mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
feat(pair-corpus-honesty): review tiers on every pair, agent-vfc loads at tier title
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.
- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
github advisory, agent-vfc title); reviewer = "pending" means title, a
named reviewer means reviewed, reviewed without a reviewer is rejected;
per_tier metrics in the payload; select_tier and GATING_TIERS for the
improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
row and training manifest row; title rows enter catalog.toml; the
catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
9e7aef6a6b
commit
b1c5f36076
@@ -6,7 +6,8 @@ Security-fix commits carrying an AI coding agent co-author trailer or generation
|
||||
|
||||
## Review checklist (Req 5.3)
|
||||
|
||||
A recipe with `reviewer = "pending"` is a candidate, not a label. Before setting `reviewer`:
|
||||
A recipe with `reviewer = "pending"` loads at `review_tier = "title"`: scored and reported by `pairs`; the improve loop's
|
||||
profile gate uses only `seeded` and `reviewed` pairs (Req 9.3, task 8.2). Setting `reviewer` to your name promotes it to `reviewed`. Before doing so:
|
||||
|
||||
1. The parent excerpt really contains the vulnerability the title claims (not a refactor).
|
||||
2. One mechanism from `benchmarks/pairs/mechanisms.toml` explains it; adjust `mechanism` and `cwe`.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# agent-vfc candidate review sheet
|
||||
|
||||
Set `reviewer = "<name>"` in `recipes.toml` for each row you confirm (and fix `mechanism`/`cwe` if the title-based guess is wrong), then run `python benchmarks/pairs/catalog_gen.py --slice agent-vfc`. Rows without a reviewer stay in `catalog-candidates.toml` and are never scored.
|
||||
Set `reviewer = "<name>"` in `recipes.toml` for each row you confirm (and fix `mechanism`/`cwe` if the title-based guess is wrong), then run `python benchmarks/pairs/catalog_gen.py --slice agent-vfc`. Rows with `reviewer = "pending"` load at `review_tier = "title"`: they are scored and reported by `pairs --slice agent-vfc`, and never gate the improve loop (Req 9.3/9.4); a named reviewer promotes a row to `reviewed`.
|
||||
|
||||
| # | name | mechanism (guess) | cwe | language | commit | title |
|
||||
|---|------|-------------------|-----|----------|--------|-------|
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59
|
||||
// cve:
|
||||
// license: AGPL-3.0
|
||||
// function: next
|
||||
// function: createHono
|
||||
// relpath: supabase/functions/_backend/utils/hono.ts
|
||||
// provenance: agent
|
||||
// mechanism: permissive_default
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59
|
||||
// cve:
|
||||
// license: AGPL-3.0
|
||||
// function: next
|
||||
// function: createHono
|
||||
// relpath: supabase/functions/_backend/utils/hono.ts
|
||||
// provenance: agent
|
||||
// mechanism: permissive_default
|
||||
|
||||
@@ -1,819 +0,0 @@
|
||||
# CANDIDATES awaiting human review (reviewer = "pending"). Not loaded by load_pair_catalog.
|
||||
# Set `reviewer` in recipes.toml after confirming vulnerability, mechanism, and license; then regenerate.
|
||||
|
||||
# agent-vfc pair slice. Reviewed isolated functions with provenance.
|
||||
# Honesty dashboard — not the local 100% CI gate.
|
||||
# Do not add these names to LANGUAGE_MANIFESTS.
|
||||
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
|
||||
|
||||
[[pair]]
|
||||
name = "anastasios-pw-session-14ec1a"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "Anas329796/Anastasios"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "14ec1ac50f9e4e255d875236d30129c6207401d4"
|
||||
parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb"
|
||||
commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4"
|
||||
vuln = "anastasios-pw-session-14ec1a/vuln.ts"
|
||||
fixed = "anastasios-pw-session-14ec1a/fixed.ts"
|
||||
relpath = "extensions/browser/src/browser/pw-session.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "extensions/browser/src/browser/pw-session.ts"
|
||||
function = "isTopLevelNavigationRequest"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
||||
|
||||
[[pair]]
|
||||
name = "astroclaw-pw-session-1553a8"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "P1R4N351/astroclaw"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
||||
parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4"
|
||||
commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
||||
vuln = "astroclaw-pw-session-1553a8/vuln.ts"
|
||||
fixed = "astroclaw-pw-session-1553a8/fixed.ts"
|
||||
relpath = "extensions/browser/src/browser/pw-session.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "extensions/browser/src/browser/pw-session.ts"
|
||||
function = "isTopLevelNavigationRequest"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
||||
|
||||
[[pair]]
|
||||
name = "capgo-app-hono-4dadd2"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "AGPL-3.0"
|
||||
repo = "Cap-go/capgo.app"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "4dadd2580d02213d227a331eee0232aa59859b59"
|
||||
parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899"
|
||||
commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59"
|
||||
vuln = "capgo-app-hono-4dadd2/vuln.ts"
|
||||
fixed = "capgo-app-hono-4dadd2/fixed.ts"
|
||||
relpath = "supabase/functions/_backend/utils/hono.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "supabase/functions/_backend/utils/hono.ts"
|
||||
function = "next"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)"
|
||||
|
||||
[[pair]]
|
||||
name = "dnf-plugin-anyrepo-config-26d19a"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "jfut/dnf-plugin-anyrepo"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
||||
parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a"
|
||||
commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
||||
vuln = "dnf-plugin-anyrepo-config-26d19a/vuln.py"
|
||||
fixed = "dnf-plugin-anyrepo-config-26d19a/fixed.py"
|
||||
relpath = "dnf_plugin_anyrepo/config.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "dnf_plugin_anyrepo/config.py"
|
||||
function = "validate_repo_name"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(config): prevent path traversal in repository names"
|
||||
|
||||
[[pair]]
|
||||
name = "edutrace-page-ee7ba2"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "jardimdesoftware/edutrace"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
||||
parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd"
|
||||
commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
||||
vuln = "edutrace-page-ee7ba2/vuln.tsx"
|
||||
fixed = "edutrace-page-ee7ba2/fixed.tsx"
|
||||
relpath = "front/src/app/editar-anamnese/page.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "front/src/app/editar-anamnese/page.tsx"
|
||||
function = "handleInputChange"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado"
|
||||
|
||||
[[pair]]
|
||||
name = "etude-lexical-markdown-editorconfig-c61a8b"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/etude-lexical-markdown"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
||||
parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5"
|
||||
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
||||
vuln = "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts"
|
||||
fixed = "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts"
|
||||
relpath = "src/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: guard deepMergeInto against prototype pollution"
|
||||
|
||||
[[pair]]
|
||||
name = "etude-lexical-markdown-editorconfig-db4f54"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/etude-lexical-markdown"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "db4f54b1ab80ad596de6425e84f90aa781c49999"
|
||||
parent = "1c865815d05b072f4973388c3ac66b6696d9efde"
|
||||
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999"
|
||||
vuln = "etude-lexical-markdown-editorconfig-db4f54/vuln.ts"
|
||||
fixed = "etude-lexical-markdown-editorconfig-db4f54/fixed.ts"
|
||||
relpath = "src/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: make prototype pollution guard recognizable by CodeQL"
|
||||
|
||||
[[pair]]
|
||||
name = "lensops-kubernetesmanagement-fe4910"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "amitknigam84/lensops"
|
||||
cve = ""
|
||||
cwe = "CWE-862"
|
||||
commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
||||
parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748"
|
||||
commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
||||
vuln = "lensops-kubernetesmanagement-fe4910/vuln.tsx"
|
||||
fixed = "lensops-kubernetesmanagement-fe4910/fixed.tsx"
|
||||
relpath = "components/KubernetesManagement.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-862"
|
||||
class = "missing authorization"
|
||||
path = "components/KubernetesManagement.tsx"
|
||||
function = "setErrorMessage"
|
||||
mechanism = "missing_auth_guard"
|
||||
evidence = "Fix missing auth header on namespaces API call"
|
||||
|
||||
[[pair]]
|
||||
name = "market-cap-route-4f8ae9"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "navaneethbv/market-cap"
|
||||
cve = ""
|
||||
cwe = "CWE-601"
|
||||
commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
||||
parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602"
|
||||
commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
||||
vuln = "market-cap-route-4f8ae9/vuln.ts"
|
||||
fixed = "market-cap-route-4f8ae9/fixed.ts"
|
||||
relpath = "app/auth/confirm/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open redirect"
|
||||
path = "app/auth/confirm/route.ts"
|
||||
function = "GET"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "Fix open redirects on the auth next param"
|
||||
|
||||
[[pair]]
|
||||
name = "melodix-playerprovider-089931"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "alexshao3/melodix"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
||||
parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7"
|
||||
commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
||||
vuln = "melodix-playerprovider-089931/vuln.tsx"
|
||||
fixed = "melodix-playerprovider-089931/fixed.tsx"
|
||||
relpath = "apps/miniapp/src/components/PlayerProvider.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "apps/miniapp/src/components/PlayerProvider.tsx"
|
||||
function = "PlayerProvider"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors"
|
||||
|
||||
[[pair]]
|
||||
name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "handielson/Mercado-do-vale-news"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
||||
parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc"
|
||||
commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
||||
vuln = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts"
|
||||
fixed = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts"
|
||||
relpath = "services/catalogMetadataService.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "services/catalogMetadataService.ts"
|
||||
function = "fetchMetadata"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(catalog): avoid metadata cors preflight"
|
||||
|
||||
[[pair]]
|
||||
name = "money-track-category-icons-4d4a5b"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "andrebubniak/money-track"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
||||
parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2"
|
||||
commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
||||
vuln = "money-track-category-icons-4d4a5b/vuln.ts"
|
||||
fixed = "money-track-category-icons-4d4a5b/fixed.ts"
|
||||
relpath = "src/lib/category-icons.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/lib/category-icons.ts"
|
||||
function = "isCategoryIcon"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard"
|
||||
|
||||
[[pair]]
|
||||
name = "nestjs-filter-normalizer-aa0e60"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "DavideCarvalho/nestjs-filter"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
||||
parent = "d899b40d3466f2ffbe9f01c4d49267412401f078"
|
||||
commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
||||
vuln = "nestjs-filter-normalizer-aa0e60/vuln.ts"
|
||||
fixed = "nestjs-filter-normalizer-aa0e60/fixed.ts"
|
||||
relpath = "packages/core/src/input/normalizer.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "packages/core/src/input/normalizer.ts"
|
||||
function = "normalizeInput"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(core): add prototype pollution guard to normalizeInput"
|
||||
|
||||
[[pair]]
|
||||
name = "new-erp-final-app-6e9644"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "Sachin-Salgar/NEW_ERP_FINAL"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
||||
parent = "08976c5d7a07b0663669b875b4507446199f85d7"
|
||||
commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
||||
vuln = "new-erp-final-app-6e9644/vuln.ts"
|
||||
fixed = "new-erp-final-app-6e9644/fixed.ts"
|
||||
relpath = "src/presentation/http/app.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "src/presentation/http/app.ts"
|
||||
function = "origin"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix: allow patch requests through cors"
|
||||
|
||||
[[pair]]
|
||||
name = "nimestream-route-d17f53"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "Irnhakim/nimestream"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
||||
parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0"
|
||||
commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
||||
vuln = "nimestream-route-d17f53/vuln.js"
|
||||
fixed = "nimestream-route-d17f53/fixed.js"
|
||||
relpath = "app/api/img/route.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "app/api/img/route.js"
|
||||
function = "GET"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API"
|
||||
|
||||
[[pair]]
|
||||
name = "openniw-jobs-0fc947"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "HHHHHejia/openniw"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
||||
parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc"
|
||||
commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
||||
vuln = "openniw-jobs-0fc947/vuln.py"
|
||||
fixed = "openniw-jobs-0fc947/fixed.py"
|
||||
relpath = "backend/app/routers/jobs.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "backend/app/routers/jobs.py"
|
||||
function = "get_job"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
||||
|
||||
[[pair]]
|
||||
name = "openniw-jobs-b74de3"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "ziyuzuo/openniw"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
||||
parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e"
|
||||
commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
||||
vuln = "openniw-jobs-b74de3/vuln.py"
|
||||
fixed = "openniw-jobs-b74de3/fixed.py"
|
||||
relpath = "backend/app/routers/jobs.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "backend/app/routers/jobs.py"
|
||||
function = "get_job"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
||||
|
||||
[[pair]]
|
||||
name = "overleaf-with-claude-exportscontroller-3980b9"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "AGPL-3.0"
|
||||
repo = "ZUENS2020/overleaf-with-claude"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
||||
parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed"
|
||||
commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
||||
vuln = "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs"
|
||||
fixed = "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs"
|
||||
relpath = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
||||
function = "exportProject"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)"
|
||||
|
||||
[[pair]]
|
||||
name = "popmark-editorconfig-e5ac40"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/popmark"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "e5ac407cef37c37178d440541ede301c838640fb"
|
||||
parent = "31d1ac79b4cfa3118597348e79800a6561115149"
|
||||
commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb"
|
||||
vuln = "popmark-editorconfig-e5ac40/vuln.ts"
|
||||
fixed = "popmark-editorconfig-e5ac40/fixed.ts"
|
||||
relpath = "src/lexical-markdown/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/lexical-markdown/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: guard deepMergeInto against prototype pollution"
|
||||
|
||||
[[pair]]
|
||||
name = "rag-pipeline-utils-config-handler-76e5f0"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "DevilsDev/rag-pipeline-utils"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
||||
parent = "ba587867118f703632ff2dc63c4feb8ad6793420"
|
||||
commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
||||
vuln = "rag-pipeline-utils-config-handler-76e5f0/vuln.js"
|
||||
fixed = "rag-pipeline-utils-config-handler-76e5f0/fixed.js"
|
||||
relpath = "src/cli/handlers/config-handler.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/cli/handlers/config-handler.js"
|
||||
function = "handleConfigSet"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(security): prevent prototype pollution in config-handler"
|
||||
|
||||
[[pair]]
|
||||
name = "registry-proxy-worker-426847"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "agents-repo/registry-proxy"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
||||
parent = "6d5937972510cdb5ebca30607b538fdc2e280094"
|
||||
commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
||||
vuln = "registry-proxy-worker-426847/vuln.js"
|
||||
fixed = "registry-proxy-worker-426847/fixed.js"
|
||||
relpath = "src/worker.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "src/worker.js"
|
||||
function = "buildUpstreamRequest"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)"
|
||||
|
||||
[[pair]]
|
||||
name = "supplieradvisor-mvp-route-387bcf"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "bigfivefoods/supplieradvisor-mvp"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
||||
parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b"
|
||||
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
||||
vuln = "supplieradvisor-mvp-route-387bcf/vuln.ts"
|
||||
fixed = "supplieradvisor-mvp-route-387bcf/fixed.ts"
|
||||
relpath = "app/api/customers/claims/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "app/api/customers/claims/route.ts"
|
||||
function = "PATCH"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)"
|
||||
|
||||
[[pair]]
|
||||
name = "supplieradvisor-mvp-route-a69e8f"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "bigfivefoods/supplieradvisor-mvp"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
||||
parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c"
|
||||
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
||||
vuln = "supplieradvisor-mvp-route-a69e8f/vuln.ts"
|
||||
fixed = "supplieradvisor-mvp-route-a69e8f/fixed.ts"
|
||||
relpath = "app/api/customers/opportunities/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "app/api/customers/opportunities/route.ts"
|
||||
function = "GET"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)"
|
||||
|
||||
[[pair]]
|
||||
name = "tools-cli-tools-a96bc0"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "D-sorganization/Tools"
|
||||
cve = ""
|
||||
cwe = "CWE-78"
|
||||
commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
||||
parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864"
|
||||
commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
||||
vuln = "tools-cli-tools-a96bc0/vuln.py"
|
||||
fixed = "tools-cli-tools-a96bc0/fixed.py"
|
||||
relpath = "src/shared/python/ai/tools/cli_tools.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-78"
|
||||
class = "command injection"
|
||||
path = "src/shared/python/ai/tools/cli_tools.py"
|
||||
function = "_is_command_allowed"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)"
|
||||
|
||||
[[pair]]
|
||||
name = "trackly-cli-path-diagnostics-1c1aed"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "trackly-app/trackly-cli"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "1c1aed89b07edb04051830c8f086e02b65e961c6"
|
||||
parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60"
|
||||
commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6"
|
||||
vuln = "trackly-cli-path-diagnostics-1c1aed/vuln.js"
|
||||
fixed = "trackly-cli-path-diagnostics-1c1aed/fixed.js"
|
||||
relpath = "lib/path-diagnostics.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "lib/path-diagnostics.js"
|
||||
function = "inspectExistingAncestor"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(apply): report blocked path traversal"
|
||||
|
||||
[[pair]]
|
||||
name = "upstreamdrift-local-server-c3a078"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "D-sorganization/UpstreamDrift"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "c3a0787080489b30e2ed0abfac03b51e45da184b"
|
||||
parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc"
|
||||
commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b"
|
||||
vuln = "upstreamdrift-local-server-c3a078/vuln.py"
|
||||
fixed = "upstreamdrift-local-server-c3a078/fixed.py"
|
||||
relpath = "src/api/local_server.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "src/api/local_server.py"
|
||||
function = "_find_logo_file"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(api): harden local server path traversal (#2805) (#2839)"
|
||||
|
||||
[[pair]]
|
||||
name = "waggledance-swarm-ssrf-host-guard-9a4548"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "Ahkeratmehilaiset/waggledance-swarm"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
||||
parent = "934b939f1cca5259eaf807db3319eb97b90d8d80"
|
||||
commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
||||
vuln = "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py"
|
||||
fixed = "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py"
|
||||
relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
||||
function = "normalize_allowed_hosts"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)"
|
||||
|
||||
[[pair]]
|
||||
name = "workers-research-utils-209444"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "G4brym/workers-research"
|
||||
cve = ""
|
||||
cwe = "CWE-89"
|
||||
commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
||||
parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4"
|
||||
commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
||||
vuln = "workers-research-utils-209444/vuln.ts"
|
||||
fixed = "workers-research-utils-209444/fixed.ts"
|
||||
relpath = "src/utils.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-89"
|
||||
class = "sql injection"
|
||||
path = "src/utils.ts"
|
||||
function = "formatDuration"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "Fix SQL injection in search by using parameterized queries (#41)"
|
||||
|
||||
[[pair]]
|
||||
name = "zoonk-origin-bfbf67"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "zoonk/zoonk"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
||||
parent = "2604269350bff51f58572c133b45010cb0976a5a"
|
||||
commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
||||
vuln = "zoonk-origin-bfbf67/vuln.ts"
|
||||
fixed = "zoonk-origin-bfbf67/fixed.ts"
|
||||
relpath = "packages/utils/src/origin.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "packages/utils/src/origin.ts"
|
||||
function = "getAllowedHosts"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(api): allow staging cors from previews (#1559)"
|
||||
@@ -2,3 +2,846 @@
|
||||
# Honesty dashboard — not the local 100% CI gate.
|
||||
# Do not add these names to LANGUAGE_MANIFESTS.
|
||||
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
|
||||
|
||||
[[pair]]
|
||||
name = "anastasios-pw-session-14ec1a"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "Anas329796/Anastasios"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "14ec1ac50f9e4e255d875236d30129c6207401d4"
|
||||
parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb"
|
||||
commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4"
|
||||
vuln = "anastasios-pw-session-14ec1a/vuln.ts"
|
||||
fixed = "anastasios-pw-session-14ec1a/fixed.ts"
|
||||
relpath = "extensions/browser/src/browser/pw-session.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "extensions/browser/src/browser/pw-session.ts"
|
||||
function = "isTopLevelNavigationRequest"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
||||
|
||||
[[pair]]
|
||||
name = "astroclaw-pw-session-1553a8"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "P1R4N351/astroclaw"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
||||
parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4"
|
||||
commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
||||
vuln = "astroclaw-pw-session-1553a8/vuln.ts"
|
||||
fixed = "astroclaw-pw-session-1553a8/fixed.ts"
|
||||
relpath = "extensions/browser/src/browser/pw-session.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "extensions/browser/src/browser/pw-session.ts"
|
||||
function = "isTopLevelNavigationRequest"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
||||
|
||||
[[pair]]
|
||||
name = "capgo-app-hono-4dadd2"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "AGPL-3.0"
|
||||
repo = "Cap-go/capgo.app"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "4dadd2580d02213d227a331eee0232aa59859b59"
|
||||
parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899"
|
||||
commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59"
|
||||
vuln = "capgo-app-hono-4dadd2/vuln.ts"
|
||||
fixed = "capgo-app-hono-4dadd2/fixed.ts"
|
||||
relpath = "supabase/functions/_backend/utils/hono.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "supabase/functions/_backend/utils/hono.ts"
|
||||
function = "createHono"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)"
|
||||
|
||||
[[pair]]
|
||||
name = "dnf-plugin-anyrepo-config-26d19a"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "jfut/dnf-plugin-anyrepo"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
||||
parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a"
|
||||
commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
||||
vuln = "dnf-plugin-anyrepo-config-26d19a/vuln.py"
|
||||
fixed = "dnf-plugin-anyrepo-config-26d19a/fixed.py"
|
||||
relpath = "dnf_plugin_anyrepo/config.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "dnf_plugin_anyrepo/config.py"
|
||||
function = "validate_repo_name"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(config): prevent path traversal in repository names"
|
||||
|
||||
[[pair]]
|
||||
name = "edutrace-page-ee7ba2"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "jardimdesoftware/edutrace"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
||||
parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd"
|
||||
commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
||||
vuln = "edutrace-page-ee7ba2/vuln.tsx"
|
||||
fixed = "edutrace-page-ee7ba2/fixed.tsx"
|
||||
relpath = "front/src/app/editar-anamnese/page.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "front/src/app/editar-anamnese/page.tsx"
|
||||
function = "handleInputChange"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado"
|
||||
|
||||
[[pair]]
|
||||
name = "etude-lexical-markdown-editorconfig-c61a8b"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/etude-lexical-markdown"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
||||
parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5"
|
||||
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
||||
vuln = "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts"
|
||||
fixed = "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts"
|
||||
relpath = "src/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: guard deepMergeInto against prototype pollution"
|
||||
|
||||
[[pair]]
|
||||
name = "etude-lexical-markdown-editorconfig-db4f54"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/etude-lexical-markdown"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "db4f54b1ab80ad596de6425e84f90aa781c49999"
|
||||
parent = "1c865815d05b072f4973388c3ac66b6696d9efde"
|
||||
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999"
|
||||
vuln = "etude-lexical-markdown-editorconfig-db4f54/vuln.ts"
|
||||
fixed = "etude-lexical-markdown-editorconfig-db4f54/fixed.ts"
|
||||
relpath = "src/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: make prototype pollution guard recognizable by CodeQL"
|
||||
|
||||
[[pair]]
|
||||
name = "lensops-kubernetesmanagement-fe4910"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "amitknigam84/lensops"
|
||||
cve = ""
|
||||
cwe = "CWE-862"
|
||||
commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
||||
parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748"
|
||||
commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
||||
vuln = "lensops-kubernetesmanagement-fe4910/vuln.tsx"
|
||||
fixed = "lensops-kubernetesmanagement-fe4910/fixed.tsx"
|
||||
relpath = "components/KubernetesManagement.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-862"
|
||||
class = "missing authorization"
|
||||
path = "components/KubernetesManagement.tsx"
|
||||
function = "setErrorMessage"
|
||||
mechanism = "missing_auth_guard"
|
||||
evidence = "Fix missing auth header on namespaces API call"
|
||||
|
||||
[[pair]]
|
||||
name = "market-cap-route-4f8ae9"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "navaneethbv/market-cap"
|
||||
cve = ""
|
||||
cwe = "CWE-601"
|
||||
commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
||||
parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602"
|
||||
commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
||||
vuln = "market-cap-route-4f8ae9/vuln.ts"
|
||||
fixed = "market-cap-route-4f8ae9/fixed.ts"
|
||||
relpath = "app/auth/confirm/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-601"
|
||||
class = "open redirect"
|
||||
path = "app/auth/confirm/route.ts"
|
||||
function = "GET"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "Fix open redirects on the auth next param"
|
||||
|
||||
[[pair]]
|
||||
name = "melodix-playerprovider-089931"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "alexshao3/melodix"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
||||
parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7"
|
||||
commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
||||
vuln = "melodix-playerprovider-089931/vuln.tsx"
|
||||
fixed = "melodix-playerprovider-089931/fixed.tsx"
|
||||
relpath = "apps/miniapp/src/components/PlayerProvider.tsx"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "apps/miniapp/src/components/PlayerProvider.tsx"
|
||||
function = "PlayerProvider"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors"
|
||||
|
||||
[[pair]]
|
||||
name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "handielson/Mercado-do-vale-news"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
||||
parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc"
|
||||
commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
||||
vuln = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts"
|
||||
fixed = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts"
|
||||
relpath = "services/catalogMetadataService.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "services/catalogMetadataService.ts"
|
||||
function = "fetchMetadata"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(catalog): avoid metadata cors preflight"
|
||||
|
||||
[[pair]]
|
||||
name = "money-track-category-icons-4d4a5b"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "andrebubniak/money-track"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
||||
parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2"
|
||||
commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
||||
vuln = "money-track-category-icons-4d4a5b/vuln.ts"
|
||||
fixed = "money-track-category-icons-4d4a5b/fixed.ts"
|
||||
relpath = "src/lib/category-icons.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/lib/category-icons.ts"
|
||||
function = "isCategoryIcon"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard"
|
||||
|
||||
[[pair]]
|
||||
name = "nestjs-filter-normalizer-aa0e60"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "DavideCarvalho/nestjs-filter"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
||||
parent = "d899b40d3466f2ffbe9f01c4d49267412401f078"
|
||||
commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
||||
vuln = "nestjs-filter-normalizer-aa0e60/vuln.ts"
|
||||
fixed = "nestjs-filter-normalizer-aa0e60/fixed.ts"
|
||||
relpath = "packages/core/src/input/normalizer.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "packages/core/src/input/normalizer.ts"
|
||||
function = "normalizeInput"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix(core): add prototype pollution guard to normalizeInput"
|
||||
|
||||
[[pair]]
|
||||
name = "new-erp-final-app-6e9644"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "Sachin-Salgar/NEW_ERP_FINAL"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
||||
parent = "08976c5d7a07b0663669b875b4507446199f85d7"
|
||||
commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
||||
vuln = "new-erp-final-app-6e9644/vuln.ts"
|
||||
fixed = "new-erp-final-app-6e9644/fixed.ts"
|
||||
relpath = "src/presentation/http/app.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "src/presentation/http/app.ts"
|
||||
function = "origin"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix: allow patch requests through cors"
|
||||
|
||||
[[pair]]
|
||||
name = "nimestream-route-d17f53"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "Irnhakim/nimestream"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
||||
parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0"
|
||||
commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
||||
vuln = "nimestream-route-d17f53/vuln.js"
|
||||
fixed = "nimestream-route-d17f53/fixed.js"
|
||||
relpath = "app/api/img/route.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "app/api/img/route.js"
|
||||
function = "GET"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API"
|
||||
|
||||
[[pair]]
|
||||
name = "openniw-jobs-0fc947"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "HHHHHejia/openniw"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
||||
parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc"
|
||||
commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
||||
vuln = "openniw-jobs-0fc947/vuln.py"
|
||||
fixed = "openniw-jobs-0fc947/fixed.py"
|
||||
relpath = "backend/app/routers/jobs.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "backend/app/routers/jobs.py"
|
||||
function = "get_job"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
||||
|
||||
[[pair]]
|
||||
name = "openniw-jobs-b74de3"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "ziyuzuo/openniw"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
||||
parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e"
|
||||
commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
||||
vuln = "openniw-jobs-b74de3/vuln.py"
|
||||
fixed = "openniw-jobs-b74de3/fixed.py"
|
||||
relpath = "backend/app/routers/jobs.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "backend/app/routers/jobs.py"
|
||||
function = "get_job"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
||||
|
||||
[[pair]]
|
||||
name = "overleaf-with-claude-exportscontroller-3980b9"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "AGPL-3.0"
|
||||
repo = "ZUENS2020/overleaf-with-claude"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
||||
parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed"
|
||||
commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
||||
vuln = "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs"
|
||||
fixed = "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs"
|
||||
relpath = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
||||
function = "exportProject"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)"
|
||||
|
||||
[[pair]]
|
||||
name = "popmark-editorconfig-e5ac40"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "dayflower/popmark"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "e5ac407cef37c37178d440541ede301c838640fb"
|
||||
parent = "31d1ac79b4cfa3118597348e79800a6561115149"
|
||||
commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb"
|
||||
vuln = "popmark-editorconfig-e5ac40/vuln.ts"
|
||||
fixed = "popmark-editorconfig-e5ac40/fixed.ts"
|
||||
relpath = "src/lexical-markdown/config/editorConfig.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/lexical-markdown/config/editorConfig.ts"
|
||||
function = "deepMergeInto"
|
||||
mechanism = "prototype_pollution"
|
||||
evidence = "fix: guard deepMergeInto against prototype pollution"
|
||||
|
||||
[[pair]]
|
||||
name = "rag-pipeline-utils-config-handler-76e5f0"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "DevilsDev/rag-pipeline-utils"
|
||||
cve = ""
|
||||
cwe = "CWE-1321"
|
||||
commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
||||
parent = "ba587867118f703632ff2dc63c4feb8ad6793420"
|
||||
commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
||||
vuln = "rag-pipeline-utils-config-handler-76e5f0/vuln.js"
|
||||
fixed = "rag-pipeline-utils-config-handler-76e5f0/fixed.js"
|
||||
relpath = "src/cli/handlers/config-handler.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-1321"
|
||||
class = "prototype pollution"
|
||||
path = "src/cli/handlers/config-handler.js"
|
||||
function = "handleConfigSet"
|
||||
mechanism = "prototype_pollution"
|
||||
sink = "path"
|
||||
evidence = "fix(security): prevent prototype pollution in config-handler"
|
||||
|
||||
[[pair]]
|
||||
name = "registry-proxy-worker-426847"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "agents-repo/registry-proxy"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
||||
parent = "6d5937972510cdb5ebca30607b538fdc2e280094"
|
||||
commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
||||
vuln = "registry-proxy-worker-426847/vuln.js"
|
||||
fixed = "registry-proxy-worker-426847/fixed.js"
|
||||
relpath = "src/worker.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "src/worker.js"
|
||||
function = "buildUpstreamRequest"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)"
|
||||
|
||||
[[pair]]
|
||||
name = "supplieradvisor-mvp-route-387bcf"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "bigfivefoods/supplieradvisor-mvp"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
||||
parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b"
|
||||
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
||||
vuln = "supplieradvisor-mvp-route-387bcf/vuln.ts"
|
||||
fixed = "supplieradvisor-mvp-route-387bcf/fixed.ts"
|
||||
relpath = "app/api/customers/claims/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "app/api/customers/claims/route.ts"
|
||||
function = "PATCH"
|
||||
mechanism = "identity_from_request_body"
|
||||
evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)"
|
||||
|
||||
[[pair]]
|
||||
name = "supplieradvisor-mvp-route-a69e8f"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "bigfivefoods/supplieradvisor-mvp"
|
||||
cve = ""
|
||||
cwe = "CWE-639"
|
||||
commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
||||
parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c"
|
||||
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
||||
vuln = "supplieradvisor-mvp-route-a69e8f/vuln.ts"
|
||||
fixed = "supplieradvisor-mvp-route-a69e8f/fixed.ts"
|
||||
relpath = "app/api/customers/opportunities/route.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-639"
|
||||
class = "insecure direct object reference"
|
||||
path = "app/api/customers/opportunities/route.ts"
|
||||
function = "GET"
|
||||
mechanism = "identity_from_request_body"
|
||||
sink = "path"
|
||||
evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)"
|
||||
|
||||
[[pair]]
|
||||
name = "tools-cli-tools-a96bc0"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "D-sorganization/Tools"
|
||||
cve = ""
|
||||
cwe = "CWE-78"
|
||||
commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
||||
parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864"
|
||||
commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
||||
vuln = "tools-cli-tools-a96bc0/vuln.py"
|
||||
fixed = "tools-cli-tools-a96bc0/fixed.py"
|
||||
relpath = "src/shared/python/ai/tools/cli_tools.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-78"
|
||||
class = "command injection"
|
||||
path = "src/shared/python/ai/tools/cli_tools.py"
|
||||
function = "_is_command_allowed"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)"
|
||||
|
||||
[[pair]]
|
||||
name = "trackly-cli-path-diagnostics-1c1aed"
|
||||
slice = "agent-vfc"
|
||||
language = "javascript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "trackly-app/trackly-cli"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "1c1aed89b07edb04051830c8f086e02b65e961c6"
|
||||
parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60"
|
||||
commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6"
|
||||
vuln = "trackly-cli-path-diagnostics-1c1aed/vuln.js"
|
||||
fixed = "trackly-cli-path-diagnostics-1c1aed/fixed.js"
|
||||
relpath = "lib/path-diagnostics.js"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "lib/path-diagnostics.js"
|
||||
function = "inspectExistingAncestor"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(apply): report blocked path traversal"
|
||||
|
||||
[[pair]]
|
||||
name = "upstreamdrift-local-server-c3a078"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "D-sorganization/UpstreamDrift"
|
||||
cve = ""
|
||||
cwe = "CWE-22"
|
||||
commit = "c3a0787080489b30e2ed0abfac03b51e45da184b"
|
||||
parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc"
|
||||
commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b"
|
||||
vuln = "upstreamdrift-local-server-c3a078/vuln.py"
|
||||
fixed = "upstreamdrift-local-server-c3a078/fixed.py"
|
||||
relpath = "src/api/local_server.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-22"
|
||||
class = "path traversal"
|
||||
path = "src/api/local_server.py"
|
||||
function = "_find_logo_file"
|
||||
mechanism = "path_join_user_input"
|
||||
evidence = "fix(api): harden local server path traversal (#2805) (#2839)"
|
||||
|
||||
[[pair]]
|
||||
name = "waggledance-swarm-ssrf-host-guard-9a4548"
|
||||
slice = "agent-vfc"
|
||||
language = "python"
|
||||
origin = "github-agent-trailer"
|
||||
license = "Apache-2.0"
|
||||
repo = "Ahkeratmehilaiset/waggledance-swarm"
|
||||
cve = ""
|
||||
cwe = "CWE-918"
|
||||
commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
||||
parent = "934b939f1cca5259eaf807db3319eb97b90d8d80"
|
||||
commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
||||
vuln = "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py"
|
||||
fixed = "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py"
|
||||
relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-918"
|
||||
class = "server-side request forgery"
|
||||
path = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
||||
function = "normalize_allowed_hosts"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)"
|
||||
|
||||
[[pair]]
|
||||
name = "workers-research-utils-209444"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "G4brym/workers-research"
|
||||
cve = ""
|
||||
cwe = "CWE-89"
|
||||
commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
||||
parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4"
|
||||
commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
||||
vuln = "workers-research-utils-209444/vuln.ts"
|
||||
fixed = "workers-research-utils-209444/fixed.ts"
|
||||
relpath = "src/utils.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "holdout"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-89"
|
||||
class = "sql injection"
|
||||
path = "src/utils.ts"
|
||||
function = "normalizeDomain"
|
||||
mechanism = "source_reaches_sink"
|
||||
evidence = "Fix SQL injection in search by using parameterized queries (#41)"
|
||||
|
||||
[[pair]]
|
||||
name = "zoonk-origin-bfbf67"
|
||||
slice = "agent-vfc"
|
||||
language = "typescript"
|
||||
origin = "github-agent-trailer"
|
||||
license = "MIT"
|
||||
repo = "zoonk/zoonk"
|
||||
cve = ""
|
||||
cwe = "CWE-16"
|
||||
commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
||||
parent = "2604269350bff51f58572c133b45010cb0976a5a"
|
||||
commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
||||
vuln = "zoonk-origin-bfbf67/vuln.ts"
|
||||
fixed = "zoonk-origin-bfbf67/fixed.ts"
|
||||
relpath = "packages/utils/src/origin.ts"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
provenance = "agent"
|
||||
split = "train"
|
||||
review_tier = "title"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-16"
|
||||
class = "permissive default"
|
||||
path = "packages/utils/src/origin.ts"
|
||||
function = "getAllowedHosts"
|
||||
mechanism = "permissive_default"
|
||||
evidence = "fix(api): allow staging cors from previews (#1559)"
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
{"class": "server-side request forgery", "commit": "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb", "commit_url": "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4", "cve": "", "cwe": "CWE-918", "file": "anastasios-pw-session-14ec1a/vuln.ts", "function": "isTopLevelNavigationRequest", "id": "anastasios-pw-session-14ec1a:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "anastasios-pw-session-14ec1a", "project": "Anastasios", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "Anas329796/Anastasios", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "14ec1ac50f9e4e255d875236d30129c6207401d4", "commit_url": "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4", "cve": "", "cwe": "CWE-918", "file": "anastasios-pw-session-14ec1a/fixed.ts", "function": "isTopLevelNavigationRequest", "id": "anastasios-pw-session-14ec1a:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "anastasios-pw-session-14ec1a", "project": "Anastasios", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "Anas329796/Anastasios", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "d3eed2dc01328f21dd404477bb28e2740fa371a4", "commit_url": "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "cve": "", "cwe": "CWE-918", "file": "astroclaw-pw-session-1553a8/vuln.ts", "function": "isTopLevelNavigationRequest", "id": "astroclaw-pw-session-1553a8:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "astroclaw-pw-session-1553a8", "project": "astroclaw", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "P1R4N351/astroclaw", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "commit_url": "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", "cve": "", "cwe": "CWE-918", "file": "astroclaw-pw-session-1553a8/fixed.ts", "function": "isTopLevelNavigationRequest", "id": "astroclaw-pw-session-1553a8:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "astroclaw-pw-session-1553a8", "project": "astroclaw", "provenance": "agent", "relpath": "extensions/browser/src/browser/pw-session.ts", "repo": "P1R4N351/astroclaw", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "8c0ac7e233946abd8dc26581b871e9fcd0928899", "commit_url": "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59", "cve": "", "cwe": "CWE-16", "file": "capgo-app-hono-4dadd2/vuln.ts", "function": "createHono", "id": "capgo-app-hono-4dadd2:vuln", "label": "vuln", "license": "AGPL-3.0", "mechanism": "permissive_default", "pair": "capgo-app-hono-4dadd2", "project": "capgo.app", "provenance": "agent", "relpath": "supabase/functions/_backend/utils/hono.ts", "repo": "Cap-go/capgo.app", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "4dadd2580d02213d227a331eee0232aa59859b59", "commit_url": "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59", "cve": "", "cwe": "CWE-16", "file": "capgo-app-hono-4dadd2/fixed.ts", "function": "createHono", "id": "capgo-app-hono-4dadd2:fixed", "label": "fixed", "license": "AGPL-3.0", "mechanism": "permissive_default", "pair": "capgo-app-hono-4dadd2", "project": "capgo.app", "provenance": "agent", "relpath": "supabase/functions/_backend/utils/hono.ts", "repo": "Cap-go/capgo.app", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "path traversal", "commit": "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a", "commit_url": "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "cve": "", "cwe": "CWE-22", "file": "dnf-plugin-anyrepo-config-26d19a/vuln.py", "function": "validate_repo_name", "id": "dnf-plugin-anyrepo-config-26d19a:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "dnf-plugin-anyrepo-config-26d19a", "project": "dnf-plugin-anyrepo", "provenance": "agent", "relpath": "dnf_plugin_anyrepo/config.py", "repo": "jfut/dnf-plugin-anyrepo", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "path traversal", "commit": "26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "commit_url": "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0", "cve": "", "cwe": "CWE-22", "file": "dnf-plugin-anyrepo-config-26d19a/fixed.py", "function": "validate_repo_name", "id": "dnf-plugin-anyrepo-config-26d19a:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "path_join_user_input", "pair": "dnf-plugin-anyrepo-config-26d19a", "project": "dnf-plugin-anyrepo", "provenance": "agent", "relpath": "dnf_plugin_anyrepo/config.py", "repo": "jfut/dnf-plugin-anyrepo", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd", "commit_url": "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "cve": "", "cwe": "CWE-1321", "file": "edutrace-page-ee7ba2/vuln.tsx", "function": "handleInputChange", "id": "edutrace-page-ee7ba2:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "prototype_pollution", "pair": "edutrace-page-ee7ba2", "project": "edutrace", "provenance": "agent", "relpath": "front/src/app/editar-anamnese/page.tsx", "repo": "jardimdesoftware/edutrace", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "commit_url": "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", "cve": "", "cwe": "CWE-1321", "file": "edutrace-page-ee7ba2/fixed.tsx", "function": "handleInputChange", "id": "edutrace-page-ee7ba2:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "prototype_pollution", "pair": "edutrace-page-ee7ba2", "project": "edutrace", "provenance": "agent", "relpath": "front/src/app/editar-anamnese/page.tsx", "repo": "jardimdesoftware/edutrace", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "0a2184f59e79a04b1365cd49200026e8f2ffdbd5", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-c61a8b:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-c61a8b", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-c61a8b:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-c61a8b", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "1c865815d05b072f4973388c3ac66b6696d9efde", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-db4f54/vuln.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-db4f54:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-db4f54", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "db4f54b1ab80ad596de6425e84f90aa781c49999", "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999", "cve": "", "cwe": "CWE-1321", "file": "etude-lexical-markdown-editorconfig-db4f54/fixed.ts", "function": "deepMergeInto", "id": "etude-lexical-markdown-editorconfig-db4f54:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "etude-lexical-markdown-editorconfig-db4f54", "project": "etude-lexical-markdown", "provenance": "agent", "relpath": "src/config/editorConfig.ts", "repo": "dayflower/etude-lexical-markdown", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "missing authorization", "commit": "9b87ecc3a44a7fe2a5185cca1fe52441647d5748", "commit_url": "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "cve": "", "cwe": "CWE-862", "file": "lensops-kubernetesmanagement-fe4910/vuln.tsx", "function": "setErrorMessage", "id": "lensops-kubernetesmanagement-fe4910:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "lensops-kubernetesmanagement-fe4910", "project": "lensops", "provenance": "agent", "relpath": "components/KubernetesManagement.tsx", "repo": "amitknigam84/lensops", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "missing authorization", "commit": "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "commit_url": "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", "cve": "", "cwe": "CWE-862", "file": "lensops-kubernetesmanagement-fe4910/fixed.tsx", "function": "setErrorMessage", "id": "lensops-kubernetesmanagement-fe4910:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "lensops-kubernetesmanagement-fe4910", "project": "lensops", "provenance": "agent", "relpath": "components/KubernetesManagement.tsx", "repo": "amitknigam84/lensops", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "open redirect", "commit": "fec6f024ce72c9c47b61cbac6ce7a35cb2280602", "commit_url": "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "cve": "", "cwe": "CWE-601", "file": "market-cap-route-4f8ae9/vuln.ts", "function": "GET", "id": "market-cap-route-4f8ae9:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "market-cap-route-4f8ae9", "project": "market-cap", "provenance": "agent", "relpath": "app/auth/confirm/route.ts", "repo": "navaneethbv/market-cap", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "open redirect", "commit": "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "commit_url": "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", "cve": "", "cwe": "CWE-601", "file": "market-cap-route-4f8ae9/fixed.ts", "function": "GET", "id": "market-cap-route-4f8ae9:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "market-cap-route-4f8ae9", "project": "market-cap", "provenance": "agent", "relpath": "app/auth/confirm/route.ts", "repo": "navaneethbv/market-cap", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "permissive default", "commit": "c074fc7413338aefcbea3170ef4d3ba486a8a4b7", "commit_url": "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13", "cve": "", "cwe": "CWE-16", "file": "melodix-playerprovider-089931/vuln.tsx", "function": "PlayerProvider", "id": "melodix-playerprovider-089931:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "melodix-playerprovider-089931", "project": "melodix", "provenance": "agent", "relpath": "apps/miniapp/src/components/PlayerProvider.tsx", "repo": "alexshao3/melodix", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "089931ef71ea1e5b7586520baf1a5498e2f05b13", "commit_url": "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13", "cve": "", "cwe": "CWE-16", "file": "melodix-playerprovider-089931/fixed.tsx", "function": "PlayerProvider", "id": "melodix-playerprovider-089931:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "melodix-playerprovider-089931", "project": "melodix", "provenance": "agent", "relpath": "apps/miniapp/src/components/PlayerProvider.tsx", "repo": "alexshao3/melodix", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "70ca282b819ac1d60f4b5e665d224b1043ff1ccc", "commit_url": "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598", "cve": "", "cwe": "CWE-16", "file": "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts", "function": "fetchMetadata", "id": "mercado-do-vale-news-catalogmetadataservice-9b5fcf:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", "project": "Mercado-do-vale-news", "provenance": "agent", "relpath": "services/catalogMetadataService.ts", "repo": "handielson/Mercado-do-vale-news", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "permissive default", "commit": "9b5fcf2dae41e56f5f97952266f2d6ba59598598", "commit_url": "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598", "cve": "", "cwe": "CWE-16", "file": "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts", "function": "fetchMetadata", "id": "mercado-do-vale-news-catalogmetadataservice-9b5fcf:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", "project": "Mercado-do-vale-news", "provenance": "agent", "relpath": "services/catalogMetadataService.ts", "repo": "handielson/Mercado-do-vale-news", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "add96df6d6a6b61506635c23dbacf6c6cfe24dc2", "commit_url": "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "cve": "", "cwe": "CWE-1321", "file": "money-track-category-icons-4d4a5b/vuln.ts", "function": "isCategoryIcon", "id": "money-track-category-icons-4d4a5b:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "money-track-category-icons-4d4a5b", "project": "money-track", "provenance": "agent", "relpath": "src/lib/category-icons.ts", "repo": "andrebubniak/money-track", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "commit_url": "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0", "cve": "", "cwe": "CWE-1321", "file": "money-track-category-icons-4d4a5b/fixed.ts", "function": "isCategoryIcon", "id": "money-track-category-icons-4d4a5b:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "money-track-category-icons-4d4a5b", "project": "money-track", "provenance": "agent", "relpath": "src/lib/category-icons.ts", "repo": "andrebubniak/money-track", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "d899b40d3466f2ffbe9f01c4d49267412401f078", "commit_url": "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8", "cve": "", "cwe": "CWE-1321", "file": "nestjs-filter-normalizer-aa0e60/vuln.ts", "function": "normalizeInput", "id": "nestjs-filter-normalizer-aa0e60:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "nestjs-filter-normalizer-aa0e60", "project": "nestjs-filter", "provenance": "agent", "relpath": "packages/core/src/input/normalizer.ts", "repo": "DavideCarvalho/nestjs-filter", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "aa0e600d05997ea3d77538ea1c2db427c439f2e8", "commit_url": "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8", "cve": "", "cwe": "CWE-1321", "file": "nestjs-filter-normalizer-aa0e60/fixed.ts", "function": "normalizeInput", "id": "nestjs-filter-normalizer-aa0e60:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "nestjs-filter-normalizer-aa0e60", "project": "nestjs-filter", "provenance": "agent", "relpath": "packages/core/src/input/normalizer.ts", "repo": "DavideCarvalho/nestjs-filter", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "permissive default", "commit": "08976c5d7a07b0663669b875b4507446199f85d7", "commit_url": "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59", "cve": "", "cwe": "CWE-16", "file": "new-erp-final-app-6e9644/vuln.ts", "function": "origin", "id": "new-erp-final-app-6e9644:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "permissive_default", "pair": "new-erp-final-app-6e9644", "project": "NEW_ERP_FINAL", "provenance": "agent", "relpath": "src/presentation/http/app.ts", "repo": "Sachin-Salgar/NEW_ERP_FINAL", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "6e9644c81ce3fb356669157182a5ef09a70c4b59", "commit_url": "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59", "cve": "", "cwe": "CWE-16", "file": "new-erp-final-app-6e9644/fixed.ts", "function": "origin", "id": "new-erp-final-app-6e9644:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "permissive_default", "pair": "new-erp-final-app-6e9644", "project": "NEW_ERP_FINAL", "provenance": "agent", "relpath": "src/presentation/http/app.ts", "repo": "Sachin-Salgar/NEW_ERP_FINAL", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0", "commit_url": "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43", "cve": "", "cwe": "CWE-918", "file": "nimestream-route-d17f53/vuln.js", "function": "GET", "id": "nimestream-route-d17f53:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "nimestream-route-d17f53", "project": "nimestream", "provenance": "agent", "relpath": "app/api/img/route.js", "repo": "Irnhakim/nimestream", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "d17f535bf3012041b056ff3aa991ff6cfa198e43", "commit_url": "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43", "cve": "", "cwe": "CWE-918", "file": "nimestream-route-d17f53/fixed.js", "function": "GET", "id": "nimestream-route-d17f53:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "nimestream-route-d17f53", "project": "nimestream", "provenance": "agent", "relpath": "app/api/img/route.js", "repo": "Irnhakim/nimestream", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc", "commit_url": "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-0fc947/vuln.py", "function": "get_job", "id": "openniw-jobs-0fc947:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-0fc947", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "HHHHHejia/openniw", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "commit_url": "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-0fc947/fixed.py", "function": "get_job", "id": "openniw-jobs-0fc947:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-0fc947", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "HHHHHejia/openniw", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "98a0c392ba96cd2c4aa746dd6fc2b183f385225e", "commit_url": "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-b74de3/vuln.py", "function": "get_job", "id": "openniw-jobs-b74de3:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-b74de3", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "ziyuzuo/openniw", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "commit_url": "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", "cve": "", "cwe": "CWE-639", "file": "openniw-jobs-b74de3/fixed.py", "function": "get_job", "id": "openniw-jobs-b74de3:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "openniw-jobs-b74de3", "project": "openniw", "provenance": "agent", "relpath": "backend/app/routers/jobs.py", "repo": "ziyuzuo/openniw", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed", "commit_url": "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431", "cve": "", "cwe": "CWE-639", "file": "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs", "function": "exportProject", "id": "overleaf-with-claude-exportscontroller-3980b9:vuln", "label": "vuln", "license": "AGPL-3.0", "mechanism": "identity_from_request_body", "pair": "overleaf-with-claude-exportscontroller-3980b9", "project": "overleaf-with-claude", "provenance": "agent", "relpath": "services/web/app/src/Features/Exports/ExportsController.mjs", "repo": "ZUENS2020/overleaf-with-claude", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "3980b9e5806defb63e45ae2696e6c1899f3a8431", "commit_url": "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431", "cve": "", "cwe": "CWE-639", "file": "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs", "function": "exportProject", "id": "overleaf-with-claude-exportscontroller-3980b9:fixed", "label": "fixed", "license": "AGPL-3.0", "mechanism": "identity_from_request_body", "pair": "overleaf-with-claude-exportscontroller-3980b9", "project": "overleaf-with-claude", "provenance": "agent", "relpath": "services/web/app/src/Features/Exports/ExportsController.mjs", "repo": "ZUENS2020/overleaf-with-claude", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "31d1ac79b4cfa3118597348e79800a6561115149", "commit_url": "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb", "cve": "", "cwe": "CWE-1321", "file": "popmark-editorconfig-e5ac40/vuln.ts", "function": "deepMergeInto", "id": "popmark-editorconfig-e5ac40:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "popmark-editorconfig-e5ac40", "project": "popmark", "provenance": "agent", "relpath": "src/lexical-markdown/config/editorConfig.ts", "repo": "dayflower/popmark", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "e5ac407cef37c37178d440541ede301c838640fb", "commit_url": "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb", "cve": "", "cwe": "CWE-1321", "file": "popmark-editorconfig-e5ac40/fixed.ts", "function": "deepMergeInto", "id": "popmark-editorconfig-e5ac40:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "popmark-editorconfig-e5ac40", "project": "popmark", "provenance": "agent", "relpath": "src/lexical-markdown/config/editorConfig.ts", "repo": "dayflower/popmark", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "ba587867118f703632ff2dc63c4feb8ad6793420", "commit_url": "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7", "cve": "", "cwe": "CWE-1321", "file": "rag-pipeline-utils-config-handler-76e5f0/vuln.js", "function": "handleConfigSet", "id": "rag-pipeline-utils-config-handler-76e5f0:vuln", "label": "vuln", "license": "MIT", "mechanism": "prototype_pollution", "pair": "rag-pipeline-utils-config-handler-76e5f0", "project": "rag-pipeline-utils", "provenance": "agent", "relpath": "src/cli/handlers/config-handler.js", "repo": "DevilsDev/rag-pipeline-utils", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "prototype pollution", "commit": "76e5f0a94d6803d0e463d26a61cedb7da90857a7", "commit_url": "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7", "cve": "", "cwe": "CWE-1321", "file": "rag-pipeline-utils-config-handler-76e5f0/fixed.js", "function": "handleConfigSet", "id": "rag-pipeline-utils-config-handler-76e5f0:fixed", "label": "fixed", "license": "MIT", "mechanism": "prototype_pollution", "pair": "rag-pipeline-utils-config-handler-76e5f0", "project": "rag-pipeline-utils", "provenance": "agent", "relpath": "src/cli/handlers/config-handler.js", "repo": "DevilsDev/rag-pipeline-utils", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "permissive default", "commit": "6d5937972510cdb5ebca30607b538fdc2e280094", "commit_url": "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "cve": "", "cwe": "CWE-16", "file": "registry-proxy-worker-426847/vuln.js", "function": "buildUpstreamRequest", "id": "registry-proxy-worker-426847:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "registry-proxy-worker-426847", "project": "registry-proxy", "provenance": "agent", "relpath": "src/worker.js", "repo": "agents-repo/registry-proxy", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "commit_url": "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8", "cve": "", "cwe": "CWE-16", "file": "registry-proxy-worker-426847/fixed.js", "function": "buildUpstreamRequest", "id": "registry-proxy-worker-426847:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "registry-proxy-worker-426847", "project": "registry-proxy", "provenance": "agent", "relpath": "src/worker.js", "repo": "agents-repo/registry-proxy", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "a7a9bc260d649ea2e582c07435bfd7d93100647b", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-387bcf/vuln.ts", "function": "PATCH", "id": "supplieradvisor-mvp-route-387bcf:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-387bcf", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/claims/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "387bcf40e984a2ee1832ab7beabf0284c5b627d8", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-387bcf/fixed.ts", "function": "PATCH", "id": "supplieradvisor-mvp-route-387bcf:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-387bcf", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/claims/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-a69e8f/vuln.ts", "function": "GET", "id": "supplieradvisor-mvp-route-a69e8f:vuln", "label": "vuln", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-a69e8f", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/opportunities/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "insecure direct object reference", "commit": "a69e8f27c0f4d402573d16f0612b51155bbc46e1", "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1", "cve": "", "cwe": "CWE-639", "file": "supplieradvisor-mvp-route-a69e8f/fixed.ts", "function": "GET", "id": "supplieradvisor-mvp-route-a69e8f:fixed", "label": "fixed", "license": "MIT", "mechanism": "identity_from_request_body", "pair": "supplieradvisor-mvp-route-a69e8f", "project": "supplieradvisor-mvp", "provenance": "agent", "relpath": "app/api/customers/opportunities/route.ts", "repo": "bigfivefoods/supplieradvisor-mvp", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "command injection", "commit": "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864", "commit_url": "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a", "cve": "", "cwe": "CWE-78", "file": "tools-cli-tools-a96bc0/vuln.py", "function": "_is_command_allowed", "id": "tools-cli-tools-a96bc0:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "tools-cli-tools-a96bc0", "project": "Tools", "provenance": "agent", "relpath": "src/shared/python/ai/tools/cli_tools.py", "repo": "D-sorganization/Tools", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "command injection", "commit": "a96bc0502a3dcdac303e4f0152508886e5c35c0a", "commit_url": "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a", "cve": "", "cwe": "CWE-78", "file": "tools-cli-tools-a96bc0/fixed.py", "function": "_is_command_allowed", "id": "tools-cli-tools-a96bc0:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "tools-cli-tools-a96bc0", "project": "Tools", "provenance": "agent", "relpath": "src/shared/python/ai/tools/cli_tools.py", "repo": "D-sorganization/Tools", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "path traversal", "commit": "8d240ad8d7fc114c8f941ad956a2fdf32391ff60", "commit_url": "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6", "cve": "", "cwe": "CWE-22", "file": "trackly-cli-path-diagnostics-1c1aed/vuln.js", "function": "inspectExistingAncestor", "id": "trackly-cli-path-diagnostics-1c1aed:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "trackly-cli-path-diagnostics-1c1aed", "project": "trackly-cli", "provenance": "agent", "relpath": "lib/path-diagnostics.js", "repo": "trackly-app/trackly-cli", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "path traversal", "commit": "1c1aed89b07edb04051830c8f086e02b65e961c6", "commit_url": "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6", "cve": "", "cwe": "CWE-22", "file": "trackly-cli-path-diagnostics-1c1aed/fixed.js", "function": "inspectExistingAncestor", "id": "trackly-cli-path-diagnostics-1c1aed:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "trackly-cli-path-diagnostics-1c1aed", "project": "trackly-cli", "provenance": "agent", "relpath": "lib/path-diagnostics.js", "repo": "trackly-app/trackly-cli", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "path traversal", "commit": "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc", "commit_url": "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b", "cve": "", "cwe": "CWE-22", "file": "upstreamdrift-local-server-c3a078/vuln.py", "function": "_find_logo_file", "id": "upstreamdrift-local-server-c3a078:vuln", "label": "vuln", "license": "MIT", "mechanism": "path_join_user_input", "pair": "upstreamdrift-local-server-c3a078", "project": "UpstreamDrift", "provenance": "agent", "relpath": "src/api/local_server.py", "repo": "D-sorganization/UpstreamDrift", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "path traversal", "commit": "c3a0787080489b30e2ed0abfac03b51e45da184b", "commit_url": "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b", "cve": "", "cwe": "CWE-22", "file": "upstreamdrift-local-server-c3a078/fixed.py", "function": "_find_logo_file", "id": "upstreamdrift-local-server-c3a078:fixed", "label": "fixed", "license": "MIT", "mechanism": "path_join_user_input", "pair": "upstreamdrift-local-server-c3a078", "project": "UpstreamDrift", "provenance": "agent", "relpath": "src/api/local_server.py", "repo": "D-sorganization/UpstreamDrift", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "934b939f1cca5259eaf807db3319eb97b90d8d80", "commit_url": "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b", "cve": "", "cwe": "CWE-918", "file": "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py", "function": "normalize_allowed_hosts", "id": "waggledance-swarm-ssrf-host-guard-9a4548:vuln", "label": "vuln", "license": "Apache-2.0", "mechanism": "source_reaches_sink", "pair": "waggledance-swarm-ssrf-host-guard-9a4548", "project": "waggledance-swarm", "provenance": "agent", "relpath": "waggledance/core/v3_13_0/ssrf_host_guard.py", "repo": "Ahkeratmehilaiset/waggledance-swarm", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "server-side request forgery", "commit": "9a454843aa35332ff2eb3106023eee0c4b5e444b", "commit_url": "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b", "cve": "", "cwe": "CWE-918", "file": "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py", "function": "normalize_allowed_hosts", "id": "waggledance-swarm-ssrf-host-guard-9a4548:fixed", "label": "fixed", "license": "Apache-2.0", "mechanism": "source_reaches_sink", "pair": "waggledance-swarm-ssrf-host-guard-9a4548", "project": "waggledance-swarm", "provenance": "agent", "relpath": "waggledance/core/v3_13_0/ssrf_host_guard.py", "repo": "Ahkeratmehilaiset/waggledance-swarm", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "sql injection", "commit": "eab923ad3099c01b002fbd6be7cf994614bbdee4", "commit_url": "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e", "cve": "", "cwe": "CWE-89", "file": "workers-research-utils-209444/vuln.ts", "function": "normalizeDomain", "id": "workers-research-utils-209444:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "workers-research-utils-209444", "project": "workers-research", "provenance": "agent", "relpath": "src/utils.ts", "repo": "G4brym/workers-research", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "sql injection", "commit": "209444eb61cc564c2d6b43267256f85fe3e5e30e", "commit_url": "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e", "cve": "", "cwe": "CWE-89", "file": "workers-research-utils-209444/fixed.ts", "function": "normalizeDomain", "id": "workers-research-utils-209444:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "workers-research-utils-209444", "project": "workers-research", "provenance": "agent", "relpath": "src/utils.ts", "repo": "G4brym/workers-research", "review_tier": "title", "split": "holdout", "year": 2026}
|
||||
{"class": "permissive default", "commit": "2604269350bff51f58572c133b45010cb0976a5a", "commit_url": "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31", "cve": "", "cwe": "CWE-16", "file": "zoonk-origin-bfbf67/vuln.ts", "function": "getAllowedHosts", "id": "zoonk-origin-bfbf67:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "zoonk-origin-bfbf67", "project": "zoonk", "provenance": "agent", "relpath": "packages/utils/src/origin.ts", "repo": "zoonk/zoonk", "review_tier": "title", "split": "train", "year": 2026}
|
||||
{"class": "permissive default", "commit": "bfbf670ccb41d63c407d32c51bd26e626a174f31", "commit_url": "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31", "cve": "", "cwe": "CWE-16", "file": "zoonk-origin-bfbf67/fixed.ts", "function": "getAllowedHosts", "id": "zoonk-origin-bfbf67:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "zoonk-origin-bfbf67", "project": "zoonk", "provenance": "agent", "relpath": "packages/utils/src/origin.ts", "repo": "zoonk/zoonk", "review_tier": "title", "split": "train", "year": 2026}
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// commit_url: https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e
|
||||
// cve:
|
||||
// license: MIT
|
||||
// function: formatDuration
|
||||
// function: normalizeDomain
|
||||
// relpath: src/utils.ts
|
||||
// provenance: agent
|
||||
// mechanism: source_reaches_sink
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// commit_url: https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e
|
||||
// cve:
|
||||
// license: MIT
|
||||
// function: formatDuration
|
||||
// function: normalizeDomain
|
||||
// relpath: src/utils.ts
|
||||
// provenance: agent
|
||||
// mechanism: source_reaches_sink
|
||||
|
||||
Reference in New Issue
Block a user