus.py b/tests/test_pair_corpus.py index a93856e..e527333 100644 --- a/tests/test_pair_corpus.py +++ b/tests/test_pair_corpus.py @@ -453,9 +453,8 @@ def test_new_slices_load_offline_and_score_with_profiles() -> None: from openultrasast.pairs import PROVENANCES catalog = load_pair_catalog() - # agent-vfc rows enter the loaded catalog only after human review (Req 5.3); candidates wait in a separate file. - candidates = Path("benchmarks/pairs/agent-vfc/catalog-candidates.toml") - assert candidates.is_file() and "reviewer" in candidates.read_text() + # agent-vfc rows load at tier `title` (Req 9.4); the candidates file is retired. + assert not Path("benchmarks/pairs/agent-vfc/catalog-candidates.toml").exists() assert all(case.provenance == "agent" for case in select_slice(catalog, "agent-vfc")) for slice_name, expected_provenance in (("vibe-py", "human"), ("vfc-js", "human")): cases = select_slice(catalog, slice_name) @@ -619,15 +618,76 @@ def test_loader_rejects_reserved_words_as_function_labels(tmp_path: Path) -> Non _load_catalog_file(tmp_path / "bad.toml") -def test_agent_vfc_stays_empty_until_reviewed() -> None: +def test_agent_vfc_loads_at_title_tier_and_tiers_default_per_slice() -> None: + from openultrasast.pairs import REVIEW_TIERS + catalog = load_pair_catalog() loaded = select_slice(catalog, "agent-vfc") - candidates = Path("benchmarks/pairs/agent-vfc/catalog-candidates.toml") - # Req 5.3: nothing loads until a human sets `reviewer`; the candidates file must not be empty meanwhile. - assert candidates.is_file() and candidates.read_text().count("[[pair]]") >= 1 - assert loaded == () or all(case.provenance == "agent" for case in loaded) - reviewed_in_recipes = 'reviewer = "pending"' not in Path("benchmarks/pairs/agent-vfc/recipes.toml").read_text() - assert bool(loaded) == reviewed_in_recipes + # Req 9.4: `reviewer = "pending"` rows are the review queue; they load at tier `title` and never gate. + assert len(loaded) >= 1 + assert all(case.review_tier in {"title", "reviewed"} and case.provenance == "agent" for case in loaded) + assert all(case.review_tier == "title" for case in loaded if not case.reviewer) # pending rows are the review queue + assert all(case.review_tier in REVIEW_TIERS for case in catalog) + by_slice = { + slice_name: {case.review_tier for case in select_slice(catalog, slice_name)} + for slice_name in ("local", "sast", "vfc", "vibe-py", "vfc-js") + } + assert by_slice == {"local": {"reviewed"}, "sast": {"advisory"}, "vfc": {"advisory"}, "vibe-py": {"seeded"}, "vfc-js": {"advisory"}} + + +def test_reviewed_tier_requires_a_reviewer_and_unknown_tiers_are_rejected(tmp_path: Path) -> None: + from openultrasast.pairs import CatalogError, _load_catalog_file + + (tmp_path / "v.py").write_text("x = 1\n") + (tmp_path / "f.py").write_text("x = 1\n") + head = '[[pair]]\nname = "t"\nslice = "sast"\nvuln = "v.py"\nfixed = "f.py"\nrelpath = "app.py"\n' + tail = '\n[[pair.expected]]\ncwe = "CWE-95"\nclass = "x"\npath = "app.py"\nsink = "eval"\nmechanism = "other"\n' + (tmp_path / "no_reviewer.toml").write_text(head + 'review_tier = "reviewed"\n' + tail) + with pytest.raises(CatalogError, match="reviewer"): + _load_catalog_file(tmp_path / "no_reviewer.toml") + (tmp_path / "bad_tier.toml").write_text(head + 'review_tier = "guessed"\n' + tail) + with pytest.raises(CatalogError, match="unknown review_tier"): + _load_catalog_file(tmp_path / "bad_tier.toml") + (tmp_path / "ok.toml").write_text(head + 'review_tier = "reviewed"\nreviewer = "mc"\n' + tail) + (case,) = _load_catalog_file(tmp_path / "ok.toml") + assert case.review_tier == "reviewed" and case.reviewer == "mc" + (tmp_path / "pending.toml").write_text(head + 'reviewer = "pending"\n' + tail) + (pending,) = _load_catalog_file(tmp_path / "pending.toml") + assert pending.review_tier == "title" + + +def test_payload_reports_metrics_per_review_tier(tmp_path: Path) -> None: + from openultrasast.pairs import evaluate_catalog, result_payload, select_tier + + src = "from flask import request\n\ndef f():\n return eval(request.args.get('x'))\n" + row = ExpectedFinding( + cwe="CWE-95", vulnerability_class="code injection", path="app.py", evidence="", sink="eval", mechanism="source_reaches_sink" + ) + seeded = _case(tmp_path, "seeded", src, "def f():\n return 1\n", row) + title = _case(tmp_path, "title", src, "def f():\n return 1\n", row) + seeded = PairCase(**{**seeded.__dict__, "review_tier": "seeded"}) + title = PairCase(**{**title.__dict__, "review_tier": "title"}) + result = evaluate_catalog([seeded, title]) + payload = result_payload(result) + assert set(payload["per_tier"]) == {"seeded", "title"} + assert payload["per_tier"]["seeded"]["pairs"] == 1 + assert all(outcome["review_tier"] in {"seeded", "title"} for outcome in payload["outcomes"]) + assert select_tier([seeded, title], ("seeded", "reviewed")) == (seeded,) + + +def test_default_catalog_has_the_new_slices_on_disk_and_off_the_stage1_list() -> None: + catalog = load_pair_catalog() + assert {"vibe-py", "vfc-js", "agent-vfc"} <= {case.slice for case in catalog} # Req 8.1 + assert all(case.vuln_file.is_file() and case.fixed_file.is_file() for case in catalog) + stage1 = {name for names in LANGUAGE_MANIFESTS.values() for name in names} + assert not ({case.name for case in catalog} & stage1) + + +def test_cli_new_slices_exit_zero_with_tier_profile_and_mechanism_metrics(capsys: pytest.CaptureFixture[str]) -> None: + for slice_name in ("vibe-py", "vfc-js", "agent-vfc"): + assert main(["pairs", "--slice", slice_name, "--json"]) == 0 + payload = json.loads(capsys.readouterr().out) + assert payload["per_tier"] and payload["per_profile"] and "per_mechanism" in payload, slice_name # --- debug round after review 3: shared named ranges, containment-only matching -----