marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 12:39:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(learning-harness): absence rows travel with their registration

Browse Source 
Eight of the ten vendored access-control rows had no named handler at all,
so every one of them would have scored `missing_context` forever rather
than as a detector miss. After the re-harvest nine are named and the tenth
states its reason.

The handler-context mode now carries the class its framework registers,
multi-line decorators, and commented-out guards -- `#@token_required`
above a ThreatByte handler is the entire bug. Where the registration lives
in another document (connexion's `operationId`, an express router), a
recipe names `context = [...]`, the harvester writes that stanza per side,
and the pair materializes both files at their repository-relative paths so
the entry-point mapper sees the layout the project has. `harvest_recipe`
fetches every blob before the first write and the driver takes `--report`,
so a failed fetch leaves a reviewed excerpt exactly as it was.

Two defects the re-harvest exposed: `.mjs` was not a known suffix, so the
one pair vendored as an ES module had no file target at all; and
`_python_route_access` matched auth words inside decorator prose, reading
`@ns.doc(description='... without proper authorization checks')` as a
guard. Recorded in the hygiene artifact: nine of the ten duplicate groups
sit on both sides of the split, which the repository-level split cannot
see.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-06 12:39:55 +02:00
co-authored by Claude Opus 5
parent 7a33756a7e
commit c2d9c4ad01
48 changed files with 1613 additions and 11776 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/measurements/2026-09-06-corpus-hygiene.json
+66 -28
View File
@@ -1,45 +1,83 @@
{
"command": "python -c 'from openultrasast.pairs import ...; duplicate_groups / split_by_repository over the vendored catalog'",
"duplicate_groups": [
[
"openssl-cve-2023-0286",
"openssl-cve-2023-0286-general_name_cmp"
],
[
"openniw-jobs-0fc947",
"openniw-jobs-b74de3"
],
"cross_split_duplicates": [
[
"curl-cve-2023-38545",
"curl-cve-2023-38545-do_socks5"
],
[
"openssl-cve-2021-3712",
"openssl-cve-2021-3712-append_ia5"
],
[
"openssl-cve-2020-1967",
"openssl-cve-2020-1967-tls1_check_sig_alg"
],
[
"openssl-cve-2022-3786",
"openssl-cve-2022-3786-ossl_punycode_decode"
],
[
"openssl-cve-2020-1971",
"openssl-cve-2020-1971-general_name_cmp"
],
[
"etude-lexical-markdown-editorconfig-c61a8b",
"popmark-editorconfig-e5ac40"
],
[
"anastasios-pw-session-14ec1a",
"astroclaw-pw-session-1553a8"
"openniw-jobs-0fc947",
"openniw-jobs-b74de3"
],
[
"openssl-cve-2020-1967",
"openssl-cve-2020-1967-tls1_check_sig_alg"
],
[
"openssl-cve-2020-1971",
"openssl-cve-2020-1971-general_name_cmp"
],
[
"openssl-cve-2021-3712",
"openssl-cve-2021-3712-append_ia5"
],
[
"openssl-cve-2022-3602",
"openssl-cve-2022-3602-ossl_punycode_decode"
],
[
"openssl-cve-2022-3786",
"openssl-cve-2022-3786-ossl_punycode_decode"
],
[
"openssl-cve-2023-0286",
"openssl-cve-2023-0286-general_name_cmp"
]
],
"duplicate_groups": [
[
"anastasios-pw-session-14ec1a",
"astroclaw-pw-session-1553a8"
],
[
"curl-cve-2023-38545",
"curl-cve-2023-38545-do_socks5"
],
[
"etude-lexical-markdown-editorconfig-c61a8b",
"popmark-editorconfig-e5ac40"
],
[
"openniw-jobs-0fc947",
"openniw-jobs-b74de3"
],
[
"openssl-cve-2020-1967",
"openssl-cve-2020-1967-tls1_check_sig_alg"
],
[
"openssl-cve-2020-1971",
"openssl-cve-2020-1971-general_name_cmp"
],
[
"openssl-cve-2021-3712",
"openssl-cve-2021-3712-append_ia5"
],
[
"openssl-cve-2022-3602",
"openssl-cve-2022-3602-ossl_punycode_decode"
],
[
"openssl-cve-2022-3786",
"openssl-cve-2022-3786-ossl_punycode_decode"
],
[
"openssl-cve-2023-0286",
"openssl-cve-2023-0286-general_name_cmp"
]
],
"generated": "2026-09-06",
@@ -53,7 +91,7 @@
"known_limit": [
"owasp-java-hash"
],
"note": "Repositories in `straddling` have pairs on both sides of the train/holdout split, so a learning path can be taught by one file of a repository and evaluated on another. Pairs in `duplicate_groups` share a vulnerable excerpt byte for byte after the provenance header is stripped. Both cap what any detector number can mean.",
"note": "Repositories in `straddling` have pairs on both sides of the train/holdout split, so a learning path can be taught by one file of a repository and evaluated on another. Pairs in `duplicate_groups` share a vulnerable excerpt byte for byte after the provenance header is stripped. Both cap what any detector number can mean. Groups in `cross_split_duplicates` sit on both sides of the split while being the same code, so the train row teaches the holdout row exactly; forks of one project defeat the repository-level split.",
"straddling": [
[
"Contrast-Security-OSS/DjanGoat",