diff --git a/.github/workflows/engine-image.yml b/.github/workflows/engine-image.yml new file mode 100644 index 0000000..0b9ad37 --- /dev/null +++ b/.github/workflows/engine-image.yml @@ -0,0 +1,47 @@ +name: Engine image +on: + workflow_dispatch: + push: + branches: [main] + paths: + - 'src/**' + - 'benchmarks/learn/engine_trace*.py' + - 'benchmarks/learn/engine_worker_service.py' + - 'Dockerfile' + - '.github/workflows/engine-image.yml' +permissions: + contents: read + packages: write +concurrency: + group: engine-image-${{ github.ref }} + cancel-in-progress: false +jobs: + image: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + - uses: docker/setup-buildx-action@v3 + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - id: names + env: + OWNER: ${{ github.repository_owner }} + run: | + echo "image=ghcr.io/${OWNER,,}/openultrasast" >> "$GITHUB_OUTPUT" + echo "sha=sha-${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT" + - id: build + uses: docker/build-push-action@v6 + with: + context: . + file: Dockerfile + push: true + tags: | + ${{ steps.names.outputs.image }}:${{ steps.names.outputs.sha }} + ${{ steps.names.outputs.image }}:main + - env: + IMAGE: ${{ steps.names.outputs.image }} + DIGEST: ${{ steps.build.outputs.digest }} + run: echo "$IMAGE@$DIGEST" >> "$GITHUB_STEP_SUMMARY" diff --git a/Dockerfile b/Dockerfile index a6ee3d1..6062c23 100644 --- a/Dockerfile +++ b/Dockerfile @@ -52,7 +52,7 @@ COPY benchmarks ./benchmarks # The core install is zero-dependency by design; `semantic` adds the tree-sitter grammars the candidate # enumerator uses. The LLM endpoint stays optional and is configured by environment, never baked in. RUN python3 -m venv /venv \ - && /venv/bin/pip install --no-cache-dir -e ".[semantic]" + && /venv/bin/pip install --no-cache-dir -e ".[semantic,s3]" ENV PATH="/venv/bin:${PATH}" # Analysis never needs root. diff --git a/benchmarks/learn/engine_trace.py b/benchmarks/learn/engine_trace.py index f121ef2..5d30cfd 100644 --- a/benchmarks/learn/engine_trace.py +++ b/benchmarks/learn/engine_trace.py @@ -26,6 +26,7 @@ from concurrent.futures import FIRST_COMPLETED, ThreadPoolExecutor, wait from pathlib import Path from engine_trace_k8s import IMAGE, Kubernetes +from engine_trace_queue import Dispatcher from engine_trace_worker import EXCLUDED_DIRS, safe_path, unit_record, write_json from openultrasast.learn.examples import read_jsonl @@ -44,7 +45,9 @@ SNAPSHOT_FILES = ( "benchmarks/learn/engine_trace.py", "benchmarks/learn/engine_trace_worker.py", "benchmarks/learn/engine_trace_k8s.py", - "src/openultrasast/model/trace.py", + "benchmarks/learn/engine_trace_queue.py", + "benchmarks/learn/engine_worker_service.py", + "benchmarks/learn/engine_trace_parse.py", "src/openultrasast/model/taint.py", "src/openultrasast/cpg/queries/taint.sc", ) @@ -628,11 +631,14 @@ def run_pin(pin, source, provenance, inputs, out, args): write_json(output / "pin.json", {**pin, "questions": prepare_questions(pin, checkout, args.question_deadline)}) name = "ousast-trace-" + pin_name(pin)[:16] started = time.monotonic() - if executor == "k8s": + if executor in {"k8s", "k8s-jobs"}: done, node = args.kubernetes.execute(source, checkout, output, json.loads((output / "pin.json").read_text())) status, reason = "failed", done.stderr if done.returncode: (output / "container.log").write_text(reason) + elif executor == "queue": + done, node = args.dispatcher.execute(checkout, output, json.loads((output / "pin.json").read_text()), pin_name(pin)[:-5]) + status, reason = "timeout", f"queue wait deadline {args.queue_timeout}s" else: command = docker_command(source, checkout, output, name, args.image, args.deadline, args.question_deadline) started = time.monotonic() @@ -666,12 +672,20 @@ def run_pin(pin, source, provenance, inputs, out, args): status=status if unit["supported"] else "unsupported", reason=reason if unit["supported"] else unit["reason"] ) record["units"].append(row) - record["container_exit"] = done.returncode if done else None + if executor != "queue": + record["container_exit"] = done.returncode if done else None + else: + record.setdefault("container_exit", None) if done is not None and done.returncode != 0: for row in record["units"]: if row["supported"]: row.update(status="failed", reason=reason) - record.update(done=True, seconds=time.monotonic() - started, analyzer=provenance, image=args.image) + record.update( + done=True, + seconds=time.monotonic() - started, + analyzer=provenance, + image=record.get("image", args.image) if executor == "queue" else args.image, + ) if (output / "container.log").exists(): shutil.copyfile(output / "container.log", out / pin_name(pin).replace(".json", ".log")) except (OSError, ValueError, subprocess.SubprocessError) as exc: @@ -681,8 +695,10 @@ def run_pin(pin, source, provenance, inputs, out, args): "analyzer": provenance, "units": [unit_record(u, "failed" if u["supported"] else "unsupported", str(exc)) for u in pin["units"]], } - if executor == "k8s": + if executor in {"k8s", "k8s-jobs"}: record.update(executor="k8s", node=node, image=args.image) + if executor == "queue": + record.update(executor="queue", worker=record.get("worker", node), pod=record.get("pod")) save_pin(out / pin_name(pin), record) print( json.dumps({"repo": pin["repo"], "pin": pin["pin"], "statuses": dict(Counter(u["status"] for u in record["units"]))}), @@ -810,7 +826,9 @@ def main(): parser.add_argument("--cache", type=Path, default=Path.home() / ".cache/openultrasast") parser.add_argument("--out", type=Path, default=DEFAULT_OUT) parser.add_argument("--image", help="default: openultrasast:dev for Docker; public 2.0.1 image for k8s/mixed") - parser.add_argument("--executor", choices=("docker", "k8s", "mixed"), default="docker") + parser.add_argument("--executor", choices=("docker", "k8s", "k8s-jobs", "mixed", "queue"), default="docker") + parser.add_argument("--queue-status", action="store_true") + parser.add_argument("--queue-timeout", type=int, default=3600, help="total queue wait including execution, seconds") parser.add_argument("--parallel", type=int, default=1, help="total pins in flight; mixed reserves one lane for Docker") parser.add_argument("--kube-context") parser.add_argument("--kube-namespace", default="ousast-engine") @@ -829,11 +847,20 @@ def main(): parser.add_argument("--dry-run", action="store_true") parser.add_argument("--summary", action="store_true") args = parser.parse_args() + if args.queue_status: + print(json.dumps(Dispatcher(args).status(), indent=2)) + return 0 + if args.queue_timeout <= 0: + parser.error("--queue-timeout must be positive") + if args.executor == "queue" and (not args.image or "@sha256:" not in args.image): + parser.error("queue requires --image with the deployed image digest") + if args.executor == "queue" and args.deadline > 900: + parser.error("queue deadline must be <= Deployment termination grace (900s)") if min(args.deadline, args.question_deadline) <= 0 or args.limit < 0: parser.error("deadlines must be positive; limit must be nonnegative") if args.parallel < 1 or (args.executor == "mixed" and args.parallel < 2): parser.error("--parallel must be positive; mixed needs at least 2 total lanes") - if (args.executor != "docker" or args.k8s_check) and not args.kube_context: + if (args.executor in {"k8s", "k8s-jobs", "mixed"} or args.k8s_check) and not args.kube_context: parser.error("--kube-context is required for Kubernetes") args.image = args.image or (IMAGE if args.executor != "docker" or args.k8s_check else "openultrasast:dev") if args.k8s_check: @@ -905,12 +932,14 @@ def main(): args.docker_image = image.stdout.strip() if not args.docker_image: raise ValueError("Docker returned no local image identity") - if args.executor != "docker" and any(u["supported"] for pin in plan for u in pin["units"]): + if args.executor in {"k8s", "k8s-jobs", "mixed"} and any(u["supported"] for pin in plan for u in pin["units"]): args.kubernetes = Kubernetes(args) args.kubernetes.namespace() + if args.executor == "queue": + args.dispatcher = Dispatcher(args) with tempfile.TemporaryDirectory(prefix="trace-source-", dir=args.out) as scratch: source = Path(scratch) / "frozen" - provenance = freeze_source(source) + provenance = {"image": args.image, "executor": "queue"} if args.executor == "queue" else freeze_source(source) failures = run_plan(plan, source, provenance, inputs, args) return 2 if failures else 0 diff --git a/src/openultrasast/model/trace.py b/benchmarks/learn/engine_trace_parse.py similarity index 100% rename from src/openultrasast/model/trace.py rename to benchmarks/learn/engine_trace_parse.py diff --git a/benchmarks/learn/engine_trace_queue.py b/benchmarks/learn/engine_trace_queue.py new file mode 100644 index 0000000..20d1d27 --- /dev/null +++ b/benchmarks/learn/engine_trace_queue.py @@ -0,0 +1,50 @@ +"""Host queue transport: source and task metadata only, never analyzer code.""" + +from __future__ import annotations + +import json +import subprocess +import time +import uuid + +from engine_worker_service import PENDING, client_from_env, pack, put, read, result_key, status + + +class Dispatcher: + def __init__(self, args, client=None, *, pause=time.sleep, clock=time.monotonic): + self.client = client if client is not None else client_from_env() + self.run = uuid.uuid4().hex + self.args, self.pause, self.clock = args, pause, clock + + def execute(self, checkout, output, pin, pin_id): + task_id = f"{self.run}-{pin_id}" + task = dict( + run=self.run, + id=pin_id, + task_id=task_id, + pin=pin, + input=f"engine-queue/inputs/{self.run}/{pin_id}/source.tar", + image=self.args.image, + deadline=self.args.deadline, + question_deadline=self.args.question_deadline, + ) + try: + self.client.put(task["input"], pack(checkout), {}) + put(self.client, PENDING + task_id, task) + end = self.clock() + self.args.queue_timeout + while self.clock() < end: + result = read(self.client, result_key(task)) + if result is not None: + (output / "result.json").write_text(json.dumps(result)) + self.client.delete(task["input"]) + return subprocess.CompletedProcess([], 0, "", ""), result.get("worker") + self.pause(2) + # Removing pending cancels work that has not been claimed; retain source for a live lease. + self.client.delete(PENDING + task_id) + return None, None + except Exception as exc: + # SDK errors can contain endpoint URLs or credentials. Do not persist their text. + raise OSError("queue transport failed") from exc + + def status(self): + return status(self.client) diff --git a/benchmarks/learn/engine_trace_worker.py b/benchmarks/learn/engine_trace_worker.py index 3717b62..ca8e9ed 100644 --- a/benchmarks/learn/engine_trace_worker.py +++ b/benchmarks/learn/engine_trace_worker.py @@ -19,8 +19,9 @@ import time from collections import Counter from pathlib import Path +from engine_trace_parse import parse_trace + from openultrasast.cpg.backend import DATAFLOW_OVERLAY, JoernBackend, _render -from openultrasast.model.trace import parse_trace def write_json(path, value): diff --git a/benchmarks/learn/engine_worker_service.py b/benchmarks/learn/engine_worker_service.py new file mode 100644 index 0000000..0c8aa1c --- /dev/null +++ b/benchmarks/learn/engine_worker_service.py @@ -0,0 +1,315 @@ +"""Image-resident queue workers. Requires strongly consistent S3 GET/PUT/LIST. + +Per-task Lamport bakery tickets use only ordinary object operations. A choosing +marker precedes ticket selection; contenders wait for choosing peers and lower +(ticket, worker) pairs. Late arrivals cannot displace a running owner. Leases +assume bounded clock skew (less than MARGIN / 2) and a worker killed by its deadline. +""" + +from __future__ import annotations + +import argparse +import contextlib +import ctypes +import io +import json +import logging +import multiprocessing +import os +import signal +import socket +import tarfile +import tempfile +import threading +import time +import uuid +from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer +from pathlib import Path + +from engine_trace_worker import unit_record, worker + +from openultrasast.plane.memory import S3Client, s3_settings + +PENDING = "engine-queue/pending/" +CLAIMED = "engine-queue/claimed/" +RESULTS = "engine-results/" +MARGIN = 60 +LOG = logging.getLogger(__name__) + + +def client_from_env(): + settings = s3_settings(os.environ) + bucket = os.environ.get("S3_BUCKET") + if not bucket: + raise ValueError("S3_BUCKET is required") + return S3Client(bucket=bucket, **settings) + + +def read(client, key): + value = client.get(key) + return json.loads(value[0]) if value else None + + +def put(client, key, value): + client.put(key, json.dumps(value).encode(), {}) + + +def result_key(task): + return f"{RESULTS}{task['run']}/{task['id']}.json" + + +def pack(root): + stream = io.BytesIO() + with tarfile.open(fileobj=stream, mode="w") as archive: + archive.add(root, arcname=".") + return stream.getvalue() + + +def unpack(data, root): + with tarfile.open(fileobj=io.BytesIO(data)) as archive: + # Source snapshots need only regular files and directories, never links/devices. + for member in archive.getmembers(): + target = (root / member.name).resolve() + if not target.is_relative_to(root.resolve()) or not (member.isfile() or member.isdir()): + raise ValueError("unsafe source archive") + archive.extractall(root, filter="data") + + +class Queue: + def __init__(self, client, identity=None, *, now=time.time, pause=time.sleep, stop=None): + self.client = client + self.identity = identity or f"{socket.gethostname()}-{uuid.uuid4().hex}" + self.now, self.pause = now, pause + self.stop = stop or threading.Event() + + def markers(self, task_id=None): + result = [] + for key in self.client.keys(CLAIMED): + if task_id is None or key.rsplit("/", 1)[-1] == task_id: + marker = read(self.client, key) + if marker: + result.append((key, marker)) + return result + + def tasks(self): + tasks = {} + for key in self.client.keys(PENDING): + task = read(self.client, key) + if task: + tasks[task["task_id"]] = task + # A dead worker may have removed pending already. Its task remains in the lease. + for _, marker in self.markers(): + if marker["expires"] < self.now(): + task = marker["task"] + tasks.setdefault(task["task_id"], task) + return list(tasks.values()) + + def claim(self, task): + if read(self.client, result_key(task)) is not None or self.stop.is_set(): + return None + key = f"{CLAIMED}{self.identity}/{task['task_id']}" + marker = dict(task=task, ticket=0, expires=self.now() + task["deadline"] + MARGIN) + put(self.client, key, marker) + try: + live = [m for _, m in self.markers(task["task_id"]) if m["expires"] > self.now()] + marker["ticket"] = 1 + max((m["ticket"] for m in live), default=0) + put(self.client, key, marker) + while not self.stop.is_set(): + # Do not start once the execution budget no longer fits within our lease. + if self.now() >= marker["expires"] - task["deadline"] - MARGIN / 2: + break + peers = [(k, m) for k, m in self.markers(task["task_id"]) if k != key and m["expires"] > self.now()] + if any(m["ticket"] == 0 for _, m in peers): + self.pause(0.1) + continue + if any((m["ticket"], k) < (marker["ticket"], key) for k, m in peers): + break # loser backs off and can try another pending task + if read(self.client, key) != marker or read(self.client, result_key(task)) is not None: + break + self.client.delete(PENDING + task["task_id"]) + return key + except Exception: + self.client.delete(key) + raise + self.client.delete(key) + return None + + def process_one(self, execute=None): + for task in self.tasks(): + key = self.claim(task) + if key is None: + continue + try: + lease = read(self.client, key) + if lease is None: + continue + budget = min(task["deadline"], lease["expires"] - self.now() - MARGIN / 2) + if budget <= 0: + continue # Leave the expired lease's task available to recovery. + result = (execute or execute_task)(self.client, {**task, "runtime_budget": budget}) + result.update(executor="queue", worker=self.identity, pod=socket.gethostname(), image=os.environ.get("ENGINE_IMAGE", "")) + put(self.client, result_key(task), result) + # Publish the result before removing either the input or the claim. + self.client.delete(task["input"]) + for old_key, old in self.markers(task["task_id"]): + if old_key == key or old["expires"] < self.now(): + self.client.delete(old_key) + return True + except Exception: + # Keep the lease and task for recovery, without logging credential-bearing errors. + LOG.error("task failed; lease retained for recovery") + return False + return False + + +def _child(pin, root, out, deadline, question_deadline): + os.setsid() + signal.signal(signal.SIGTERM, signal.SIG_DFL) + worker(pin, root, out, deadline, question_deadline) + + +def adopt_orphans(): + # Linux PR_SET_CHILD_SUBREAPER: escaped Joern sessions reparent here, not + # outside the service. There is exactly one task process tree per worker. + if ctypes.CDLL(None, use_errno=True).prctl(36, 1, 0, 0, 0) != 0: + raise OSError("cannot enable task descendant cleanup") + + +def kill_children(): + """Freeze parents before walking children, including new-session JVMs.""" + seen = set() + + def freeze(parent): + for entry in Path("/proc").iterdir(): + if not entry.name.isdigit() or int(entry.name) in seen: + continue + try: + # comm can contain spaces or parentheses. Fields after it begin at state. + fields = (entry / "stat").read_text().rsplit(")", 1)[1].split() + if int(fields[1]) != parent: + continue + pid = int(entry.name) + os.kill(pid, signal.SIGSTOP) + seen.add(pid) + freeze(pid) + except (FileNotFoundError, ProcessLookupError, PermissionError): + continue + + # A child that exited during discovery can reparent descendants to this + # subreaper. Repeat until every remaining descendant is frozen. + while True: + count = len(seen) + freeze(os.getpid()) + if len(seen) == count: + break + for pid in seen: + with contextlib.suppress(ProcessLookupError): + os.kill(pid, signal.SIGKILL) + + +def execute_task(client, task): + adopt_orphans() + pin = task["pin"] + started = time.monotonic() + budget = task.get("runtime_budget", task["deadline"]) + status, reason, code = "failed", "worker produced no result", None + with tempfile.TemporaryDirectory(prefix="engine-task-") as scratch: + root, out = Path(scratch) / "case", Path(scratch) / "result.json" + root.mkdir() + try: + if task["deadline"] > 900 or task["deadline"] <= 0: + raise ValueError("deadline exceeds deployment grace") + if task.get("image") != os.environ.get("ENGINE_IMAGE"): + raise ValueError("task image differs from deployed image") + source = client.get(task["input"]) + if source is None: + raise ValueError("missing source") + unpack(source[0], root) + # The shipped worker also checks frontend input and graph output for every language. + files = [p for p in root.rglob("*") if p.is_file()] + if not files: + raise ValueError("empty source") + LOG.info("input proof: first file bytes=%d", len(files[0].read_bytes())) + if time.monotonic() - started >= budget: + status, reason = "timeout", "task input deadline" + raise TimeoutError(reason) + process = multiprocessing.get_context("fork").Process(target=_child, args=(pin, root, out, budget, task["question_deadline"])) + process.start() + try: + process.join(max(0, budget - (time.monotonic() - started))) + if process.is_alive(): + status, reason = "timeout", "task deadline" + else: + reason = f"worker exit {process.exitcode}" + code = process.exitcode + finally: + # Joern creates separate sessions. Kill the whole descendant tree, + # not merely the Python wrapper's process group. + kill_children() + process.join() + # Reap adopted JVMs and their launchers after the direct child. + while True: + try: + os.waitpid(-1, 0) + except ChildProcessError: + break + record = json.loads(out.read_text()) if out.exists() else {**pin, "units": []} + except Exception: + record = {**pin, "units": []} + reason = "worker input or execution failed" + if not record.get("done") or code != 0: + previous = {u["unit"]: u for u in record["units"]} + record["units"] = [ + previous[u["unit"]] + if code is None and previous.get(u["unit"], {}).get("status") in {"path", "asked-nothing"} + else unit_record(u, status if u["supported"] else "unsupported", reason if u["supported"] else u["reason"]) + for u in pin["units"] + ] + record.update(done=True, container_exit=code, seconds=time.monotonic() - started) + return record + + +def status(client): + return { + "pending": len(client.keys(PENDING)), + "claimed": len(client.keys(CLAIMED)), + "done": len([k for k in client.keys(RESULTS) if k.endswith(".json")]), + } + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--port", type=int, default=8080) + args = parser.parse_args() + logging.basicConfig(level=logging.INFO) + stop = threading.Event() + signal.signal(signal.SIGTERM, lambda *_: stop.set()) + signal.signal(signal.SIGINT, lambda *_: stop.set()) + client = client_from_env() + queue = Queue(client, stop=stop) + + class Health(BaseHTTPRequestHandler): + def do_GET(self): + self.send_response(200 if self.path == "/healthz" and not stop.is_set() else 503) + self.end_headers() + + def log_message(self, *_): + pass + + server = ThreadingHTTPServer(("0.0.0.0", args.port), Health) + threading.Thread(target=server.serve_forever, daemon=True).start() + try: + while not stop.is_set(): + try: + if not queue.process_one(): + stop.wait(2) + except Exception: + LOG.error("queue unavailable; retrying") + stop.wait(5) + finally: + server.shutdown() + server.server_close() + + +if __name__ == "__main__": + main() diff --git a/benchmarks/learn/joern_leak_audit.py b/benchmarks/learn/joern_leak_audit.py new file mode 100644 index 0000000..19dccec --- /dev/null +++ b/benchmarks/learn/joern_leak_audit.py @@ -0,0 +1,242 @@ +"""Offline audit of completed Joern results; never launches an analyzer or reads corpora. + +Missing results stay in coverage, not signal denominators. Observed non-path rows +score zero for path features. Sink kinds are one-hot indicators, never ordinal +category IDs. Both signed and best-direction metrics expose reversed shortcuts. +""" + +from __future__ import annotations + +import argparse +import ast +import hashlib +import json +import re +from collections import Counter +from pathlib import Path + +from slice_leak_audit import THRESHOLD, complete_pairs, metrics + +ROOT = Path(__file__).resolve().parents[2] +UNITS = ROOT / "plane/experiments/exp-005-graph-slice.units.jsonl" +RESULTS = Path.home() / "ousast-results/plane/engine-trace" +OUTPUT = ROOT / "benchmarks/measurements/2026-10-04-joern-slice-leak-audit/record.json" +STATUSES = ("path", "asked-nothing", "failed", "timeout", "unsupported", "missing") +ASKED = {"path", "asked-nothing"} +SIGNALS = ("has_path", "shortest_path_steps", "sanitized", "guard_present", "asked") +ASYMMETRY = ("vulnerable_only", "fixed_only", "both", "neither", "not_both_asked") + + +def materialization_version(): + # Read the producer's literal without importing its execution dependencies. + tree = ast.parse(Path(__file__).with_name("engine_trace.py").read_bytes()) + for node in tree.body: + if isinstance(node, ast.Assign) and any(isinstance(t, ast.Name) and t.id == "MATERIALIZATION_VERSION" for t in node.targets): + return ast.literal_eval(node.value) + raise ValueError("Producer has no materialization version") + + +def features(row): + path = row["status"] == "path" + traces = row.get("traces", []) if path else [] + candidates = [(i, t) for i, t in enumerate(traces) if t.get("steps")] + index, trace = min(candidates, key=lambda it: len(it[1]["steps"])) if candidates else (None, {}) + witnesses = row.get("witness_rows", []) + witness = witnesses[index] if index is not None and index < len(witnesses) else {} + guard = trace.get("guard", {}) + sink = witness.get("sinkKind") + if not sink: + # Retain only the call target: arguments, literals and code are not kinds. + match = re.search(r"([\w:$>.\\-]+)\s*\(", str(witness.get("sink", ""))) + sink = match[1] if match else "unknown" + return { + "has_path": int(path), + "shortest_path_steps": len(trace["steps"]) if trace else None if path else 0, + "sanitized": int(bool(trace.get("sanitized", witness.get("sanitized", False)))) if trace else None if path else 0, + "guard_present": int( + bool(guard.get("text") or guard.get("bounded") or witness.get("bound") or witness.get("bounded")) + or any("guard" in s.get("roles", []) for s in trace.get("steps", [])) + ) + if trace + else None + if path + else 0, + "sink_kind": str(sink) if path else "no-path", + "asked": int(row["status"] in ASKED), + } + + +def scored(rows, signal): + eligible = [r for r in rows if r[signal] is not None] + result = metrics(eligible, signal) + result["excluded_rows"] = len(rows) - len(eligible) + result["flagged"] = (result["pairs"] >= 10 and (result["best_direction_within_pair_accuracy"] or 0) >= THRESHOLD) or ( + result["rows"] >= 10 and (result["best_direction_pooled_auc"] or 0) >= THRESHOLD + ) + return result + + +def signal_metrics(rows, kinds): + return { + **{s: scored(rows, s) for s in SIGNALS}, + "sink_kind": {kind: scored([{**r, "is_kind": int(r["sink_kind"] == kind)} for r in rows], "is_kind") for kind in kinds}, + } + + +def scope_report(rows, kinds): + pairs = complete_pairs(rows) + asymmetry = Counter() + honest = [] + for v, f in pairs: + if not (v["asked"] and f["asked"]): + asymmetry["not_both_asked"] += 1 + else: + honest.extend((v, f)) + asymmetry[ + "both" + if v["has_path"] and f["has_path"] + else "vulnerable_only" + if v["has_path"] + else "fixed_only" + if f["has_path"] + else "neither" + ] += 1 + observed = [r for r in rows if r["status"] != "missing"] + return { + "rows": len(rows), + "coverage": {s: sum(r["status"] == s for r in rows) for s in STATUSES}, + "complete_pairs": len(pairs), + "pair_asymmetry": {s: asymmetry[s] for s in ASYMMETRY}, + "both_asked_pairs": len(honest) // 2, + "signals": signal_metrics(observed, kinds), + "both_asked_signals": signal_metrics(honest, kinds), + } + + +def audit(units, results, *, expected_rows=501, expected_pairs=195): + if len(units) != expected_rows or len({u["unit"] for u in units}) != expected_rows: + raise ValueError(f"Expected {expected_rows} unique units") + if len(complete_pairs(units)) != expected_pairs: + raise ValueError(f"Expected {expected_pairs} complete pairs") + if not results.is_dir(): + raise ValueError(f"Results directory is unreadable: {results}") + version = materialization_version() + unit_index = {u["unit"]: u for u in units} + matched = {} + files = [] + counts = Counter() + for path in sorted(results.glob("*.json")): + raw = path.read_bytes() + record = json.loads(raw) # Corruption fails loudly; producer uses atomic replace. + if not isinstance(record, dict) or "repo" not in record or "pin" not in record: + continue + stale = record.get("materialization_version") != version + unfinished = record.get("done") is not True + counts["stale"] += stale + counts["unfinished"] += unfinished + counts["skipped"] += stale or unfinished + files.append( + {"path": str(path), "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest(), "stale": stale, "unfinished": unfinished} + ) + if stale or unfinished: + continue + counts["accepted_files"] += 1 + counts["result_rows_read"] += len(record["units"]) + for row in record["units"]: + if row["unit"] not in unit_index: + continue + unit = unit_index[row["unit"]] + if any(row.get(k) != unit.get(k) for k in ("family", "label", "pair")): + raise ValueError(f"Result metadata mismatch: {row['unit']}") + if row["status"] not in STATUSES[:-1] or not row.get("source"): + raise ValueError(f"Invalid result status/source: {row['unit']}") + if row["unit"] in matched: + raise ValueError(f"Duplicate current result: {row['unit']}") + matched[row["unit"]] = { + **unit, + "source": row["source"], + "status": row["status"], + "repo": record["repo"], + "pin": record["pin"], + "pin_role": row.get("pin_role"), + **features(row), + } + rows = [ + matched.get(u["unit"], {**u, "source": u.get("source", "unknown"), "status": "missing", **features({"status": "missing"})}) + for u in units + ] + kinds = sorted({r["sink_kind"] for r in rows if r["status"] != "missing"}) + scopes = {"overall": scope_report(rows, kinds)} + for field in ("family", "source"): + scopes[f"by_{field}"] = { + value: scope_report([r for r in rows if r[field] == value], kinds) for value in sorted({r[field] for r in rows}) + } + return { + "cost_usd": 0, + "materialization_version": version, + "threshold": THRESHOLD, + "minimum_samples": 10, + "unit_rows_read": len(units), + "matched_rows": len(matched), + "inputs": { + **{k: counts[k] for k in ("accepted_files", "result_rows_read", "stale", "unfinished", "skipped")}, + "files_read": len(files), + "bytes_read": sum(f["bytes"] for f in files), + "files": files, + }, + "semantics": { + "signals": "Shortest nonempty trace (first on ties); its sanitizer, guard and corresponding witness sink call target.", + "missing": "Coverage only; absent source metadata is unknown. Skipped result units are never consumed.", + "non_path": "Observed non-path rows score zero; path rows lacking trace evidence have null trace features.", + "asked": "path or asked-nothing=1; failed, timeout, unsupported=0; missing excluded from metrics.", + "asymmetry": "Disjoint categories; not_both_asked takes precedence over path asymmetry.", + "flags": "Best of both directions, >=0.70 with >=10 pairs for pair accuracy or >=10 rows for AUC.", + "sink_kind": "One binary indicator per observed call target, including no-path/unknown; no ordinal encoding.", + "limits": "Exploratory associations, not proof of leakage; running input snapshot, no multiple-testing correction.", + }, + **scopes, + "units": rows, + } + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--results", type=Path, default=RESULTS) + parser.add_argument("--units", type=Path, default=UNITS) + parser.add_argument("--output", type=Path, default=OUTPUT) + args = parser.parse_args() + raw = args.units.read_bytes() + units = [json.loads(line) for line in raw.splitlines() if line.strip()] + report = audit(units, args.results) + report["units_input"] = {"path": str(args.units), "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest()} + args.output.parent.mkdir(parents=True, exist_ok=True) + args.output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n") + overall, inputs = report["overall"], report["inputs"] + lines = [ + f"Joern leak audit: $0; materialization_version={report['materialization_version']}", + f"Units read: {len(units)}; bytes={len(raw)}; file={args.units}", + f"Result files read: {inputs['files_read']}; bytes={inputs['bytes_read']}; accepted={inputs['accepted_files']}", + f"Skipped: {inputs['skipped']} (stale={inputs['stale']}, unfinished={inputs['unfinished']}; counts overlap)", + f"Result rows read: {inputs['result_rows_read']}; matched={report['matched_rows']}", + f"Coverage: {overall['coverage']}", + f"Pairs: {overall['complete_pairs']}; both asked={overall['both_asked_pairs']}", + f"Asymmetry: {overall['pair_asymmetry']}", + ] + for signal in (*SIGNALS, "sink_kind"): + + def brief(value, signal=signal): + if signal == "sink_kind": + return {k: brief_metric(m) for k, m in value.items()} + return brief_metric(value) + + lines.append(f"{signal}: all={brief(overall['signals'][signal])}; both asked={brief(overall['both_asked_signals'][signal])}") + lines.append(f"Family/source metrics and per-file read evidence: {args.output}") + print("\n".join(lines)) + + +def brief_metric(metric): + return {k: metric[k] for k in ("rows", "pairs", "within_pair_accuracy", "pooled_auc", "flagged")} + + +if __name__ == "__main__": + main() diff --git a/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json b/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json new file mode 100644 index 0000000..bc22133 --- /dev/null +++ b/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json @@ -0,0 +1,326 @@ +{ + "created": "2026-10-04", + "note": "COUNTS ONLY. Batch 3 of real (vulnerable function, fixed function) pairs whose function survives the fix, mined at zero model cost from reviewed GitHub advisories (pip, npm, maven, composer) and added as pointer-pair corpus benchmarks/pairs/advisory-fixes-3 (source `advisory-fixes-3` in learn/sources.toml); labelled, given static feature records, built into the memory store and embedded. No chat-model call, no Docker, no Joern. Candidate, path, function and repository names stay in the catalog; the pairs the reserved-population guard flagged are withheld (found by bisection with the test output discarded; names never printed).", + "method": { + "enumeration": "gh api /advisories?type=reviewed&ecosystem=&cwes=&published=>2023-01-01 per ecosystem (pip, npm, maven, composer) x six compiled families; Go, Ruby and C# not enumerated; newest first", + "advisories_enumerated": 8531, + "advisories_published_after_2026_06_01": 1855, + "automated_screen": "as batch 2 (single family by CWE; linked fix commit, at most 3, one repository; repository not named anywhere under benchmarks/ incl. batches 1-2; excluded v3 file names never opened; no WordPress plugin; one pair per repository; SPDX licence permissive; one-parent commit; the function holding most changed code lines inside its own matcher span, declared once on both sides, body changed, >= 25% of the file's changed code lines) plus three widenings: (a) an advisory linking only a merged pull request uses its single commit or its squash/rebase merge commit; (b) commits of up to 6 non-test source files / 240 changed lines (batch 2: 4 / 120); (c) a second pass over advisories whose CWEs span two families, the family then chosen from the function's diff on review", + "file_reads": "commit metadata and the two versions of each changed source file through the contents API into scratch (no clone, no scanner, engine, plane Run or model on these repositories); scratch deleted after", + "manual_review": "every automated candidate's in-function diff read (agent, no model call); kept only when the named function itself holds the fix; a weak inline check replaced by a stronger helper call counts as the fix, a function that only forwards a flag or calls a fix made elsewhere does not", + "reserved_population_guard": "pytest -q tests/ -k 'reserved or v3' with output discarded, bisected over catalog subsets (18 runs; baseline with an empty batch green); final catalog green", + "rename_check": "canonical full_name of every kept repository from the API: no two kept pairs share a repository, none renamed into a name the benchmarks use", + "mechanism": "family default as batch 2 (injection/output_encoding/deserialization source_reaches_sink, path path_join_user_input, access_control missing_auth_guard, untrusted_destination validation_strength for CWE-601 else source_reaches_sink); provenance = agent" + }, + "screened": { + "advisories_examined": 8805, + "outcomes": { + "no fix commit linked": 3480, + "repository already in benchmarks/ (populations v1/v2 or a pair corpus)": 1993, + "licence not permissive or unrecorded": 1249, + "repository already kept (one pair per repository)": 657, + "kept": 398, + "CWEs span several families": 274, + "no function declared on both sides with a changed body": 191, + "large commit (refactor or release, not the fix)": 173, + "fix spread over several commits or repositories": 167, + "merge or root commit": 115, + "no source file changed": 42, + "language outside the feature vocabulary (go/ruby/c#/...)": 32, + "manual review: the chosen function does not hold the fix (comment-only, misattributed, partial or family mismatch)": 19, + "repository unavailable": 9, + "WordPress plugin (population v3 safety)": 4, + "fix commit unavailable": 2 + }, + "outcomes_note": "single-family pass (screen 2, every advisory examined, no quota met) plus the two-family pass; `kept` = automated candidates; `manual review: the chosen function does not hold the fix (comment-only, misattributed, partial or family mismatch)` = the screen re-meeting a function the 2026-10-03 review had dropped", + "candidates_manually_reviewed": 412, + "kept_after_review": 255, + "review_drops": { + "total": 157, + "change in the function unrelated to the advisory (refactor, rename, formatting, another advisory)": 33, + "function misattributed (matcher span overrun or an undetected enclosing declaration)": 33, + "partial: the function only calls or configures the real fix": 29, + "function diff not small (rewrite or refactor around the fix)": 28, + "unsure": 17, + "family mismatch": 11, + "same fix as a kept pair in a fork or sibling repository (would leak across repository folds)": 3, + "WordPress plugin (population v3 safety; missed by the automated screen)": 2, + "reserved-population guard (flagged by the 2026-10-03 guard run; name not printed)": 1 + }, + "one_pair_per_repository_drops": 3, + "reserved_population_drops": 2, + "kept": 251 + }, + "kept": { + "total": 251, + "by_family": { + "access_control": 20, + "deserialization": 9, + "injection": 56, + "output_encoding": 69, + "path": 71, + "untrusted_destination": 26 + }, + "post_cutoff_by_family": { + "injection": 5, + "output_encoding": 5, + "path": 2 + }, + "post_cutoff_total": 12, + "by_language": { + "java": 37, + "javascript": 37, + "php": 46, + "python": 83, + "typescript": 48 + }, + "post_cutoff_by_language": { + "python": 6, + "typescript": 6 + }, + "by_family_language": { + "access_control:java": 5, + "access_control:javascript": 3, + "access_control:php": 7, + "access_control:python": 2, + "access_control:typescript": 3, + "deserialization:java": 2, + "deserialization:php": 1, + "deserialization:python": 6, + "injection:java": 5, + "injection:javascript": 7, + "injection:php": 9, + "injection:python": 24, + "injection:typescript": 11, + "output_encoding:java": 7, + "output_encoding:javascript": 20, + "output_encoding:php": 12, + "output_encoding:python": 14, + "output_encoding:typescript": 16, + "path:java": 10, + "path:javascript": 4, + "path:php": 10, + "path:python": 34, + "path:typescript": 13, + "untrusted_destination:java": 8, + "untrusted_destination:javascript": 3, + "untrusted_destination:php": 7, + "untrusted_destination:python": 3, + "untrusted_destination:typescript": 5 + }, + "by_ecosystem": { + "composer": 46, + "maven": 37, + "npm": 81, + "pip": 87 + }, + "licences": { + "Apache-2.0": 80, + "BSD-2-Clause": 3, + "BSD-3-Clause": 18, + "ISC": 1, + "MIT": 147, + "MPL-2.0": 1, + "Unlicense": 1 + }, + "split": { + "holdout": 124, + "train": 127 + }, + "published_by_year": { + "2023": 50, + "2024": 52, + "2025": 66, + "2026": 83 + }, + "published_range": [ + "2023-01-04", + "2026-10-01" + ], + "via_pull_request": 13, + "commit_over_120_source_lines": 10, + "two_family_advisory_family_chosen_on_review": 3, + "verification": { + "verified": 251, + "excerpt_bytes_read": 1297516 + }, + "targets": { + "asked": "injection and untrusted_destination >= 60 each; path, access_control, output_encoding, deserialization >= 30 where advisories allow; >= 250 total", + "met": { + "access_control": false, + "deserialization": false, + "injection": false, + "output_encoding": true, + "path": true, + "untrusted_destination": false + }, + "limit": "the reviewed-advisory pool, not the review: every advisory since 2023-01-01 in the four ecosystems was examined; the post-cutoff pool was largely spent by batch 2 (its repositories are now excluded), and untrusted_destination/access_control/deserialization advisories mostly lack a linked single fix commit or sit in repositories the benchmarks already use" + } + }, + "labels": { + "command": "ousast learn labels --root . --out --snapshot ", + "rows": [ + 6981, + 7985 + ], + "pairs_rows": [ + 1936, + 2940 + ], + "new_pair_rows": 1004 + }, + "features": { + "command": "benchmarks/learn/build_features.py --labels --units --catalog benchmarks/pairs/advisory-fixes-3/catalog.toml --kinds pairs", + "records": { + "plane:access_control": 40, + "plane:deserialization": 18, + "plane:injection": 112, + "plane:output_encoding": 138, + "plane:path": 142, + "plane:untrusted_destination": 52, + "static:access_control": 40, + "static:deserialization": 18, + "static:injection": 112, + "static:output_encoding": 138, + "static:path": 142, + "static:untrusted_destination": 52 + }, + "instrument_states_plane_all_families": { + "agree:missing": 164, + "agree:none": 338, + "delta:not_applicable": 502, + "engine:missing": 406, + "engine:none": 96, + "entry_points:not_applicable": 502, + "facts:not_applicable": 502, + "language:ran": 502, + "model_sinks:missing": 502, + "quick:ran": 502, + "roles:ran": 502, + "source:ran": 502, + "verify:missing": 164, + "verify:none": 338 + }, + "note": "quick rules and deterministic roles ran on each side; engine, verify, agree and model sinks never ran for these pairs (missing/none: null features, never zeros)" + }, + "memory_build": { + "command": "ousast learn memory build --labels --units --profile static --root . (exit 2: adjudications 9 of 43 anonymous functions, unchanged since 2026-10-01; rows kept)", + "examples": [ + 1133, + 1635 + ], + "pairs_examples": [ + 968, + 1470 + ], + "pairs_counts_after": { + "absent_fixed_side": 0, + "examples": 1470, + "labels": 2940, + "no_excerpt": 0, + "no_record": 1470, + "recorded": 1470, + "unread": 0 + } + }, + "complete_pairs": { + "how": "store example rows (profile static) keyed as learn.experiments.freeze_units pairs them: (repo, candidate, family) holding both labels; whole memory, every family", + "before": 459, + "after": 710, + "by_family": { + "access_control": [ + 37, + 57 + ], + "config_secrets": [ + 12, + 12 + ], + "deserialization": [ + 32, + 41 + ], + "injection": [ + 68, + 124 + ], + "memory": [ + 149, + 149 + ], + "output_encoding": [ + 77, + 146 + ], + "path": [ + 38, + 109 + ], + "unknown": [ + 2, + 2 + ], + "untrusted_destination": [ + 44, + 70 + ] + }, + "exp_004_005_units": "195 complete pairs inside exp-004/005's frozen 501 units (six families, evaluation folds); those units are frozen and were not regenerated here" + }, + "positives_only_groups": { + "before": 99, + "after": 99, + "groups_both_by_family": { + "access_control": [ + 37, + 57 + ], + "config_secrets": [ + 2, + 2 + ], + "deserialization": [ + 32, + 41 + ], + "injection": [ + 53, + 109 + ], + "memory": [ + 5, + 5 + ], + "output_encoding": [ + 38, + 107 + ], + "path": [ + 38, + 109 + ], + "unknown": [ + 2, + 2 + ], + "untrusted_destination": [ + 42, + 68 + ] + } + }, + "embeddings": { + "command": "ousast learn memory embed --budget-usd 0.20 (dry run first: 144,806 estimated tokens, $0.0029)", + "requested": 1479, + "cached": 1004, + "embedded": 475, + "calls": 15, + "tokens": 150339, + "usd": 0.003007 + }, + "spend": { + "chat_model_calls": 0, + "embedding_usd": 0.003007, + "github_api": "metadata and raw contents only" + } +} diff --git a/benchmarks/measurements/2026-10-04-joern-slice-leak-audit/record.json b/benchmarks/measurements/2026-10-04-joern-slice-leak-audit/record.json new file mode 100644 index 0000000..37bb05f --- /dev/null +++ b/benchmarks/measurements/2026-10-04-joern-slice-leak-audit/record.json @@ -0,0 +1,27014 @@ +{ + "by_family": { + "access_control": { + "both_asked_pairs": 0, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + } + } + }, + "complete_pairs": 28, + "coverage": { + "asked-nothing": 0, + "failed": 0, + "missing": 0, + "path": 0, + "timeout": 0, + "unsupported": 66 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 0, + "not_both_asked": 28, + "vulnerable_only": 0 + }, + "rows": 66, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 38, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5 + } + } + } + }, + "deserialization": { + "both_asked_pairs": 18, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5277777777777778, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.5277777777777778 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5324074074074074, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5324074074074074, + "positive": 18, + "rows": 36, + "ties": 16, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.4722222222222222, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.4722222222222222 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5277777777777778, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.5277777777777778 + } + } + }, + "complete_pairs": 25, + "coverage": { + "asked-nothing": 28, + "failed": 2, + "missing": 0, + "path": 22, + "timeout": 0, + "unsupported": 12 + }, + "pair_asymmetry": { + "both": 4, + "fixed_only": 0, + "neither": 13, + "not_both_asked": 7, + "vulnerable_only": 1 + }, + "rows": 64, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5502564102564103, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5502564102564103, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.6507692307692308, + "best_direction_within_pair_accuracy": 0.52, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.6507692307692308, + "positive": 39, + "rows": 64, + "ties": 24, + "within_pair_accuracy": 0.52 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.6523076923076923, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 1, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.6523076923076923, + "positive": 39, + "rows": 64, + "ties": 23, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5071794871794872, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.4928205128205128, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.6507692307692308, + "best_direction_within_pair_accuracy": 0.52, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.34923076923076923, + "positive": 39, + "rows": 64, + "ties": 24, + "within_pair_accuracy": 0.48 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.6666666666666666, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.6666666666666666, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.5, + "positive": 39, + "rows": 64, + "ties": 25, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5087179487179487, + "best_direction_within_pair_accuracy": 0.52, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 25, + "pairs": 25, + "pooled_auc": 0.49128205128205127, + "positive": 39, + "rows": 64, + "ties": 24, + "within_pair_accuracy": 0.52 + } + } + } + }, + "injection": { + "both_asked_pairs": 40, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.525, + "best_direction_within_pair_accuracy": 0.525, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.475, + "positive": 40, + "rows": 80, + "ties": 38, + "within_pair_accuracy": 0.475 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5021875, + "best_direction_within_pair_accuracy": 0.55, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 4, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.4978125, + "positive": 40, + "rows": 80, + "ties": 36, + "within_pair_accuracy": 0.45 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5125, + "best_direction_within_pair_accuracy": 0.5125, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5125, + "positive": 40, + "rows": 80, + "ties": 39, + "within_pair_accuracy": 0.5125 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5125, + "best_direction_within_pair_accuracy": 0.5125, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.4875, + "positive": 40, + "rows": 80, + "ties": 39, + "within_pair_accuracy": 0.4875 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 40, + "pairs": 40, + "pooled_auc": 0.5, + "positive": 40, + "rows": 80, + "ties": 40, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 53, + "coverage": { + "asked-nothing": 94, + "failed": 3, + "missing": 0, + "path": 24, + "timeout": 0, + "unsupported": 28 + }, + "pair_asymmetry": { + "both": 4, + "fixed_only": 0, + "neither": 36, + "not_both_asked": 13, + "vulnerable_only": 0 + }, + "rows": 149, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.516522210184182, + "best_direction_within_pair_accuracy": 0.5094339622641509, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.516522210184182, + "positive": 78, + "rows": 149, + "ties": 52, + "within_pair_accuracy": 0.49056603773584906 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5327735644637053, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5327735644637053, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5140845070422535, + "best_direction_within_pair_accuracy": 0.5188679245283019, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.4859154929577465, + "positive": 78, + "rows": 149, + "ties": 51, + "within_pair_accuracy": 0.4811320754716981 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5296135789093536, + "best_direction_within_pair_accuracy": 0.5377358490566038, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 4, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5296135789093536, + "positive": 78, + "rows": 149, + "ties": 49, + "within_pair_accuracy": 0.46226415094339623 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5094339622641509, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 52, + "within_pair_accuracy": 0.5094339622641509 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5006319971108704, + "best_direction_within_pair_accuracy": 0.5094339622641509, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.49936800288912964, + "positive": 78, + "rows": 149, + "ties": 52, + "within_pair_accuracy": 0.49056603773584906 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5128205128205128, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5128205128205128, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5012639942217407, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.4987360057782593, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5327735644637053, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.46722643553629467, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5006319971108704, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.49936800288912964, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.528169014084507, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.47183098591549294, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5064102564102564, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5064102564102564, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5070422535211268, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.49295774647887325, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5192307692307693, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5192307692307693, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 71, + "pairs": 53, + "pooled_auc": 0.5, + "positive": 78, + "rows": 149, + "ties": 53, + "within_pair_accuracy": 0.5 + } + } + } + }, + "output_encoding": { + "both_asked_pairs": 12, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 12, + "pairs": 12, + "pooled_auc": 0.5, + "positive": 12, + "rows": 24, + "ties": 12, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 28, + "coverage": { + "asked-nothing": 32, + "failed": 0, + "missing": 0, + "path": 5, + "timeout": 0, + "unsupported": 32 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 12, + "not_both_asked": 16, + "vulnerable_only": 0 + }, + "rows": 69, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5905923344947736, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5905923344947736, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5609756097560976, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5609756097560976, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5609756097560976, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5609756097560976, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5609756097560976, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5609756097560976, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5609756097560976, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.43902439024390244, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 28, + "pairs": 28, + "pooled_auc": 0.5, + "positive": 41, + "rows": 69, + "ties": 28, + "within_pair_accuracy": 0.5 + } + } + } + }, + "path": { + "both_asked_pairs": 18, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5277777777777778, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.5277777777777778 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.4722222222222222, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.4722222222222222 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5216049382716049, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5216049382716049, + "positive": 18, + "rows": 36, + "ties": 15, + "within_pair_accuracy": 0.4722222222222222 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.4722222222222222, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.4722222222222222 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5277777777777778, + "best_direction_within_pair_accuracy": 0.5277777777777778, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5277777777777778, + "positive": 18, + "rows": 36, + "ties": 17, + "within_pair_accuracy": 0.5277777777777778 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 18, + "pairs": 18, + "pooled_auc": 0.5, + "positive": 18, + "rows": 36, + "ties": 18, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 29, + "coverage": { + "asked-nothing": 38, + "failed": 2, + "missing": 0, + "path": 6, + "timeout": 0, + "unsupported": 20 + }, + "pair_asymmetry": { + "both": 2, + "fixed_only": 0, + "neither": 15, + "not_both_asked": 11, + "vulnerable_only": 1 + }, + "rows": 66, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5410065237651445, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5410065237651445, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5195712954333644, + "best_direction_within_pair_accuracy": 0.5172413793103449, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5195712954333644, + "positive": 37, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5172413793103449 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5172413793103448, + "best_direction_within_pair_accuracy": 0.5172413793103448, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.4827586206896552, + "positive": 37, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.4827586206896552 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.516775396085741, + "best_direction_within_pair_accuracy": 0.5172413793103448, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 1, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.516775396085741, + "positive": 37, + "rows": 66, + "ties": 26, + "within_pair_accuracy": 0.4827586206896552 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5037278657968314, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.4962721342031687, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5195712954333644, + "best_direction_within_pair_accuracy": 0.5172413793103448, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.4804287045666356, + "positive": 37, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.4827586206896552 + }, + "open": { + "best_direction_pooled_auc": 0.5135135135135135, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5135135135135135, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5037278657968314, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.4962721342031687, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5135135135135135, + "best_direction_within_pair_accuracy": 0.5172413793103449, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5135135135135135, + "positive": 37, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.5172413793103449 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 29, + "pairs": 29, + "pooled_auc": 0.5, + "positive": 37, + "rows": 66, + "ties": 29, + "within_pair_accuracy": 0.5 + } + } + } + }, + "untrusted_destination": { + "both_asked_pairs": 17, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5017301038062284, + "best_direction_within_pair_accuracy": 0.5294117647058824, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.4982698961937716, + "positive": 17, + "rows": 34, + "ties": 16, + "within_pair_accuracy": 0.47058823529411764 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 17, + "pairs": 17, + "pooled_auc": 0.5, + "positive": 17, + "rows": 34, + "ties": 17, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 32, + "coverage": { + "asked-nothing": 39, + "failed": 2, + "missing": 0, + "path": 15, + "timeout": 0, + "unsupported": 31 + }, + "pair_asymmetry": { + "both": 2, + "fixed_only": 0, + "neither": 15, + "not_both_asked": 15, + "vulnerable_only": 0 + }, + "rows": 87, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5932432432432433, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5932432432432433, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5794594594594594, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5794594594594594, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.575945945945946, + "best_direction_within_pair_accuracy": 0.515625, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.575945945945946, + "positive": 50, + "rows": 87, + "ties": 31, + "within_pair_accuracy": 0.484375 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.517027027027027, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.482972972972973, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5794594594594595, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.4205405405405405, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5964864864864865, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5964864864864865, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 37, + "pairs": 32, + "pooled_auc": 0.5, + "positive": 50, + "rows": 87, + "ties": 32, + "within_pair_accuracy": 0.5 + } + } + } + } + }, + "by_source": { + "adjudications": { + "both_asked_pairs": 0, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + } + } + }, + "complete_pairs": 0, + "coverage": { + "asked-nothing": 11, + "failed": 1, + "missing": 0, + "path": 6, + "timeout": 0, + "unsupported": 6 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 0, + "not_both_asked": 0, + "vulnerable_only": 0 + }, + "rows": 24, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.6521739130434783, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.6521739130434783, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": 0.6304347826086957, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.3695652173913043, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.6304347826086957, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.3695652173913043, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": 0.5217391304347826, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.4782608695652174, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": 0.6304347826086957, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.6304347826086957, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": 0.5869565217391304, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.41304347826086957, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": 0.5217391304347826, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.4782608695652174, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 23, + "pairs": 0, + "pooled_auc": 0.5, + "positive": 1, + "rows": 24, + "ties": 0, + "within_pair_accuracy": null + } + } + } + }, + "advisory-fixes": { + "both_asked_pairs": 33, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5303030303030303, + "best_direction_within_pair_accuracy": 0.5303030303030303, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 2, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5303030303030303, + "positive": 33, + "rows": 66, + "ties": 31, + "within_pair_accuracy": 0.5303030303030303 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5266299357208448, + "best_direction_within_pair_accuracy": 0.5151515151515151, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 2, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5266299357208448, + "positive": 33, + "rows": 66, + "ties": 28, + "within_pair_accuracy": 0.48484848484848486 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5303030303030303, + "best_direction_within_pair_accuracy": 0.5303030303030303, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.4696969696969697, + "positive": 33, + "rows": 66, + "ties": 31, + "within_pair_accuracy": 0.4696969696969697 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5, + "positive": 33, + "rows": 66, + "ties": 33, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5151515151515151, + "best_direction_within_pair_accuracy": 0.5151515151515151, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5151515151515151, + "positive": 33, + "rows": 66, + "ties": 32, + "within_pair_accuracy": 0.5151515151515151 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5151515151515151, + "best_direction_within_pair_accuracy": 0.5151515151515151, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 33, + "pairs": 33, + "pooled_auc": 0.5151515151515151, + "positive": 33, + "rows": 66, + "ties": 32, + "within_pair_accuracy": 0.5151515151515151 + } + } + }, + "complete_pairs": 76, + "coverage": { + "asked-nothing": 52, + "failed": 2, + "missing": 0, + "path": 14, + "timeout": 0, + "unsupported": 84 + }, + "pair_asymmetry": { + "both": 6, + "fixed_only": 0, + "neither": 25, + "not_both_asked": 43, + "vulnerable_only": 2 + }, + "rows": 152, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5131578947368421, + "best_direction_within_pair_accuracy": 0.5131578947368421, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 2, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5131578947368421, + "positive": 76, + "rows": 152, + "ties": 74, + "within_pair_accuracy": 0.5131578947368421 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5124653739612188, + "best_direction_within_pair_accuracy": 0.506578947368421, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 2, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5124653739612188, + "positive": 76, + "rows": 152, + "ties": 71, + "within_pair_accuracy": 0.4934210526315789 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.513157894736842, + "best_direction_within_pair_accuracy": 0.513157894736842, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.4868421052631579, + "positive": 76, + "rows": 152, + "ties": 74, + "within_pair_accuracy": 0.4868421052631579 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.5, + "positive": 76, + "rows": 152, + "ties": 76, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.506578947368421, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 152, + "ties": 75, + "within_pair_accuracy": 0.506578947368421 + }, + "unserialize": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.506578947368421, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 76, + "pairs": 76, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 152, + "ties": 75, + "within_pair_accuracy": 0.506578947368421 + } + } + } + }, + "advisory-fixes-2": { + "both_asked_pairs": 35, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5142857142857142, + "best_direction_within_pair_accuracy": 0.5142857142857142, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.4857142857142857, + "positive": 35, + "rows": 70, + "ties": 34, + "within_pair_accuracy": 0.4857142857142857 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5004081632653061, + "best_direction_within_pair_accuracy": 0.5142857142857142, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.4995918367346939, + "positive": 35, + "rows": 70, + "ties": 34, + "within_pair_accuracy": 0.4857142857142857 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 35, + "pairs": 35, + "pooled_auc": 0.5, + "positive": 35, + "rows": 70, + "ties": 35, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 72, + "coverage": { + "asked-nothing": 66, + "failed": 4, + "missing": 0, + "path": 4, + "timeout": 0, + "unsupported": 70 + }, + "pair_asymmetry": { + "both": 2, + "fixed_only": 0, + "neither": 33, + "not_both_asked": 37, + "vulnerable_only": 0 + }, + "rows": 144, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5069444444444444, + "best_direction_within_pair_accuracy": 0.5069444444444444, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.4930555555555556, + "positive": 72, + "rows": 144, + "ties": 71, + "within_pair_accuracy": 0.4930555555555556 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.500096450617284, + "best_direction_within_pair_accuracy": 0.5069444444444444, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.49990354938271603, + "positive": 72, + "rows": 144, + "ties": 71, + "within_pair_accuracy": 0.4930555555555556 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 72, + "pairs": 72, + "pooled_auc": 0.5, + "positive": 72, + "rows": 144, + "ties": 72, + "within_pair_accuracy": 0.5 + } + } + } + }, + "dev-php": { + "both_asked_pairs": 0, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + } + } + }, + "complete_pairs": 0, + "coverage": { + "asked-nothing": 0, + "failed": 0, + "missing": 0, + "path": 1, + "timeout": 0, + "unsupported": 0 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 0, + "not_both_asked": 0, + "vulnerable_only": 0 + }, + "rows": 1, + "signals": { + "asked": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 1, + "rows": 1, + "ties": 0, + "within_pair_accuracy": null + } + } + } + }, + "population-v1": { + "both_asked_pairs": 9, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5555555555555556, + "best_direction_within_pair_accuracy": 0.5555555555555556, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.4444444444444444, + "positive": 9, + "rows": 18, + "ties": 8, + "within_pair_accuracy": 0.4444444444444444 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5246913580246914, + "best_direction_within_pair_accuracy": 0.6666666666666667, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.47530864197530864, + "positive": 9, + "rows": 18, + "ties": 6, + "within_pair_accuracy": 0.3333333333333333 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5555555555555556, + "best_direction_within_pair_accuracy": 0.5555555555555556, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5555555555555556, + "positive": 9, + "rows": 18, + "ties": 8, + "within_pair_accuracy": 0.5555555555555556 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5555555555555556, + "best_direction_within_pair_accuracy": 0.5555555555555556, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.4444444444444444, + "positive": 9, + "rows": 18, + "ties": 8, + "within_pair_accuracy": 0.4444444444444444 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 9, + "pairs": 9, + "pooled_auc": 0.5, + "positive": 9, + "rows": 18, + "ties": 9, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 14, + "coverage": { + "asked-nothing": 18, + "failed": 1, + "missing": 0, + "path": 6, + "timeout": 0, + "unsupported": 10 + }, + "pair_asymmetry": { + "both": 3, + "fixed_only": 0, + "neither": 6, + "not_both_asked": 5, + "vulnerable_only": 0 + }, + "rows": 35, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5357142857142857, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5357142857142857, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5357142857142857, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.4642857142857143, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5357142857142857, + "best_direction_within_pair_accuracy": 0.5357142857142857, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.4642857142857143, + "positive": 21, + "rows": 35, + "ties": 13, + "within_pair_accuracy": 0.4642857142857143 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5425170068027211, + "best_direction_within_pair_accuracy": 0.6071428571428572, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.4574829931972789, + "positive": 21, + "rows": 35, + "ties": 11, + "within_pair_accuracy": 0.39285714285714285 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5238095238095238, + "best_direction_within_pair_accuracy": 0.5357142857142857, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5238095238095238, + "positive": 21, + "rows": 35, + "ties": 13, + "within_pair_accuracy": 0.5357142857142857 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5357142857142857, + "best_direction_within_pair_accuracy": 0.5357142857142857, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.4642857142857143, + "positive": 21, + "rows": 35, + "ties": 13, + "within_pair_accuracy": 0.4642857142857143 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5238095238095238, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.47619047619047616, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5357142857142857, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5357142857142857, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 14, + "pairs": 14, + "pooled_auc": 0.5, + "positive": 21, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.5 + } + } + } + }, + "population-v2": { + "both_asked_pairs": 11, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 11, + "pairs": 11, + "pooled_auc": 0.5, + "positive": 11, + "rows": 22, + "ties": 11, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 15, + "coverage": { + "asked-nothing": 27, + "failed": 1, + "missing": 0, + "path": 0, + "timeout": 0, + "unsupported": 7 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 11, + "not_both_asked": 4, + "vulnerable_only": 0 + }, + "rows": 35, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.525, + "best_direction_within_pair_accuracy": 0.5333333333333333, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.475, + "positive": 20, + "rows": 35, + "ties": 14, + "within_pair_accuracy": 0.4666666666666667 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 20, + "rows": 35, + "ties": 15, + "within_pair_accuracy": 0.5 + } + } + } + }, + "vfc": { + "both_asked_pairs": 0, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "guard_present": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "has_path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sanitized": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "shortest_path_steps": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "HttpResponse": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "User.objects.raw": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cur.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "cursor.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "db.query": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "fs.readFileSync": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "header": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "no-path": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "open": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "os.system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "pickle.loads": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "redirect": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "send_from_directory": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.exec": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "session.execute": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "subprocess.Popen": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "system": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "text": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unknown": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + }, + "unserialize": { + "best_direction_pooled_auc": null, + "best_direction_within_pair_accuracy": null, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 0, + "pairs": 0, + "pooled_auc": null, + "positive": 0, + "rows": 0, + "ties": 0, + "within_pair_accuracy": null + } + } + }, + "complete_pairs": 1, + "coverage": { + "asked-nothing": 0, + "failed": 0, + "missing": 0, + "path": 0, + "timeout": 0, + "unsupported": 2 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 0, + "not_both_asked": 1, + "vulnerable_only": 0 + }, + "rows": 2, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 1, + "pairs": 1, + "pooled_auc": 0.5, + "positive": 1, + "rows": 2, + "ties": 1, + "within_pair_accuracy": 0.5 + } + } + } + }, + "vfc-js": { + "both_asked_pairs": 15, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5333333333333333, + "best_direction_within_pair_accuracy": 0.5333333333333333, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.4666666666666667, + "positive": 15, + "rows": 30, + "ties": 14, + "within_pair_accuracy": 0.4666666666666667 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5022222222222222, + "best_direction_within_pair_accuracy": 0.5333333333333333, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.49777777777777776, + "positive": 15, + "rows": 30, + "ties": 14, + "within_pair_accuracy": 0.4666666666666667 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 15, + "coverage": { + "asked-nothing": 28, + "failed": 0, + "missing": 0, + "path": 2, + "timeout": 0, + "unsupported": 0 + }, + "pair_asymmetry": { + "both": 1, + "fixed_only": 0, + "neither": 14, + "not_both_asked": 0, + "vulnerable_only": 0 + }, + "rows": 30, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5333333333333333, + "best_direction_within_pair_accuracy": 0.5333333333333333, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.4666666666666667, + "positive": 15, + "rows": 30, + "ties": 14, + "within_pair_accuracy": 0.4666666666666667 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5022222222222222, + "best_direction_within_pair_accuracy": 0.5333333333333333, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.49777777777777776, + "positive": 15, + "rows": 30, + "ties": 14, + "within_pair_accuracy": 0.4666666666666667 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 15, + "pairs": 15, + "pooled_auc": 0.5, + "positive": 15, + "rows": 30, + "ties": 15, + "within_pair_accuracy": 0.5 + } + } + } + }, + "vibe-py": { + "both_asked_pairs": 2, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 2, + "rows": 4, + "ties": 2, + "within_pair_accuracy": 0.5 + } + } + }, + "complete_pairs": 2, + "coverage": { + "asked-nothing": 29, + "failed": 0, + "missing": 0, + "path": 39, + "timeout": 0, + "unsupported": 10 + }, + "pair_asymmetry": { + "both": 0, + "fixed_only": 0, + "neither": 2, + "not_both_asked": 0, + "vulnerable_only": 0 + }, + "rows": 78, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5657894736842105, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.4342105263157895, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.756578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": true, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.756578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.756578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": true, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.756578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5328947368421053, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5328947368421053, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5131578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5131578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.756578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": true, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.24342105263157895, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "open": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5855263157894737, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5855263157894737, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5657894736842105, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5657894736842105, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.506578947368421, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.506578947368421, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5197368421052632, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5197368421052632, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 2, + "pairs": 2, + "pooled_auc": 0.5, + "positive": 76, + "rows": 78, + "ties": 2, + "within_pair_accuracy": 0.5 + } + } + } + } + }, + "cost_usd": 0, + "inputs": { + "accepted_files": 441, + "bytes_read": 25558078, + "files": [ + { + "bytes": 1258, + "path": "/home/mc/ousast-results/plane/engine-trace/003e34771021a900322da555a564ec81034eec930a27223f990769dff3243343.json", + "sha256": "7f13ef41e3faab12c923f0c024c72d33da669bd3893738f91b52e6fa63c7df2a", + "stale": false, + "unfinished": false + }, + { + "bytes": 24664, + "path": "/home/mc/ousast-results/plane/engine-trace/00d060297b72ad7727eec5e0494cb602c6a4c88d65c4e179cbad7a9f18dfd343.json", + "sha256": "b7f62e6429cc310efc16923b3a74a5f713ed3e6c5768faa60e32d653327866ab", + "stale": false, + "unfinished": false + }, + { + "bytes": 17390, + "path": "/home/mc/ousast-results/plane/engine-trace/0127b1f644bcf0ae54d029f7f913d948542b9478c1afaa0e3b70ae40ff669c5f.json", + "sha256": "884f1f0ac8800462c686c7b61f4144fe0b4ad7b4352222472f678db8960c4624", + "stale": false, + "unfinished": false + }, + { + "bytes": 9312, + "path": "/home/mc/ousast-results/plane/engine-trace/01a06cc4198c8c95736202fb99dcf9529185a533309bde6b8ed3007bbecd37e1.json", + "sha256": "8976ff4f5961d619519608f4e513aeb96a886675a4aa5bbfe71955f4f83dc8c2", + "stale": false, + "unfinished": false + }, + { + "bytes": 9322, + "path": "/home/mc/ousast-results/plane/engine-trace/025d67edc68344917bdae178834453612dfa3b70765da61ef2e07dab3fac92e3.json", + "sha256": "fea393591a5c42da269d7a60af266044160a4dd55ad168dce22cecc38bfe4ff6", + "stale": false, + "unfinished": false + }, + { + "bytes": 1294, + "path": "/home/mc/ousast-results/plane/engine-trace/03d03b00df4af82952ea61b416b9a086fdde46e6e734af02cdfb16a9750d812d.json", + "sha256": "80f24f152a153029e6442737bd49b7760bb765de188f014cac70e0e85c94f813", + "stale": false, + "unfinished": false + }, + { + "bytes": 200463, + "path": "/home/mc/ousast-results/plane/engine-trace/05549d5bf81f0e94087e0b8bf2d15142a442b19b589de98dab3eb6dd5b745541.json", + "sha256": "c02cb9fa8d0270d9293376f6ee7ce8cfb28e7b465f10f1ec3e92dce7de8447ab", + "stale": false, + "unfinished": false + }, + { + "bytes": 1278, + "path": "/home/mc/ousast-results/plane/engine-trace/05e45feb6cae461c9ccba57e19fbd4bc6d814efb5c3da5549e38651bceea6f71.json", + "sha256": "e5fbfb90e3dbd71a58696815cd923bd6adf7f66025ffe00de8421f58eb9ace5d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1296, + "path": "/home/mc/ousast-results/plane/engine-trace/0747641094c37650b4de7a81c001b3878478e6f17509fb2c43b4d773c766e4b2.json", + "sha256": "9ccc498d357c3a73794e67020149e149b0c5ad79005e07c90855ea078fb7034d", + "stale": false, + "unfinished": false + }, + { + "bytes": 66953, + "path": "/home/mc/ousast-results/plane/engine-trace/07cad9e3b1dd11e6acb962292219c5a6d64e769502c81b253dfe4a28465991cf.json", + "sha256": "eeaf2a2848939ece93ce23057236753eb0f246bfb43c9911a69b2cdd6bc1731f", + "stale": false, + "unfinished": false + }, + { + "bytes": 74863, + "path": "/home/mc/ousast-results/plane/engine-trace/083faef3c74f6bc4573b6d893ccb2889121007404ded7ff588061b439c3cbc4d.json", + "sha256": "48e49e9d4fd9ff788ae51804af7dad4e4fca61fafb37641a20a1eb78f3f76657", + "stale": false, + "unfinished": false + }, + { + "bytes": 1285, + "path": "/home/mc/ousast-results/plane/engine-trace/09b8c29b556fa20dae86345b6f82fb919c69c2ce97c39209fcf294abc412733c.json", + "sha256": "f8fa8e08daae3113045c383f4f42548d9f249286d487bad4fd2105de2e39efd0", + "stale": false, + "unfinished": false + }, + { + "bytes": 1250, + "path": "/home/mc/ousast-results/plane/engine-trace/09d9504e3355079a9e1e5b5c839862645d6cb20ce916dd97edc043fcfcbd2afc.json", + "sha256": "9e2c951abd19a810d20c4fd81679de365247b90e8aa68421e24eb3c603f44100", + "stale": false, + "unfinished": false + }, + { + "bytes": 1306, + "path": "/home/mc/ousast-results/plane/engine-trace/0ba9f6937c9c3e98d965d6f3259fa1614d49e44e258596109e88807b561e6897.json", + "sha256": "5be4e1ce2129048e36ead892e2c4bb2118438d6e37315e5944a6fab38d4036a7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1313, + "path": "/home/mc/ousast-results/plane/engine-trace/0bac3c7273a674307f42da2a9faf035248f731e337ee7b2a293ce7f9c72da14b.json", + "sha256": "cd02ce1be7b670964bb7a80c88e1fd68fca85378f278a713e9160b2baee2d0c6", + "stale": false, + "unfinished": false + }, + { + "bytes": 1315, + "path": "/home/mc/ousast-results/plane/engine-trace/0c4aa2109ee4708318e6db16d918c51b5639c340f8e42522e06c2dfa486e08e5.json", + "sha256": "9d068e5dc8262a0b7ead4a19a124621a4487c7582f584a0cadf67f71cf9e9b41", + "stale": false, + "unfinished": false + }, + { + "bytes": 16699, + "path": "/home/mc/ousast-results/plane/engine-trace/0d1d588bedd2309be14c0434b0177d3046ede9df9286a6b6a36d4ff202f22c76.json", + "sha256": "a5701191b4e6916c3119b7f090d7102f4a320122bea78ed190d53d190a25d437", + "stale": false, + "unfinished": false + }, + { + "bytes": 1316, + "path": "/home/mc/ousast-results/plane/engine-trace/0d338a02a11a539eb59eb8d869eb755a5db50043e347cdb5fc06cb147c339ff0.json", + "sha256": "10866b98313d7f4cb22146a3a626c5dd3f4cbea8bae6627b34814d46c698a312", + "stale": false, + "unfinished": false + }, + { + "bytes": 1353, + "path": "/home/mc/ousast-results/plane/engine-trace/0d6f38edf03327be598e47cc70bc7458f003ff9a064e88467fd17c77fcb1c49b.json", + "sha256": "8ee4f578237e390e4833d6951ef50bd5900a5a9b9208d1a23dd89bd977ea409d", + "stale": false, + "unfinished": false + }, + { + "bytes": 21029, + "path": "/home/mc/ousast-results/plane/engine-trace/0e19276c311e196cc51080a91e835fe6dbb099b63545ce0dd356089d8639035f.json", + "sha256": "0f30fbf2d266cb261729f413e8305afbced9833226222cfaa94a82e1f948f1ce", + "stale": false, + "unfinished": false + }, + { + "bytes": 1241, + "path": "/home/mc/ousast-results/plane/engine-trace/0f53dbbf18a3946ffe5ffba6bc2b9e65335f68a489c43374b3d7b7291763684a.json", + "sha256": "8cdb466b4564e5c46a93c5d9d5238435e1cf2cdcb3859accb4a157f00fe85fce", + "stale": false, + "unfinished": false + }, + { + "bytes": 9311, + "path": "/home/mc/ousast-results/plane/engine-trace/0f86a73991c65781fd959a3a54b29d3408f535a16b6c3f4233c12ac3df77f0e9.json", + "sha256": "31ddac0f6f4a379ea564a11dac7338e2887b165963e3109628d0798b198d2dc0", + "stale": false, + "unfinished": false + }, + { + "bytes": 1297, + "path": "/home/mc/ousast-results/plane/engine-trace/0f994e18786f7072c3cb786f0751879558d9ed2acc95bd326f98fc189b517484.json", + "sha256": "d16ece454d946e7cbad1ec2d65bc90850ea76ec9a03058ef363b960029144f62", + "stale": false, + "unfinished": false + }, + { + "bytes": 1324, + "path": "/home/mc/ousast-results/plane/engine-trace/103282ec7321e55e6fadecb208c1ff2114b0ccc1e1354dc4418272507aded16e.json", + "sha256": "7fd6d72a19b00f413e7c0898f742349c60232a07ad28fb53d7100525bac024be", + "stale": false, + "unfinished": false + }, + { + "bytes": 1292, + "path": "/home/mc/ousast-results/plane/engine-trace/11ecc692fbb31b92698de5eb0d1a90b23898d3f31b1d057bc12cce511ae5fbb0.json", + "sha256": "ae6ffd2a6c34b6a4090a2032ab64589de4c28f4e45e1e6d2632dda4bb56373a4", + "stale": false, + "unfinished": false + }, + { + "bytes": 1319, + "path": "/home/mc/ousast-results/plane/engine-trace/1230ce1365544899134be96cd90c30045122156b63007b78f3d87d6265977e2e.json", + "sha256": "3dc36cd588a4a286fbd61d1435eade0252509ba1d1aba6c0dba0759cd8f1a421", + "stale": false, + "unfinished": false + }, + { + "bytes": 1291, + "path": "/home/mc/ousast-results/plane/engine-trace/1297de941f02eb8ddd8aebfec5bef93d8d4a7a8c9e8da44684c84b12f4991936.json", + "sha256": "70e80efd59e91b7c908cab493a7d139a07ae7b7811357fb4066bcab5a59d7015", + "stale": false, + "unfinished": false + }, + { + "bytes": 63285, + "path": "/home/mc/ousast-results/plane/engine-trace/12bb8272dda9fe63243bb86509c628bd846bcaa52fc20a3e65a71a2bfdbe66a8.json", + "sha256": "32a5591c7de7fd602e74a6a86862297e73d2a703318d93d93d509f1bb9fa8dc0", + "stale": false, + "unfinished": false + }, + { + "bytes": 14569, + "path": "/home/mc/ousast-results/plane/engine-trace/12e33e643326772cbbf26f1cc595fc6bad657485d83724e6e2f9e0793621d6d6.json", + "sha256": "eeff1a34d7615440c5f286d6183d9850068eb9a7e89bcedc55bf90c3214d1130", + "stale": false, + "unfinished": false + }, + { + "bytes": 59596, + "path": "/home/mc/ousast-results/plane/engine-trace/1330b99fe5a48add7ab05c308d21ab06ae2e373be0fe6fc1824ac1d1dbf3d16d.json", + "sha256": "98b37d6269fb1fb29d89e38ef38bcc4dcd67057b3f27bdd3428d6d63d8f971cc", + "stale": false, + "unfinished": false + }, + { + "bytes": 42813, + "path": "/home/mc/ousast-results/plane/engine-trace/134f0792103802c0d7e94cefd8d5c3153e7d763d8a463e7946427cef2b72b258.json", + "sha256": "0c002a8215e109aeea7c90dbffbd2a4ce4f2819ed1f0f45172aa93f0c48b04f2", + "stale": false, + "unfinished": false + }, + { + "bytes": 49467, + "path": "/home/mc/ousast-results/plane/engine-trace/13863659d6b7164b6a8e43ba4a226751371b6a9d5195ca5dd5ccd8d2f8af4bbb.json", + "sha256": "be8d66be7c46a8d8e344448267ce2e0cfe397d97114b56d6db8452832fff1244", + "stale": false, + "unfinished": false + }, + { + "bytes": 27625, + "path": "/home/mc/ousast-results/plane/engine-trace/149b5beea40a2aafa6f2516877f1ed5ab4b0a78b29d71f6a03e231c9fe140f8a.json", + "sha256": "3e9da8d7f5abeeaf6f4c71ec9eae97cbf93ade81a78787f75d630a060d7009a3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1274, + "path": "/home/mc/ousast-results/plane/engine-trace/14b2667daa571dc0811d11c59b88c29c1373d93137124bcd8cb84beabb25a930.json", + "sha256": "6d16242b36e8a888b60125d3cd990386013b695d6dd06a26672847c340bb3d50", + "stale": false, + "unfinished": false + }, + { + "bytes": 12423, + "path": "/home/mc/ousast-results/plane/engine-trace/14f535b5be327ab70a11b68b63733d010499a1a047db690274f7ba865b4a0029.json", + "sha256": "81426b69dadf788ae49244f934dbc3201688a09804e44f0e079632266cb7bf18", + "stale": false, + "unfinished": false + }, + { + "bytes": 38289, + "path": "/home/mc/ousast-results/plane/engine-trace/1591f451645bbeaf1e7753c9d7cc32bdfa2f43fc02a47cc40db17301084311ab.json", + "sha256": "77218f09e4e96ca3c3a8025a08792dad96a9a0dcb4246d3a753b9618278a9c3b", + "stale": false, + "unfinished": false + }, + { + "bytes": 122172, + "path": "/home/mc/ousast-results/plane/engine-trace/1633d7ac7fa75a0b2f4f0299bd5391bb1e2bab93a5a20e1ccf5eaab5256f3e96.json", + "sha256": "ff02616f1fb97d0743173bc7fecc23e4b336b1f48924ac14b92cb481035ff226", + "stale": false, + "unfinished": false + }, + { + "bytes": 1301, + "path": "/home/mc/ousast-results/plane/engine-trace/17b7e94ac38949a59575b4db0ddc04d19c74c7ea4be1a7cda9e9b081bcc71708.json", + "sha256": "b5e96fcec57ce90245ca2ff5f3d99c2f39094a2a3d771e96aec6b12691347fb8", + "stale": false, + "unfinished": false + }, + { + "bytes": 137880, + "path": "/home/mc/ousast-results/plane/engine-trace/18d8f89cffba01ae6a4a9969ecf5434d60fa1761f40ab2308bca95c53dd33467.json", + "sha256": "c2a85d8eaf7075b627e9c7307e989767fe53f980ff87f14b5f2ee82ad864a5cf", + "stale": false, + "unfinished": false + }, + { + "bytes": 39093, + "path": "/home/mc/ousast-results/plane/engine-trace/1a9b80062e1a9672070182861e164adeb94e5a9c2a0b8be1a025ac8749111f77.json", + "sha256": "5308e4d4aef76d9f40b7ffdebd5bd5f1ec6b55928de4f6fa762ae5eadf6f305e", + "stale": false, + "unfinished": false + }, + { + "bytes": 63449, + "path": "/home/mc/ousast-results/plane/engine-trace/1e34e79747607d923e5373be128a7dde09d2a57f0137db2aef3a554052f20bdb.json", + "sha256": "43cd6388bf4162dbd2b539c3a6816579d833d94637206054a7e11d2c25d7399f", + "stale": false, + "unfinished": false + }, + { + "bytes": 145368, + "path": "/home/mc/ousast-results/plane/engine-trace/1e3e66a5c350957ded63de1fc299b11d3d15a8aa69ce1ec221d57ac6c6aba0ac.json", + "sha256": "e5b2004c6247dfdeae0d0ebf5bfe93ab7fcaeb7b412b9baf4a678c4764cb04de", + "stale": false, + "unfinished": false + }, + { + "bytes": 76474, + "path": "/home/mc/ousast-results/plane/engine-trace/1ead490551e00ad2a16ea2cb861887621bb1412c8647bbcc7cf9656b145bbde0.json", + "sha256": "27fcba05b548ae16cfc7afcf494f5a6ea3a7d9fd7e24d52a7508d84dda455d21", + "stale": false, + "unfinished": false + }, + { + "bytes": 1260, + "path": "/home/mc/ousast-results/plane/engine-trace/1ef35559d35195949f8835c97197d628fae271bcf53a073ce37410d169d993dd.json", + "sha256": "b1e38ecfc2e3f5c0790f117e39a994b6eaf9dc257dc482692c09680a2b1709c7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1290, + "path": "/home/mc/ousast-results/plane/engine-trace/1f4ae41ff0527d0a1579e9d1189362d4a0fd55a4b339881aae597d2022f95f7a.json", + "sha256": "aa3f1a3835cb89a4a1911ccfeea013f61dd7b74723fe8dce443c7e468f4056a5", + "stale": false, + "unfinished": false + }, + { + "bytes": 1372, + "path": "/home/mc/ousast-results/plane/engine-trace/1fa49db79debda84a992ac55bc16ebb2bc23565d2bfc0b4320ddab28d730d092.json", + "sha256": "145cd072a3f0f4832dd7e1e19dc1266b19168e520ff354b584a6c2097bb20358", + "stale": false, + "unfinished": false + }, + { + "bytes": 1309, + "path": "/home/mc/ousast-results/plane/engine-trace/1fed1ceb860ba9da8e8a078b556f23e6aa1fdfc4a8484c84b9e39d812ee05d53.json", + "sha256": "e24dc96d3323ce45eca242b86ffaa03d8d7d8540929fff6dd6df22684b106c9d", + "stale": false, + "unfinished": false + }, + { + "bytes": 9202, + "path": "/home/mc/ousast-results/plane/engine-trace/1ff55e7c8a3009322b43ba1a09f17de37d65d4d1f240600588ec99252f9e2a83.json", + "sha256": "2d9d332cf90c26fe42d27651308a185f26a41d60b90b0f1770373b2386ec6eab", + "stale": false, + "unfinished": false + }, + { + "bytes": 36417, + "path": "/home/mc/ousast-results/plane/engine-trace/20c9d129312b63c4d1ee12cb930d92599b96a7c024ba4ba52398dc09c6345ca2.json", + "sha256": "8ac0bd4f37281bc65160fd03f7d6405737598bae305d4cad24443417344d7717", + "stale": false, + "unfinished": false + }, + { + "bytes": 136176, + "path": "/home/mc/ousast-results/plane/engine-trace/224ddf75aa76fd4faaf95e0341db833f49160da4f190c43820fac9f6d4683fb5.json", + "sha256": "91c5e6228995ec6aea0dc419ce19fa6f532a819c18842dd1bfd13fef1b31a0f8", + "stale": false, + "unfinished": false + }, + { + "bytes": 1286, + "path": "/home/mc/ousast-results/plane/engine-trace/2461130d65582729aa7444dc02dbb5411b619062e3be8ebc4e56e11a76762673.json", + "sha256": "d0b73f06385053a45260c8dfc401b087aaf7bd33b6c506db033cf8c7d9732f3a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1296, + "path": "/home/mc/ousast-results/plane/engine-trace/247c0bd31e51182032b55c6ef58b3cc3a37d509a0ae7fee3b3a76eba652d3cf6.json", + "sha256": "3604a5dbeefd70a92791fff6bbe937238ad161e8400cbbc67b68119f25ef0100", + "stale": false, + "unfinished": false + }, + { + "bytes": 27845, + "path": "/home/mc/ousast-results/plane/engine-trace/24a06e750918c19b3b7dd5a332c0bd5f5eefd9894f59a6954b8f91d61f23ea04.json", + "sha256": "e4a1fd7890d3e89c526f8debca78abb3afd4aac81ad4e2abf55d659c321dfad5", + "stale": false, + "unfinished": false + }, + { + "bytes": 1255, + "path": "/home/mc/ousast-results/plane/engine-trace/24c62151e460a8dd0b67847d8c0e958e62b63ab7bc5e417699f148cac4606439.json", + "sha256": "35ab7b8bc546557fb3aa646be632d17a28351f4a2ccd46719d5bba0f427fbb44", + "stale": false, + "unfinished": false + }, + { + "bytes": 1296, + "path": "/home/mc/ousast-results/plane/engine-trace/24fa5946de3f395751ebc4b32f61345d65610651046abfd7bf570fa57e88ed67.json", + "sha256": "715cc015dd148c682d7bd910bf30068c599a47117f0be5b45b072c06b9cf42ac", + "stale": false, + "unfinished": false + }, + { + "bytes": 1304, + "path": "/home/mc/ousast-results/plane/engine-trace/25f15675ee70a1795fc502d446169a0bc9c7339af4ca34eac2a8b5964dbf4d7f.json", + "sha256": "b6eef70c7d08993eb9b9c4122d7fdea24b9b08ea33aa22a88256dcc601b359d6", + "stale": false, + "unfinished": false + }, + { + "bytes": 1265, + "path": "/home/mc/ousast-results/plane/engine-trace/2624dd163ec3e4b884b09d0ca2329c9536bdab0a4a54a4dd0d22519d34324d75.json", + "sha256": "76daa59d541530f996330f18479e7d74ed0bcc7e471e22506721788808669931", + "stale": false, + "unfinished": false + }, + { + "bytes": 10046, + "path": "/home/mc/ousast-results/plane/engine-trace/2650fc83b7bf735ced693e00179e8929f72ace25b46e6029e84fd9baaf2588db.json", + "sha256": "8548e6f4317c151b8b952afc6f2c25fe66166208b8559a0021f901eebe2a53a1", + "stale": false, + "unfinished": false + }, + { + "bytes": 1330, + "path": "/home/mc/ousast-results/plane/engine-trace/2654511d8cf50a3cf0e898fe4ea1675cf6d678f3cb1c528201ceeb92463aace4.json", + "sha256": "8334a08c3015a68753a2917101330099e9065e429b5ed5e9039c4a4b204f4b8e", + "stale": false, + "unfinished": false + }, + { + "bytes": 256001, + "path": "/home/mc/ousast-results/plane/engine-trace/26a574dfeb82e5bfe2450904ff5e4167d3b984afc3774ab29f5dac7c279f9a42.json", + "sha256": "6b0a48fbb41d8577fa2246db1f6e973b6aabef20615e73b18cf0c99d896418d5", + "stale": false, + "unfinished": false + }, + { + "bytes": 9052, + "path": "/home/mc/ousast-results/plane/engine-trace/26d75eceeba88552580f3ff8be5327fcb4a0061dd37b2951879178a8a8baf038.json", + "sha256": "d6dbacf1410b197e922bc7e6b786ca21398d715d516209af7a88a5e8ece562c4", + "stale": false, + "unfinished": false + }, + { + "bytes": 1311, + "path": "/home/mc/ousast-results/plane/engine-trace/27a50d2bcac6e3bf9ccd8d8757ed61b5fbd7e61310b001b6d9ff543d7d9a950d.json", + "sha256": "574954a7ccf042b2906264026cceb89e5b07914ea22c7a4a446f43b5932bc6e0", + "stale": false, + "unfinished": false + }, + { + "bytes": 42173, + "path": "/home/mc/ousast-results/plane/engine-trace/289b6a3f4e83f51b0923d53855ed54854739c1193968f5151cb0aa921618d233.json", + "sha256": "72c3a002f65e55b4d39b796aef43421e70980e1e060be7dc570b7144aa0ee770", + "stale": false, + "unfinished": false + }, + { + "bytes": 1289, + "path": "/home/mc/ousast-results/plane/engine-trace/28e63fcd62ed84b1e5b09c6ca09d0d2ccd51d46ca23b363319062ac8734c9183.json", + "sha256": "cb9c8ccee6ba4dc23765cd3ac1b633d74b3970fda588fd6ab9bd11693dc0459c", + "stale": false, + "unfinished": false + }, + { + "bytes": 9077, + "path": "/home/mc/ousast-results/plane/engine-trace/28fb8e9501d29300c5f14074f976502b7b634db2297831ef5ea152de5333b4cd.json", + "sha256": "7ad326d0910252a3e5db97980abc54e1b8968f8dcf3b43040ab232ae4d05683b", + "stale": false, + "unfinished": false + }, + { + "bytes": 25143, + "path": "/home/mc/ousast-results/plane/engine-trace/295953a4ac58113ae87266ca6bd366794c4e19c517a4663fab794c173cca9819.json", + "sha256": "5290103dfba8462d545395a00cc82014637a523740c66c2fb70f41c64dd3578b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1288, + "path": "/home/mc/ousast-results/plane/engine-trace/2979766e4eef7eefc7ca52a98172eca6dc31bdf528588065b4e41628309cda7e.json", + "sha256": "5ba00fa68d2584e8ab0a46e20d4950f1db105eacdaf0e5664b5097c9096dff5e", + "stale": false, + "unfinished": false + }, + { + "bytes": 12054, + "path": "/home/mc/ousast-results/plane/engine-trace/29ba237890a8e56df9ff0602f5b154a66fd5c16f9757202af62ef7d139fd544a.json", + "sha256": "242eb6d7aa74acc3dbf86e9016928e10b5e6de9d99bbbd78d004c2259de71984", + "stale": false, + "unfinished": false + }, + { + "bytes": 12420, + "path": "/home/mc/ousast-results/plane/engine-trace/29be30cbb387644885d730b4363023b1a342570791aa8d2e82a6382a5c47b504.json", + "sha256": "cb5bbdc0cd0487a6c0dc1274500866777922bddbc3cf40d10146de4cd893e2ac", + "stale": false, + "unfinished": false + }, + { + "bytes": 28819, + "path": "/home/mc/ousast-results/plane/engine-trace/2b2d8f1f00546259dfa5199971065d92118bc82e672b83f7ded78bccb9a24275.json", + "sha256": "ecf62da0529cb138335e674183fb76ba79d51ceb3d459a740b48881dd8fc2d54", + "stale": false, + "unfinished": false + }, + { + "bytes": 1230, + "path": "/home/mc/ousast-results/plane/engine-trace/2cd98fa2259fd9c1c4f682abd51c64e1cd2237c4f66dc3f038cd46daea710354.json", + "sha256": "f96f91cf8351c1467bd7205a74b17ed5c0635b6ea68516bf8f6b2d52ba465ac0", + "stale": false, + "unfinished": false + }, + { + "bytes": 25974, + "path": "/home/mc/ousast-results/plane/engine-trace/2d35776438b4f8dba2c2359d07895c4ea78569255e2b9ec478c05265b186f855.json", + "sha256": "f00207cea7e67fec0217811cdb486f00d6cbe6f5b470e34c8d825636893b4c8f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1367, + "path": "/home/mc/ousast-results/plane/engine-trace/2d9701bf9166189c5b3f1fee8fe002dd3aee58f9c7bd0c87943e3cae5dace8d0.json", + "sha256": "4d588e1867e5f4eb76ee2d1d11a12603abe2235d53c195adf2bad4ff51df93ec", + "stale": false, + "unfinished": false + }, + { + "bytes": 1248, + "path": "/home/mc/ousast-results/plane/engine-trace/2e7c1d47e673e4dccda733415f3db3bd968cfce3c6a197e2cbe7c452c5f8b4d0.json", + "sha256": "066746c874894860697d43c44c9dd991950671df21a95a0b427d30d2015a496a", + "stale": false, + "unfinished": false + }, + { + "bytes": 9056, + "path": "/home/mc/ousast-results/plane/engine-trace/2f26b7aca29635999520ffa54bd070a11385089c57375736ce768962eb67146b.json", + "sha256": "2d0fa4f994645f6987e1049724f67b17817a7e678ed2270678830aacb4cb31b7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1327, + "path": "/home/mc/ousast-results/plane/engine-trace/2fe98874d80d2765393ba8af851da636277426914fd5a0857bb7bf0fb9829737.json", + "sha256": "f35a9527d5ad89a14274f8b04c731c884f5a5ff51e5ec397f7a39dedfc2fa36b", + "stale": false, + "unfinished": false + }, + { + "bytes": 20535, + "path": "/home/mc/ousast-results/plane/engine-trace/30240eb41856b9c50792bff9fb8b269721cfb28eed3c068cc2828c4d9b42ec88.json", + "sha256": "9d45d3a84f00df1cfac81abca97c8c8c389b3ba5cb8d4f33b95e4b31168a91f0", + "stale": false, + "unfinished": false + }, + { + "bytes": 1254, + "path": "/home/mc/ousast-results/plane/engine-trace/305e8c3282adedf1a9de68dcc7427b1869635ed736db028a98228e7f912b2c63.json", + "sha256": "378ed9809053e98135dfc05bfb0d7416dc3d1fb494c22bf6c789db33ce7312de", + "stale": false, + "unfinished": false + }, + { + "bytes": 1271, + "path": "/home/mc/ousast-results/plane/engine-trace/32247faff684535cdb3c84597063916840c85a91a40bfecea1fc213eb68aed6b.json", + "sha256": "bd64fa8c95de60c003b2af0d03b3fd8116376488f3e2be0b6a81570bacb8b225", + "stale": false, + "unfinished": false + }, + { + "bytes": 69179, + "path": "/home/mc/ousast-results/plane/engine-trace/32e4e4ea2de040d6a0398633b80e6e33068d51ef38873c2546dad7765b4e0a09.json", + "sha256": "60a858ad0f3871894e88d9ea65db64af4320f1d997c3f3beb7118da2e82049bf", + "stale": false, + "unfinished": false + }, + { + "bytes": 1241, + "path": "/home/mc/ousast-results/plane/engine-trace/34ec83736d2b5621c339cc4c8d68bbb495cd3a3847145fc6a0a4e2db6ae2dec8.json", + "sha256": "5a8057e6fb9115c56e3dd534d5713648862d8830271af09b326a8f713d82bd3e", + "stale": false, + "unfinished": false + }, + { + "bytes": 1270, + "path": "/home/mc/ousast-results/plane/engine-trace/353258182455f41cf40ab3631d883f83b850b853c1bd920c6c11c4c5c3213223.json", + "sha256": "41fe1a078486db8afb283629cd4a32268f066e3abd0a2e1209abeed1e582807b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1278, + "path": "/home/mc/ousast-results/plane/engine-trace/3557d9704b4eb18379a00e9fabc5080f74226097406c5a795925b3b2e02d23c5.json", + "sha256": "ad50650f36877eb6dcb64495252cf1b48453359d7754f6164a59a1019f095f16", + "stale": false, + "unfinished": false + }, + { + "bytes": 29359, + "path": "/home/mc/ousast-results/plane/engine-trace/36199c5469a088cc60ecf272eb08e243f6a0a6aaf457faa9b118d67e5ef40b5c.json", + "sha256": "165d94674e6a35e8810653d3e047f867e67e04dce62cda27066ad0c20ae02d59", + "stale": false, + "unfinished": false + }, + { + "bytes": 1365, + "path": "/home/mc/ousast-results/plane/engine-trace/366e038dfb6e7dafa7dc22160899370544f0d6c7f407c38d82a5c2c5bcbdf37d.json", + "sha256": "0c6ea306294cfb5cdddfae7a9fb09514ee6d68ef71120e3a4a0ad4fcf5625057", + "stale": false, + "unfinished": false + }, + { + "bytes": 9164, + "path": "/home/mc/ousast-results/plane/engine-trace/367d53085a2971e3442fc54081aadd2b631b798890a2f46d2ca496ea4d9722f5.json", + "sha256": "20a591358da3cbf14295f079cbf879344ec6b8a54e82d87ae512c33ae21f2236", + "stale": false, + "unfinished": false + }, + { + "bytes": 1314, + "path": "/home/mc/ousast-results/plane/engine-trace/3690a1bd20ffde52300e5f397e2a5b698b702fa785fd433b4987fa8a64070d6b.json", + "sha256": "38a63a2e46f58d6de747fd79b65f05174e10a1a7b07d79f5e33b27830c6f6206", + "stale": false, + "unfinished": false + }, + { + "bytes": 11984, + "path": "/home/mc/ousast-results/plane/engine-trace/3732c62ab5baf8d0832ae59aff1e17d54f3f05aaa478a9a69309110afd361c3f.json", + "sha256": "ed4e320939d87e4fa631d1b98298e0418765744ea1949c86b9f61cc4547cd20a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1218, + "path": "/home/mc/ousast-results/plane/engine-trace/379145404f24707bc0ea59708c865d06ad62947cb02a49061f1aa7e571846aba.json", + "sha256": "b908d68c3990388c4ab190b450e3b16f8dd0b2081d5ab79af90d7b28d9bf18cc", + "stale": false, + "unfinished": false + }, + { + "bytes": 1278, + "path": "/home/mc/ousast-results/plane/engine-trace/3a3b6d6444263917b8770cfff31b550f1849cf5ec15a4abec61b6e004e371f05.json", + "sha256": "63c72e10dc18edc8bb3b6fdf6ec985866b28900d3b9ddc7ce70123a803109709", + "stale": false, + "unfinished": false + }, + { + "bytes": 122177, + "path": "/home/mc/ousast-results/plane/engine-trace/3a6b3e58983e7244223d86dc6f0d2ee81ed9e11f093f02b311f6bfe95cc629ab.json", + "sha256": "dde7df0c6ed73f582e747de4fc2b407cc5427d0902f976073aa2116e02100235", + "stale": false, + "unfinished": false + }, + { + "bytes": 85028, + "path": "/home/mc/ousast-results/plane/engine-trace/3a75e425c315935036e2d86388c7a1ccb6056b4a7def548db00d85a2276378e5.json", + "sha256": "396d1c95fd82c6f980d4c08dc82c34867c41aeaa936704180bf3d4bca983238f", + "stale": false, + "unfinished": false + }, + { + "bytes": 33955, + "path": "/home/mc/ousast-results/plane/engine-trace/3b0cb2f53816d852ab511fc044188010be826fc784896ea265ed35473f184660.json", + "sha256": "cf8bed5fc91956df6f1083c1406d1be25f5d6aa2fd6a750409054caa110136ab", + "stale": false, + "unfinished": false + }, + { + "bytes": 90436, + "path": "/home/mc/ousast-results/plane/engine-trace/3bef2f4563c13fc81096bc2864d504f845609eab7e605f43f5396525370d061a.json", + "sha256": "e5e16639e280955ee69278413dba1f8d5f797a096a7d3483d972ab2debfbdd87", + "stale": false, + "unfinished": false + }, + { + "bytes": 1317, + "path": "/home/mc/ousast-results/plane/engine-trace/3bfa7fd8d158bd06651b6881915fd3fbcb315eedf09efc9908a98aee4018304d.json", + "sha256": "4f7d046c8ec22ca472bf22c438c92d3be2bb6728af39ff4c4c01ed54d2ae103c", + "stale": false, + "unfinished": false + }, + { + "bytes": 29420, + "path": "/home/mc/ousast-results/plane/engine-trace/3cc7795b4a4063d15cbabf2eb7148f3320b7ddfb57a56ca79b65abe0aede687c.json", + "sha256": "ca4a6b5a5c04bd345eb52faeb896012a5dd1c5618a5f696f4abbde2d2d53ab24", + "stale": false, + "unfinished": false + }, + { + "bytes": 20058, + "path": "/home/mc/ousast-results/plane/engine-trace/3d0a9ac14af2f29b80ad4d015a32e8daf58ede04c3ebcff42bae7c9d6f0aa778.json", + "sha256": "a0995a6363562f57269e9976c301aa0e6d0fd9df8a08ac458da4575386d9d378", + "stale": false, + "unfinished": false + }, + { + "bytes": 8911, + "path": "/home/mc/ousast-results/plane/engine-trace/3d199797b0e40af80c8c2385ce917018a61cf4eb5719e4e70e3d6afedf014a06.json", + "sha256": "fe90502757807f27c6e3964afe085d90e3e0f241e6e11c2fa454c69cb6d9e0cb", + "stale": false, + "unfinished": false + }, + { + "bytes": 143523, + "path": "/home/mc/ousast-results/plane/engine-trace/3d6c3c7aba0dc0038204ce9a2263069687033b917981628df2ee11dedb95a293.json", + "sha256": "91f43d01630c382af43d1aca5134a876b46167575995df128972dada4970c261", + "stale": false, + "unfinished": false + }, + { + "bytes": 1332, + "path": "/home/mc/ousast-results/plane/engine-trace/3e2c9da2cbe973683f60f46b0c92cce84b0aa5dad4da560c31c79937b5399ea4.json", + "sha256": "3dc830111e492fa7227ef66d10f18ba5bb7863e31bf0e5cbd7df67e14d82c000", + "stale": false, + "unfinished": false + }, + { + "bytes": 1373, + "path": "/home/mc/ousast-results/plane/engine-trace/3e83dc7afb08eba40356f0f97a93ed11a8423c19f8c998163b3c6c8fbbcc39eb.json", + "sha256": "add5b8c523b1894d3538f6771525ac3a45b21234f85f98c5e6589c5ea208ca09", + "stale": false, + "unfinished": false + }, + { + "bytes": 33511, + "path": "/home/mc/ousast-results/plane/engine-trace/3f297ad383c5f099df950621ef8ec92a410de258dfbdc8c42287be62db915ff5.json", + "sha256": "8b9a567f4e387041ad1e1372e74420bdfee7ebfac64b74303ce9afd2ab7b7c41", + "stale": false, + "unfinished": false + }, + { + "bytes": 14623, + "path": "/home/mc/ousast-results/plane/engine-trace/406b8feed2e82ab8ed6fd4fc959e2caec872708c56dd9c7c1ab62a54f54dc5a4.json", + "sha256": "c00a50121acfaa195b9b2254d2fb140dd821d1c06ea74fe71f00f2ecbc5b8071", + "stale": false, + "unfinished": false + }, + { + "bytes": 14958, + "path": "/home/mc/ousast-results/plane/engine-trace/41858de45f76b982e6b03003fd628a4f347d22244b58013b36a2234f92f6cb8c.json", + "sha256": "d01ead611199da6ef5429b9910be2e42ce3629708dd8235182623c0ed181e23f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1293, + "path": "/home/mc/ousast-results/plane/engine-trace/42a10dd1f38033aae6bb9d28bf683615bfbb7b869f758e5465e7fb36a90c4c42.json", + "sha256": "ff25890f028c1fd35d91a0e7777f3217b114ed5ed90dd04277f0a56745e65f47", + "stale": false, + "unfinished": false + }, + { + "bytes": 14164, + "path": "/home/mc/ousast-results/plane/engine-trace/43be6f83d6b0d0ea2307b075b341eb1c763fe607a587c57814f933653ab29ccf.json", + "sha256": "54c79af9bbbf25b7515a79782f81be6ef1ca3037f33f73c9d97d9db700e98340", + "stale": false, + "unfinished": false + }, + { + "bytes": 1305, + "path": "/home/mc/ousast-results/plane/engine-trace/4413825f6393d8caab185f13a93094899ae7a4a5c9af67e1154114aa2c7f4e77.json", + "sha256": "d9cd9f548e40596734df4ae9f97de39010ab47f6df099ad73f912275e9384779", + "stale": false, + "unfinished": false + }, + { + "bytes": 16674, + "path": "/home/mc/ousast-results/plane/engine-trace/445a04429d2a88c6b073cc33a2e55a189b71ef45002b04eb1ec85e682ec3f4bd.json", + "sha256": "45895fa5376edc2c094679712926159211617f3e616c848e7dc68e2dbd9f58dc", + "stale": false, + "unfinished": false + }, + { + "bytes": 9121, + "path": "/home/mc/ousast-results/plane/engine-trace/44918bff169e4b5e1be5ea9bf0d9f87993cb01a663809c65a1becd13d15b49e8.json", + "sha256": "53806761f96c675dee99e89bd569e0f956ba86bb7b52b9aba831878728cb9d27", + "stale": false, + "unfinished": false + }, + { + "bytes": 16833, + "path": "/home/mc/ousast-results/plane/engine-trace/44c5ea0b3e2eaffe22a0a2eea73bcc1e8c4b364822be6e9d0e37090258a4b001.json", + "sha256": "f7606035af59d1ceafd54d296bf82ef97e6378c8c834216b6cf06905d25cc9e9", + "stale": false, + "unfinished": false + }, + { + "bytes": 16534, + "path": "/home/mc/ousast-results/plane/engine-trace/44cf459255d5d13a93cc892ff14dea98d5c25f44783755b57402d0f31b0e7f01.json", + "sha256": "ca02648cb3c414d04bef7575617ad680ea5912af7d7e0bc6d35b50932994c7ba", + "stale": false, + "unfinished": false + }, + { + "bytes": 14136, + "path": "/home/mc/ousast-results/plane/engine-trace/44e237ac0337c8b789d03e6f5c74d69b3148a8b27ae5a7c3304ccf22786e5799.json", + "sha256": "d990c52c74cc96d0f99a303fd958fda5de7d536075cf732bfb65ee5f1447d174", + "stale": false, + "unfinished": false + }, + { + "bytes": 29425, + "path": "/home/mc/ousast-results/plane/engine-trace/462e6ad3227e0b915947dd6f1f262d2a874bc677a21283588c9b5433420847f3.json", + "sha256": "bca0df6ae59b2e56ff51a3b5a4ca6797f707677659a9432b08922ae548f21c34", + "stale": false, + "unfinished": false + }, + { + "bytes": 28437, + "path": "/home/mc/ousast-results/plane/engine-trace/4765f950e97ea36dd2a1b5e80d5e59a6b928f809f6d8a565c1bbf1013b62536f.json", + "sha256": "4006b6ccf620b1217843a2d1d62aeb5b8e3e29b937bd90a2b48f3ca5937d8b58", + "stale": false, + "unfinished": false + }, + { + "bytes": 1287, + "path": "/home/mc/ousast-results/plane/engine-trace/49f59e17f9ccbc345092051f4b4ae4b568ed9da64b37f58d0a9886513418233a.json", + "sha256": "774daadd49469ee4fc9a7c09539388a997500eb3c6aaaf9c848f496992fc7b4b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/4a23771c6371285ba0d431adc35c139dccc2601a2c91fd7f0f74cc69d2afc98c.json", + "sha256": "e65b0b71e6f4bd338559a3bcea7e173e5358da911672878718e40d48def29213", + "stale": false, + "unfinished": false + }, + { + "bytes": 1246, + "path": "/home/mc/ousast-results/plane/engine-trace/4a5a96d739f21809e150e74f00322839ef1a1f840b0b68a7ad174b93457d3e94.json", + "sha256": "3f30effbe892b5a55a2189e9f81fc07dbe69757fe43f9c61267f6f8c9e166c60", + "stale": false, + "unfinished": false + }, + { + "bytes": 193918, + "path": "/home/mc/ousast-results/plane/engine-trace/4a6e3167da9fb325209be0e66b1b394779e6ec7fab6f7cf698cc656d07837961.json", + "sha256": "5b25b0848be5d50a71bf65bb476847fa6faf25d51a2fad33dc901ff9e0c6a6c0", + "stale": false, + "unfinished": false + }, + { + "bytes": 14186, + "path": "/home/mc/ousast-results/plane/engine-trace/4af36910846f7179140234616a61ea6819ad90574eb60b431ded51ab548d4ead.json", + "sha256": "bbaae02b59a92d0e4588d0639068a264f65ac96ba045625d2e3a1f2f90b0d9ca", + "stale": false, + "unfinished": false + }, + { + "bytes": 9184, + "path": "/home/mc/ousast-results/plane/engine-trace/4af91d862c5763dd74a724a69036a856b0d8296af48d959612d8250f4d9cb685.json", + "sha256": "6908052cc737c21896df5fad06e20f78229be8533d3bee3187177746e700359b", + "stale": false, + "unfinished": false + }, + { + "bytes": 644066, + "path": "/home/mc/ousast-results/plane/engine-trace/4b461464c242dffaa55bcfb51b83dec50e1e07d00b23bd4106c2fc6338b10187.json", + "sha256": "7baf5650705e01372144bdfa90f706868615cb84c26b5f11cb15265c0b7bc54a", + "stale": false, + "unfinished": false + }, + { + "bytes": 9936, + "path": "/home/mc/ousast-results/plane/engine-trace/4c1bcbf83d3dcf078126753f82474482623f271508b75150134bbf120d3c5573.json", + "sha256": "8836e496c35a4e27c78f7fe4d2c43b12c93576fb7343cdb5d169e7b83f1936c6", + "stale": false, + "unfinished": false + }, + { + "bytes": 1246, + "path": "/home/mc/ousast-results/plane/engine-trace/4c80e47aac3cd6172257e54f00aed3c4b541931d13f96fc94231331f49cbf80f.json", + "sha256": "f0d0a679739bee0e1d222f42c687b2e1bede00474e78c02bf252d1515bc178d7", + "stale": false, + "unfinished": false + }, + { + "bytes": 12589, + "path": "/home/mc/ousast-results/plane/engine-trace/4e616df01b94fdc6714206cb0f05493a2a537f5f6599c66b286199dcc516b4bf.json", + "sha256": "7a0a8f117ffd89bb9b633823bd79877b78aa8fa7e0aa557774b95316c80698f3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1265, + "path": "/home/mc/ousast-results/plane/engine-trace/4f3094473362e23c4fa7e7a3fab2078a1898755fc45dc0521d6cb88cee4a44cc.json", + "sha256": "26ddcc455ddb19c293a081e7fd48ba2a3b9a83591ae60dbb8e182a0d3cda5bbd", + "stale": false, + "unfinished": false + }, + { + "bytes": 730724, + "path": "/home/mc/ousast-results/plane/engine-trace/4f8a38f5a3f201891c769f28dd57a796ca6ceca2369b9daf6aa61944ed9fcb77.json", + "sha256": "c12f046c73e30528f13f25d9eab414e7b10e8e35b5a3532f7f717d47446d8108", + "stale": false, + "unfinished": false + }, + { + "bytes": 9167, + "path": "/home/mc/ousast-results/plane/engine-trace/4f988f45612f57ac00734406140cc723a801f9a792efc3d77984c347630e685d.json", + "sha256": "cc067093d7188e0892c936055708ea3e204ea58c7782a618d2b83bcbe47425b9", + "stale": false, + "unfinished": false + }, + { + "bytes": 1288, + "path": "/home/mc/ousast-results/plane/engine-trace/50978ecdb51711e020911e4d14a1f03473dfdea1ef71d4d35f83adc75200fc1b.json", + "sha256": "d7d336c871d2975a419ae5bedf2e423c246be6b140a373663c7554efd704730c", + "stale": false, + "unfinished": false + }, + { + "bytes": 9325, + "path": "/home/mc/ousast-results/plane/engine-trace/5113708057576082a21d1df33f53209df903fd9163ae184f8c384e7e39fecb95.json", + "sha256": "efa09e6e2d5bedb39909b3e11731c6f642928bf1719324778d699e78dd5685a7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1264, + "path": "/home/mc/ousast-results/plane/engine-trace/512b608eb04562e2d08d49fc03dab237756f397881e41ff34dd634bc39ffd454.json", + "sha256": "2c8c3c95210cb14d82eaba86f46fd07428a6c70699b8a52ac2cd91e7bed6ea68", + "stale": false, + "unfinished": false + }, + { + "bytes": 2373, + "path": "/home/mc/ousast-results/plane/engine-trace/534946c75e1a38a780931397bc71de927e1be64434047ba516a7c8cf7b161dea.json", + "sha256": "6b20b94d2fc630873d6b514da3c1c478fc48aa85f2f809723caea108be15fdc9", + "stale": false, + "unfinished": false + }, + { + "bytes": 13753, + "path": "/home/mc/ousast-results/plane/engine-trace/546f850781f75aa417a9a8c60beb3549d26465e3a5d238826dba536c776e20b6.json", + "sha256": "f0bef247c62a35fe6d729e14d260330107e2f2d64ddc537fc2072bbbe62fdd05", + "stale": false, + "unfinished": false + }, + { + "bytes": 74683, + "path": "/home/mc/ousast-results/plane/engine-trace/54c499f7b8ca0e9746485cf026a1068f76d52e1a60cbe56739da8aaabe166fd6.json", + "sha256": "8c866484fb2c1e595544b03682f8e5b9e6a5284a35adbdc58464dfbced8c2f2f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1285, + "path": "/home/mc/ousast-results/plane/engine-trace/54d57aaef8f28d4b9770b72d178f6a398e562b88806c8a6f1115d6c89ccc27e0.json", + "sha256": "a729deb51d68231e8d1fcb79e33a3f36172e92e1fdea802865feb8087538fc00", + "stale": false, + "unfinished": false + }, + { + "bytes": 20283, + "path": "/home/mc/ousast-results/plane/engine-trace/551df2ee75698a523e59b6ed8e60ccace00fbdd1b7f09956c8ee81c8b536b865.json", + "sha256": "35148110e708e3bcd62db8577c22bf1d38b3264a9de9763874cfa9e1d826d870", + "stale": false, + "unfinished": false + }, + { + "bytes": 14815, + "path": "/home/mc/ousast-results/plane/engine-trace/56e65e9031e43b551fc5fd95f64638cbfe9f316526bc60084e394560613708a1.json", + "sha256": "79c716163ac7437118644c2cdcb26da6d0f61266eaaf078e7baf92b71d95e744", + "stale": false, + "unfinished": false + }, + { + "bytes": 295284, + "path": "/home/mc/ousast-results/plane/engine-trace/57e7120bb82a7c7f48a0331e01a37826097c0a3c7e23a871784fe5d046038aa8.json", + "sha256": "a4496c96ed0563f2b11a6fcc3a96930e5b1a0fafd8b8d87a7b79f1eaad6858f2", + "stale": false, + "unfinished": false + }, + { + "bytes": 1297, + "path": "/home/mc/ousast-results/plane/engine-trace/580ae624cf8eca812b739584c4961147abb9ee5b5834e799f3aee19902a91b85.json", + "sha256": "a2f5786e6398fe655d6a556cfc299cb9ba07c1da4d1f900e80dc4f9421a015b3", + "stale": false, + "unfinished": false + }, + { + "bytes": 28432, + "path": "/home/mc/ousast-results/plane/engine-trace/584b762476436b7fc4fd466c6684433b3702ff7429df8cca255369722da8e3d6.json", + "sha256": "3c2966d5ab915bb6cfa8b6352ab28cb40826ed636debd2ce8d1fbd722729d6fd", + "stale": false, + "unfinished": false + }, + { + "bytes": 784716, + "path": "/home/mc/ousast-results/plane/engine-trace/59244308a2986bae6d10bafd9f0a9c90eb6afe50103afe4e0335c21c1d3b57db.json", + "sha256": "9c3bfc09d4175d65bb17da754fe354b9e1b820cf7b327e0e0e33534acd6df13a", + "stale": false, + "unfinished": false + }, + { + "bytes": 14144, + "path": "/home/mc/ousast-results/plane/engine-trace/5a05580e8f5f1a7512947179189deed5788a68031e1a2ee17f37a3eec1646e1b.json", + "sha256": "508ea2cf99f6d0c4661d99b1c2e66ff12e6f2ae0793b4246d1ed83b68b0ce6c3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1273, + "path": "/home/mc/ousast-results/plane/engine-trace/5a0e868021c77a7e2c536fbccedf391725e7ca59dba18c68e11b964573057fcd.json", + "sha256": "4d5fdaf698ad1964f95a91e18ddb93e358ccd294697a378b6d54e798d6acf262", + "stale": false, + "unfinished": false + }, + { + "bytes": 1306, + "path": "/home/mc/ousast-results/plane/engine-trace/5abb35a78026a5f99ff50fde7b39983c0e515cad1dbcdf86f15a12c776e57fec.json", + "sha256": "9ffa69ff32d8d417dc4d2c21331e4f1f1fc2cae3591a5c75ca745cfb673c136b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1311, + "path": "/home/mc/ousast-results/plane/engine-trace/5b5d1b17da18a0b06d7bdf1393a6483be117409baeb847397b8eb954c99b49f2.json", + "sha256": "e9e7e82173af5bffa687b6646af446af702a040eb290d281ce2a7c4ae9036816", + "stale": false, + "unfinished": false + }, + { + "bytes": 43530, + "path": "/home/mc/ousast-results/plane/engine-trace/5bce689bb3b6e094595b7f10f5f7189f64380033c1bd156c5f43c3dbab11fe9a.json", + "sha256": "548d2e0c02ea0fd52cbdd81d75538b7d1adfd49b68cf11c9ec44cb4fcd274f37", + "stale": false, + "unfinished": false + }, + { + "bytes": 11696, + "path": "/home/mc/ousast-results/plane/engine-trace/5be35f0891590a23952dbecc04600c31c37ec355322f11e24c726d78d518b1d9.json", + "sha256": "9168d1c7fbfb060c83737db7cc96c7b3b891630741da52b7a576266bc6304e9c", + "stale": false, + "unfinished": false + }, + { + "bytes": 13500, + "path": "/home/mc/ousast-results/plane/engine-trace/5c5dbae351edbccfd1fb86f3b43e614a010508c534224e41fad65e0007edeb36.json", + "sha256": "5c099b801fa2c3c31e6a63173db54b4a8fa445f27fb9257f5bc814b692f7485a", + "stale": false, + "unfinished": false + }, + { + "bytes": 66940, + "path": "/home/mc/ousast-results/plane/engine-trace/5c79234a9d0fd4151a63cceaa990c13c576bae66d48ab08dc049adb9c1101836.json", + "sha256": "33cf5e8f10d25d2a0adf50e65f74f8c6a007548f4458a81347b64e395914598d", + "stale": false, + "unfinished": false + }, + { + "bytes": 12291, + "path": "/home/mc/ousast-results/plane/engine-trace/5c946315dc987af0447facfe1eb07d54e9352ae959f3af51f55550e26c8cc2ef.json", + "sha256": "7d0c9afff3a11c9926862910f21018ae0fc34d6e2434e85c4e3aba9ca68aa32d", + "stale": false, + "unfinished": false + }, + { + "bytes": 9240, + "path": "/home/mc/ousast-results/plane/engine-trace/5ea1364e66509b96d4620588436908900ea67ffeffd2256df3c2d52a0e411d92.json", + "sha256": "eee8a3343be73c82ce60aff80c733535c9aacd785ebd80ee6812ac9d401afb61", + "stale": false, + "unfinished": false + }, + { + "bytes": 75354, + "path": "/home/mc/ousast-results/plane/engine-trace/5fed103e854458408d845aa0a8687635116388e93f7ec55892a88935083c8c18.json", + "sha256": "6161edf4f8b599a0f082e95baeaf6adb9f22a7d87b95af2812e2fbf4d6a86397", + "stale": false, + "unfinished": false + }, + { + "bytes": 32139, + "path": "/home/mc/ousast-results/plane/engine-trace/5ff438041c36a859b0cb115acc466300071ded12446995beee0460d7c6b7b1f3.json", + "sha256": "571e0cf440c565b729c473658895b839d581cd3c43ea21246f0a74603b375ce1", + "stale": false, + "unfinished": false + }, + { + "bytes": 9231, + "path": "/home/mc/ousast-results/plane/engine-trace/602d0ca805586df0081c5e598520a57385c5f96c3d72f2015b3739a74b0ec29a.json", + "sha256": "c93f927c7aa36c3d1ef64e78cf634d19d634d248519792510198e57a1ce09d75", + "stale": false, + "unfinished": false + }, + { + "bytes": 12857, + "path": "/home/mc/ousast-results/plane/engine-trace/611e98d107f744ccb13e713ed400e844e92e72224008bcb0f2b5fe191556454d.json", + "sha256": "ae62d309c2e1b0ec5bfd27e94a2f4878f7ddedfe9fb461401a33c85e8786237c", + "stale": false, + "unfinished": false + }, + { + "bytes": 22714, + "path": "/home/mc/ousast-results/plane/engine-trace/6210d4930b405a29187a61a56876cb0a7039f7ac71c37111122063969180baf2.json", + "sha256": "5bc6568cbcd85612df2f992ce376e2250d72907c3ec79a23ad038f4b0e6c9871", + "stale": false, + "unfinished": false + }, + { + "bytes": 1335, + "path": "/home/mc/ousast-results/plane/engine-trace/62f10310e1306338cbaacc184e48ef51f0ad2289a2adb99f3a0d63cf88396a94.json", + "sha256": "4206b2f52e8c6c5297750689262d663c419da99708213baa3519a21c53c3a06d", + "stale": false, + "unfinished": false + }, + { + "bytes": 145369, + "path": "/home/mc/ousast-results/plane/engine-trace/6372a49f430cf48d411ea9fb2842e2d8d0f57deeb75bbd28d8ca6e388dedfea0.json", + "sha256": "8b8ddf9664869432b93f01d960a838d681a338c51afcef840b02ebccd07b3609", + "stale": false, + "unfinished": false + }, + { + "bytes": 14530, + "path": "/home/mc/ousast-results/plane/engine-trace/639812d61aab7eb6e397d15e8f485a70215146bf6ae459aa834bd67bcd3345ff.json", + "sha256": "9302c72f94da4ac0e5a6e4695986d55a9789c00c039a3c7bee8dfadd2ecda69d", + "stale": false, + "unfinished": false + }, + { + "bytes": 25749, + "path": "/home/mc/ousast-results/plane/engine-trace/63c992b500590a9d4b643c9458df1d6cf71d770b06cc70594acbdba99b06c00b.json", + "sha256": "eea76121bdaba0cd2741b5ddc31b392f249aa5ea0516ddb7c7f1925069a1c2e3", + "stale": false, + "unfinished": false + }, + { + "bytes": 10303, + "path": "/home/mc/ousast-results/plane/engine-trace/64a24b7b1e9bd90ba5c168c9f82f38c46c45fc1f06f7a456cef544dee6731f13.json", + "sha256": "4b78c6cd0b70e76ad4b4da62af480b09707e6ca3999834ae0ddf1ca2e5989fb7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1301, + "path": "/home/mc/ousast-results/plane/engine-trace/65426899f3ea89fbcc32aaff858475dd8ca53b7d7bf3c32848fcb98938511f80.json", + "sha256": "abc113293b1692a0adcf71fd3accbf9102c326f0acc409b122d3507581f5e7b4", + "stale": false, + "unfinished": false + }, + { + "bytes": 1292, + "path": "/home/mc/ousast-results/plane/engine-trace/66482a00a92f15b9f831c70676574824db868a74648e5769884d6b7204439fef.json", + "sha256": "0897bc994baaf1df959a79645076812c768779b2760e5f907a1baadf44800dc7", + "stale": false, + "unfinished": false + }, + { + "bytes": 140259, + "path": "/home/mc/ousast-results/plane/engine-trace/667c661436bb4e0e65d457e6d82c35483feebf1a07aa75c419245b3a7d1bd51a.json", + "sha256": "66b1dab07067852063bc2de8e47b1011ac3c162c6dfdbec7b8bc405db9a9f0d2", + "stale": false, + "unfinished": false + }, + { + "bytes": 1298, + "path": "/home/mc/ousast-results/plane/engine-trace/66df73c89ce005e5637e9edf8a811b39b08f4cd5cbe1e789ba533819e82c7b4a.json", + "sha256": "2bb00eef9cdf6c10523253c3509c424edc9a036cdcbdbf09bc147426f71060e9", + "stale": false, + "unfinished": false + }, + { + "bytes": 4380, + "path": "/home/mc/ousast-results/plane/engine-trace/673a53f21698cc115457f3f933000ad45eb7e0863d845bda6e331f1f210637a5.json", + "sha256": "94030e137756db3265096921c7b408fd53d24b7fe240bc42319eb5c760da8276", + "stale": false, + "unfinished": false + }, + { + "bytes": 17362, + "path": "/home/mc/ousast-results/plane/engine-trace/67fc840db3a884f13eca1a04670fd354d9ecb6205f1155fbf2873af3074ae9a1.json", + "sha256": "b34ed58f346d14f41ca0a2e4d1f6b58c07df7f5b85052d453d67406091d88a1d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1317, + "path": "/home/mc/ousast-results/plane/engine-trace/67fef4c1fffd65c4cc0a0614896ecc0f0dba82de739d372868452dbc19137c8f.json", + "sha256": "ab1c45dfb4c3ceedc7a3c4738fb364be5df91dcfb608f506a62ec14ff628b42c", + "stale": false, + "unfinished": false + }, + { + "bytes": 53904, + "path": "/home/mc/ousast-results/plane/engine-trace/680b36dea8361f5c24483db06e7aa5c755689878b60663088e35cad7756f2a64.json", + "sha256": "2fa9a175af4f13e3b59075a732778bb43455f5b4c00e0feefc8927fcc0d55652", + "stale": false, + "unfinished": false + }, + { + "bytes": 12923, + "path": "/home/mc/ousast-results/plane/engine-trace/680e8cf299b00b9fafe4f2d9ddc26e0818beac52742c38bc81c0637fd7a865e2.json", + "sha256": "a6ac22cca5b5699e7a68277c554ccb57f3ffc18d8901016b46c2563c2d6e1b48", + "stale": false, + "unfinished": false + }, + { + "bytes": 1223, + "path": "/home/mc/ousast-results/plane/engine-trace/683dbd6c3c55fba1e9c06e448f76e1736dac5aff305d0ae9a68a49d957512e4f.json", + "sha256": "283c433b9f1a382dd159156aa3eb9348251c5e388434a5ba3f3a082c95b42a53", + "stale": false, + "unfinished": false + }, + { + "bytes": 164186, + "path": "/home/mc/ousast-results/plane/engine-trace/68b8be7f8657f52788b0072007c4519d27522888aa69e2297da4fcda67cd9269.json", + "sha256": "ddb7b9b008c33a39bf97bfd331462bba8680adc3a651caa56142616bdaaf2913", + "stale": false, + "unfinished": false + }, + { + "bytes": 10410, + "path": "/home/mc/ousast-results/plane/engine-trace/697b2db797f9cda840c8ef013141225c8095759a3ab20dced20f729f11fb9c6c.json", + "sha256": "0dbbb6832f7b89ba54c1c23a256710de766f6ac9517f8d745adb8a51797adb6f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1280, + "path": "/home/mc/ousast-results/plane/engine-trace/698b76d7a84053c23a794a41f8a2a8c4ca6d50043ffc80650d99200695c47368.json", + "sha256": "6283a8b06901ddfe44ef0b9d8201b9248e66beafad9595644146afb351476804", + "stale": false, + "unfinished": false + }, + { + "bytes": 1281, + "path": "/home/mc/ousast-results/plane/engine-trace/6a2b6a9de7cbfb8c98b0348605ec987d7b5d12dfe129ce69f43c1c11f11db6de.json", + "sha256": "b79037264d27e28c8222f765b7fd95d67cbd3efe8b62fa292bfc0c3bcf759498", + "stale": false, + "unfinished": false + }, + { + "bytes": 25967, + "path": "/home/mc/ousast-results/plane/engine-trace/6b78f8fac0721b3552aaae4aa2d2169aa5c53a35804397df38e9cf41410646f9.json", + "sha256": "015af82a4557e38e919e83da07f547c396579f8aae3a1ee7f133b4d5be13a3fa", + "stale": false, + "unfinished": false + }, + { + "bytes": 16679, + "path": "/home/mc/ousast-results/plane/engine-trace/6be16bca5fefbe333153e9a4567c585315146dc6db8c30b88ecb4f2693f7431d.json", + "sha256": "82b325b354cf71e85f2b43af9b027532c6c703de3451ba04dac2a11080d1dd57", + "stale": false, + "unfinished": false + }, + { + "bytes": 1269, + "path": "/home/mc/ousast-results/plane/engine-trace/6bf758243449cf4d45df78d57f3655cd63a1b3de2641d91cc8844207324a466e.json", + "sha256": "7858fb84d32cd249067bc5da48c0dde972239a15684a5fe30653846af72d464f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1330, + "path": "/home/mc/ousast-results/plane/engine-trace/6c0668a2e7586861642b1e6558aa5077b2a81e7636b3d339c52cc2892de1e07b.json", + "sha256": "657c0b5fd79573ffd02251d2db4c1dd41dc1e7947a9516dfe1a15c1c48e3ba82", + "stale": false, + "unfinished": false + }, + { + "bytes": 1300, + "path": "/home/mc/ousast-results/plane/engine-trace/6c58350962440853e847070cb88983e8ad1ee0483f2bd259b49841af222cfb01.json", + "sha256": "8becead7f262444564b0748f7df4d93f5df990f19aa67ef92cfc1b9a521f11ca", + "stale": false, + "unfinished": false + }, + { + "bytes": 1291, + "path": "/home/mc/ousast-results/plane/engine-trace/6cb76bfbacef030b3f21d8bd9c7d92f0c3cd867d30b22b6e56115197f8d3dcb2.json", + "sha256": "f5532ae05b78c81e5c9f63a7afcef5efb935ec709fcc66e4fa2955dba8105200", + "stale": false, + "unfinished": false + }, + { + "bytes": 1294, + "path": "/home/mc/ousast-results/plane/engine-trace/6cebbd2adaf76bbbf089b7077d2d72d0dc2cf4cfcee43a55ebf2f8bc968f9464.json", + "sha256": "895a418652b0ba25df501bbd9d42ad1edbc530e9c96e132575840c6eb7050340", + "stale": false, + "unfinished": false + }, + { + "bytes": 214594, + "path": "/home/mc/ousast-results/plane/engine-trace/6d56f05a16ca6edb3fec59a77dc78686b0c03f2bcacb9a10d835ff86724ffac5.json", + "sha256": "44654710c65949bde6e0ae487deba1aa1842a980a04139dad588915c194b00f6", + "stale": false, + "unfinished": false + }, + { + "bytes": 9192, + "path": "/home/mc/ousast-results/plane/engine-trace/6df0a0bb70780e951b20bffc19fd072399b407006c4258fbef674063a9ae77bc.json", + "sha256": "112088a7df3f3b7a0fae152096c243419816fec8ded466d26a87f627c819d975", + "stale": false, + "unfinished": false + }, + { + "bytes": 1300, + "path": "/home/mc/ousast-results/plane/engine-trace/6e365f17da9ea38c5b75a56ff3a9d753d640c5f35da1c197e1524fa2a88bbad5.json", + "sha256": "9db02920adf0b1c4396be1969a86abfead52e270265efa4f44fe4b52a912295d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1272, + "path": "/home/mc/ousast-results/plane/engine-trace/6e9ae13bf93646fd2a5ce0b1307e58761e8ff75e876575a292a262e5e257e058.json", + "sha256": "2eda6b115955427104e317cb90db4f5e3ef0517b9b02f0234799c3ef980dfa8d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1306, + "path": "/home/mc/ousast-results/plane/engine-trace/6f2012a24fc3953a93f99c0e19261e1cf01c424f983c7075556883cf5e4a0e5a.json", + "sha256": "49a2c67027cfb76a00de52f7bebd9db229412f7cdad688226505cec55bbcae37", + "stale": false, + "unfinished": false + }, + { + "bytes": 246489, + "path": "/home/mc/ousast-results/plane/engine-trace/6fa8bbaf71b3520753a2dbc3d73a418c973c5c05f24ed6d31acc8554def3f4fb.json", + "sha256": "f45ec8d57a5990b8d6153dd5b4d90e20823e3e3222eb6e4796b218f81c746fff", + "stale": false, + "unfinished": false + }, + { + "bytes": 74527, + "path": "/home/mc/ousast-results/plane/engine-trace/6ffc3b834cc256c09cfb5aa625f463d911233b05349973f8515e3ad5b8787a0a.json", + "sha256": "5fc63bbfe339be0abf3e10ba8ccebafbf12545df7a27b18b8625e811517cff9d", + "stale": false, + "unfinished": false + }, + { + "bytes": 261642, + "path": "/home/mc/ousast-results/plane/engine-trace/70c5353546afb511585be2e70266269a9717f7224163f4de85b0f4b0a439556d.json", + "sha256": "66eab549422255ba85483684535ab4cfbdf9ad8d917dd625810b54215f599cdb", + "stale": false, + "unfinished": false + }, + { + "bytes": 17368, + "path": "/home/mc/ousast-results/plane/engine-trace/7180edcb1098d8dd2027b4e5d986655ac4391a24df595686daeaa3f1dd3eedff.json", + "sha256": "ab40d673a8121232b3bf2398be3a5c312ace6945671a121f371b2773d2c22e68", + "stale": false, + "unfinished": false + }, + { + "bytes": 9293, + "path": "/home/mc/ousast-results/plane/engine-trace/71b1b44596ce052fa35241ff617b4d760aee5df5c9856d095c17ee598d164568.json", + "sha256": "cc1b942fd4d1ae9b6faca3ffab69fed315e8e92ee2763825f861024dcdc36b41", + "stale": false, + "unfinished": false + }, + { + "bytes": 43536, + "path": "/home/mc/ousast-results/plane/engine-trace/725caf84926e8858209415ab4d1dfd0618840050ed306a271e1e60dfedf565c3.json", + "sha256": "7e827279766ba1a273b451d46ac49b35a9501b1ce8c3d657332e95815b9de77a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1323, + "path": "/home/mc/ousast-results/plane/engine-trace/732f459dc33efe9e718cca26f8aca99e1133326b4a004d3edecc8e5222ee8718.json", + "sha256": "b0f2f014aa2a0e96311d0685d137cf0895d937f4786632ccd08e35e7a55a0366", + "stale": false, + "unfinished": false + }, + { + "bytes": 13663, + "path": "/home/mc/ousast-results/plane/engine-trace/74b07a6842f87cc14bf3f0c96826d8d6e63bbdd5fed60f3dbeb4d0d48e27f6d7.json", + "sha256": "f7fedbf69600f9f8831c01f9afc1617d2441571f1a9fa8421eb1af6c9d346292", + "stale": false, + "unfinished": false + }, + { + "bytes": 1296, + "path": "/home/mc/ousast-results/plane/engine-trace/7507338f53932fc078949dd430d484c69cb0239cfb6206148c71a617657e77df.json", + "sha256": "e79184d09bd61a8a9502f02e920ee0333ba5fd5062abc1bf130732133fc11386", + "stale": false, + "unfinished": false + }, + { + "bytes": 27722, + "path": "/home/mc/ousast-results/plane/engine-trace/75229286b75af88d5dd98dc46f5dd72148d1ca624a503fd353036a139d8e0673.json", + "sha256": "c8f102c5921e63f83204b0d2c25f258255a507a9f20a36405a20d5631f55757b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/75ddbd78032d1c043f6e1c12d7ae5cc8d742e6d70e47a3a763280346e4cb4f57.json", + "sha256": "87316fe9fb01897ddb1784e9978a833e43ab14a4942a5430dacd1761ff287152", + "stale": false, + "unfinished": false + }, + { + "bytes": 261649, + "path": "/home/mc/ousast-results/plane/engine-trace/766e07a7322ed9a027cc9834029e1ba1d9e39dbb2f090238b07aa90d799ab5f1.json", + "sha256": "a8dd08717ab74727c60322b1cdb60d39581f24d7f2efa6210818fcd8f738bcce", + "stale": false, + "unfinished": false + }, + { + "bytes": 1293, + "path": "/home/mc/ousast-results/plane/engine-trace/76c3c47875019351750b90e6868c0c14c2d3ddf65fef26f8eac945b781b1d5a9.json", + "sha256": "cef377706d593afb8b78cad1dfe726035daaa56c45e1403f0c8130cf87c78884", + "stale": false, + "unfinished": false + }, + { + "bytes": 68335, + "path": "/home/mc/ousast-results/plane/engine-trace/7837dd2faa6cec8e9a820ddb6dddf86962d3e04283e5d02bcb5a0256a5c4f906.json", + "sha256": "40c24756e9ef10b6102a8c22c9c2a7cc9d86652386cfa2395fa22b70eeb52a23", + "stale": false, + "unfinished": false + }, + { + "bytes": 1333, + "path": "/home/mc/ousast-results/plane/engine-trace/7865f91b3e358d022a33e46930ad8aec8f1d669c922898d514b04bb91046175d.json", + "sha256": "011ea6cfd8a92fce571632c20e214d25d2b096d799676b5ecd0d3c53ce33ac63", + "stale": false, + "unfinished": false + }, + { + "bytes": 32895, + "path": "/home/mc/ousast-results/plane/engine-trace/788273bc720c92851d45e98916cfbdab115684f69f62096dd44fbc94231dc01d.json", + "sha256": "2d36a8aa01f4718f98ab4fd6215794ea71e6cf42df6b6d7a259689758aa35b66", + "stale": false, + "unfinished": false + }, + { + "bytes": 16714, + "path": "/home/mc/ousast-results/plane/engine-trace/7888c95ec5c0ec6e253068529ca5feda9033126a43fc69b4abaf90876a27aa4f.json", + "sha256": "fb93a3bcdc9709de35236f8a13e6c6611cfad95da908965b8e51ccbda5ea5a34", + "stale": false, + "unfinished": false + }, + { + "bytes": 17534, + "path": "/home/mc/ousast-results/plane/engine-trace/78eea6248717e3c8a56778f5df625f7c94ad1594510fc85589ad1104364cd7d7.json", + "sha256": "09e2000326178ccf3f879ed70b7621943e18b60c16482075c2739815fbadbcf1", + "stale": false, + "unfinished": false + }, + { + "bytes": 9162, + "path": "/home/mc/ousast-results/plane/engine-trace/7992a31b83438da76671ee7c33c9684335dd428c65d5e2e2d7b2d7e3d1339c1c.json", + "sha256": "ba39f55480520317e1eb5e0442c15eadba75e5740005b80b2abff3572ad57727", + "stale": false, + "unfinished": false + }, + { + "bytes": 1315, + "path": "/home/mc/ousast-results/plane/engine-trace/79e408070bb5194f8f683567f0f1a56deb7c22fbbc7ccca617865adfc6b308d0.json", + "sha256": "b26165738bad38589bc745747f0a9fed34028524aaaed24b07c2021e3b784991", + "stale": false, + "unfinished": false + }, + { + "bytes": 151731, + "path": "/home/mc/ousast-results/plane/engine-trace/7b5d75f3a418c1b79f67b5fac6fc694ffdc9ff74688805e9118a5934e98b0ba6.json", + "sha256": "b8e16e3e8090b634fcb185502cea8e5ad81bd823aae4c2e5b06e6e985932fb20", + "stale": false, + "unfinished": false + }, + { + "bytes": 200465, + "path": "/home/mc/ousast-results/plane/engine-trace/7d480209c2e6ad9654c73c417e591e66502e62cda543c3dcabdd09d999791e9b.json", + "sha256": "53597d81dc0bcef12af50afb6463caf5ed1ae0cfbc60ba85c7a17eecdd5ce54d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1285, + "path": "/home/mc/ousast-results/plane/engine-trace/7d6d8e728145aa361db5322e5dbadb50ebc813c1a070b3706229634fc97442f8.json", + "sha256": "366eec961a8048684b4e8ba71792b5b2c7a5a154eb279f11d7a1f8e6b8a2c3be", + "stale": false, + "unfinished": false + }, + { + "bytes": 1269, + "path": "/home/mc/ousast-results/plane/engine-trace/7db9ead05ce6a1f71ba7b585f1cee42bf4735b3f8f458f6d40e58978c2cc0a23.json", + "sha256": "293ee132bf0ff65df1b1c6a68dfa38dbe68d00126467ec958bfdbedb773dd4b0", + "stale": false, + "unfinished": false + }, + { + "bytes": 43162, + "path": "/home/mc/ousast-results/plane/engine-trace/7dd413a7ddbc604a019655a57c5c2093b2bdd3ba302e8522f355ba797f99d256.json", + "sha256": "09b65c80b90ce5958b12dcd3b98057fd3b5a724d72ff1266138be9dcd2ea2456", + "stale": false, + "unfinished": false + }, + { + "bytes": 1260, + "path": "/home/mc/ousast-results/plane/engine-trace/7e2eb08014006f2fb5a0b5c0493928eff39affe3e90b1f2f8c6885b583cd3f66.json", + "sha256": "09eb438921b9668268811d385529fa71e4e636cef45dbad74472585d75d86b9a", + "stale": false, + "unfinished": false + }, + { + "bytes": 66953, + "path": "/home/mc/ousast-results/plane/engine-trace/7e875f023adaaef41576a484e11d1f84eef3b935a4b030201422ff729e740198.json", + "sha256": "262f004b885dd9cebcfa5f50191eb2ce725e9fbcc8613b23b3a6cb84651bac71", + "stale": false, + "unfinished": false + }, + { + "bytes": 1300, + "path": "/home/mc/ousast-results/plane/engine-trace/7f784ef607968bd0572eaf2e8c8f3bef3b5a2da9a3b82092f8dabc769e6e6072.json", + "sha256": "536243e284a1be0be0c4801a711c1aac0ce8952f07eedc56c752abff10fecc13", + "stale": false, + "unfinished": false + }, + { + "bytes": 1338, + "path": "/home/mc/ousast-results/plane/engine-trace/814f8b2258fbf66e24d32576f9a5c44f28758ebb7031f975b38352b7d90dd4ae.json", + "sha256": "65b5670219bca756ece895e1901299b700eb7d79216a10e86c4f3e866d01a3de", + "stale": false, + "unfinished": false + }, + { + "bytes": 25273, + "path": "/home/mc/ousast-results/plane/engine-trace/824ca836ea66dee44a63810c1561e69af395babfe99119cc3d3b1e7fb98a8f98.json", + "sha256": "922f810e71ce3769ab79142be9f66bc045499de7bc4173a12b728883197cdfb4", + "stale": false, + "unfinished": false + }, + { + "bytes": 21689, + "path": "/home/mc/ousast-results/plane/engine-trace/83b66ed6a9c3f6ea4053589ab5ace0b0ef55ad9b9e92dab82e4ed7327388a902.json", + "sha256": "c5d064da11ac37ea996e22f640becb4ce38368285762402b5655c927937bff59", + "stale": false, + "unfinished": false + }, + { + "bytes": 37641, + "path": "/home/mc/ousast-results/plane/engine-trace/83d6d3c70e7b65b76be05b9706661018d42c324847cee391d28ba8d1f617deb1.json", + "sha256": "d97f89263e199f5c13275624e4f57f9d8e7e0ad924d7643ea5c1ece90e94c164", + "stale": false, + "unfinished": false + }, + { + "bytes": 87013, + "path": "/home/mc/ousast-results/plane/engine-trace/8410acf1a50effd2b1dd0ea76efe5fcc4d0b8f1f9c8259d89cbc4a964e8425e4.json", + "sha256": "d26a0d6962abc3db1022eafe0dc24b9f6a2042d76ba8aeeb615d6e597d176c99", + "stale": false, + "unfinished": false + }, + { + "bytes": 1305, + "path": "/home/mc/ousast-results/plane/engine-trace/8496b85be727814a2be34b51365c38be53be26bde234ef24b296b90e1f981d50.json", + "sha256": "182b6080e907a26e09577f66364b30217b181c42235b0d617dbc8b96addeba24", + "stale": false, + "unfinished": false + }, + { + "bytes": 1319, + "path": "/home/mc/ousast-results/plane/engine-trace/8513dea5555f966f41d26f28a4de053c86ca5bf572b1f95e71a8855b25b8422b.json", + "sha256": "d07cc17e29f0b42e4a603495da42ba2199c6832417a89e1ceb4651b9d4785dc4", + "stale": false, + "unfinished": false + }, + { + "bytes": 1391, + "path": "/home/mc/ousast-results/plane/engine-trace/86b8f01395cc0926cfe7c52c9a3e9f12402ca9aa6c8c6671c657d42337ea1a39.json", + "sha256": "6db4582ba7e2609101bee9cc18b0fe3ae0190aa0ad53318cb232fc30c7bd4063", + "stale": false, + "unfinished": false + }, + { + "bytes": 1305, + "path": "/home/mc/ousast-results/plane/engine-trace/87686bd2866de12cf2e741aa1f4ca423f834ff8952ff1228565770a46847c977.json", + "sha256": "3d094bac84150566cde6b74383f45316ef65afbaa6b0a653a7b928fcc29eabc5", + "stale": false, + "unfinished": false + }, + { + "bytes": 25137, + "path": "/home/mc/ousast-results/plane/engine-trace/888016fc2237356e42ffdf90b53bd9f70819ad916ef5d8490166e33f161ae203.json", + "sha256": "1854ee81a3fdf243a2673581bb91a18f69369d4e44c63e0159dfa1bb9770f9d0", + "stale": false, + "unfinished": false + }, + { + "bytes": 43019, + "path": "/home/mc/ousast-results/plane/engine-trace/89f198a26eebdf667a345c6e18ecc5d5768f66892f0eef0516ceeb17a0c7abe1.json", + "sha256": "d83de637be3bff0f8ab6075696d2454b83b25c583811f88eb725eb4fd3a875cc", + "stale": false, + "unfinished": false + }, + { + "bytes": 1250, + "path": "/home/mc/ousast-results/plane/engine-trace/8a8617747f3b3f010c3a80b880d98ab5c56740470e58024a62e0d017fb3c3722.json", + "sha256": "68c3d0596f72958749f1a9624cf5983da0fa5407163864375bc336f76d0bf02e", + "stale": false, + "unfinished": false + }, + { + "bytes": 535603, + "path": "/home/mc/ousast-results/plane/engine-trace/8af4a32b985ebc955dd79c5e699a85f4b81ed0f8cbef50e3b809ff0c6da3a198.json", + "sha256": "8d1802b067a6c786bd7bf3cfdb3871d27badac42600504099db7fa8c25b4aba0", + "stale": false, + "unfinished": false + }, + { + "bytes": 26317, + "path": "/home/mc/ousast-results/plane/engine-trace/8afb1dcf24188f0a1825911fb35c79903a976dfd16ad095b839e88ad4ebcd8af.json", + "sha256": "f1fb083eaa5800b09fbbcd8e4d420019f3dfb3d0d2078ff63866ac06cbe5c731", + "stale": false, + "unfinished": false + }, + { + "bytes": 16011, + "path": "/home/mc/ousast-results/plane/engine-trace/8b050e2671f2ac1bb58bf0de9ab4bbccaa810510020a19c99261ceb85af1fa4f.json", + "sha256": "5a4d0ca3e8b256b8bd1732fa0494c654253d81326138bdea2145d7bafbb239b5", + "stale": false, + "unfinished": false + }, + { + "bytes": 22722, + "path": "/home/mc/ousast-results/plane/engine-trace/8b2db429d9c846d47aab2506ffd3b8079fa5922e25391e8d3065467a95046f44.json", + "sha256": "3ea3da10d9534aa86782e8e26af2a3982918024cb1a48c419a09478d1d204491", + "stale": false, + "unfinished": false + }, + { + "bytes": 74403, + "path": "/home/mc/ousast-results/plane/engine-trace/8b586bce49142d416e6eaa0fd2d78a9e17cb95b3aaa36edf26203123d85e902d.json", + "sha256": "4293ec8245225902258ad4e0618b5a162cc159d2b7b5f81551982b658e0ec6af", + "stale": false, + "unfinished": false + }, + { + "bytes": 25749, + "path": "/home/mc/ousast-results/plane/engine-trace/8bd2f48dfb2d00cfc5b60a5dee3a8c87e6970671121caa17221f2449c1254fb2.json", + "sha256": "3b322b7bfe1a86e122003bd5077abe6650480bab35e6f5e0445f5dcf46a9a340", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/8be970872b48f26820332ee56448f8b0dd794b19a4cb277a5244a5999906d505.json", + "sha256": "bd179331ad46a2e75d74a3c772498b683377ffb1c107877a3e676457eb5c233e", + "stale": false, + "unfinished": false + }, + { + "bytes": 10305, + "path": "/home/mc/ousast-results/plane/engine-trace/8cf04b2edba3012161113afef79919dc93de6d1dc0bdea2eac4c4a460723ffe8.json", + "sha256": "2d019868591781d47fd4477e537c90988d6f09141619b2421cf6eefc66565203", + "stale": false, + "unfinished": false + }, + { + "bytes": 1282, + "path": "/home/mc/ousast-results/plane/engine-trace/8d55eee59fde196a078237538355c44395c88d948c80c203033c0fa10f1e0d8b.json", + "sha256": "850a9e76470d0c0841103abd5c75f138c897ac542d0bfa84c9d5d0d3b6a960d5", + "stale": false, + "unfinished": false + }, + { + "bytes": 60257, + "path": "/home/mc/ousast-results/plane/engine-trace/8d6d54c88d638201bb2057768c679cdbdf44b83cee88c604475d49c68a0dddda.json", + "sha256": "59fa600bdd3f65a56ef6db948c27fb5e8a67ff1e3286304da00cec268f71e964", + "stale": false, + "unfinished": false + }, + { + "bytes": 2452132, + "path": "/home/mc/ousast-results/plane/engine-trace/8d7187023f48048724e97e95a38c1006b2bae15e3e487196eb38bdd0fd3d2659.json", + "sha256": "ffa532afe75c048a025621bb163897c95898e6c87791ef8dd1a4bfc2f3bab08b", + "stale": false, + "unfinished": false + }, + { + "bytes": 38728, + "path": "/home/mc/ousast-results/plane/engine-trace/90211200d18830db08cd1b93d12c76c0f1fc0c485f67e62106e9e66aa8fa48c9.json", + "sha256": "650e9bb34dfda75eba61f65c6473f57b4c01fe9efb40245b8e2c93a34ddae5d8", + "stale": false, + "unfinished": false + }, + { + "bytes": 1299, + "path": "/home/mc/ousast-results/plane/engine-trace/90343e67160c1631d3ad7044274f58ecd268a46f507c892a2f5eebefced936e8.json", + "sha256": "061c8ea0ec474bbb40f78e0c8a354aa0eb21f06508ce848e7f9a1068f58f0e78", + "stale": false, + "unfinished": false + }, + { + "bytes": 17530, + "path": "/home/mc/ousast-results/plane/engine-trace/91249f3dff8f1c8232b89c2e43484e72f7ffad04257b6f24cb3296b89b27b37f.json", + "sha256": "9f909e532a422323ed8ea9c0afcd2a1a59dad89e783c4d7ea21e4cdb645b2c8e", + "stale": false, + "unfinished": false + }, + { + "bytes": 10979, + "path": "/home/mc/ousast-results/plane/engine-trace/91309278de6ed626d199e78d606ab3b4ed4653faee32b5de9d68923a93595a9c.json", + "sha256": "32be0ea7b15baa1c5df656ccbc984de14b2c2d939e5579e293af0a922f93f14e", + "stale": false, + "unfinished": false + }, + { + "bytes": 33878, + "path": "/home/mc/ousast-results/plane/engine-trace/915d18fad7360e61caf37103bdf9e2d568d198ef65a285997da2e341c775b729.json", + "sha256": "ce7b18cc7bd0cdc5925fc4283f4d9a018c5f4ff067271bedfeffd11f3af99e7f", + "stale": false, + "unfinished": false + }, + { + "bytes": 13313, + "path": "/home/mc/ousast-results/plane/engine-trace/916dfc312dad5cc426fe033c8036bc1257e03f0e75619f7789c26e606a5416e5.json", + "sha256": "90f51e43292f73607bee0138a0536fd0c7e5b27689e2cb9ae9d72aebc34b8722", + "stale": false, + "unfinished": false + }, + { + "bytes": 33012, + "path": "/home/mc/ousast-results/plane/engine-trace/91865710f6bc90d0b023ca58ecd69b02e3fabe79b4031bad48c6e3208a3c6d50.json", + "sha256": "403b2faca8dff128f94e6aba75d50f7de3832816e8243a120ad080ac86bd9aef", + "stale": false, + "unfinished": false + }, + { + "bytes": 18420, + "path": "/home/mc/ousast-results/plane/engine-trace/930dda77d41fcdded1c22c31337f665bb26e6e2ff66b797005ed7eec67b83d6d.json", + "sha256": "2ebc90f7f208154d1c59315ac1fa2089a7a661259732a322eb75340a5e39ad23", + "stale": false, + "unfinished": false + }, + { + "bytes": 1289, + "path": "/home/mc/ousast-results/plane/engine-trace/93857d7449375d7ba623d0b21626c082d06ee9ebc4a1dfcd14dc3baf1401f480.json", + "sha256": "073777772b2b17bd9d6bcc63891f707c205da977024d640a71f948630f669670", + "stale": false, + "unfinished": false + }, + { + "bytes": 1286, + "path": "/home/mc/ousast-results/plane/engine-trace/9445087ea24a7fea79fd6f99f8b96678d7dacd0bb10bf817e0db20cc9b391216.json", + "sha256": "26a0049b0fbb84b79e31e4616ca7838ef915568330cb9af2f2618783c49bf6b4", + "stale": false, + "unfinished": false + }, + { + "bytes": 24803, + "path": "/home/mc/ousast-results/plane/engine-trace/948881d856dbc12c54a9993cbe12d78a1cf7d411864c67d171d2f9efee9afdea.json", + "sha256": "8825941660fea740784386cd00a32647d721a008a7667ec1a23434635641e4e0", + "stale": false, + "unfinished": false + }, + { + "bytes": 1315, + "path": "/home/mc/ousast-results/plane/engine-trace/9490ade59fea285935cd96ae5289ee90e9cea0a336f2355b63c825bc2061aef3.json", + "sha256": "a015cc43538bae2c747ad12582f971deb1987d89ca99ad6ad4e2809c8472f047", + "stale": false, + "unfinished": false + }, + { + "bytes": 1320, + "path": "/home/mc/ousast-results/plane/engine-trace/94b8d4939d5182050fd56ddd67bbc3fcb91be21e72edad272a670807565abbb7.json", + "sha256": "9def86c520700be1a87d36f3973aa511b3942d5d6c6dc51dde784db137b46748", + "stale": false, + "unfinished": false + }, + { + "bytes": 145690, + "path": "/home/mc/ousast-results/plane/engine-trace/95eb434970e8e6e2dd723f827a3533583c30f6b5f721c7987172a592dca1f21a.json", + "sha256": "5872f257691b421373b37a9c18b5bcd8bee3abf2d73d10f9d5254e55541e2b80", + "stale": false, + "unfinished": false + }, + { + "bytes": 9158, + "path": "/home/mc/ousast-results/plane/engine-trace/969580260f074c1ff4fcbcfc29531b5af7be457aad38f78227f56c6378b6a3b1.json", + "sha256": "6ca2487957acc7ac31739c640bfbfa2aa90cb572807f34e962d6bb4838b31654", + "stale": false, + "unfinished": false + }, + { + "bytes": 1264, + "path": "/home/mc/ousast-results/plane/engine-trace/96f19315f9c4b55e686e831ca2c0ed9446a0784c37c97b9e0b57eeb5d66e90fb.json", + "sha256": "0d160fb7b05ffe760d6d3fe3ece33acb070c48797542c32a1e4f003f878899f9", + "stale": false, + "unfinished": false + }, + { + "bytes": 846744, + "path": "/home/mc/ousast-results/plane/engine-trace/9823b3410d359197d8fd8e9207ab153b45e6bd0b4b630737473235d7e24f3947.json", + "sha256": "59dda12bbe65822b008956ca83bb2ac8f169f91fb949daf0b80b1d16bfa5c668", + "stale": false, + "unfinished": false + }, + { + "bytes": 133414, + "path": "/home/mc/ousast-results/plane/engine-trace/9af2b65e5dec8b32e52f53e7f8af864a6c059fbc8b8daaa0a0f66124f6550e49.json", + "sha256": "94534f64a3652343cbd53d4fdd1c74fb9f8afd8266ca83b4c2ddc9de65b2cc89", + "stale": false, + "unfinished": false + }, + { + "bytes": 1413, + "path": "/home/mc/ousast-results/plane/engine-trace/9b229a1497fcb0a3242e5ec06b29917626b8e4a33c7215c967a4d3d3af005ff5.json", + "sha256": "bc9162b631f8ada769d757ab27c20e1707394b59bd614374ffc1e1d23c207509", + "stale": false, + "unfinished": false + }, + { + "bytes": 251298, + "path": "/home/mc/ousast-results/plane/engine-trace/9b635efb9c550d3859eb27d863460a64af057a765e024d86ead7352c09a45ad8.json", + "sha256": "8187a14691b7d960fb4921935cd8c73957dcc019c643216687e7b94a81ec8eaf", + "stale": false, + "unfinished": false + }, + { + "bytes": 20955, + "path": "/home/mc/ousast-results/plane/engine-trace/9b949b5281f3bf38d523921e9bc95e3ab43fd2f09a61e7901ca292eed24c05a5.json", + "sha256": "c55c6b29d4eb67e84e20f401c8028a0d313b5b5651add3a857a4e317e9b04e91", + "stale": false, + "unfinished": false + }, + { + "bytes": 1351, + "path": "/home/mc/ousast-results/plane/engine-trace/9bd5d14cfcbdf2af4ab607c4b8db27e6f5e55573a4867ad760036db7cb4629f8.json", + "sha256": "5574dbd4962a465ced18e4571fa9f754200c1fbd8b64bcbd92adb79d94f18ee5", + "stale": false, + "unfinished": false + }, + { + "bytes": 15413, + "path": "/home/mc/ousast-results/plane/engine-trace/9bf92e697ee052ac9ef1509c5bd04ab259c9ffdfe49b3b54439259bcc173d4eb.json", + "sha256": "e6b607b72d268bf27a8d460ce1ffbbedd86903cb10c7cc488e9307bc7c71f2c9", + "stale": false, + "unfinished": false + }, + { + "bytes": 4428, + "path": "/home/mc/ousast-results/plane/engine-trace/9c1e26602ec6f254f8e9e8b4334dc10728db3688f035e420ac8741c281d8abe3.json", + "sha256": "49a83fdeb99c3852d9321a5a70471938e30c71b3f0189b11f74d7dabed4d93ff", + "stale": false, + "unfinished": false + }, + { + "bytes": 59594, + "path": "/home/mc/ousast-results/plane/engine-trace/9c8912d4146362b6676520fdb7916673244d110ba96dc41bfe19de02545e197c.json", + "sha256": "a3c4694b282187aa389e4e39d593f0033525ce5703927637651c10922288ea25", + "stale": false, + "unfinished": false + }, + { + "bytes": 1301, + "path": "/home/mc/ousast-results/plane/engine-trace/9c90a99faf131f5a20838f0e2d2991489d214dcd1f37cdbd4e5d98d07bde5e4a.json", + "sha256": "cbc00e91febb86154944c919202856b43bcbd7486ac85e1b82da97bd7441e8d0", + "stale": false, + "unfinished": false + }, + { + "bytes": 1285, + "path": "/home/mc/ousast-results/plane/engine-trace/9d0bbb1671f6ab60c8a6af2b93375259a4c77f6bee9ba8bbb8d54e00f5fd3035.json", + "sha256": "2bdfe7f72361cbac6f07e7c1b1c0529551eb84a7940c0d36457732ae0c41c932", + "stale": false, + "unfinished": false + }, + { + "bytes": 13522, + "path": "/home/mc/ousast-results/plane/engine-trace/9d1634164980e68dead2c9f367ae14408026b476695d08ccf56e67b911aa003b.json", + "sha256": "6dde064f6f5c6fe69b4b67a31bd2c708d806c73e069b2c54113fd5efccd09393", + "stale": false, + "unfinished": false + }, + { + "bytes": 123807, + "path": "/home/mc/ousast-results/plane/engine-trace/9db96c37f6464f3e89baabd2c8065c68337906d4557780f62614b20d09249670.json", + "sha256": "2a2a6543a9516bdf6dd362f7604166d4d2831beee78cce9e50d2b86553750ab3", + "stale": false, + "unfinished": false + }, + { + "bytes": 38723, + "path": "/home/mc/ousast-results/plane/engine-trace/9ddcc25da7311dd03f14e20a60ff1220ed4765631cda03c8aa6f492d668e4b18.json", + "sha256": "d8088991c5deee98fb39367e44f50c4e0aca74571b2c455fddbd873f4d965343", + "stale": false, + "unfinished": false + }, + { + "bytes": 25070, + "path": "/home/mc/ousast-results/plane/engine-trace/9ef895955c1eb1f4f3037dcd3b6bcf24d36569ea1d7b51673bdf8c2d644daf0e.json", + "sha256": "110f213843fe1dc6064dc05c9922cf46620799b04ab89c79cb97cb9e1c3e14b2", + "stale": false, + "unfinished": false + }, + { + "bytes": 75337, + "path": "/home/mc/ousast-results/plane/engine-trace/a0831ea65077e207d501d7996030715a608d4822f07100bf5b89241e22c35c5e.json", + "sha256": "57f6c3805257cbfe661c25945feac077ea54ac4013c29298a5313d67c318cef5", + "stale": false, + "unfinished": false + }, + { + "bytes": 74530, + "path": "/home/mc/ousast-results/plane/engine-trace/a1092f82a9b6bb43c93fe654d02bf912fb52f8cc39c2d7864bff94b0e8953288.json", + "sha256": "75de112197c13aa02309d9fa0a0e77c6b5557aa21eecd07ecab95d34db5c1dbc", + "stale": false, + "unfinished": false + }, + { + "bytes": 16886, + "path": "/home/mc/ousast-results/plane/engine-trace/a15380f38bc160fe9d6a59b5792e4f982b1d284b2c68212c2665788c27e286b2.json", + "sha256": "b68bc4cb4c57b2d4be40064d62226b2f9cfcbd53d1ef5720e7793b449da3c56b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1287, + "path": "/home/mc/ousast-results/plane/engine-trace/a154ee55d4e8d038b7d8bd1c15c026da09acd69f48f914a3d8cf69946a1abd5f.json", + "sha256": "f9a25e5fdb3384d3428e6566ded6bdd87661bac99b8f0c2655539d56c7dabc19", + "stale": false, + "unfinished": false + }, + { + "bytes": 16243, + "path": "/home/mc/ousast-results/plane/engine-trace/a351eb4005f25c91611ce092b6417b55cc32b0cff20961bfd62148c3b5f4a2da.json", + "sha256": "ce5989ce4c23feab31f5048fc3d2185c120fb2481f13b8b453e5978c16eaacbf", + "stale": false, + "unfinished": false + }, + { + "bytes": 10404, + "path": "/home/mc/ousast-results/plane/engine-trace/a43ebe3b24d777f004919ce1e1ba327a0c31473f86f00d3f5d2de3d1de2f5507.json", + "sha256": "d08c5581b71affdcd94a71904f9c6fd4f1cfa43cf02b2d5eed36997f151efcfa", + "stale": false, + "unfinished": false + }, + { + "bytes": 43790, + "path": "/home/mc/ousast-results/plane/engine-trace/a44ec08d7c92b46a58ba91451a393dbc3630110fdec8af63e31eef29e889b8cd.json", + "sha256": "fabda814d44351e0bd35a01367a5ebc6cdb825b990b3b7652c18ce5de661536c", + "stale": false, + "unfinished": false + }, + { + "bytes": 37636, + "path": "/home/mc/ousast-results/plane/engine-trace/a50067cc16b302c9c760316e8144aad6a0f0354d9ffd294d95bcbc5f008a25f2.json", + "sha256": "00cf817cbf6ac76626fa6eb5d230e922c814db66849b2fb25c67fb0b12b8a9da", + "stale": false, + "unfinished": false + }, + { + "bytes": 10987, + "path": "/home/mc/ousast-results/plane/engine-trace/a50cd93c0d3a668b60e3f1f9c5b757a548aa25693fbdc9a3fdab81e997b0677d.json", + "sha256": "4441e129dccfdf0af192e05b8b159d5b7eea78568c9d604f792b992862736506", + "stale": false, + "unfinished": false + }, + { + "bytes": 1299, + "path": "/home/mc/ousast-results/plane/engine-trace/a5564a1593961b98222539de5eaa56fd06515c4c323822fa46319e7355e15989.json", + "sha256": "17224eda290b6ad8060cf77a576f5b8d5e37afffe8a2a27809732b1eb29581ee", + "stale": false, + "unfinished": false + }, + { + "bytes": 1301, + "path": "/home/mc/ousast-results/plane/engine-trace/a6218db04acf5cca0ad68669f91edec46e578ef2034a26169416cbc9820f36eb.json", + "sha256": "c84eb659c77c8bb2a84ff48cd2d1a89314cc56e79f94a742b146c1fd1895843f", + "stale": false, + "unfinished": false + }, + { + "bytes": 16523, + "path": "/home/mc/ousast-results/plane/engine-trace/a6c020275a4695c8e83b706ba3b61ba402fc4eec808ac286c8b864214490303d.json", + "sha256": "59d5314b270f82f64532f74a4440231e578c4c889c206ed4f6ef38f67f4b8932", + "stale": false, + "unfinished": false + }, + { + "bytes": 298614, + "path": "/home/mc/ousast-results/plane/engine-trace/a763849111ce43422c6830742c5567453ae3a8ca37eff6e37f7ef9dd84b6a0d1.json", + "sha256": "6795c5f56de4e64e793e740ebffade250a0016ed97ba9040216bdb037bf67b0b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1285, + "path": "/home/mc/ousast-results/plane/engine-trace/a8e912ca050b8673d57064e5a8cf0e09085ba03ea3a9deae5bf2fdf71d723f47.json", + "sha256": "e9239d7e49c434218a92b58c7b9a24458ec16768c4f39994cb3829e0835e565c", + "stale": false, + "unfinished": false + }, + { + "bytes": 1314, + "path": "/home/mc/ousast-results/plane/engine-trace/a9315ece9c42ea421ec67672b3fb07267ba36ab645d26b849a88d18c373e729a.json", + "sha256": "08a839b87cf3c4fc381f1c9d5ae3eeac35b3ac59bc9d9d878952528b1bd7c2f7", + "stale": false, + "unfinished": false + }, + { + "bytes": 9111, + "path": "/home/mc/ousast-results/plane/engine-trace/a95e8bb60ab948a56d4b4b96d49a3e8ed1c7f9ef26eb5e36cdf8439f0be9f331.json", + "sha256": "1812e0dc30c5e9756eb52ccbb90b153bddc26a0295726647a507d3e7a7a07aaa", + "stale": false, + "unfinished": false + }, + { + "bytes": 31292, + "path": "/home/mc/ousast-results/plane/engine-trace/aa6dac1743934d9c6c89a5de0f4bf82de748671699aea9aea4e1f831509026c6.json", + "sha256": "4065aeb6d7a3a81f5b6af6b4d81e784e2f9f29c3347f7bfecc5342bd244b3bd6", + "stale": false, + "unfinished": false + }, + { + "bytes": 34899, + "path": "/home/mc/ousast-results/plane/engine-trace/ab135bd22c23256188e4a3aeba8978902f66cc49b1aa825c8f9f869943029d83.json", + "sha256": "50f5e286d8d50988df90945cae60d6c730aa5da0ba98ad1fbe120f3a152d1453", + "stale": false, + "unfinished": false + }, + { + "bytes": 1325, + "path": "/home/mc/ousast-results/plane/engine-trace/ab4a46b69b43fea0732514a1ef2777bf796756bbe963877d8621de89b9dde10a.json", + "sha256": "aa7e25190bbc7020f2aa93b0e600be7fecaa742756ed3bf92893fbbc3340b89f", + "stale": false, + "unfinished": false + }, + { + "bytes": 43797, + "path": "/home/mc/ousast-results/plane/engine-trace/ab7d2b66decb692f903a2ac9689c18b9aa64795c7fecfdc1e277a3a97ab2b9f0.json", + "sha256": "c1fce2a64728d9300d9ea79d400d6a0f5308daf5439cd6d4d6858c6cd956dd9d", + "stale": false, + "unfinished": false + }, + { + "bytes": 215702, + "path": "/home/mc/ousast-results/plane/engine-trace/ab85d06ece86c1f765e8c0d9d4ad8c43e77623d2a7d71a6cca147e9bbc0fcdcc.json", + "sha256": "a8875512f6cea1fca590b5b33b04948cb63421c3c041a61e1de9fcc9317828f4", + "stale": false, + "unfinished": false + }, + { + "bytes": 1306, + "path": "/home/mc/ousast-results/plane/engine-trace/ad1233729d879bb9f0cb4a6c104a8316b11881baa5a36dd76728e774bc94a5a3.json", + "sha256": "b2c7a0f5af60438ee925abd6e65fab338cc0e01479da4adcb6fbe18f29a280ac", + "stale": false, + "unfinished": false + }, + { + "bytes": 16692, + "path": "/home/mc/ousast-results/plane/engine-trace/ad2190850ab7ceb317ea85f51fcebfbb39c263cfe569935c9ce56541c8751c7d.json", + "sha256": "9785baab75836f3b041d0c12848f752e3ce5df31650e9d67dc2d3b6638e15557", + "stale": false, + "unfinished": false + }, + { + "bytes": 23474, + "path": "/home/mc/ousast-results/plane/engine-trace/ad2997d921f3803830e58164fa734fa9ccfeb1d45fc2d2d5cfead2f5b9bdb952.json", + "sha256": "ee2def3a1fe90f76979c1e9c6d5e7a1fbd326ec166eb3e6ae5112e0f2133a606", + "stale": false, + "unfinished": false + }, + { + "bytes": 9065, + "path": "/home/mc/ousast-results/plane/engine-trace/ad4735a82d772e89be9a78f7acbecc321d2a388818f5db761c156156debc7107.json", + "sha256": "35129dc72265edf8c7655163f2ef74e670d84a8ee026183583e4b0b1229dabae", + "stale": false, + "unfinished": false + }, + { + "bytes": 1276, + "path": "/home/mc/ousast-results/plane/engine-trace/ad6a5d88ef51acbbec356855f49ecfcda78eacedf1085f50438e6ffc7064d7e0.json", + "sha256": "57054eb37410f6d1643e43abf1575cc7129186c66ce3402ec7c165429001a19e", + "stale": false, + "unfinished": false + }, + { + "bytes": 14173, + "path": "/home/mc/ousast-results/plane/engine-trace/ad6f0d1eab2ac57466b2f67e4b74db06dd1fef0330ff1b5adeb8079c06c0191d.json", + "sha256": "3ff751baf5a0bc41b0d0cb58a2b6d98c5c83356936166224d9d2e01c519b167a", + "stale": false, + "unfinished": false + }, + { + "bytes": 15412, + "path": "/home/mc/ousast-results/plane/engine-trace/adbf8faa67cddadf59d32804ab1f4caf37cc329bf52526a4fde614e2922ac7e4.json", + "sha256": "11fc344b249df3a9138726a369d5bdf1ff8b3b10ea8dfee1494517a99f3da1eb", + "stale": false, + "unfinished": false + }, + { + "bytes": 66991, + "path": "/home/mc/ousast-results/plane/engine-trace/ae6412a970ec2a78e3c05ca2f04ad9119e230f704d733c3b32eb1f0fb29692f3.json", + "sha256": "806cae7a8c7a739dbe36119e36c1195d1d9dfb9e5e04496cd8a737652f6e9dbe", + "stale": false, + "unfinished": false + }, + { + "bytes": 24501, + "path": "/home/mc/ousast-results/plane/engine-trace/ae8ae8fd76a7e44ce668ed791d7dc5e097468b1ace56092c5dee64595d14f158.json", + "sha256": "23474c85be88922b46210f01422dabb08ea591a0f477e1318a8e4777e21e32b7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/aeba71f6f1d68b0023cf1af86ce3fa46061731561ac35aa06b04db6e13b7bc63.json", + "sha256": "1a3f130f4890cb6165099eef4545ec9690216ba8a621602db424fc533f4184f2", + "stale": false, + "unfinished": false + }, + { + "bytes": 1322, + "path": "/home/mc/ousast-results/plane/engine-trace/af00e7623ae65ae60d1ccff7725ba194d032834afc69aec0c663233798f91010.json", + "sha256": "16692f9d49aa0ce4e916e6ed11f7bef9540ba3a49de070db295f1b673f19458e", + "stale": false, + "unfinished": false + }, + { + "bytes": 1307, + "path": "/home/mc/ousast-results/plane/engine-trace/af7a3713dcb53892c7e329fce87af0c9e07f2d4b97bbe85748d1c7345f72c90f.json", + "sha256": "0c6aa1a330a42d4c8f37474a5576bad218a60f4bfa29ef951be76559eafc5f22", + "stale": false, + "unfinished": false + }, + { + "bytes": 18418, + "path": "/home/mc/ousast-results/plane/engine-trace/b0881494676b424c62addde2ec55412f9fc2665d1d70c98d04b7d7ee60e9c4d9.json", + "sha256": "6db5e58073be0055482d0094ec1130410115c3682400d9c2d24e75eb93f176be", + "stale": false, + "unfinished": false + }, + { + "bytes": 1356, + "path": "/home/mc/ousast-results/plane/engine-trace/b1265757bd9e685a5de1ba5dbce0114ee0253524977eec223ef2f3b721163021.json", + "sha256": "f1d0bdacef50f0a852ef1cb0f352d685cb4bbb1dadc61485c41a295a1b8b8e48", + "stale": false, + "unfinished": false + }, + { + "bytes": 1311, + "path": "/home/mc/ousast-results/plane/engine-trace/b151af4c505493d909e10db30a3ffa2e2a26a23f9f347af073b5670f9a242ed2.json", + "sha256": "8711a2f6ebccc32f3f49b7b9d341f27ddde3a8d7700f9185be9cdd95a9ae3684", + "stale": false, + "unfinished": false + }, + { + "bytes": 69429, + "path": "/home/mc/ousast-results/plane/engine-trace/b19267cc8e6b9d71a0a0552e86fb51ab56a76a0604c1ca4cca969ed7e33658bf.json", + "sha256": "f1b44d4385182447a2b6086b9a875c28ed9c275ecadc2048326aa892e447e13b", + "stale": false, + "unfinished": false + }, + { + "bytes": 20063, + "path": "/home/mc/ousast-results/plane/engine-trace/b1fe7b5c2c7667c6152902beb456cf63d071866a111322d2d7c271b73cf55f4f.json", + "sha256": "9dad9c811e122feb850c423d612239c5b919a9232830ca4016c0675355b955e5", + "stale": false, + "unfinished": false + }, + { + "bytes": 289029, + "path": "/home/mc/ousast-results/plane/engine-trace/b43a2400f0c6f57884a798d585251ae41731a289e4890f454ccfdd16c01fee2e.json", + "sha256": "d0b55bfb8fe5921c79bf19d00b8f9328e80769ac67ab64a6a5465c3f0ebdb5e2", + "stale": false, + "unfinished": false + }, + { + "bytes": 66901, + "path": "/home/mc/ousast-results/plane/engine-trace/b4be7b3c17aeae703bb48022e6fee4fdb40eb298d2f5ca43d4c9b55798601fc3.json", + "sha256": "e7b69cca6076c868f8fb7b217ddac4a8817fd0761251cce6584e660bd7269e29", + "stale": false, + "unfinished": false + }, + { + "bytes": 12923, + "path": "/home/mc/ousast-results/plane/engine-trace/b5a843db4e699150da8c2cde24e2bab97baef84b18e0b412785ffe448ed81c71.json", + "sha256": "8ee8e746820f873b03e4f77a1cfbd2bbb1a4062c1bfa89516dcea4438c6bfbdb", + "stale": false, + "unfinished": false + }, + { + "bytes": 25046, + "path": "/home/mc/ousast-results/plane/engine-trace/b65fb3c5947916b99b23325c2e2c34b02fcefa794654fc6e73debb254301e7c7.json", + "sha256": "ba4a1079877a926457fdab01c7f956779662b8671fca7efad3efc24c8488f974", + "stale": false, + "unfinished": false + }, + { + "bytes": 1380, + "path": "/home/mc/ousast-results/plane/engine-trace/b675edceae02375f2f034c275d0a25f71f727dfc06eb315364d7666248e85b17.json", + "sha256": "f33b8fbb872557cafe6964a1eda61b87981f08cd70c33f979cbb34d90e0f3367", + "stale": false, + "unfinished": false + }, + { + "bytes": 1247, + "path": "/home/mc/ousast-results/plane/engine-trace/b784d783c2d0838be28a473d8d8789b53bb064345e88b312d80bb02b6a4f6ef4.json", + "sha256": "8ef34f7cd129ac41afeb75e9445a98e0a434e5d8b13594641d6bfae59d87cc36", + "stale": false, + "unfinished": false + }, + { + "bytes": 16251, + "path": "/home/mc/ousast-results/plane/engine-trace/b903976bc3062d90f41a87d92166f2b92b84db91b9596eb5e51b789d6f1764bb.json", + "sha256": "b6ad74051c1b43b850feb91150f8f758b0c9bbdd47efac8bd8efaad5baa533c3", + "stale": false, + "unfinished": false + }, + { + "bytes": 9939, + "path": "/home/mc/ousast-results/plane/engine-trace/b94d0324623cb14c68a89cbcbdab17833d6cc46d7a45d4f2e90c90982497dc6c.json", + "sha256": "01349649a5de3e6c1bb6cb475e93a178f706d0a0aaa4ffa69e383bf4987f461d", + "stale": false, + "unfinished": false + }, + { + "bytes": 295289, + "path": "/home/mc/ousast-results/plane/engine-trace/bad4d89b89c33a02470d3624a91b63e6f2b4b780b9b95aae51720560337aa55b.json", + "sha256": "fcf7ab3a0f62619f084276ffb0a30e98963193ba924a764280cb8e12cfd013d8", + "stale": false, + "unfinished": false + }, + { + "bytes": 9150, + "path": "/home/mc/ousast-results/plane/engine-trace/bb4a787d2f35e8b6b689bbf9b29e50aae4e0a194e3b37ee2d9de3d998e685571.json", + "sha256": "afe27d03f8aafc3e2378b99454a40b53b5655a7adba0fe08963f9b4b12271d42", + "stale": false, + "unfinished": false + }, + { + "bytes": 9213, + "path": "/home/mc/ousast-results/plane/engine-trace/bb8195ecb679672f41d551733b86343348bf79cbe15ec7f23ecfc776339c9dac.json", + "sha256": "c4c300f41ac602501454fb35b60a9159dd0c0662ecb40b4d8e1629f514879023", + "stale": false, + "unfinished": false + }, + { + "bytes": 29653, + "path": "/home/mc/ousast-results/plane/engine-trace/bb8ae01a60936182776e01505227a9e582d065f2eda0abcc7661ec1651e2e353.json", + "sha256": "00188f048b2fe075bddcddb19127247b2546520123791b8895ab422544e61ec8", + "stale": false, + "unfinished": false + }, + { + "bytes": 1282, + "path": "/home/mc/ousast-results/plane/engine-trace/bca90480112299873035a6e030c232b7c0c394bf1b812e179e05373d4d9d8b10.json", + "sha256": "79f69276e16e3dbd5a7ff49420b5b0b1db5f7dd8c6fc8a566f08b07c3ced69e2", + "stale": false, + "unfinished": false + }, + { + "bytes": 25269, + "path": "/home/mc/ousast-results/plane/engine-trace/bd2ede1e96e7161915ea3453f55c148e38f9908013b0e7b2c8537fcb8aec915d.json", + "sha256": "cb232a95dc0f143d3a3480f85f0750ae51f8d94060efc4f9530e18e4ced0c91b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1272, + "path": "/home/mc/ousast-results/plane/engine-trace/bda278648a81cbd4b2afdc1d2ef24cd2f1f616763858ae224dab574eb20cfb46.json", + "sha256": "0c288d41e576b54889a4cb2723f7602eaa7a8108f27a6957f55991b2ac62383f", + "stale": false, + "unfinished": false + }, + { + "bytes": 11306, + "path": "/home/mc/ousast-results/plane/engine-trace/be0413ba92ce96972423e84a015aeda71ebc8a057cff91918434b47d078915c8.json", + "sha256": "87fca3934a0d9ba15968e43647070ca7bc3167309bd1ef06cfe98dde9663fcc1", + "stale": false, + "unfinished": false + }, + { + "bytes": 1348, + "path": "/home/mc/ousast-results/plane/engine-trace/be2947b7846c78d1a075040a0b2917713b3a6d6e7d95005272b5a2c0a6d521c3.json", + "sha256": "67f4adf17ffec54f3e919c7e0ed930ad69e9903dfc4eee92ee9efc94644f63b3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1257, + "path": "/home/mc/ousast-results/plane/engine-trace/beecb900fa8827bbb6bd785a48c8a4f700880b0410fac8f3ab68321540026d1f.json", + "sha256": "49b15ac3d6835403512d0d075d1c65dc0386ebc28991519c115d50680d52138f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1280, + "path": "/home/mc/ousast-results/plane/engine-trace/bf1f8efc7d7de3858882a77ff52dde942792f3e641a55466d01a551c15828c01.json", + "sha256": "a1dbf130c8d1cfc5a1efa96eabb42cbd36d227dcd4069b362050d487c4db067f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1272, + "path": "/home/mc/ousast-results/plane/engine-trace/bffc1c09d340c4bce953b4892b8c70813cb0ac075103361e7d06727f4b7528ea.json", + "sha256": "1d267836c75892c117bf4af7e0eba6928cfdb93745109a880aa5d529694c6bae", + "stale": false, + "unfinished": false + }, + { + "bytes": 38290, + "path": "/home/mc/ousast-results/plane/engine-trace/c0949c9c49f2454aed693242efc3de3d05b6db04ecbf844dfc70cfbbbed10820.json", + "sha256": "238a01d74900c46d55294758984a5ba014fe0e5492e0e4956e7d99dcc40db184", + "stale": false, + "unfinished": false + }, + { + "bytes": 1291, + "path": "/home/mc/ousast-results/plane/engine-trace/c0d117a371ec452960421d82cde4858677a4cd612fa8804c6bf4aaa77aced50b.json", + "sha256": "36745059ff905afe4faada2bf5f32be699f5da57af929540ae44c035c2db118c", + "stale": false, + "unfinished": false + }, + { + "bytes": 1302, + "path": "/home/mc/ousast-results/plane/engine-trace/c115fdf60d256730db47ea39162d5b0f50efd0b7acde92c38289f1e3a0a9b822.json", + "sha256": "72b0e6afe764c1472d38e0440b07f25e2aa521ffbf61a498ad48cc5244f936fc", + "stale": false, + "unfinished": false + }, + { + "bytes": 24798, + "path": "/home/mc/ousast-results/plane/engine-trace/c142b93b15749d1fea868f6d2bff84698e48ab54df98e37864714af2d3736a9f.json", + "sha256": "e775f260ea9a3fd56e94f5ec5b3a5f2be4ebb7f652961b2c80416a3b903ad04a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1276, + "path": "/home/mc/ousast-results/plane/engine-trace/c28cf74d632cf231b53d8c94a900b83483119d9584439401769184861e1608c8.json", + "sha256": "6697c93500e217702bc39b6c9a14a9c667d1a1c025237f34aa0e1f984544e8fb", + "stale": false, + "unfinished": false + }, + { + "bytes": 28170, + "path": "/home/mc/ousast-results/plane/engine-trace/c2a438fef130735ce2fc8397527bbf102315f51d0a4577c2276775a6a2cdf005.json", + "sha256": "1db4be7c8a2d5903ba8e53ba295607c0370556fa6d17453cbf7931696a21f212", + "stale": false, + "unfinished": false + }, + { + "bytes": 12553, + "path": "/home/mc/ousast-results/plane/engine-trace/c2f5ff6aec59c20198ef2e58bf45d5f05f049ecfe7a9ba6c66d549134e326d88.json", + "sha256": "3359b5cccbf6a9fd60d04f7cdb73023e548c1f947af669cf450dc5559c8fe967", + "stale": false, + "unfinished": false + }, + { + "bytes": 845946, + "path": "/home/mc/ousast-results/plane/engine-trace/c3333aa2993f84e7344a213966e5660a335abf433a693091a4c0b664efa9ed99.json", + "sha256": "bae086a3f73b388e53bdad97d6ba828d54f3b87ccd72a0326171d8840cb300cd", + "stale": false, + "unfinished": false + }, + { + "bytes": 27799, + "path": "/home/mc/ousast-results/plane/engine-trace/c3e2f10a2d3fed5ed2b360504fddeb74b132c0510d8c8acbd7aaeb24c2dc9561.json", + "sha256": "765ce093dd229dd2c6beadcb5828de30763b01b8e5b8386e5e23f83740556761", + "stale": false, + "unfinished": false + }, + { + "bytes": 43533, + "path": "/home/mc/ousast-results/plane/engine-trace/c4587db29765cc29295ffca0edbb179a743f71aa4794d4091b78ea9d42deb212.json", + "sha256": "8ac2ee0e9523838ae48adb11de0ab788b5e03b5d5b4deb5256593d9cba6bd912", + "stale": false, + "unfinished": false + }, + { + "bytes": 241047, + "path": "/home/mc/ousast-results/plane/engine-trace/c476f7a7c373953bddf158fa7ae7ba60bae9102455e60a03c656cc62d3aca1c2.json", + "sha256": "cee87a881ff20dcb2a1f2c9b28bf3b22f53b405d115e1dd1ac156c2b438b9e22", + "stale": false, + "unfinished": false + }, + { + "bytes": 852467, + "path": "/home/mc/ousast-results/plane/engine-trace/c4ed9b1af597019d594e36df57f6cda7e62c4136ee24fc5c7cd130e94db936ef.json", + "sha256": "53dad7c9b15aae1e3fc44696634e4eee6e3f64072e731bd3800b10b26ac5bdb8", + "stale": false, + "unfinished": false + }, + { + "bytes": 9844, + "path": "/home/mc/ousast-results/plane/engine-trace/c5e22722667e2d687d1ca9a150a177b2b7aead3eb27cc0a8ca3b9139e93c1ff5.json", + "sha256": "38a718369c17f661cc4699c7c5992295d41f1686b0ef40e801b10c1949732907", + "stale": false, + "unfinished": false + }, + { + "bytes": 43048, + "path": "/home/mc/ousast-results/plane/engine-trace/c81609b0c201427baf0426a86815dee2465ea360f856d8cfa08e61c81b184e44.json", + "sha256": "aa048e215b70409053a84eea36b03e58a71342072f47c99c385b3762fc04228a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1259, + "path": "/home/mc/ousast-results/plane/engine-trace/c8eab0c2857cb1ec876389e0b4f6d12b5e11ea9d33185f36f359b809b89c13cb.json", + "sha256": "777f7e273928c1bbcbc511e801444a8ef1bdd21231324e82a7718c0d954d65ef", + "stale": false, + "unfinished": false + }, + { + "bytes": 23626, + "path": "/home/mc/ousast-results/plane/engine-trace/c9f1dd584faecea6d793a3ace0ce35343c2b185223f70cf77db25be9230d95ba.json", + "sha256": "02e669a5e118d99c18633a701f384fab64a894a37408c2a668581e93ceb3f821", + "stale": false, + "unfinished": false + }, + { + "bytes": 9186, + "path": "/home/mc/ousast-results/plane/engine-trace/cac29f0d99140b5d96e7118eacc1da839f6342dd15b13312507e4116e38f30ce.json", + "sha256": "605dc69160d52e27209ad929a60f9c8d8a24c76783ce596d8813090330b1ae99", + "stale": false, + "unfinished": false + }, + { + "bytes": 1318008, + "path": "/home/mc/ousast-results/plane/engine-trace/caffe69bda4edeba5839e4b283434a868f3bfd26720961b830a1891dbdde47f0.json", + "sha256": "bef012858ebbfc8186d9697a20343043a1c59d84d03a2dd3e9f9e44619a5ff15", + "stale": false, + "unfinished": false + }, + { + "bytes": 1279, + "path": "/home/mc/ousast-results/plane/engine-trace/cb2db8ce47d8fd174357ab136106be1dad6e82a543095427c83fcb5dee5298d4.json", + "sha256": "b5f5a67b19d98a7f1ab2ceddbfaa2dff56f16690ea5efc69cca25aa9ef540a3d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1318016, + "path": "/home/mc/ousast-results/plane/engine-trace/cbffab8a6b1067e29e4d0488e67fef485d10736a008a4c6e0e34b6fff991f7a1.json", + "sha256": "31f0e840cf09792b18bac3c2ac154d4838b3a2609576fae2e4229a5e68a9f145", + "stale": false, + "unfinished": false + }, + { + "bytes": 1318, + "path": "/home/mc/ousast-results/plane/engine-trace/cc0b9dd4e3cc95ab9fd203f14cb267b205a56fa104fd5a19c2921878d94a7bfe.json", + "sha256": "d2d27e8d921d9a560a5d192183b64cdf7d59932732a58540aece46e1cee816b9", + "stale": false, + "unfinished": false + }, + { + "bytes": 53480, + "path": "/home/mc/ousast-results/plane/engine-trace/ce3f97250965b1de306ba62f8787b02ce894332089d2c01c9add1d930ac949c2.json", + "sha256": "54c85f7eb7b2cfa95ab78ea7b9857672b3f339f27d692f91d345cb7db49f7cd9", + "stale": false, + "unfinished": false + }, + { + "bytes": 9837, + "path": "/home/mc/ousast-results/plane/engine-trace/ced92f1bdbe9a64e0b777b4a8c8129da36c26f51e8c67bb8b8274d043e0d9a39.json", + "sha256": "7f73dab67f7faf0683d8b8c5877c3d9ec5c8884ca1b54306ec4bc0825368c630", + "stale": false, + "unfinished": false + }, + { + "bytes": 1318, + "path": "/home/mc/ousast-results/plane/engine-trace/d00ba9eda8a6f90e732233bdbc4c44f97dd547a3e8844264623232a8407b16c2.json", + "sha256": "fedfcfc484282f3bf68b9822ea7a961768deafcffc41af85482a0050090bf320", + "stale": false, + "unfinished": false + }, + { + "bytes": 33350, + "path": "/home/mc/ousast-results/plane/engine-trace/d0c8218609801f4296b608981f04343abb597a691d2a00a1b11cbfe6a51dda72.json", + "sha256": "d6d725abd16514b116ad4892aa7fd46ac8e6a0e4d1d88a05c3825fa4a84000f8", + "stale": false, + "unfinished": false + }, + { + "bytes": 24834, + "path": "/home/mc/ousast-results/plane/engine-trace/d331d2b5b6b4dcc0b3b539fef7e55a07fe3ef0d1b8489031d756e7d7d492cffe.json", + "sha256": "5b8acca36f4fe23a3b00d0bb77f41b402fa1d0d8da04e4dfb06ad760a90329b0", + "stale": false, + "unfinished": false + }, + { + "bytes": 27854, + "path": "/home/mc/ousast-results/plane/engine-trace/d341d586c44cc1605e70f2be31b938a5c50e8b465823df5ad94c022400eb0de2.json", + "sha256": "f932b0c7947413540fdae8dc82ce04999f38dde7b26e6c022a446efb9b012ccc", + "stale": false, + "unfinished": false + }, + { + "bytes": 16630, + "path": "/home/mc/ousast-results/plane/engine-trace/d37e4cd352fb73052c11b659b5bd51d455ea6314176b1146eb520a92077e67eb.json", + "sha256": "a881eb5a6d72b0e282c2cdbb0b2d691b0c77ff03c419ee0dcf1e109618a1fdaa", + "stale": false, + "unfinished": false + }, + { + "bytes": 1275, + "path": "/home/mc/ousast-results/plane/engine-trace/d3c91fe6391f96ba987c7a8ea58b9d8c46f642642fd4e59e43991cf8562a302f.json", + "sha256": "add99e24f8db8a9ed27cb3e0d5cc7c8ad383ffd3ed85f68eaa7cdafa8899bbdc", + "stale": false, + "unfinished": false + }, + { + "bytes": 1282, + "path": "/home/mc/ousast-results/plane/engine-trace/d40df8298f229dd60833491580418c70c809b8c15c4d85cc56fd29e884991edd.json", + "sha256": "f6048922644964a2821e4d717b67e98acfc5c5ff19a8e886a7259559fa52b3f0", + "stale": false, + "unfinished": false + }, + { + "bytes": 452697, + "path": "/home/mc/ousast-results/plane/engine-trace/d4370070128774fd2f32b6800d5491c18b0e5b3ef31d760b4a1daedf1b344c4b.json", + "sha256": "c672a968a8555f0b0841ecfc211b48275904a4ca00f27b1a2b74660e50a94dcb", + "stale": false, + "unfinished": false + }, + { + "bytes": 42158, + "path": "/home/mc/ousast-results/plane/engine-trace/d47da6d35fc9c9ff129fbebc62507faa26ab7b77f499f955da5797b0fbceeb5e.json", + "sha256": "b3b0937c00394f5b9c1d4ccdcffb4ca1ae47bac570cc87c597e2bc1a2ad5d9b8", + "stale": false, + "unfinished": false + }, + { + "bytes": 1302, + "path": "/home/mc/ousast-results/plane/engine-trace/d4883722f407b9b687fb175cb5a8944ef3e07cf62bf71f71a6c530650cdca7bb.json", + "sha256": "d22550af58e2ed1e6e14fdbe5c060f95b83c80f9049d412466e29dc3fb7dbda1", + "stale": false, + "unfinished": false + }, + { + "bytes": 1296, + "path": "/home/mc/ousast-results/plane/engine-trace/d4e81dbc8555de40bb1c63944a5827bc9571479f7581a05b9c12482e63072c94.json", + "sha256": "386094bf376f15a3ce1017e82810dd0c8dcdc5914424a88cf701db5dc03c16db", + "stale": false, + "unfinished": false + }, + { + "bytes": 38146, + "path": "/home/mc/ousast-results/plane/engine-trace/d5951f39d4d20e23859c6aad27b3e465d0bc9aae5f1f020842193ca8e3dd3e49.json", + "sha256": "c83c74728681e644a7348f7754c12698385b268c93b8ad2c51f628f697abced7", + "stale": false, + "unfinished": false + }, + { + "bytes": 1287, + "path": "/home/mc/ousast-results/plane/engine-trace/d5f04dd854a46bb8e3e36712144826f6d0d066c8b5ee4a0695feaba21b95eb16.json", + "sha256": "a2982de0d8c87300bbe05bb06e78a0b57d7fe7b4a4436cbc8fc8267f080f0174", + "stale": false, + "unfinished": false + }, + { + "bytes": 1379, + "path": "/home/mc/ousast-results/plane/engine-trace/d6361f7bca17d1c2a543e1875601bde805462daf449a5aef8c974fc93a8c9926.json", + "sha256": "b64c4a6d094e0387ca509e1470fcec44a37b4191d6bc3f360491fa142337bbf1", + "stale": false, + "unfinished": false + }, + { + "bytes": 29648, + "path": "/home/mc/ousast-results/plane/engine-trace/d7ecdf1cb20440e7f22fb17e1c623810564e646a7786c07eba3e6939e7ba3ce6.json", + "sha256": "4c68f5f0f8ab47f7b7caec9fd72ee70d5d7e071759cc37f13c8054fa56549808", + "stale": false, + "unfinished": false + }, + { + "bytes": 235171, + "path": "/home/mc/ousast-results/plane/engine-trace/d8085fe38b77c7be09ead2d8bfe9a0e832455abc0c0ba9133921788f6d655cc5.json", + "sha256": "536752006ab8982884398ffae12d3ed98aa1f8cc0fc3e45d7e912ea577c4a5a4", + "stale": false, + "unfinished": false + }, + { + "bytes": 9051, + "path": "/home/mc/ousast-results/plane/engine-trace/d81a2fce512cf5af69688a36e706185d9cbb75ace12ca7839c329fb000a8e558.json", + "sha256": "09c2ecccea93f39d5a2f80a373a9d4e0867cddce7484d5d8b0c0e73141d1a047", + "stale": false, + "unfinished": false + }, + { + "bytes": 13627, + "path": "/home/mc/ousast-results/plane/engine-trace/d83d84d0f9a01b435f844c95b52f367b6e3c4c91af83a1e7d60b4db20d5ac626.json", + "sha256": "414d4560e64522eb59ddf4d17db2a522062c7336ea792b7cbe56674888ffbf37", + "stale": false, + "unfinished": false + }, + { + "bytes": 173144, + "path": "/home/mc/ousast-results/plane/engine-trace/d86fe238d879c7131fab0506be67aad391583fef830518651ef9dd851bcdbbcd.json", + "sha256": "7a940bef8cd13ee6b3ebe6a9c3910a588d1570d034d2283f005c16e14ce19870", + "stale": false, + "unfinished": false + }, + { + "bytes": 13635, + "path": "/home/mc/ousast-results/plane/engine-trace/d8ba1c53d31d40a62297530bfd63f522e2184619ca0d6a41fe0c7c2adf95071e.json", + "sha256": "a05c1518e79d8d9ec21cd5ef1a3fdf95acab3abb439989ca65c0ac84270e96d5", + "stale": false, + "unfinished": false + }, + { + "bytes": 1282, + "path": "/home/mc/ousast-results/plane/engine-trace/d8ee5f27431105a0859ac60e6ccb9110f81eed934c5e3dd5fae1e039af9cc11c.json", + "sha256": "c9be5975250143e1a62e590d7fe004cfb279522daaa05c422c5e9c007d7ec2af", + "stale": false, + "unfinished": false + }, + { + "bytes": 11156, + "path": "/home/mc/ousast-results/plane/engine-trace/d92d1e2eec5f875b357578fe3a5873b2303136b0946bb6139282792dfac3cba5.json", + "sha256": "ff0cd9830628c51fa8c388ec2244a077fca23ad5ef3565473c95ed1b5b6e3c7d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1281, + "path": "/home/mc/ousast-results/plane/engine-trace/dad45bf2f9f1ebc5d992331dfc613da9dd2eef4e61c06380aba2062fffc85743.json", + "sha256": "5a336c9b83efad167bbaa74b2a237f0b15fcdabad1ceb4964e458c8764042eaa", + "stale": false, + "unfinished": false + }, + { + "bytes": 83851, + "path": "/home/mc/ousast-results/plane/engine-trace/dc0a615aaef483483a47e0d24cdd8780cc77b91783f3cb710d4ae250a117b301.json", + "sha256": "f110d614e5f10f4ec3415a340af3ab2bd6231bfc5cae9824c6623eeed1e1f855", + "stale": false, + "unfinished": false + }, + { + "bytes": 13928, + "path": "/home/mc/ousast-results/plane/engine-trace/dcaf1622055688df731593edcbda94bd39c4bf2aed1922b401a44291af6fa18e.json", + "sha256": "eb5feaab0a30489b765495e9f9d3f711ddbbf9d431eeb1bc91ab05bc6a8cc45e", + "stale": false, + "unfinished": false + }, + { + "bytes": 1407, + "path": "/home/mc/ousast-results/plane/engine-trace/dce68539338f49a9c9037b4e4186e78648f2693774ff0621bd561c6c525c6c1f.json", + "sha256": "4f43b75d3466f7ddb8a4941cad9708494653e08222ff75f8fe27c67a20961693", + "stale": false, + "unfinished": false + }, + { + "bytes": 9342, + "path": "/home/mc/ousast-results/plane/engine-trace/dd0f22c6eda5393fe886e081c7a2c960bff1d674d067b2392da83fe6a557d7f2.json", + "sha256": "2c34f89d07e9b38cf2a0fe16ae223dc44191c569e9ba9dc28b8b026c4eec2e16", + "stale": false, + "unfinished": false + }, + { + "bytes": 21089, + "path": "/home/mc/ousast-results/plane/engine-trace/dd14b163a0a8cecdff52ad32aa5ed19699319c7981b844a78a76db0997579b11.json", + "sha256": "1f94ecf7ea6bf14537cca926186f66139ed5d7c8e5a2af424d06c3379de08880", + "stale": false, + "unfinished": false + }, + { + "bytes": 1243, + "path": "/home/mc/ousast-results/plane/engine-trace/dda408c60c7e89d1603752fb82262c94770cb4dbc15a90475f67829519ec01e5.json", + "sha256": "31b6459c3ff0ebf8f8f5eeba19e4195b2f6cc218123827ac08ba23a4ac9a689f", + "stale": false, + "unfinished": false + }, + { + "bytes": 898658, + "path": "/home/mc/ousast-results/plane/engine-trace/ddc00c9db1a1897759b1604619a1f52fe5ad846d4c0ceaa69e51666f9e0f32f6.json", + "sha256": "9bc0fafbe5f73dd58c87b942343050ff2ba38e88a854c10515bb072d7a9b71c7", + "stale": false, + "unfinished": false + }, + { + "bytes": 13666, + "path": "/home/mc/ousast-results/plane/engine-trace/de173b668b3208ad8beb4f1332b695da7c50193c3838f516895e1d998b2cecab.json", + "sha256": "931cb6cf5417db981e366cea8a2f2a06fdd2c51b7c6539b840a6b521b36fcb7c", + "stale": false, + "unfinished": false + }, + { + "bytes": 38151, + "path": "/home/mc/ousast-results/plane/engine-trace/deb7fcb931dd291db49cf4f0ab5ae6494a9a7459c5c24a59220e5865b2e673c8.json", + "sha256": "86de99bd43aa61a0f6d69c4ce9661efc37d75a4a0c946206d40e1ab40a4e4d28", + "stale": false, + "unfinished": false + }, + { + "bytes": 20539, + "path": "/home/mc/ousast-results/plane/engine-trace/e030fd6195f689c4345c568ccf4c7cf76375f450456c920502a0ef710aa06b86.json", + "sha256": "d4c49756590f4ce34305ae8d23eadc092af003971c0dfc26af8b150a14b16655", + "stale": false, + "unfinished": false + }, + { + "bytes": 14524, + "path": "/home/mc/ousast-results/plane/engine-trace/e0918cbe023b29deee406a074f3ea7201ec353894f2f57439199050095dea5a2.json", + "sha256": "2640f8cca7124c9dc72923fb6b0d13c64dd792a5c1cf6f1522dccbfc0bf46afd", + "stale": false, + "unfinished": false + }, + { + "bytes": 1290, + "path": "/home/mc/ousast-results/plane/engine-trace/e09f93f406a6b975e4522081a5e9dc13ee4f3dbdf5ab33342703b28b85a0e263.json", + "sha256": "3c4304418aa4083f331ae6ed6ed9fa4cd92fd2e50946c574f62ab7415954b44b", + "stale": false, + "unfinished": false + }, + { + "bytes": 1309, + "path": "/home/mc/ousast-results/plane/engine-trace/e14107927967eba0970dde7effedfc218bec22a8ef6872dfaeda72066a8fede6.json", + "sha256": "5c18bace1f60f3f0fa77c55d76ef197bd1e1d21e7843a964f3d5a63a90a93c8d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1301, + "path": "/home/mc/ousast-results/plane/engine-trace/e16effdd9b32757614ff2beccf0104b2ad554e69f39fc8e54e4032fe9c08b0b4.json", + "sha256": "3bf707aa4f7532e8804d097ecefac1ac6c4843167460fce1902cee2d603e99ad", + "stale": false, + "unfinished": false + }, + { + "bytes": 19353, + "path": "/home/mc/ousast-results/plane/engine-trace/e200fe14bb68e3fefcb486ad8144b77ee9a89b6bd53e8f36bec20241189c8194.json", + "sha256": "efa066b2f6d1d177f5ef41a7929c4fd220d011774a05002e6ccb2e0bd8cce771", + "stale": false, + "unfinished": false + }, + { + "bytes": 27004, + "path": "/home/mc/ousast-results/plane/engine-trace/e226021a8e1b144ada6e71bea86f37097ba9eacfc7b628b2ca4aa2725430a775.json", + "sha256": "619077f985462ffb87d7847a94c41a6a98a95d06161d3d38aa4dd1894870f633", + "stale": false, + "unfinished": false + }, + { + "bytes": 10039, + "path": "/home/mc/ousast-results/plane/engine-trace/e250fbe2685057bcee0e98436356974c2769f07012504b0b7914f5f7df2f2c44.json", + "sha256": "994f6abe3d93f303852e8e78f907ad6acbdc475a3a5f90265b24e507cab875ca", + "stale": false, + "unfinished": false + }, + { + "bytes": 1306, + "path": "/home/mc/ousast-results/plane/engine-trace/e3043450c070f36a35b4ad3fd1a8509231133007cb5537188876d41255d2afac.json", + "sha256": "04ee30312ec02e079f203c95bed34e269fae50f2b4ea230462786d78dfc60cb1", + "stale": false, + "unfinished": false + }, + { + "bytes": 1282, + "path": "/home/mc/ousast-results/plane/engine-trace/e3138c48884af646b8bcaebd351004e7713b5565176969a74085d8f655417a1c.json", + "sha256": "8e2d3e4b03c63b89ce83583e8b1f6c861280974f31ef18e790e18280700809c6", + "stale": false, + "unfinished": false + }, + { + "bytes": 63454, + "path": "/home/mc/ousast-results/plane/engine-trace/e36630c98cb6dc8f101a3656f1a9b0b78a7462280f77309d9fc40db223415ae7.json", + "sha256": "3475b604183668efb4c2645ca2668995297ccf2dc68832f612db7f75e67a0db9", + "stale": false, + "unfinished": false + }, + { + "bytes": 1251, + "path": "/home/mc/ousast-results/plane/engine-trace/e3c162c73250ee6f775c3c07725435155477a90148ed5ebd93ad0ed7ca612178.json", + "sha256": "c7189d8aa2a42941f4a14aab42a6a46a3377baf29279efc25859c6f8ae32187c", + "stale": false, + "unfinished": false + }, + { + "bytes": 164193, + "path": "/home/mc/ousast-results/plane/engine-trace/e3f0c0dbc9a0d9c8d750a150f8f6fcc198997253e17292a9417d21ca3f36b9c7.json", + "sha256": "503b36767abee662b91cbddda0df10acdecfb968668297f6ea0566ec97416036", + "stale": false, + "unfinished": false + }, + { + "bytes": 13074, + "path": "/home/mc/ousast-results/plane/engine-trace/e402d63abd2b459a204581ce4ce4d9a0d2ee4e937f11be13f743bd10315993ed.json", + "sha256": "6f1ac8e70ce28a888a713b98cc1919b2e2f94d4450d6f5bd4d58af8d46efcf0a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1283, + "path": "/home/mc/ousast-results/plane/engine-trace/e4a867e7f3759e4bef4ddb7653656e19e6e44751d6e6f31f8a6d2df6599ee964.json", + "sha256": "2a9d4c2d495ed563e7af929acf0f98718098148c2f7430fdb928cb84e589d17f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1327, + "path": "/home/mc/ousast-results/plane/engine-trace/e830e631505e7e1b06cab8080f4cb5b7e52f776e5f8220a245eb19d3a77ccb74.json", + "sha256": "b0042c8cc77d4d047df24665bd04b3b250cc355ba1789ab72b908d0411aa1604", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/e8a94aa55b82a74064b9da0760d11fe555c90041468e531baa2e923125a74432.json", + "sha256": "1dc6b0821bff174a75021a9fe66f10956b994a7bf987e104a0c933bd8c536a45", + "stale": false, + "unfinished": false + }, + { + "bytes": 215707, + "path": "/home/mc/ousast-results/plane/engine-trace/e9b09011ea06f2fcd7ab41b9b58b78e46ae36778db320d1130ed4de84395a586.json", + "sha256": "35c90449fe7dd4851cf3e021174aef92c89c2ab626be6242b8108a0180593cbd", + "stale": false, + "unfinished": false + }, + { + "bytes": 17395, + "path": "/home/mc/ousast-results/plane/engine-trace/e9b51fe0c79da4b04cde071074dfddf7fe71d5001b07ed2d5b6a0b77d7712d8c.json", + "sha256": "5778a8fb6073cc70dfe86a4f53b2080549c552b4be56f1dc0224f6c4496141ec", + "stale": false, + "unfinished": false + }, + { + "bytes": 2383, + "path": "/home/mc/ousast-results/plane/engine-trace/e9b83f3d9976217f77bc987007389e4dd76013693b842f911eb8a1619bfec0ae.json", + "sha256": "5d7be144361c1a4ff3515c251d46cd7aef2583ecf27db0798e682459ae63fb0a", + "stale": false, + "unfinished": false + }, + { + "bytes": 1021394, + "path": "/home/mc/ousast-results/plane/engine-trace/ea12f20714839e3c8c740e9309f731d8d12731b45c961224fec9604d7e2a2843.json", + "sha256": "011999e01b2b9d7ea1f2c9eb0b5aa9243074997a86eb0dd24a4fc9026ba6c98c", + "stale": false, + "unfinished": false + }, + { + "bytes": 16532, + "path": "/home/mc/ousast-results/plane/engine-trace/eb0e5c4a995e93b8b2701e91e3591897ccfd593f76092dd11521ca35eb58316f.json", + "sha256": "0c20eda54cf812d3a818854b2fab04c06339a7e8f9c67b77e25e3b800df39af5", + "stale": false, + "unfinished": false + }, + { + "bytes": 1283, + "path": "/home/mc/ousast-results/plane/engine-trace/eb5673a0090123e8988abdb9fb8bc19a19b74375364705b233c787c1c4259a55.json", + "sha256": "269ffecdeef3e711d755680e3350555e440df196b480d6cbf8ee6a285820b584", + "stale": false, + "unfinished": false + }, + { + "bytes": 20165, + "path": "/home/mc/ousast-results/plane/engine-trace/ec4b6bdb23b4425e1012a780f791b39ead886a93d3c2e04f5a60913abbb3eafa.json", + "sha256": "3b6e78650e3160570fec26775bee4b34cf3aab5544256037ed7fa7674ff8d4c2", + "stale": false, + "unfinished": false + }, + { + "bytes": 14038, + "path": "/home/mc/ousast-results/plane/engine-trace/ec7103215d55e5d6f8e6248f5b7c19d020f5fbab8f8c46be8a1ed58310aeac9d.json", + "sha256": "38f232487a9943ff843d197bcb8843a2cf3e318c9fb44071ef25fdee5d7321bd", + "stale": false, + "unfinished": false + }, + { + "bytes": 12296, + "path": "/home/mc/ousast-results/plane/engine-trace/ece603cf67850f5adace2bd3d375dfba003dfcd803b3cd3bbe213ac9e6ef854b.json", + "sha256": "0dde1e9ca05273010d11ee6180951961d271d28702b3ea0f6ee883c9892ad6d9", + "stale": false, + "unfinished": false + }, + { + "bytes": 72777, + "path": "/home/mc/ousast-results/plane/engine-trace/ed261d7c9bbe011a80d23c2850561099459dffd0913c1d57dcb787779a5f69e4.json", + "sha256": "b0d38cf3c3e2edcf7b0e4d5a79988b9a65f1dda1aba2c7c122952aa37195d4d3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1283, + "path": "/home/mc/ousast-results/plane/engine-trace/ed822bcbf54e53c950bc44212165d7afae877559557a552b9fc49c50779e6b63.json", + "sha256": "838cb08114231a09874a2732057a87b2c233ac00acd3e93eea2b1cff59abbe9c", + "stale": false, + "unfinished": false + }, + { + "bytes": 21082, + "path": "/home/mc/ousast-results/plane/engine-trace/edb7dc02423ee05ac9ff332b33aa173b5d20a5b460fd2d4ddb3198fdf40b3028.json", + "sha256": "271cf4031a1179553a52ce12ef8e28cf098504f9796f8b03e62acd1e59df7d7f", + "stale": false, + "unfinished": false + }, + { + "bytes": 1275, + "path": "/home/mc/ousast-results/plane/engine-trace/ee92457bd0d1836af8eea3ef0a8fd7ea97decc8400f37c9b2b92217a21e62e52.json", + "sha256": "69dcb73cbf2b7b281dadd03cd73185fa328828fd38e9bfdcbdd55b68ce134dbc", + "stale": false, + "unfinished": false + }, + { + "bytes": 1263, + "path": "/home/mc/ousast-results/plane/engine-trace/eea06808f5f2e5d84d77203f26a45e356b6ca920c6621786d68d4cdd374918fd.json", + "sha256": "71ab3c04f47c1c8d8c94fda38834f6f8b03b60368f3f78d40652b21dabc65a81", + "stale": false, + "unfinished": false + }, + { + "bytes": 16679, + "path": "/home/mc/ousast-results/plane/engine-trace/ef766f2b86b9ac0f22a152a61bf936ff0abfab5ff6d35b11b69e4cf2ed67aa92.json", + "sha256": "86daba276f5eb4b5053adbc0dd7d7092c9b2576d9ef04ae75ceb07824f9e2807", + "stale": false, + "unfinished": false + }, + { + "bytes": 1236, + "path": "/home/mc/ousast-results/plane/engine-trace/ef8de61faf4838498e028de2929a0cfd375d8036a996fe431c715a65cd7a56bc.json", + "sha256": "b55b161588128fed6b3a08f97a16ed919651b051d3767de1959e805f6d883e3e", + "stale": false, + "unfinished": false + }, + { + "bytes": 10299, + "path": "/home/mc/ousast-results/plane/engine-trace/f012f5c910fffe5efb5f883fdec77b3d7bba9f9a3d020603f1de9f15c72aadda.json", + "sha256": "afae624185fed22ccc30604f114c799d2f9400601452e1e310e609c4e3a5ebef", + "stale": false, + "unfinished": false + }, + { + "bytes": 1310, + "path": "/home/mc/ousast-results/plane/engine-trace/f10f4f96df4fe7dc4ddbdef4bb8ec6ef3b1146d9f71af97365ef618f01b1ef0a.json", + "sha256": "bce4ebd039ddd0877ec24c751cbe0b94f2f76bcc82243eb977eb4c6e6048acf8", + "stale": false, + "unfinished": false + }, + { + "bytes": 32135, + "path": "/home/mc/ousast-results/plane/engine-trace/f1aeb518f1dfae3f5674e114e6e01f97b4bb515cda3cf3c55f17c6dcbc20bf30.json", + "sha256": "d5064ef417ab29af00ac5af4ccb10b2fdc695a71118792892e8cd0ff40869643", + "stale": false, + "unfinished": false + }, + { + "bytes": 1294, + "path": "/home/mc/ousast-results/plane/engine-trace/f31b40558fb9cafe2f06cf4d2bdbcdf0e96fe3147f4469a838f836002b5a0989.json", + "sha256": "0db7ee28c19089a1982e8d6cebea8fd20e2facd7f5ed00baa65a87a42ff49d26", + "stale": false, + "unfinished": false + }, + { + "bytes": 1291, + "path": "/home/mc/ousast-results/plane/engine-trace/f3508094c285b0851c85de2c052ab10c2a5772687c91cfa160b880f8eb6be027.json", + "sha256": "a6d2b8b8a444d85ea45a0e46d56a70294e10812539daa5cd1b84f7599907abb4", + "stale": false, + "unfinished": false + }, + { + "bytes": 69315, + "path": "/home/mc/ousast-results/plane/engine-trace/f371453dd0a28c9d4970f5b4341ae07115d2aad4316a265ae5bf9e0af4e1a4b6.json", + "sha256": "ce45251e6066d4509e4d7385f34f77686f7e5a08ee2e11e443072ab6ac9b1bee", + "stale": false, + "unfinished": false + }, + { + "bytes": 20158, + "path": "/home/mc/ousast-results/plane/engine-trace/f4a92ac20a0f14c9fce1e70cbcb1a70605bd565c9dcebd070925020cb6f21b7e.json", + "sha256": "2ed945b9172a40c05de0e9585e07ecb59e8c022f9d17b122a1a89357d9939873", + "stale": false, + "unfinished": false + }, + { + "bytes": 90433, + "path": "/home/mc/ousast-results/plane/engine-trace/f51edfb24e0abcd4e8e42c74c4461f3ccd444381d9c1a1c04dd55bc097f10c91.json", + "sha256": "02f41739be69fa60edfc068598ee867863ef4d3cdc5b15291597e06837da9e15", + "stale": false, + "unfinished": false + }, + { + "bytes": 43115, + "path": "/home/mc/ousast-results/plane/engine-trace/f638f0c6e51d83f82958afa66c4d1cc4dde21118eda45e4abfd4268e8d849c84.json", + "sha256": "ac475d3f9613b8a26fb9badca5c12768bc5eecd203c3254c678d9d7132c01410", + "stale": false, + "unfinished": false + }, + { + "bytes": 53626, + "path": "/home/mc/ousast-results/plane/engine-trace/f69a3a31a9efb6d1461028468d5efcc5c48d8c6d69c8158a235f66fecc86d102.json", + "sha256": "de1a6f06b6fad51b285e7354a4c8fd46eb7e86658cc26deacead1b0e1ba1d541", + "stale": false, + "unfinished": false + }, + { + "bytes": 12556, + "path": "/home/mc/ousast-results/plane/engine-trace/f70db68c98a02180695bc45b68f147e74359fc9b8b7e695a7ed16e819ebd449a.json", + "sha256": "c7e8968a59227df4fee724ff8667c5368c175b065b66928b20446ce80fe07353", + "stale": false, + "unfinished": false + }, + { + "bytes": 13317, + "path": "/home/mc/ousast-results/plane/engine-trace/f7a8ba8668eaf591d2b74c464eb260189317e6096f14937b11b665f1b3e88da5.json", + "sha256": "aab51416389b2e7fc24da1648888cb345e651f88077fcfbf62d5537d85fc5acf", + "stale": false, + "unfinished": false + }, + { + "bytes": 24504, + "path": "/home/mc/ousast-results/plane/engine-trace/f7aa074d60e4bb1195cb4cde2d401ece3456abf527e8997cf5091a702bad1d5c.json", + "sha256": "213631f47098cac0d1f1da1f2fe21ba35734e0b81aaf6efd336343f9379ef2b8", + "stale": false, + "unfinished": false + }, + { + "bytes": 1290, + "path": "/home/mc/ousast-results/plane/engine-trace/f8f9ca46b041dcb43a39d8537ef64de5eb09c417612391c378a380f9366aa313.json", + "sha256": "7434cfc6411ac04821af501e52d95e585d9084bedbba331e6994cf7b9413fd3a", + "stale": false, + "unfinished": false + }, + { + "bytes": 43549, + "path": "/home/mc/ousast-results/plane/engine-trace/f9664030516f5437cae3a0e8a908407dd34c1e71afdbfe8b4badf3ffc954902f.json", + "sha256": "ae43fc3eea8fdf88e47cccce7e4f02745b3475ed1318c291146e369c231ac581", + "stale": false, + "unfinished": false + }, + { + "bytes": 1262, + "path": "/home/mc/ousast-results/plane/engine-trace/f9cc8b9750541da02a7905180c50c83df68f10e38303c1b7c22c57a0362e0acb.json", + "sha256": "23db8a9acce1c18ab463e71502c2a8b6c274736755211375e9f0f269b4e6d3e2", + "stale": false, + "unfinished": false + }, + { + "bytes": 37016, + "path": "/home/mc/ousast-results/plane/engine-trace/fa0f8a3766acb9d745d3d3f9350c11fc41774cabee761d26ee8c8aefecdc37ce.json", + "sha256": "27a05b8cf626418918c5681969bf6f45ddb7b45d23e61f984668af0923560bfc", + "stale": false, + "unfinished": false + }, + { + "bytes": 1277, + "path": "/home/mc/ousast-results/plane/engine-trace/fa1e02d98bfb67262c02b033f45c7d6bd09dde442d031f50dfa14201432dbef0.json", + "sha256": "143babaea72c852338fa5022019817547258427e8067a5e6cc901bdecff7c408", + "stale": false, + "unfinished": false + }, + { + "bytes": 14527, + "path": "/home/mc/ousast-results/plane/engine-trace/fadca2638005da4d1886e87b5bc81847ab52e48b5cf81ae82b0b1ffa3d1f109c.json", + "sha256": "b310a0164a786a9ed96815cbd5da7c2794c76d3f51de5a397ee228723099022d", + "stale": false, + "unfinished": false + }, + { + "bytes": 1294, + "path": "/home/mc/ousast-results/plane/engine-trace/fb318af74f399c1011f0992049f0e6fdd1572b0a9e4c7ef7b5f6668c19cfc6c6.json", + "sha256": "f8d4ffd0766945a84dfd9270bbeaf33a31f3b45f2cd0e52888a4a78ae209c1af", + "stale": false, + "unfinished": false + }, + { + "bytes": 1314, + "path": "/home/mc/ousast-results/plane/engine-trace/fb493f16881fe5118ce3030c3fd3f181e8955d0852ae62bdd7da78506fa8d1b8.json", + "sha256": "c2a487f2acc2e3ea25c17cead93bb8295cdbb94d9a92371af90c4becd60ebab3", + "stale": false, + "unfinished": false + }, + { + "bytes": 1290, + "path": "/home/mc/ousast-results/plane/engine-trace/fb4df74b280226586208dea0307cb858259bf2d75b632807b3eeb70d2ec3fd52.json", + "sha256": "1084bf06d65bceb4066eb14bc6a4e5366d9eb240e8919f462b207306169a6b7c", + "stale": false, + "unfinished": false + }, + { + "bytes": 19743, + "path": "/home/mc/ousast-results/plane/engine-trace/fe2c20b1c5044902ce84b197fa4338224dedc7b7d1e80a13673f2f1450f457ee.json", + "sha256": "bb568f947a9f76855f77b54f2856c7468060677187ce21eae492a84760d70aa3", + "stale": false, + "unfinished": false + }, + { + "bytes": 41291, + "path": "/home/mc/ousast-results/plane/engine-trace/fea072eb273be879d2af7019c67ac121bf2d283a3400e8b011111230a9ad6f41.json", + "sha256": "fd55d2120d435a3fcb26775e59de360067a67db316684441127f25368cacf5fd", + "stale": false, + "unfinished": false + }, + { + "bytes": 1289, + "path": "/home/mc/ousast-results/plane/engine-trace/fecf023e3e069c86c74f5c0771f42c62a678e7572d448789a4e3aefb829f2b90.json", + "sha256": "28e4ea0aa8942710aafd2ee48281892d4c8266bfdbe9bf7bbca0ffcd9afeee96", + "stale": false, + "unfinished": false + }, + { + "bytes": 61887, + "path": "/home/mc/ousast-results/plane/engine-trace/ff8ffdd515f27cd0f7008927f231992bfc98b752ab24c402535642662ce43600.json", + "sha256": "1ac8549adbfea43408b7bf7048c3dc0bf6f05e7f26c78157dfc53d19ad2f625a", + "stale": false, + "unfinished": false + }, + { + "bytes": 40163, + "path": "/home/mc/ousast-results/plane/engine-trace/ffcf484c5f4a2769e706aa7d92f878b372d454858696af607798a759cb5339b0.json", + "sha256": "d41b73b0c4a43d0acd665aac80a03b57ffe03f6e5062f9292566417355ddf64c", + "stale": false, + "unfinished": false + } + ], + "files_read": 441, + "result_rows_read": 501, + "skipped": 0, + "stale": 0, + "unfinished": 0 + }, + "matched_rows": 501, + "materialization_version": 3, + "minimum_samples": 10, + "overall": { + "both_asked_pairs": 105, + "both_asked_signals": { + "asked": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5095238095238095, + "best_direction_within_pair_accuracy": 0.5095238095238095, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 2, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5095238095238095, + "positive": 105, + "rows": 210, + "ties": 103, + "within_pair_accuracy": 0.5095238095238095 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5142857142857142, + "best_direction_within_pair_accuracy": 0.5142857142857142, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.4857142857142857, + "positive": 105, + "rows": 210, + "ties": 102, + "within_pair_accuracy": 0.4857142857142857 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.507891156462585, + "best_direction_within_pair_accuracy": 0.5285714285714286, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 8, + "higher_on_vulnerable": 2, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.507891156462585, + "positive": 105, + "rows": 210, + "ties": 95, + "within_pair_accuracy": 0.4714285714285714 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5047619047619047, + "best_direction_within_pair_accuracy": 0.5047619047619047, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5047619047619047, + "positive": 105, + "rows": 210, + "ties": 104, + "within_pair_accuracy": 0.5047619047619047 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5047619047619047, + "best_direction_within_pair_accuracy": 0.5047619047619047, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.49523809523809526, + "positive": 105, + "rows": 210, + "ties": 104, + "within_pair_accuracy": 0.49523809523809526 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5095238095238095, + "best_direction_within_pair_accuracy": 0.5095238095238095, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.49047619047619045, + "positive": 105, + "rows": 210, + "ties": 103, + "within_pair_accuracy": 0.49047619047619045 + }, + "open": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5, + "positive": 105, + "rows": 210, + "ties": 105, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5047619047619047, + "best_direction_within_pair_accuracy": 0.5047619047619047, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5047619047619047, + "positive": 105, + "rows": 210, + "ties": 104, + "within_pair_accuracy": 0.5047619047619047 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5047619047619047, + "best_direction_within_pair_accuracy": 0.5047619047619047, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 105, + "pairs": 105, + "pooled_auc": 0.5047619047619047, + "positive": 105, + "rows": 210, + "ties": 104, + "within_pair_accuracy": 0.5047619047619047 + } + } + }, + "complete_pairs": 195, + "coverage": { + "asked-nothing": 231, + "failed": 9, + "missing": 0, + "path": 72, + "timeout": 0, + "unsupported": 189 + }, + "pair_asymmetry": { + "both": 12, + "fixed_only": 0, + "neither": 91, + "not_both_asked": 90, + "vulnerable_only": 2 + }, + "rows": 501, + "signals": { + "asked": { + "best_direction_pooled_auc": 0.5399714721042564, + "best_direction_within_pair_accuracy": 0.5025641025641026, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5399714721042564, + "positive": 283, + "rows": 501, + "ties": 194, + "within_pair_accuracy": 0.49743589743589745 + }, + "guard_present": { + "best_direction_pooled_auc": 0.5, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "has_path": { + "best_direction_pooled_auc": 0.5541219567543035, + "best_direction_within_pair_accuracy": 0.5051282051282051, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 2, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5541219567543035, + "positive": 283, + "rows": 501, + "ties": 193, + "within_pair_accuracy": 0.5051282051282051 + }, + "sanitized": { + "best_direction_pooled_auc": 0.5068807339449541, + "best_direction_within_pair_accuracy": 0.5076923076923077, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 3, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49311926605504586, + "positive": 283, + "rows": 501, + "ties": 192, + "within_pair_accuracy": 0.49230769230769234 + }, + "shortest_path_steps": { + "best_direction_pooled_auc": 0.5522092910169546, + "best_direction_within_pair_accuracy": 0.5153846153846153, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 8, + "higher_on_vulnerable": 2, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5522092910169546, + "positive": 283, + "rows": 501, + "ties": 185, + "within_pair_accuracy": 0.4846153846153846 + }, + "sink_kind": { + "$wpdb->get_col": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5025641025641026, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 194, + "within_pair_accuracy": 0.5025641025641026 + }, + "$wpdb->get_var": { + "best_direction_pooled_auc": 0.5005267935293545, + "best_direction_within_pair_accuracy": 0.5025641025641026, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 1, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49947320647064547, + "positive": 283, + "rows": 501, + "ties": 194, + "within_pair_accuracy": 0.49743589743589745 + }, + "HttpResponse": { + "best_direction_pooled_auc": 0.508833922261484, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.508833922261484, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize": { + "best_direction_pooled_auc": 0.5005267935293545, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49947320647064547, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "User.objects.raw": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "cur.execute": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "cursor.execute": { + "best_direction_pooled_auc": 0.5035335689045937, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5035335689045937, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "db.query": { + "best_direction_pooled_auc": 0.5010535870587092, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.4989464129412909, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "fs.readFileSync": { + "best_direction_pooled_auc": 0.5005267935293545, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49947320647064547, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "header": { + "best_direction_pooled_auc": 0.502820371511006, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49717962848899405, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "no-path": { + "best_direction_pooled_auc": 0.5541219567543034, + "best_direction_within_pair_accuracy": 0.5051282051282051, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 2, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.4458780432456965, + "positive": 283, + "rows": 501, + "ties": 193, + "within_pair_accuracy": 0.4948717948717949 + }, + "open": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "os.system": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "pickle.loads": { + "best_direction_pooled_auc": 0.5229681978798587, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5229681978798587, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "popen": { + "best_direction_pooled_auc": 0.5005267935293545, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49947320647064547, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "redirect": { + "best_direction_pooled_auc": 0.5171410509936136, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5171410509936136, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "send_from_directory": { + "best_direction_pooled_auc": 0.5005267935293545, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49947320647064547, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "session.exec": { + "best_direction_pooled_auc": 0.5091743119266054, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.4908256880733945, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "session.execute": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "subprocess.Popen": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "system": { + "best_direction_pooled_auc": 0.5022935779816513, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.49770642201834864, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "text": { + "best_direction_pooled_auc": 0.5053003533568905, + "best_direction_within_pair_accuracy": 0.5, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 0, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5053003533568905, + "positive": 283, + "rows": 501, + "ties": 195, + "within_pair_accuracy": 0.5 + }, + "unknown": { + "best_direction_pooled_auc": 0.5017667844522968, + "best_direction_within_pair_accuracy": 0.5025641025641026, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5017667844522968, + "positive": 283, + "rows": 501, + "ties": 194, + "within_pair_accuracy": 0.5025641025641026 + }, + "unserialize": { + "best_direction_pooled_auc": 0.5001864038642332, + "best_direction_within_pair_accuracy": 0.5025641025641026, + "excluded_rows": 0, + "flagged": false, + "higher_on_fixed": 0, + "higher_on_vulnerable": 1, + "negative": 218, + "pairs": 195, + "pooled_auc": 0.5001864038642332, + "positive": 283, + "rows": 501, + "ties": 194, + "within_pair_accuracy": 0.5025641025641026 + } + } + } + }, + "semantics": { + "asked": "path or asked-nothing=1; failed, timeout, unsupported=0; missing excluded from metrics.", + "asymmetry": "Disjoint categories; not_both_asked takes precedence over path asymmetry.", + "flags": "Best of both directions, >=0.70 with >=10 pairs for pair accuracy or >=10 rows for AUC.", + "limits": "Exploratory associations, not proof of leakage; running input snapshot, no multiple-testing correction.", + "missing": "Coverage only; absent source metadata is unknown. Skipped result units are never consumed.", + "non_path": "Observed non-path rows score zero; path rows lacking trace evidence have null trace features.", + "signals": "Shortest nonempty trace (first on ties); its sanitizer, guard and corresponding witness sink call target.", + "sink_kind": "One binary indicator per observed call target, including no-path/unknown; no ordinal encoding." + }, + "threshold": 0.7, + "unit_rows_read": 501, + "units": [ + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "adonisjs/http-server", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6b0b3cab2df3397b", + "pin": "9ab160580dc2a579d8a48c6c686e2b5cce0d0a56", + "pin_role": "fixed", + "repo": "adonisjs/http-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "0ac37b7154242dfa637140af643fb4595e85510a17ab1a12c111441b9d293238" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "adonisjs/http-server", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6b0b3cab2df3397b", + "pin": "082ffe43664779344d95f37b7baf49ae47514b25", + "pin_role": "vulnerable", + "repo": "adonisjs/http-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6e5e274946d0e8f13a7ef4e37f6c7ed1828d057304a9262db0311413f18e1731" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "agentfront/frontmcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c0d0c91757f5ba95", + "pin": "ce46fd476baa0e2e04687b6db163b6886cc76f0e", + "pin_role": "fixed", + "repo": "agentfront/frontmcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "285891b16ee6870af50b36dec3c2ca9a90ee15d9e14851c61e66ad443e6eab59" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "agentfront/frontmcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c0d0c91757f5ba95", + "pin": "042fea96f809ae7e06af9c718e3e9a30c86a1fbc", + "pin_role": "vulnerable", + "repo": "agentfront/frontmcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "f33fb2413edf1499a524c4592b3b2f93d166be845f5b65291969a086a4bec334" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "ahujasid/blender-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f56f2a107ae591be", + "pin": "21a5800e21273b945d33f07ca9d3949aeb99e1d0", + "pin_role": "vulnerable", + "repo": "ahujasid/blender-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "350149bf9cafbb547f500b714a164734d2361b22e86fc9819c7bad3507d8458a" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "ahujasid/blender-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f56f2a107ae591be", + "pin": "14df53aa1c7420a8d0d11b9bbe2ed6e5eab17885", + "pin_role": "fixed", + "repo": "ahujasid/blender-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ad125319dd2d4c9d2d99a1eb34bb4cfab9f099a96e7547d0d59a8ecf1c990347" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "aio-libs/aiohttp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ee577ee4b6076fab", + "pin": "6f95adbc96ac5abf7c2ba13add27bebf749c260b", + "pin_role": "vulnerable", + "repo": "aio-libs/aiohttp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "2523f55d035d1a772a842090bc335e5d755b2fe15b376dd5b6b9e30b9dae82d1" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "aio-libs/aiohttp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ee577ee4b6076fab", + "pin": "890fd7d656e48f14f61a2c2c9263b230fdd3ca6b", + "pin_role": "fixed", + "repo": "aio-libs/aiohttp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "ca0f6c160d7839204f6fcc1709bcbc749a02a0b3b8bb648e2a238eacbf22ed78" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "alchemycms/alchemy_cms", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c95b6b01d0c2db2a", + "pin": "7fe8193142f30c584827b7f3f3f862d3d68a66ef", + "pin_role": "vulnerable", + "repo": "AlchemyCMS/alchemy_cms", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "15540c23be0c42472a49039658ec2ec0bbd8c6b318e35dd040a9d427370e0ef0" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "alchemycms/alchemy_cms", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c95b6b01d0c2db2a", + "pin": "4bbea2ab50fdc8956efb715012a44e11f0331ed1", + "pin_role": "fixed", + "repo": "AlchemyCMS/alchemy_cms", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "542471980417e964182d7d3db59a05fe12bdd072449f3bd77f7daa5515dbc909" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "angular/angular", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "29252934ef4bcfcf", + "pin": "2d81f26f59c41bb1c48e2b447869378238df1447", + "pin_role": "fixed", + "repo": "angular/angular", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "63bae9240b31f9cf1dfe00d9b01d4d0ffda95931c9e7d040df1fd718f04d828b" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "angular/angular", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "29252934ef4bcfcf", + "pin": "caaeda1a8ba184f0400be9668ee5b9d40ff5677b", + "pin_role": "vulnerable", + "repo": "angular/angular", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "cce2af1743834dcc3df58827ac263a2d63296ca1b2a2f9bdb811954fb5767c33" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "anotherik/threatbyte", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "41ed2fd487e0ecc5f453acbbd70ddb847d9f6658", + "pin_role": "vulnerable", + "repo": "anotherik/ThreatByte", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "bcc636b23dfb5f570d8864b17fe07b6b4fb52b65a40988c32011f1422f74d504" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "anotherik/threatbyte", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "34d1025dc3821ef2c855123a8cbe898a340db5fd", + "pin_role": "vulnerable", + "repo": "anotherik/ThreatByte", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "dbcf1e67a1be7ccf7d51701f9b8339339164055135443044c23a446b16b3d934" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "anotherik/threatbyte", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "8176fd281be4573ddd2bbeb8d2fc16aac7d97690", + "pin_role": "vulnerable", + "repo": "anotherik/ThreatByte", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "cursor.execute", + "source": "vibe-py", + "status": "path", + "unit": "50408f68114ecb4de3bebd836d52d9afad86b22dd1843641ac8a49b617c09e33" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "anxolerd/dvpwa", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "b2747ddf7c9b6288cbcee7f8ea5f65d425559116", + "pin_role": "vulnerable", + "repo": "anxolerd/dvpwa", + "sanitized": 0, + "shortest_path_steps": 7, + "sink_kind": "cur.execute", + "source": "vibe-py", + "status": "path", + "unit": "cafb0f00f80dc6beeba40eb95c764bf9a3569193070ba321c28677dfa425ec88" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "apache/airflow", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "07317a2258292656", + "pin": "ec9c86298ec173de6aee5d1b0ae8bd6d892c6bd4", + "pin_role": "fixed", + "repo": "apache/airflow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "a9f292d7cb467def582d9c0b31a397b13cdaefa77380ce971bfe9fbf535bb660" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "apache/airflow", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "07317a2258292656", + "pin": "e12b3cba750296af830b4ab5ff68e9241446390a", + "pin_role": "vulnerable", + "repo": "apache/airflow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ed363d0dfa620707be477b90eb4b83a901bfd402040b918aeee6f06b2c5b795c" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-3", + "group": "apache/inlong", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1544b6dfa2299d60", + "pin": "566e7801aa6f80175fad0551dda94acf200ab798", + "pin_role": "vulnerable", + "repo": "apache/inlong", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "failed", + "unit": "d45018fc4ce3dfd715c7087d4d197ad4108c0c8b6625c02c4d4da0adb9f6a140" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-3", + "group": "apache/inlong", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1544b6dfa2299d60", + "pin": "95e82877f92a4454b5d61397422e198b6b434bb8", + "pin_role": "fixed", + "repo": "apache/inlong", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "failed", + "unit": "f295c7dfb095595a4aa985c58688e4757c29be9e06b7a4ca55035ac5d06b1ef8" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "apache/logging-log4net", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "fe0e104d111c2555", + "pin": "c0668501e69d1d4f8b9e837e8b6cb13c85aa169c", + "pin_role": "vulnerable", + "repo": "apache/logging-log4net", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "088036fab9962be2b96f9162ea4f32190575678d3c5ba96bdfeac178bc22b2c4" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "apache/logging-log4net", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "fe0e104d111c2555", + "pin": "5789433a33fcaafc1628985164d7b8e62d81ae18", + "pin_role": "fixed", + "repo": "apache/logging-log4net", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "7fd2b56a816e25358477eee64487fb2c77f34c652703ad0a7120c368492017a3" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "apache/wicket", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b6742570f7f0e026", + "pin": "70088314ad307cd30bf9e3be4d1bd1e15da28583", + "pin_role": "vulnerable", + "repo": "apache/wicket", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "7c6c1d27aee6557f1b6bf371b8209003f0d2d1122cfa35b6629eb43f38769cf4" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "apache/wicket", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b6742570f7f0e026", + "pin": "e04cc3b588028a3807879e64295faf2f245ad03a", + "pin_role": "fixed", + "repo": "apache/wicket", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "df8300d84dd784d0be46969ea432ef97b8ce611bae7a896ed4f349bd4d6897db" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "apolloconfig/apollo", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "0f584bb97a154488", + "pin": "59cec0870d09fc3c1049fbf8a58d5fcec00a52db", + "pin_role": "vulnerable", + "repo": "apolloconfig/apollo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "222a84ffc7c58d45e8f10df221762b23bf20d0287ecd20f375558134928886ca" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "apolloconfig/apollo", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "0f584bb97a154488", + "pin": "0ae6a038e074eaa8f1eafc6e207cbafdfc0253e5", + "pin_role": "fixed", + "repo": "apolloconfig/apollo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "25e4c9d2941f59f072385a7bde3fd0bd76f9e986ed24b06ce81962ab447f5094" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "appium/java-client", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b15b924b4f7b1ae1", + "pin": "185353885df85526a0b1f8e22d17b754d5a8eaec", + "pin_role": "fixed", + "repo": "appium/java-client", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "failed", + "unit": "2fa95fce0751c97db1a12a80ddb249ff5c54ee31c7dc3cd47765099c7b673e52" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "appium/java-client", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b15b924b4f7b1ae1", + "pin": "93c5cee588ed8e9ada59431e741784593c93bcf0", + "pin_role": "vulnerable", + "repo": "appium/java-client", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "failed", + "unit": "52be8128053102eafbee67c2d3aac88c83ca290b943ab2f2cfdcd2630601c7d9" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "arcadedata/arcadedb", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d31ca58f2a1d27d1", + "pin": "a1c0d4b2b9996b0d238ebbd2637cf503e325494e", + "pin_role": "fixed", + "repo": "arcadedata/arcadedb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "2ae40ea61d691060e7b9f6c8e910e3aa0edf16bc6f88bec81aa9a7dae5cf5603" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "arcadedata/arcadedb", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d31ca58f2a1d27d1", + "pin": "bf1831bc0cde800b9a21b0b6ad7e2761a4be6b6b", + "pin_role": "vulnerable", + "repo": "arcadedata/arcadedb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "4876728701698045e65eeae6e11e133c30f43b09029d7777d6d780f7d0855885" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "archivy/archivy", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "bb3d7baed62e6bb7", + "pin": "26d3f965e34c68b6e950c23dd238d8855dcdcceb", + "pin_role": "fixed", + "repo": "archivy/archivy", + "sanitized": 0, + "shortest_path_steps": 20, + "sink_kind": "redirect", + "source": "advisory-fixes", + "status": "path", + "unit": "e8ae88fd2b677e3f64ac94bddb012e3b903afa294ecc87774d10087c0d50489c" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "archivy/archivy", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "bb3d7baed62e6bb7", + "pin": "aa46c6f42b3c2b9b6d93b4fb5805297bef82e301", + "pin_role": "vulnerable", + "repo": "archivy/archivy", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "advisory-fixes", + "status": "path", + "unit": "f6b0d241891dc1d897d74d98b6ff7ada2c1f1ce7874ca32097630c06ca53e389" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-1", + "group": "argos-ci/argos-javascript", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d9d8cfa38981847f", + "pin": "7c90302f07da35319136376370c17bffa1d3598b", + "pin_role": "fixed", + "repo": "argos-ci/argos-javascript", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "864f1800617f5218a2300ce390ba7922fe1bd0a182de115952342b61d627bb16" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-1", + "group": "argos-ci/argos-javascript", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d9d8cfa38981847f", + "pin": "42be45cbb990ed17c434d79c284350ccf5f50b9f", + "pin_role": "vulnerable", + "repo": "argos-ci/argos-javascript", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "fdcda2307e20ef1b9247b7082a85337f457dd1f4e648bb8264077bf983c03271" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "arikusi/deepseek-mcp-server", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1f73ad2576d52a64", + "pin": "c711faf9c4ace986e140a3670ffd5663c98699b0", + "pin_role": "fixed", + "repo": "arikusi/deepseek-mcp-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "0bc9634940734cf7f41628f220032fb7e2fd2ff5b584afc519875e90ea0be5a4" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "arikusi/deepseek-mcp-server", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1f73ad2576d52a64", + "pin": "defac60049b6fe37808b1d74925c7346aafe2f9c", + "pin_role": "vulnerable", + "repo": "arikusi/deepseek-mcp-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "ddb59b2dc39715281a6d48b32e7ca4ec0354b85b953fff55139579f83905b7d6" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "arthurkatcher/google-maps-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a7326e6daa507b79", + "pin": "c5ea7cb302c9893f798464d29e63f7db45399995", + "pin_role": "vulnerable", + "repo": "arthurkatcher/google-maps-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "793ebf4c8e0f46d8ce3b3d090d2f6290d4167931a3b574f8269b90008e3dcde7" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "arthurkatcher/google-maps-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a7326e6daa507b79", + "pin": "fc7938f3f1699318bc91ffa785c643e5d88f86d4", + "pin_role": "fixed", + "repo": "arthurkatcher/google-maps-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b8d25f337fad527544c33c82f473015e08399457276fc480477f3cfcfc9c5b8a" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-1", + "group": "asymmetric-effort/nogginlessdom", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "211ba072bdfa67b7", + "pin": "1a0c221dd7e7a8ae60b442f09589404d421980f4", + "pin_role": "fixed", + "repo": "asymmetric-effort/nogginlessdom", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "3217f9d672a4a1d78005c8fb66e1bc60a542cb26bd8c46903402c765c123d60a" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-1", + "group": "asymmetric-effort/nogginlessdom", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "211ba072bdfa67b7", + "pin": "2c6dfac4d848992ca3f3c3c4cad91ed4083fbeb7", + "pin_role": "vulnerable", + "repo": "asymmetric-effort/nogginlessdom", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "8370f9624baa0d144e56b8087eea897b98e5b2afcd6eb3a029d03e5b4b69d584" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "authlib/authlib", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "baccf350d5cc9911", + "pin": "f9589c2988d87630bd42e8342f288fa871f89ea9", + "pin_role": "vulnerable", + "repo": "authlib/authlib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "50a3ca70700c8b41874c43ba94e6b7ffe0aa28b8930ff941a40767e1057065b5" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "authlib/authlib", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "baccf350d5cc9911", + "pin": "e7af5bab7a6c1bff57a02f13602e28d4c430907e", + "pin_role": "fixed", + "repo": "authlib/authlib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "62927a118d3662c81450e19d49f4146b66f29a58d55ec0d1606ed521b1883f12" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "axios/axios", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "697f34e19bda57f3", + "pin": "646ab5e2d6b793311ff3bbe7943658e04bb54b11", + "pin_role": "vulnerable", + "repo": "axios/axios", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "775b6d900ec1ba71e4082ed49bb94439f38066628eed91461eecf0658caee78a" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "axios/axios", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "697f34e19bda57f3", + "pin": "330a381846cc6bacdcaf142ee97ae635dac86dad", + "pin_role": "fixed", + "repo": "axios/axios", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "9e855586c685b3c62ffe32407a82966661d5839e2cff742f2676acaba645a97a" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "axllent/mailpit", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "143b900b99a46cf4", + "pin": "98c7deecc71c2e2a176bc7a7134844d5b9f0e53d", + "pin_role": "vulnerable", + "repo": "axllent/mailpit", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "200f96cd784ff5c39d8bba22883f22bc8a7c87c6970a7c871802f48a45548337" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "axllent/mailpit", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "143b900b99a46cf4", + "pin": "718c09bd9d988df2b7dcd7e7ace5ee6c3c17f6e9", + "pin_role": "fixed", + "repo": "axllent/mailpit", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "7a0d62ec424849ec4681f4333fbb077e8239054d1e964bd99b40847ad7ccdb01" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "basecamp/trix", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "4b4e81797ca48cbf", + "pin": "81b37d13cf21161cc691b36dc41fa1b51505de0d", + "pin_role": "vulnerable", + "repo": "basecamp/trix", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "a4d17d85973d024a615b89334ad5a2f46afea660ef5d0bcf2b2196c998b1caf2" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "basecamp/trix", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "4b4e81797ca48cbf", + "pin": "f873850222515d667629b1041a1af3d7c68e490d", + "pin_role": "fixed", + "repo": "basecamp/trix", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "d604e460d8f5291124ba6fab5f9c94c7dfda61ea5f6808e512162334d6d6db4f" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "beaugunderson/ip-address", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "bcbd06e53147628b", + "pin": "f318efd09f101d89a0abe6932d635f3978c0449d", + "pin_role": "vulnerable", + "repo": "beaugunderson/ip-address", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "0b5cfe2d64771e30e50ff92cc409b8dd5e30079c252918ba03774cb5198a73b5" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "beaugunderson/ip-address", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "bcbd06e53147628b", + "pin": "485ae1a34ebe0e9f21b98adf30ffbb5c3bef7c16", + "pin_role": "fixed", + "repo": "beaugunderson/ip-address", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b805976c35330452af6c9f814ff4617b7b9ad0e82e1fa4440a443f93f0772c4a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "browserify/static-eval", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c12dbc8a50f7fe9b", + "pin": "dbdc955a673f96008fc48eb4530cd7a18b429225", + "pin_role": "vulnerable", + "repo": "browserify/static-eval", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "04beb8a0fd054b92c2dd0ed83907330fdee6124d86114df948ac72a297a7d51f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "browserify/static-eval", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c12dbc8a50f7fe9b", + "pin": "5feabc7b188233ae2519ea70a1b6d3e9f1473776", + "pin_role": "fixed", + "repo": "browserify/static-eval", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "c5029016a6fd2e3f9df59dba0ce3c173bbbb0d2b1de22d151086e01e1b272119" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "budibase/budibase", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "b7e63df737eede85d951aa9665b0c0778ece7ccb", + "pin_role": "vulnerable", + "repo": "github.com/Budibase/budibase", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "0e213aeabacf4205db024ea3c557e720c3aba911424555784917e967d6404867" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "budibase/budibase", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e8bc65415bd42e43", + "pin": "dd8c0654b35cd89ce3645f2355f4bf2ff9a5dd80", + "pin_role": "fixed", + "repo": "github.com/Budibase/budibase", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "4920230ef773595a9fd9a92a090dff42b48499a1dc5fc8831f941dae55cb2538" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "budibase/budibase", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e8bc65415bd42e43", + "pin": "b7e63df737eede85d951aa9665b0c0778ece7ccb", + "pin_role": "vulnerable", + "repo": "github.com/Budibase/budibase", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "49209a810f207eb61382e2ceeab7076936838a5652546f21c187d066e220160b" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "budibase/budibase", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "b7e63df737eede85d951aa9665b0c0778ece7ccb", + "pin_role": "vulnerable", + "repo": "github.com/Budibase/budibase", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "9e2964884cdf281fa3f18ee3481aa62f9a8a0a195d605da2df5bd71876fe311a" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "budibase/budibase", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "b7e63df737eede85d951aa9665b0c0778ece7ccb", + "pin_role": "vulnerable", + "repo": "github.com/Budibase/budibase", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "f9cc6f1bbcd59f5dc0de8f96248f722ea0679f8afa47c53f70832151ce7616d3" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "cakephp/authentication", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e69463f945f9a0f4", + "pin": "a38c0efd2023183300ced00a528fa7db7e6a18f6", + "pin_role": "fixed", + "repo": "cakephp/authentication", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "5feace7b28e260175f80c682e9009025aea6fae3dc75409cabbb955b560d0372" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "cakephp/authentication", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e69463f945f9a0f4", + "pin": "8129ca98c648306c0c835e8d70689edc2da896bc", + "pin_role": "vulnerable", + "repo": "cakephp/authentication", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "799a4f5a5b9324e86c90752f0239f059984f44e8ff1ec0dd518d0d9413e34c66" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "cakephp/cakephp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "71f56810b8ee6947", + "pin": "359b6f4c83466f20dd55e39d9e23f91e299ca89c", + "pin_role": "fixed", + "repo": "cakephp/cakephp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "c659c0e717b7dc1084e1178288f6c9b2e87fbf0ef518ba3bbaedb0fbadae15c1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "cakephp/cakephp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "71f56810b8ee6947", + "pin": "c310291c7fc33d0a257ae3d50e9e7c2bbcca9c30", + "pin_role": "vulnerable", + "repo": "cakephp/cakephp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "c8d2e035a6099fb775c8b4ecf00196c1488dbddd9eed3d2d268a4f1d2567b194" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "cesargb/laravel-magiclink", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "768fc9db8a75a351", + "pin": "f86d242bce9a6324ea12393f8069704085198ac5", + "pin_role": "fixed", + "repo": "cesargb/laravel-magiclink", + "sanitized": 0, + "shortest_path_steps": 2, + "sink_kind": "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "adc6527469618f72b1dd7776814717cbd0056a0c625e05bef74199171ce73f1a" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "cesargb/laravel-magiclink", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "768fc9db8a75a351", + "pin": "7d15c0f348860e9766254ecbea4646856cc40510", + "pin_role": "vulnerable", + "repo": "cesargb/laravel-magiclink", + "sanitized": 0, + "shortest_path_steps": 2, + "sink_kind": "MagicLink\\Security\\Serializable\\ActionSerializable::unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "da47663a57e370a75cc65b810b8a380aa26d12dcabb1d9b3c02641398ff7d348" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "christopy/serve-here.js", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "fab4ce020049724b", + "pin": "d2b7412d899d959343c1ff41b8013048d2838b3d", + "pin_role": "fixed", + "repo": "ChristoPy/serve-here.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "b9be90242be627aa46462143ac85940a906232ebc0b47776b5729475b27d215e" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "christopy/serve-here.js", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "fab4ce020049724b", + "pin": "4828f0f46b8d6f1cef8235894b7bb1f18b9f6978", + "pin_role": "vulnerable", + "repo": "ChristoPy/serve-here.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "ece12ea7d87b4a12c4da30faed9eb530b51fc879c271b68ba5304b230cda8e79" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "chrome-php/chrome", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9126ba83905eb8b4", + "pin": "13cb5529e34cdee727a137b211bd00203f90c96d", + "pin_role": "vulnerable", + "repo": "chrome-php/chrome", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "d8dc50b7bb40bbcfc3f3d4f1f8d3a4d17eb1c662d5f759efd18656a482dd2e32" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "chrome-php/chrome", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9126ba83905eb8b4", + "pin": "fbd8034affba22411e8e8a0ecf0bee8970532444", + "pin_role": "fixed", + "repo": "chrome-php/chrome", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "f426f9307621b3f2d6a8d1669cdb4c19e962b94e34fbb394d4660cbde5921c88" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-1", + "group": "commenthol/serialize-to-js", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "7ac5e21d9d8f4c47", + "pin": "e64371ae457576636328949d200e945d1b0fa009", + "pin_role": "fixed", + "repo": "commenthol/serialize-to-js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1d1efa2fd7323c264290d4d314c957c853e1c7a9c877a54d6f03ab7d2af2ca86" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-1", + "group": "commenthol/serialize-to-js", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "7ac5e21d9d8f4c47", + "pin": "7de2cc698cd787a672fa12f1c1c88b33f116ec79", + "pin_role": "vulnerable", + "repo": "commenthol/serialize-to-js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b5dc78c7ac0b76803dc98904142c1139083fb9daafb5bff40e7b5c3f14ee03f5" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "contrast-security-oss/djangoat", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "27d20e136a226281c490dd765984ee97d2dc3165", + "pin_role": "vulnerable", + "repo": "Contrast-Security-OSS/DjanGoat", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "0894a7212280bab755cd9d93b1f0ede2c51e4fca76b76e5ed9e24ef8f8cf0b9c" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "contrast-security-oss/djangoat", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "41c88db0d491e643499b40095db6ed123e754c9c", + "pin_role": "vulnerable", + "repo": "Contrast-Security-OSS/DjanGoat", + "sanitized": 0, + "shortest_path_steps": 8, + "sink_kind": "User.objects.raw", + "source": "vibe-py", + "status": "path", + "unit": "02694b5fb85e9e52bf5eaaab4e0b628f1f44ff3a8d5ad026cc10afdbc4222eaf" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "contrast-security-oss/djangoat", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "da33ad901e2197195504e812a9cfc702fddd7ab6", + "pin_role": "vulnerable", + "repo": "Contrast-Security-OSS/DjanGoat", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "cursor.execute", + "source": "vibe-py", + "status": "path", + "unit": "db9a3e888780501dd3c2c125af2f9d47f68ebf02f0e0db8370b2ea09c6f9d070" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "contrast-security-oss/vulnpy", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "eda17b67115aa16bc8cff8271a6ce8f52ffad7fd", + "pin_role": "vulnerable", + "repo": "Contrast-Security-OSS/vulnpy", + "sanitized": 0, + "shortest_path_steps": 2, + "sink_kind": "subprocess.Popen", + "source": "vibe-py", + "status": "path", + "unit": "9af96b099dedcc4005e5fcd19ad78f73864e1cfbafbe6953b4edb6260957943d" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "contrast-security-oss/vulnpy", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "a0535512e97bd4d357b417ea1b102d0786505ba7", + "pin_role": "vulnerable", + "repo": "Contrast-Security-OSS/vulnpy", + "sanitized": 0, + "shortest_path_steps": 2, + "sink_kind": "os.system", + "source": "vibe-py", + "status": "path", + "unit": "9e7c2a786068a936a6c664cc229d6f39cea1fe57caf0806306f0cfc44515460c" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "cps-it/mailqueue", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "07d1dc4d299a7700", + "pin": "bbab24b798738c590ef35fb54e3bfd58f363c7d8", + "pin_role": "vulnerable", + "repo": "CPS-IT/mailqueue", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "0e664e274dfb438d2f721edc81f8469ac48387dbd5c1b43973cd7e651db46db3" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "cps-it/mailqueue", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "07d1dc4d299a7700", + "pin": "56f1029b127a624d1273f1a65434c5cc44d8add0", + "pin_role": "fixed", + "repo": "CPS-IT/mailqueue", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "da55f60378c67e91683b9720f2fa0e6659e28c7b392c050278b40713e47c84a3" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "cstigler/node-xhtml-purifier", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "749eee05a507fe93", + "pin": "5466cd5ba9b46c9a1294468d99a0cc5c6e29595b", + "pin_role": "vulnerable", + "repo": "cstigler/node-xhtml-purifier", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "24fbb1dffcca083382a23e48db232e0d83bbbf2ff2b325f0dc0f4c72dd1a16bc" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "cstigler/node-xhtml-purifier", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "749eee05a507fe93", + "pin": "453b498095e493320a0df825b5add8e20799c138", + "pin_role": "fixed", + "repo": "cstigler/node-xhtml-purifier", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "640e1626f8d7d9d5c2478ede48cc7b2780370bda98ae114bae102bba892da90c" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "czlonkowski/n8n-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e36bbaf8f3cfe65c", + "pin": "d71a75a9bbf6721c2487bb28dd62f0895d6a2dd5", + "pin_role": "fixed", + "repo": "czlonkowski/n8n-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "14f7c65fb5621ac5e2068c8695ddbf482103e4320ec3b36886f6e1f08cbc312d" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "czlonkowski/n8n-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e36bbaf8f3cfe65c", + "pin": "64679aa09e63a857fa7151f7c48b75b934573c21", + "pin_role": "vulnerable", + "repo": "czlonkowski/n8n-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "c96dd379dec2ecfd99051d7a20e6ef5601821f93c46eb34ed087daf5fbed2d47" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "danger/danger-js", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b81c8c63cae892f6", + "pin": "782faec5199034c530db31495042a266dca3e68b", + "pin_role": "fixed", + "repo": "danger/danger-js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "5982fe7fa1ea6bfc1c8dcb8c71cd4410de475d25cafa324147649f26a1ae1324" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "danger/danger-js", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b81c8c63cae892f6", + "pin": "9813142614b22449b1d550bd6783a4df605ff51a", + "pin_role": "vulnerable", + "repo": "danger/danger-js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "59916deeb8ba14922eebac61c9eac122e15d1f7590ee3cb1b97f019585fb798f" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "danielgatis/rembg", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "bab3a167ab5ca505", + "pin": "3b8f24cd8e0f219e407b4dd828521a0f54f8ad0b", + "pin_role": "vulnerable", + "repo": "danielgatis/rembg", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "5ebea23aee96c80fa0d2d9239964d99614613c4ae36f709811bc19e61ebc720c" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "danielgatis/rembg", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "bab3a167ab5ca505", + "pin": "0abcdaf50722c7d34cc90e9ce77eee97c6e8baf7", + "pin_role": "fixed", + "repo": "danielgatis/rembg", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "9bfea8d7a6ffa6d79d16f77fc355fc1bb605189513ebad561ee523d577a1498b" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "datapizza-labs/datapizza-ai", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5a91049be21aa611", + "pin": "19b1f6fba5f4a50254918611a66e79d5509aa725", + "pin_role": "vulnerable", + "repo": "datapizza-labs/datapizza-ai", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "1ab9936627aa59c3a60ea44074ad44b68aea4f9c04f14c1949dd9c77ca13ff0a" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "datapizza-labs/datapizza-ai", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5a91049be21aa611", + "pin": "0681df3587eb890443f1d55a67fccbe575dffd7a", + "pin_role": "fixed", + "repo": "datapizza-labs/datapizza-ai", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "8df72b9eab3f2fd858c40312d0a806cb67c620bd62873826c8732ba8795d9cfa" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "davila7/claude-code-templates", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "acdb5893412a81eaec9862ee24a4613bf296ab45", + "pin_role": "vulnerable", + "repo": "github.com/davila7/claude-code-templates", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "115d87f37bf1d4ab91fa3010303e81b127f84b817268b60b8fd4b9934efeae4f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "davila7/claude-code-templates", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2b8101c89c839614", + "pin": "bc4618b07232633c1c0aac12a43e436268d31783", + "pin_role": "fixed", + "repo": "github.com/davila7/claude-code-templates", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "7bb7d858a670fc51f81e08c141c2bca3b8b7524254ab679e33b22ce79536e895" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "davila7/claude-code-templates", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c23acf4f38945093", + "pin": "bc4618b07232633c1c0aac12a43e436268d31783", + "pin_role": "fixed", + "repo": "github.com/davila7/claude-code-templates", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "82bdc0b6bb0c19e342efa63af0c9014a607461d0682cdd14bd5fea33516fbd50" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "davila7/claude-code-templates", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2b8101c89c839614", + "pin": "acdb5893412a81eaec9862ee24a4613bf296ab45", + "pin_role": "vulnerable", + "repo": "github.com/davila7/claude-code-templates", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "886285661b88f14e00ff8e863b31cf7b7afb303ad4aa4aa13b1cffbf1272d5e0" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "davila7/claude-code-templates", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c23acf4f38945093", + "pin": "acdb5893412a81eaec9862ee24a4613bf296ab45", + "pin_role": "vulnerable", + "repo": "github.com/davila7/claude-code-templates", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "bf74aae5a48156f183426a80cafca6da219ab13b2ae4b40fa88fca75acb72980" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "delmaredigital/payload-puck", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d7cc37a3a54315cb", + "pin": "d12f2424b682f211dc346787615f8b409f0251fe", + "pin_role": "fixed", + "repo": "delmaredigital/payload-puck", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "4aecd43c6e5b81daf7aadd6a6e22f22c17c08b652a2f5121a49320ca1057b186" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "delmaredigital/payload-puck", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d7cc37a3a54315cb", + "pin": "7327939f8a7ea20f0cd8dfa17904a92c26f80ea5", + "pin_role": "vulnerable", + "repo": "delmaredigital/payload-puck", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "88123ae860be2fdc28fd6a289cf26c3e0af0689f455cf8c15098e5dc76e5c8a8" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "dep0we/atomic-agents-stack", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5011004f06f1e217", + "pin": "1d9c345ba6e72742eeea8db7a69f36cae9d7f3f3", + "pin_role": "vulnerable", + "repo": "dep0we/atomic-agents-stack", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "6c48682d1b02ff2559d92346d192cc9dbe6a0bbe2ab2c146653110420105ff1d" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "dep0we/atomic-agents-stack", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5011004f06f1e217", + "pin": "727c747afa07b7e367d58363b1b7c1cc30c1a46f", + "pin_role": "fixed", + "repo": "dep0we/atomic-agents-stack", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "d3592260108a838246e0cfd5ab6d48bceb0ef870e223565745dcfd68f1826840" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "devbridge/jquery-autocomplete", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "81caad96b221c2b8", + "pin": "268e2fbade9417c54d806efa5217a0029778a88c", + "pin_role": "fixed", + "repo": "devbridge/jQuery-Autocomplete", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "3c2dc720ed159e55629ba737665d93859def9790427289567a513c83c133e236" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "devbridge/jquery-autocomplete", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "81caad96b221c2b8", + "pin": "7fa9dac6807123e2ba7f39989c726c6ebd9c947c", + "pin_role": "vulnerable", + "repo": "devbridge/jQuery-Autocomplete", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "e8b9595a320776c8e663fd0b168193c1e64e36a9052784d1219f2c4a91d647f2" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "dgtlmoon/changedetection.io", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "f9b6599018ef3b60", + "pin": "dc5d8b6fc3c4c91ddb651183fe3b206982bcd324", + "pin_role": "fixed", + "repo": "dgtlmoon/changedetection.io", + "sanitized": 0, + "shortest_path_steps": 12, + "sink_kind": "send_from_directory", + "source": "advisory-fixes", + "status": "path", + "unit": "7558d6ee39a311c5459e35fe6f7b12917b7f843b21ab1fbb5e485a07f53b7d78" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "dgtlmoon/changedetection.io", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "f9b6599018ef3b60", + "pin": "99b40f1edbb0b9039e5e12546d6836d9bba4ef41", + "pin_role": "vulnerable", + "repo": "dgtlmoon/changedetection.io", + "sanitized": 0, + "shortest_path_steps": 11, + "sink_kind": "send_from_directory", + "source": "advisory-fixes", + "status": "path", + "unit": "b1a6cf450a074788ffca2bebd880435abac2c376e89cb328d7a22d277fdccad8" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "dicebear/dicebear", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "eaf2f03db2c502b5", + "pin": "86dc344383276912610f5ada57637599539b2fc8", + "pin_role": "vulnerable", + "repo": "dicebear/dicebear", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "38dbfbf745d7cbcc52c6fff83248d84663273fe6a1f1b014eac7776c4bb8f074" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "dicebear/dicebear", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "eaf2f03db2c502b5", + "pin": "20ed7e4453aaa39eec0a9d62d51e156cbe7600ff", + "pin_role": "fixed", + "repo": "dicebear/dicebear", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "a84d848ef56b72fc15872d88acaae1743c9cdf88095d13b1869abbec6a0d8a8f" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "docling-project/docling-core", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "7df48bca2c9fabfc", + "pin": "b5b7b317aa2b3e73f506ec1facca4d152c6fadd9", + "pin_role": "fixed", + "repo": "docling-project/docling-core", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "7b76ce8f55d61071adb367018cc3e50f04a05d08c7c4919c3806fc1cc8bf41a7" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "docling-project/docling-core", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "7df48bca2c9fabfc", + "pin": "e2593489122176bf3b4e184ba7b4ede2ec7b8b6e", + "pin_role": "vulnerable", + "repo": "docling-project/docling-core", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c82ea0adc9c8366aa2b77ce73772038676fc37ff50879e873ff397958fdd7ec1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "dolevf/damn-vulnerable-graphql-application", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "1fb05691c01937837e63562c667f9f0b5093a039", + "pin_role": "vulnerable", + "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "text", + "source": "vibe-py", + "status": "path", + "unit": "7f02a09b8d8f2321f2cdade74c2fa1d52442e006149a749a8be768daaa62195d" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "dolevf/damn-vulnerable-graphql-application", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "e799f50fef542d649ba8f0945db5ee1a1932361b", + "pin_role": "vulnerable", + "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "9b5e439943ce5c2b04d6201b7a843634aa1b13b726813c23450ff54ce03f3dd6" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "dolevf/damn-vulnerable-graphql-application", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5b836889b4da4921", + "pin": "8ae4995cce066920aff0c85911ec3e75ab925f91", + "pin_role": "vulnerable", + "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "a84c2ce4a4eadf265d4481ad7f6864edf1d7e3084c6ee32cbbfe454bb2946bfe" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "dolevf/damn-vulnerable-graphql-application", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5b836889b4da4921", + "pin": "ea0a154b6b688a7cf606c317249df14741bc20fb", + "pin_role": "fixed", + "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "caeed7f097a3311fe2e84efd372fe4b4c140f63a80a9f07ba0b61966dbab15e0" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "electerm/electerm", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ac526f457067fad8", + "pin": "baee4cd927f518661ab8d95ffc4cdf09821361b9", + "pin_role": "fixed", + "repo": "electerm/electerm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "50d8bafd5189fab0429bd4135d9ed400cc2fc14706226a2de98d65746ebfdcc7" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "electerm/electerm", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ac526f457067fad8", + "pin": "59eb91a597f12b117e3ea303ac1dd021bc28d94d", + "pin_role": "vulnerable", + "repo": "electerm/electerm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "9532b70b0df76a34170b57c74deafaba54d5d2f16a729c39b0dfd3eb2022d899" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "elyin/gemini-bridge", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c97a971a18f85244", + "pin": "4b12061a976201f03c10a47c946a5da7fe1193f6", + "pin_role": "vulnerable", + "repo": "elyin/gemini-bridge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "95c80c503ed43fe9a0370f89ea935d47badee6a9625548b9dca78e04275003dd" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "elyin/gemini-bridge", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c97a971a18f85244", + "pin": "28c93514bc690d577a19c82fe08bb52c67ffcdf8", + "pin_role": "fixed", + "repo": "elyin/gemini-bridge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "e9810872beb9c158f54048392142c2f701314f854d6dfc748553ca36ed6c08d0" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "erev0s/vampi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "25a7da74014dda069872b48392bc27994ba16e40", + "pin_role": "vulnerable", + "repo": "erev0s/VAmPI", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "c2a2c2d85114a97f892fb1e5500fbd98622457a8c46451e1f9e958ab08a40318" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "erev0s/vampi", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "2d9ffcb38777a2f7e5cdbf06883ae6e98ff45212", + "pin_role": "vulnerable", + "repo": "erev0s/VAmPI", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "text", + "source": "vibe-py", + "status": "path", + "unit": "29d8be8206c88ba7efd86b56a7dcf8b655e33b4a792c2d18b028c92c6252daab" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "esphome/device-builder", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6a4e0bd705331747", + "pin": "4cb449f78db7b585a1208f322df7ae91ec586540", + "pin_role": "fixed", + "repo": "esphome/device-builder", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6db80439d89b54f60f836c415dd403fd09d21cf630da81435d4d2f9cef5d883c" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "esphome/device-builder", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6a4e0bd705331747", + "pin": "cd418231329b187db76e48eedd9f9362afc83324", + "pin_role": "vulnerable", + "repo": "esphome/device-builder", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "bf257e4f0812012be330fe119d07d29253d291161f435262787f491762c6bfb1" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "etaminstudio/prosemirror_to_html", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f96f0fb245948915", + "pin": "5306c823eb10b74dc67adf265924edd7fd10cf97", + "pin_role": "fixed", + "repo": "etaminstudio/prosemirror_to_html", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "0954e6931373915c204b9ec8d2b8ae6297a95667bfd41aadf9035625ad93967f" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "etaminstudio/prosemirror_to_html", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f96f0fb245948915", + "pin": "fadb71fc9aac67799b3ff2ba824460f1b781b37a", + "pin_role": "vulnerable", + "repo": "etaminstudio/prosemirror_to_html", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "5e09cdae2504e834d591b6f92a808427f07550364b5419899f7e6f76084fc377" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "ether/etherpad", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "bf11f138fe39675e", + "pin": "bf7e2efaba2c5e39a818c53eb0db69bcc3e4a566", + "pin_role": "fixed", + "repo": "ether/etherpad", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "56f0d0b156992af56141d6368fdb0c5376fc7a44a03991d754f97202b9d77008" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "ether/etherpad", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "bf11f138fe39675e", + "pin": "d97dc7ac9ebb9d7861886df52d541c9124631a6a", + "pin_role": "vulnerable", + "repo": "ether/etherpad", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "8271af5017894167556893da2070188060d06eebc87f27db45c46234c359631d" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "fastify/fastify-static", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9d937c2dffb4aadc", + "pin": "3c74bf00aa409c6b8ac1d32c01fbdb6725abc5c0", + "pin_role": "fixed", + "repo": "fastify/fastify-static", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "01ac12bb06e660d0aeef8b1e26dddc5c99d52cc333f7af6d1981eee2818e64fd" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "fastify/fastify-static", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9d937c2dffb4aadc", + "pin": "cb9922d01293aa4df74f8ff5e655774e08290afb", + "pin_role": "vulnerable", + "repo": "fastify/fastify-static", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "9612edf0f927048335e83e9925f01be9aea9b772bdbdc568ad9cc0a17055662a" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "feathersjs/feathers", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d4f648048e45f2ea", + "pin": "a7899e6b0c9941648b794bcb61f8a80e54e770ee", + "pin_role": "vulnerable", + "repo": "feathersjs/feathers", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "08807c8110b8c1b8635a6883c229fb91f2b9566db8b6c252448a0db7b2ddd47e" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "feathersjs/feathers", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d4f648048e45f2ea", + "pin": "c842dd309598437521f647838cecb08b2e6ef0a4", + "pin_role": "fixed", + "repo": "feathersjs/feathers", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "10869c931053bf77ecaa98a47f56dea27d643d1abed2a4758bcf48a78547ccc9" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-1", + "group": "fecommunity/reactpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "662e1f36c230d7f1", + "pin": "78ecb70af1c021455c05fdcbe137212c70e310d6", + "pin_role": "fixed", + "repo": "github.com/fecommunity/reactpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "0b73332b25413902c26d5b5dee6767465eed99ff71a814582988ffe0d8ec1a30" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "fecommunity/reactpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "c3dd10681b3d2b5e224f7ac647b3769557603975", + "pin_role": "vulnerable", + "repo": "github.com/fecommunity/reactpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "8c8e46d0c7d361b784baff9d70f38744b2805ef1ee0aaacaa616bc20a2c6f32d" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-1", + "group": "fecommunity/reactpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "c3dd10681b3d2b5e224f7ac647b3769557603975", + "pin_role": "vulnerable", + "repo": "github.com/fecommunity/reactpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "aca938682c196fd4c85b39b89eeedb97c35f6a5a017651fe9c03c5b727cab7ea" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "fecommunity/reactpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "c3dd10681b3d2b5e224f7ac647b3769557603975", + "pin_role": "vulnerable", + "repo": "github.com/fecommunity/reactpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "cec00d1509a129364da6ab8537fb3f433fd847e26d073c90311ccdaf7a1b39e7" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-1", + "group": "fecommunity/reactpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "662e1f36c230d7f1", + "pin": "c3dd10681b3d2b5e224f7ac647b3769557603975", + "pin_role": "vulnerable", + "repo": "github.com/fecommunity/reactpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "e0f58a7ac5627de3e7b6cfe5add41d18b0f64b998c1cc788d42eb2cdbbc3fe41" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "filebrowser/filebrowser", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2c251a645094f389", + "pin": "68e9ee734e60a840f01ad3ba5ca8793cd7f48ded", + "pin_role": "fixed", + "repo": "filebrowser/filebrowser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "0d41cc634771048f72d07c4aa9feaed669d0bfe3844d61dcdc525a0f899617e2" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "filebrowser/filebrowser", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2c251a645094f389", + "pin": "5971938c46b001d9781dfd6bb7722f1a96c11439", + "pin_role": "vulnerable", + "repo": "filebrowser/filebrowser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "ca8288d0b8b94dc6b7e4c681936ea610d295fe949cba5f64f09b6de134ef9875" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "forgekeep/nebula-mesh", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2ac5ec5011615c9b", + "pin": "dd0a1573a30a14af461bbb468e9ac9f7dc63b717", + "pin_role": "vulnerable", + "repo": "forgekeep/nebula-mesh", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "2f427f403af3cb58d776437736c2389805543413fdb91aad98979158c6d00de3" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "forgekeep/nebula-mesh", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2ac5ec5011615c9b", + "pin": "afcfd0d513005b666f61c6873c04a8d5ae8d5762", + "pin_role": "fixed", + "repo": "forgekeep/nebula-mesh", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "cddc8c5bed0841b80e7b20d0b378e858f8e4ac37fd7b890ce76611d989857f92" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "frangoteam/fuxa", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "193a888f8e3f805325072829b1644a2c768c948b", + "pin_role": "vulnerable", + "repo": "github.com/frangoteam/FUXA", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "0c7830c2912ff285855d8a3c8e9b47db4ca4af840baa66d4b5d3f4422f46f95d" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", + "pin_role": "vulnerable", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 15, + "sink_kind": "system", + "source": "adjudications", + "status": "path", + "unit": "5383a8c2a78fabd3d17a5b3021125953b5ebbee61f8900c30d016c56b1a3bad6" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "360d8bfd2f116e98", + "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", + "pin_role": "fixed", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "7c1989a4ec3622bdaebcf1161de850f22cfed041cb38830ca1ded4fa99d40466" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ec8c706cc2b20f36", + "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", + "pin_role": "vulnerable", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "848688dcd0fe8d46e6762cc8aee1d82e8fad8a2a044c94b547aea11049c85bfc" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ec8c706cc2b20f36", + "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", + "pin_role": "fixed", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "983cc9231f91baee4e2d626193f3b88aa5b09907f6faab870949bdc9c336b816" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e4ad86416d5c6668", + "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", + "pin_role": "fixed", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "98ff1dff2afe80709b8e61a9c95cfeea12b2110c13b7120478268b4762e2c992" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "360d8bfd2f116e98", + "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", + "pin_role": "vulnerable", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "a1a825d23e34757c8e961e43ae791253e62682e130acdb846b58118588006a98" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", + "pin_role": "vulnerable", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "a7fa4207508b3989baabc7a1f0ff2ea5229b366c1cb106e7fc945134b8b106c8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "froxlor/froxlor", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e4ad86416d5c6668", + "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", + "pin_role": "vulnerable", + "repo": "github.com/froxlor/froxlor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "ef5c53f3114d0057e694df13dc07cbcb532c3b0d59150eda269b87b021d7a6e8" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "getgrav/grav", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "9ae575048504c690", + "pin": "a2113a2900181bd48c3b1a5b00c6313d0f0acf24", + "pin_role": "vulnerable", + "repo": "getgrav/grav", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "header", + "source": "advisory-fixes", + "status": "path", + "unit": "176acf077fd58c3e6f940753179ffa3e8316661f355d94acb5e0345b51925ca4" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "getgrav/grav", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "9ae575048504c690", + "pin": "f01db15fd940d8d95e9508b64f12f1f0e198d1b0", + "pin_role": "fixed", + "repo": "getgrav/grav", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "header", + "source": "advisory-fixes", + "status": "path", + "unit": "228b34ebc2090b5239c7821d28366ddc663e7118d015a79b45dca6618d5490fb" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "getgrav/grav-plugin-api", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d6edb5496b3fdba2", + "pin": "41e1a954fb6b59ce912bac8fe7e5a20ed4528abc", + "pin_role": "fixed", + "repo": "getgrav/grav-plugin-api", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "9acb8017ebadc480515a664181c427f37359edcc1dc6f344f368a87e0c191b3f" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "getgrav/grav-plugin-api", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d6edb5496b3fdba2", + "pin": "4d580b995b1decbfcb37407978c3c29e299a8b4f", + "pin_role": "vulnerable", + "repo": "getgrav/grav-plugin-api", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "c1bfe63148bc700c812fde95ad9f83d456e4fa04e10c6f5394072a08f73174c6" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "gitpython-developers/gitpython", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "27e1c8e8ee93a892", + "pin": "f054d52e24cdbc4244a0e7d8079463736baaf8ea", + "pin_role": "fixed", + "repo": "gitpython-developers/gitpython", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "47fb89b132d6de48674c37965579e727d922bef1796db70f8b9f862ac47cb9a5" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "gitpython-developers/gitpython", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "27e1c8e8ee93a892", + "pin": "6ffa79cb39d0294e45d72122db5e4bc3b4c4851e", + "pin_role": "vulnerable", + "repo": "gitpython-developers/gitpython", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "79887f0ca8b05d6599d55167d8a9faf67bdb2254d17c143141da44971077002d" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "gofiber/template", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a3fdf9ce3441ec86", + "pin": "59a30d498fb81e58717ed2581606aa0a7f145af8", + "pin_role": "fixed", + "repo": "gofiber/template", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "653236018929ab8534c27704a20ec5d358047bc66e451620d2ac32081c91d333" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "gofiber/template", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a3fdf9ce3441ec86", + "pin": "0cf91d1a057aae5d8ea833796e4fb028428d8f14", + "pin_role": "vulnerable", + "repo": "gofiber/template", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b70ca2c43f5929e7b885bd728349e721fd85d7605e2f722a7e8cfe0f0d477b0c" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "groundhoggwp/groundhogg", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "9472a1dd79d4556c40eece501a61930793f170d3", + "pin_role": "vulnerable", + "repo": "github.com/groundhoggwp/groundhogg", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "92400e83890882a66ffdea1a405e2354a195442e176d85fb707b0442c44d45ca" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "gtsteffaniak/filebrowser", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f9dcf3a0fb0f0a14", + "pin": "49549778b5a15a966385809ee317e62c4ba6685a", + "pin_role": "fixed", + "repo": "gtsteffaniak/filebrowser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "7ca6dd4f673976b000a657f885af3463740419ce41e14f972af0c5483cb75a7d" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "gtsteffaniak/filebrowser", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f9dcf3a0fb0f0a14", + "pin": "f698857eeba133d278fab3c40ac9b109ef207995", + "pin_role": "vulnerable", + "repo": "gtsteffaniak/filebrowser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "86c1db3a5e9f843d6546146449171e0378ac61d6c8f44c6dd72fd379cdbb188a" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "h2oai/h2o-3", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "3e71f79348a6b770", + "pin": "ff566989cf591b07191330938038ece346ad8c64", + "pin_role": "vulnerable", + "repo": "h2oai/h2o-3", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "200250ebceadde4cbdfec2802a4f9fbfa220dbd7fa4c2dd5ed717fb1f3ea7447" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "h2oai/h2o-3", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "3e71f79348a6b770", + "pin": "a919a7249847b4cce36610d163ec9ff8f815ffd2", + "pin_role": "fixed", + "repo": "h2oai/h2o-3", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "b9faa5007c8cbb67ada3f1f026ca59e0ace6fbb9c3d1f1369d4521a7e323e7da" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "h3js/h3", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "8972a0f56ee57477", + "pin": "8a83b4a0e720482f61d4229781410c6a21805673", + "pin_role": "fixed", + "repo": "h3js/h3", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6b987df2960828dcb1b2b3f190a903a40361d58117d63321d671aecc6c2cb570" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "h3js/h3", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "8972a0f56ee57477", + "pin": "5deb3650166d044f9fc052cf78828bb830fc1c0a", + "pin_role": "vulnerable", + "repo": "h3js/h3", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "ca3fa87dd37435c01a7121119912c1a1e261259c11805c0b66e7d4b315640945" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "handsontable/formula-parser", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6144baeb491f4a56", + "pin": "851190dff48f575ba6cba9911268bfbf49b59dcb", + "pin_role": "fixed", + "repo": "handsontable/formula-parser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "f5c22ce104e9593e5272b6e8b3c6f3b61fa4578552ccea80e6021ee90bdb3ffc" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "handsontable/formula-parser", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6144baeb491f4a56", + "pin": "2b9568b55442b9c2a0591082ab812a5ba22791b9", + "pin_role": "vulnerable", + "repo": "handsontable/formula-parser", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "f687e7e95dbe47f602a1e0002a44f94fd48e5b1c33f77ecebc6c2d814fcbf450" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "heartcombo/devise", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2ef4471c66e5e4ab", + "pin": "48dd8fc37c57586105d1cab35cf0f75d5aabbf9c", + "pin_role": "fixed", + "repo": "heartcombo/devise", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "ad7c8e368fe1699a044e058d5c10b41bd9fc0f91c3f3c384c5dac40af39e71f6" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "heartcombo/devise", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2ef4471c66e5e4ab", + "pin": "27eed1d2b39fd88cc8fbf98550193c4a15dabf88", + "pin_role": "vulnerable", + "repo": "heartcombo/devise", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "d888baf7194bbe7158cb3932f58b47a9a235351d388d10df82a130ddd54c2d46" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "honojs/hono", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5628c54152216646", + "pin": "7f357f6a52482ab4da68b1b2a941eecfb3d8f30a", + "pin_role": "vulnerable", + "repo": "honojs/hono", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "47d081c9f6060218967902f694e61c88f64f57c65bec6fc3073afeb0b77d117c" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "honojs/hono", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5628c54152216646", + "pin": "b5869153ed0ec29f2c0c0f9a871fb63573fc8892", + "pin_role": "fixed", + "repo": "honojs/hono", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "e1297bccf9c3606e0b41d762a69ff5d0a33ae4f7f1506071af6b9cb4a177ff56" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "hs-web/hsweb-framework", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e52aa814c36ace1f", + "pin": "3836d348b5ead5d07fa22d129aa5dcd186fe3c54", + "pin_role": "vulnerable", + "repo": "hs-web/hsweb-framework", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "failed", + "unit": "2d6d74364f1982e91f27f1c995b8699df1fc8f8dce6e1e2cf274bf01b6e9494e" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "hs-web/hsweb-framework", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e52aa814c36ace1f", + "pin": "fa2611c3cf9a70e806166f4c995222c09a61fb50", + "pin_role": "fixed", + "repo": "hs-web/hsweb-framework", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "failed", + "unit": "4727471fea2cf0a92d43b4b1503f1339a7dde87f872ba8064dacbf855c57705b" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "huggingface/datasets", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a07929b3fc1cfc28", + "pin": "febf44ca13d5455b7245c648ef9b34164b78e5cb", + "pin_role": "vulnerable", + "repo": "huggingface/datasets", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "0637029194bd7378237b4dc944dc5cf9f2b63db9796f27410a74a9d567b66dc4" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "huggingface/datasets", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a07929b3fc1cfc28", + "pin": "807bd01afe28c3f21b41db2a524a68046b8e0423", + "pin_role": "fixed", + "repo": "huggingface/datasets", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ffd286c8588a77929639a89e4a742e15306b642af14aa906c721165df804ccd3" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "ibm/mcp-context-forge", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6548e1527e82bd99", + "pin": "4d31004661858a2e99055b3c0c9f14218b8f7120", + "pin_role": "fixed", + "repo": "github.com/IBM/mcp-context-forge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "5542613f6d2eb9421b8213b8bb864894f0ecf9fe64945681019230ef0d75cfaa" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "ibm/mcp-context-forge", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "0f8e0ad679f1fff685f486e17f642ac863c8ca9e", + "pin_role": "vulnerable", + "repo": "github.com/IBM/mcp-context-forge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "6c2adee34e9e8384535ec1073eda60e2ab528ac77c36747802c303e1f5e9ffe8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "ibm/mcp-context-forge", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "0f8e0ad679f1fff685f486e17f642ac863c8ca9e", + "pin_role": "vulnerable", + "repo": "github.com/IBM/mcp-context-forge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "7ce70e9b20107cc7ebb87d173da765fc53ffd268e521749a06a9a1f38d746845" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "ibm/mcp-context-forge", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6548e1527e82bd99", + "pin": "0f8e0ad679f1fff685f486e17f642ac863c8ca9e", + "pin_role": "vulnerable", + "repo": "github.com/IBM/mcp-context-forge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "c3e54975464323e58ec96ee4d83e7bc08baf94553d553a8dc3fb28cd9c70ff21" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "ibm/mcp-context-forge", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "0f8e0ad679f1fff685f486e17f642ac863c8ca9e", + "pin_role": "vulnerable", + "repo": "github.com/IBM/mcp-context-forge", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "d3173c1e43eb6402a71ea2dec1592913dc078a2194ba1c1d509ab129a3180f6f" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "internlm/lmdeploy", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "0924befc49c7bb18", + "pin": "71648d239c978452720a6d6692fe914efc8a7b94", + "pin_role": "vulnerable", + "repo": "github.com/InternLM/lmdeploy", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "e7e4872db40f0420547ed622fbdd7a072b64a7ba466d1ccfff68e691cee6ad99" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "internlm/lmdeploy", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "0924befc49c7bb18", + "pin": "03c313006d17cc3feae86b633c44206a997c44db", + "pin_role": "fixed", + "repo": "github.com/InternLM/lmdeploy", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "f7d95f43fb2df20ebc4c37fceabdd00ffd8159f404ca384481f1764252382388" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "iximiuz/node-diskusage-ng", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d4ee6cfeba71e398", + "pin": "0df2d4369fd415e30536572fc5133961c26c128c", + "pin_role": "fixed", + "repo": "iximiuz/node-diskusage-ng", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "e79582de3031bada2617a0667ef7ff5cd7183d4aa885f55a665cf0ec88d17624" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "iximiuz/node-diskusage-ng", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d4ee6cfeba71e398", + "pin": "e2094560fbae57a46724754e1d0c0e70440a9cb0", + "pin_role": "vulnerable", + "repo": "iximiuz/node-diskusage-ng", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "fef35272853e7f3692efd54daa01c12862953352fa6ccbbb5e3f7fea70c63d78" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "jarofghosts/glance", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "772e18821701d60f", + "pin": "519d032145a1f325aaa37bd5f71fd6c2e8d3a4c6", + "pin_role": "vulnerable", + "repo": "jarofghosts/glance", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "89a0496c7663bbfd67d660c9f481c12420da2dd1bdb29dc079735ee7a0a49626" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "jarofghosts/glance", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "772e18821701d60f", + "pin": "80b38c799fa72bf8912902b64156cc3cfbc8eaeb", + "pin_role": "fixed", + "repo": "jarofghosts/glance", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "d3241ceaa50a7d23a4650e6a2a55372b08ec96b35b0bede844bc40e16e818ebc" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "jas-/node-libnmap", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "250de1302c7e541d", + "pin": "13a7313ef17cac28e60f9b7ea209bde1e22654b8", + "pin_role": "vulnerable", + "repo": "jas-/node-libnmap", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "5d03535f2df2acdbc319d9e6b20da65d51f3e810b80f3c8f89b5074a971a3f1c" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "jas-/node-libnmap", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "250de1302c7e541d", + "pin": "7898ee76c4bda544b26fdbc07114a03180c35faa", + "pin_role": "fixed", + "repo": "jas-/node-libnmap", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "78f977cfc096e34b4eada7f798ad2973ef45728d0d01bfab6ac9e2a3257827ef" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "jashkenas/underscore", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c10bfb006f2da55a", + "pin": "0ea4df08bd3d5416c60d981228084885cc0bea76", + "pin_role": "vulnerable", + "repo": "jashkenas/underscore", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "1ea4b86dbd84581b1d7b7cabbab9f28c8b213416a60778879666ff42d23fd7f1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "jashkenas/underscore", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c10bfb006f2da55a", + "pin": "06f5e7ae7acf44d8b0e2a2bf06f89baf844ef66d", + "pin_role": "fixed", + "repo": "jashkenas/underscore", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "7647021f742da24c660b2d407886771786e957076c4cf336def560a570dd8778" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "jellyfin/jellyfin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a73421efb106ab0a", + "pin": "9029cd726525266c7bad46b0bafb436deab9c4cd", + "pin_role": "vulnerable", + "repo": "jellyfin/jellyfin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1f6f207a758582de0c0e6b331b19fe119abe18727d45ccbbe09aabb795f3a292" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "jellyfin/jellyfin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a73421efb106ab0a", + "pin": "234c4363349b22991bafa2c9e9d1d72e030b5659", + "pin_role": "fixed", + "repo": "jellyfin/jellyfin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "32fbdad39eaf5177db4ad0a11d53e785b30bc7b2376ad9d460f29a08429bd0c7" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "jenkinsci/cas-plugin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "0458e3fd444409f9", + "pin": "1e2cb01065f13719513ca3d547369d2866b0abc7", + "pin_role": "fixed", + "repo": "jenkinsci/cas-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "b521216bb4106738b3571ad3902d08f6230aabd88cf3a8f9f26f1c8ec01304cb" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "jenkinsci/cas-plugin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "0458e3fd444409f9", + "pin": "71d7b2c4e1e0e379b42b4c6a3cfd23e61f6645da", + "pin_role": "vulnerable", + "repo": "jenkinsci/cas-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c87d2871907798fa2e73d31381e9d63089b0388033f096d247373fec07c2cb36" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "jenkinsci/google-login-plugin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6bdccabcf5b9fdc9", + "pin": "629863bdb60ddfd9738222cf5e7fb4aea4cf1e1d", + "pin_role": "fixed", + "repo": "jenkinsci/google-login-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "3d6ddca5eb264d88411b86755909f1d2abddd09c129cabd54c96ff26b4105316" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "jenkinsci/google-login-plugin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6bdccabcf5b9fdc9", + "pin": "11110e792965849be9f1a28caffeb2b07a18fa3b", + "pin_role": "vulnerable", + "repo": "jenkinsci/google-login-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "e055b898802279bc63204cc601e29f7f1018efad7228cab0cce00ea5866ecc7b" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "jenkinsci/mcp-server-plugin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "91bc832e70680c92", + "pin": "648c9fc182c37cd025528cd9acefd67ca63d1be9", + "pin_role": "vulnerable", + "repo": "jenkinsci/mcp-server-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1060c63ff0fae3af567448f3d4c60d9c159b61ccc358964243eb152a9ac38865" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "jenkinsci/mcp-server-plugin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "91bc832e70680c92", + "pin": "1eb5b7b9395dd96cede9cafe21c98c447912b6bc", + "pin_role": "fixed", + "repo": "jenkinsci/mcp-server-plugin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "369dffd1e730d7997813adfbebf1481cc68987cae0d0085e47b91a26d5330cf8" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "jihong88/suneditor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "137fb3496a3a75f4", + "pin": "362e3e612193b8e909685eb74f65684af8f2a6de", + "pin_role": "fixed", + "repo": "jihong88/suneditor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "7e8b6c484999229b23d50d9f5a4c4c5b2a8d954a5d64230981b1c6705b760fbf" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "jihong88/suneditor", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "137fb3496a3a75f4", + "pin": "f5c7c341d0e908b037f18af0a83356d521b3b871", + "pin_role": "vulnerable", + "repo": "jihong88/suneditor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "c461154e4dbd74e35a4ed2e85de7b076f0582beeec459be28104c38f616c7565" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "jknack/handlebars.java", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a4144258dffb3b8d", + "pin": "0aca422c4000ac672eb33e3cc51a56289250bf43", + "pin_role": "vulnerable", + "repo": "jknack/handlebars.java", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "7ab301e1614979f44c353e665540582493f78ef4bfc41209562c19b900710f8c" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "jknack/handlebars.java", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a4144258dffb3b8d", + "pin": "cac1f4e78b370103ff3cd826dc0ce3ba22faa7f3", + "pin_role": "fixed", + "repo": "jknack/handlebars.java", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "ea95e8387dff32ded9dc7b04c11a76a545b4e2ea6db0076b9b13971a59904bb3" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "jmespath/jmespath.rb", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "858330e01d3cf9bb", + "pin": "c96ba3f96eba8121c16f01d0ec57060aef467d5c", + "pin_role": "vulnerable", + "repo": "jmespath/jmespath.rb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "033cda2b7cffa5a5fa6abf0b7f2cd27ba78d916eb3cab8c79decccd8776f4a3f" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "jmespath/jmespath.rb", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "858330e01d3cf9bb", + "pin": "4914cc5371fd94e267c3591b5083242a24a661bb", + "pin_role": "fixed", + "repo": "jmespath/jmespath.rb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "d44c4555a5ae19aa17b468ec5cff56b33a0b221df52e04d8abcb656399499dee" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "jooby-project/jooby", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c6a49339d4f0c798", + "pin": "3058e07dc5b328868a90d1d81863b07e70700eba", + "pin_role": "vulnerable", + "repo": "jooby-project/jooby", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "dc2e4cd5bd963643702d2b832ae170dd25744162e4076e36687256a09e69d089" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "jooby-project/jooby", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c6a49339d4f0c798", + "pin": "8d3acfb8f96f1536f83161d92034e6d7de66f6b1", + "pin_role": "fixed", + "repo": "jooby-project/jooby", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "f83cd137b85e651ca5299c5a42176b797ed4964cbef31418c96d63c52fdb65f5" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "jowilf/starlette-admin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "4b6526d132e9ac86", + "pin": "54897e8eddf526185de64c77ab26ee17f6eb82bf", + "pin_role": "vulnerable", + "repo": "jowilf/starlette-admin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "8ec3596444f3045684242840e9a1df19879383f2733aca8f8af6f6cf8a96d388" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "jowilf/starlette-admin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "4b6526d132e9ac86", + "pin": "3a3ccf8319891f26abf9f3c83b98dac5b953f27c", + "pin_role": "fixed", + "repo": "jowilf/starlette-admin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "f3d39162fa14446b207aabe7bf3c913dc32a9637ac83352ea5cb2fdbb43720a8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "jsonata-js/jsonata", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "80abf1d5c4a3f6a5", + "pin": "3f279018190c8fa3e3823753fe75b3e51dd87a0f", + "pin_role": "fixed", + "repo": "jsonata-js/jsonata", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "3df3c6d9941352dd2861427da56b94ee335f308d0a2a27c6f745aef60349c80f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "jsonata-js/jsonata", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "80abf1d5c4a3f6a5", + "pin": "455038ccfce2eb65a8eec5be03f193eaaeb4518d", + "pin_role": "vulnerable", + "repo": "jsonata-js/jsonata", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "4fde61a570906e658d9b14db0e5d1f5acc0c7489951421bff2afde25033ff73c" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "jsonbored/gittensory", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5ec37c0f475001ca", + "pin": "212da777bf7b2234f41ac52c20e8fd720030a71d", + "pin_role": "vulnerable", + "repo": "jsonbored/gittensory", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "5d8175fb21a4649bdc8730358e9b87adb90b2aafc4da5fee203829663e4f46a0" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "jsonbored/gittensory", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5ec37c0f475001ca", + "pin": "b32082db3cb9c901de02e8779ad5d14c9c427eec", + "pin_role": "fixed", + "repo": "jsonbored/gittensory", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "af845e9e332555096dd350401977b2f07015433f3db8a040891d9470f3f9e355" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "keras-team/keras", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "68d44ef338ef3470", + "pin": "173f42c6109dc8827fcd38149f4aa1c1d12497c3", + "pin_role": "vulnerable", + "repo": "keras-team/keras", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "3020ac6c3186d7974953b1c4da65b80141b81aca5203436ae7a2d7aca0870944" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "keras-team/keras", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "68d44ef338ef3470", + "pin": "c49e68c26b1328e3453c1de638c97dee2dbad95c", + "pin_role": "fixed", + "repo": "keras-team/keras", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "8fdb85a6bfec89f0715ea81e83fd91616f92c59954c092e79272154f202b7488" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "kevin1024/vcrpy", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c74525e844650de2", + "pin": "f53e076b3c39d0565a073395b909deebc735a36c", + "pin_role": "vulnerable", + "repo": "kevin1024/vcrpy", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "2e444ad34ee5f47d73f0cfad0a10c70363337b4ddf9067ecd1b8072d8232652c" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "kevin1024/vcrpy", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c74525e844650de2", + "pin": "96557dea5eeb73c6ca76efa256f84b4b36199faf", + "pin_role": "fixed", + "repo": "kevin1024/vcrpy", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c492d325f5ff82b5f817aa4be1440cec8595054dd0719e07a58ac5501b2ae7eb" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "koajs/koa", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "111a5a80a3abc2c9", + "pin": "418b5510106a023929d1810b97a6b0922e6e5d3b", + "pin_role": "vulnerable", + "repo": "koajs/koa", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c7ae403742450deb2bd051ad1231121d2117ba56fa72a038c82d58d207cb3870" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "koajs/koa", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "111a5a80a3abc2c9", + "pin": "3b5ae261f023792eab7eaa93770e500409d38edb", + "pin_role": "fixed", + "repo": "koajs/koa", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "debe34831afca6f8220b9952036a2d4570babdb5e321a2f8dbaec661a016bd50" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "9d0cb5a6f5634464759998ff68ee0b7d37b5771e", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "9950b85412b021ebabb11eea4c490a660ad380d14c673a87c3fb568ba4bcfac9" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "da3ff1fa9bcebf039bd1a4da7f71e986776dd367", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "656df5ff8e69dcdb1f9ba1ed52d734966eb29773bc745587483a355743b8eb5a" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "af6055c6902f65d5f220fe295f2abb24104cdd92", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "91652a4e776fbce70cde9e4a99c6da5e17da7f8d6d0404867c61eec04161b6cf" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "7c75ad32c647c64e54f0f1b1981ffa3225987aba", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "e53bb3a217dc4737e8dd03671de4f6a895599024070a985a268c65a034295e7c" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "80782401589cd15434f7e86711ede5ea39bf71ab", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "3d7aba22444811a337abcad0e4fc62990bb704d3a10e72d893342fa94699026b" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "cfe77d962b5d5a2e0885a347777d0aa85141f118", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "HttpResponse", + "source": "vibe-py", + "status": "path", + "unit": "5f18a3026a51f7140b7aaa3aa8563e8b6fdda6065d95e19e25b1dac4b9ce0e00" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "4cd4dc812fb405225b4792d6ecb4301cee20fa8c", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "0fccc306ce80cb4cbfdcde0a2e56d637bcefa9dd30423d6c54a4f77860afe740" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "0a990e9255948c76998f1aeac7780c7b11f50412", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "1e2eaa45661345f1b6759d968d7696dd0d96d6fba1350a00e4d0a2ebaaa2e391" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "99d1ad32d71d33196f48c8ac04cc0aca772b29f4", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "8b9a8ff0e32a327df75eb8a1811464d5f34690079d5930139dd917063bdd2809" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "fc96af91910ad37126362b1b8e743cf7c094f25a", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "245d0e939b7c1ccf098c798492009e3a73ea17400fa613dd865cd369d2e7f383" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "8ae5f0ec67338e62f953cef0dde71233b04d0054", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "653c48df493f31c2d01c973d1e379a180fbe6a6edc83a500bc62509112175f41" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "44221e5823c91c4a7246430bc722700610c65a02", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "3719fe21d45b50b35458bcd2e263e4baee67adbd3c98adf0eaab6bc6183c5651" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "14389c71f0787a33794550664189cfe819ba8a4c", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "1209a6cc8c1548ed83d4a9a09d6a27f706a23e69cf0c261fc5e3a27536a83306" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "bad2dc96bebde4164c69cbf4e3916107baed2c6b", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "362c90495dc468bb732c71f62d71ec308854161de31ad18d2a870056d947ddb6" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "974736e91b25de05f047216b71add0bac017fc6c", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "b52e53fec9707b2b442c4dc7a41d376cf76946d2c45c2eb600c9477fc6baebaa" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "c3ca3e0b2ebc6102cafe97c52d8ae6f423ca7f80", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "477e3b90b92e622888dbe0e9d3a23b31271ddfa3104a5ab326eb9e9e765aa01d" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "fe7f844765b191f1eb6ac3d273f3052aaa903ca3", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "HttpResponse", + "source": "vibe-py", + "status": "path", + "unit": "660c63c4a73bfe64088ae3249e40d9c5d69a6f8a505ff671217c5708a345c5b0" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "1874c7656b61a450cacd3a849f8d7e77e1170e8a", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "4d60c386c801bedb61c1461fced29a3cfb50b09d6435e8617c60398343719d93" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "2caeb0b2491b4c212e65e7e8bbc624790e5d0c77", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "f1fddcc1354a29bef55610ee2b73eaa440192f2f18a0d22d08057b9d1e1b61b8" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "42bd6eca4d5cca731bb9d628904804c4e8c2d2e8", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "6d9886c38221b2f9aacf83749218ac5ebc354a6fcc4170e6c78bedb92b88296a" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "b68539f253e0cb85eaa4ee00dba2d8364420bb58", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "5550fec4a81c4c9cb22d7312d8a63e1fb2b03c4aed0c1f316d44c1eb27511bac" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "ac0aa0583e1d30a520cef58673edbe672de708fd", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "8ff87dd04140f0137ea1891f220b1276156ce10a58be5a49d0c8e07be531ffb2" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "d23e38bb63d3369b3c4edd5a8013cbee65555d81", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "f24b19cc0f67247eccb274521a62741fef8f4729f0ddc9b5c1fa561a4947182a" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "d90684e2ee452ccdeb8d9bd80232092c8bbf99a4", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "83523c9d83380d4cdae593a593d361493e00d18e61740f84e762aad41b991e18" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "58586afb17e32077eb300360736f13c692a8841d", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "c6c9bde6630678377d250701073c5c223c7892e6ff8f2f8e0293dea22c5b5e7e" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "85e23cee133a5d4296d574aa2318c066f306ace2", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "HttpResponse", + "source": "vibe-py", + "status": "path", + "unit": "b9b15958973c83f8d7b58372ab5ba58eb191c400125579d5ae8c5b52d5d1368e" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "36262a3b2c996d40ff972c9967a220d45d9ca151", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "b95ec12e4e126ad558e944e2c260116ed6a63f5f3ab97fb5cbcdca75a931ad73" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "15fdfa1ae4bc77d4cbfe9bb6aa7644fd594323af", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "38a5545ac9ef67e15db720d1396a2d5915f9d06d6f4772012e5bc95f33770376" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "3c600a7b758811f3caff32162828c8341dfa525c", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "c8bbe9be91c976be97b7ca387048a7d4537d9f6fcc6cbad0a541d1080629d5a6" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "b6cce96a86446468b328902fd520668429bad0d7", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "ffacd53f1bd75155e63b318fb9cba27ec03e754841e1eb39d1d4fa0b2c3dfca2" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "e7bbf858740909bb48853421c70ca9520aeefed1", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "HttpResponse", + "source": "vibe-py", + "status": "path", + "unit": "8fd920175fc43b91b4397acffacb10ab8f7fd0ee38bcf2d2f3ed06a3fad0dfe9" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "d0884edfbd89d759effa93c947f893c2ed0e5dc0", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "86c9598ebe3dcda261a69ae545513f6ce73101f3980066e4506ece99bebea84f" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "d93efeb3b87ef2f0f42aaea7ea3ce9355ebbeb44", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "e5190fcc57505116f79a31c51aed69f8a1eea13a8ae3e7265f44c72418277ef9" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "7808f80cb983952283dd3041af267416d8b5eb2f", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "2b807ff54e6c47e941124c16d0c27c691cef54f2203060a3a6ce812d478c5261" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "fe909076f3ebc3e0df374931754cfb1e5160fde6", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "401aefb4b4791301ace2d770d321c6b26743b0aab7b96f8b410254c704be6d2e" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "4615d616a40050eb0329e1fb72f3912fc1dc6e90", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "22d186c93498e21418b6c1d0547a73374b13041d8afc89a80d9540fa658b6b42" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "9eb99665c4bc204d451c2f2461c3f9272c80193f", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "dbfb6df14fe37f8c0efda5f16643297fb0550dfc5ad5805d4e4b844d967773b2" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "93077533f19a9335a9c010ffe19592004ff34f77", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "f0da8cfe4ac1e586aa7903d72e67b44500bbd5306d72b4b342d10613efc69222" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "c06d1ba585070ae771f78e4dd6c28ee07418cc42", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "2b8fd73943f456da266434470333a7775f55d9a41953e97a000fdaa3257b6a30" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "0985f6272f8f8e201d32aca7e2c70a83a414f12f", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "a612091f452e60f28f44eefec641175170dc5db04456a39a099cbb13c50b4d2c" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "4d01f0fdfc1f4b002304db41aaa3cbd49795e167", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "4c6600facd83bbf234a32d9e28ac494fb516df6e3d9e9dc28d720ff35252d067" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "165d81647e70bffb773e6489ea84ccd7dbe5e520", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "fb0ea8cab8c9430d22d1b0fdd65a69146fa95fbff94e720b4861b96538d992c6" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "7f7ab01599f8f44adddfd0da1a15b659857cea6b", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "e81f91a56058ac1473579767abea57064c53d7d007797a854314814e3c35ee74" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ebe7b0d204806305d867376f133c694dba40be2e", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "unsupported", + "unit": "5851ecd96a449f98b05f243bfda0a7cf3af8612b27f53c414ae1f4ea67242a7f" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "8405c6ac4dd48e2b30c60995ab67163eba686d38", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "328621ef2a94632e5d37ea6267d17b766233384cde35c07e29a4eb672d40ba28" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "07a3068955c73e61789c4dd4e9178e95f57e17f6", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "HttpResponse", + "source": "vibe-py", + "status": "path", + "unit": "04b2eae2128608dad460ba8275142a41a44e32c4243a29e2a6fb2c9ebf3d8f1a" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "d37b8c7447425234742172f8fef42168441ab68e", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "33337002ff5f5a189610b042522ceea254c9d107c1f24771b4f616a0f96f636e" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "eae9e57f28891ea7b15fb44cb8e84cde4ba18646", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "02c09a783cbf058856fc2b448406f3ffa6fbfbacf9b70f4e5e22fd741a5c7699" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-0", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "0bf4edc81bae933cf46475c090f6125f4b69ce45", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django", + "sanitized": 0, + "shortest_path_steps": 4, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "956260164cb21a47c499e5598491031ef303418943f5096f225a87162b588574" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "b27b4f775c8c0500e943f93e81fdfa15dab383c5", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "8bd8c5aed69eae3019cc2d3654b36bdf2b31435e6a020a389cd103696a2f874c" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "14f7e6f300dc75dfb750ab194fb1b5b3eed6d799", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "redirect", + "source": "vibe-py", + "status": "path", + "unit": "1d8397ef4a9fde7b48e2e1e871bba0f960a802cd7823ecfc10e9dfaddb955ccc" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "2e946a999adf8c5e83f234fa8786803dbeed676c", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "c9db92476032eb4296b950a1eff8fa4aaa26f11542a01a5cf10c7b2e32dc6433" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "4bf34bb007cac0535cbc548baf7285dad869bf2b", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "d3e0d0f9b0f4b723080989b5486395cda0a5b186a674022ea70e7fa7ab561323" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "9b07826918aabf8a209f03ec422a277b95d61c01", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "pickle.loads", + "source": "vibe-py", + "status": "path", + "unit": "44ff3b3e61c02744830c4abea872821ca7e0f94950c082740c5c48ef13604e94" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "2605dbad5bc35f58850cf23335c874875e977f32", + "pin_role": "vulnerable", + "repo": "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "4103e979a99233c3e71fdfe9f1cdcbab34a2c60b5351b75c5ff5dfc287b962d0" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "koxudaxi/datamodel-code-generator", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f73ecbfda2bcadef", + "pin": "da771cfff3713e44a3dffed7bf79b7f946218801", + "pin_role": "fixed", + "repo": "koxudaxi/datamodel-code-generator", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "53e596dabf90b2992d5b3e50394791859b393beedc8f84e00484e37498627ff0" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "koxudaxi/datamodel-code-generator", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f73ecbfda2bcadef", + "pin": "1e8b3dba6fc740e2a3456b9ec1ba298ac1ecd76e", + "pin_role": "vulnerable", + "repo": "koxudaxi/datamodel-code-generator", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "6daaccf64706e876dd505c65a62aeacc1357f3470a5cef7b1ac874032a6fcf99" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "kozea/weasyprint", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6768bfae38c6859d", + "pin": "204c96406d59db44718cad360ca2647d6b87f273", + "pin_role": "vulnerable", + "repo": "kozea/weasyprint", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "f376519889a00950f5af67eb15c639306ea70da7235d3be4a94dbc19cb096cf5" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "kozea/weasyprint", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6768bfae38c6859d", + "pin": "099a88245490e6f3188bde1b8c28c07f4f5556e7", + "pin_role": "fixed", + "repo": "kozea/weasyprint", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "f3fea4e334f49ef6fe6b17121fef553eb8e33a9ffa13e6d6cbc4c448da996a7c" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "kubev2v/migration-planner", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d670253fa209671c", + "pin": "8403b2d84818f271605c70081447dd513ae0297d", + "pin_role": "vulnerable", + "repo": "kubev2v/migration-planner", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1aeebe2e440bdd70525c31f93180f33be93f820db5ba46a2e59c371ef83ee794" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "kubev2v/migration-planner", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d670253fa209671c", + "pin": "2e25b2f22fc9de6658f56ad0707691619e020b8c", + "pin_role": "fixed", + "repo": "kubev2v/migration-planner", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b11c8a8a24d3809c0507228568fe7cc05ca0a22ed28cb19019adb13cb619d63f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "kylefarris/clamscan", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "33260f3e6c8ea6d0", + "pin": "92b2303f505810e597435e5843bab522d679c133", + "pin_role": "fixed", + "repo": "kylefarris/clamscan", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "7ca409c7dbc1c38ff005624e212efc6d424cb421e27b482dc8dc0d6881f4c11a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "kylefarris/clamscan", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "33260f3e6c8ea6d0", + "pin": "1805f86fd95345740e30a44bc94be401a662b149", + "pin_role": "vulnerable", + "repo": "kylefarris/clamscan", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "fc364d7ed77c7c0508da00e5ba847ec0792f3bc373d8b4297747189ef42d1ae0" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "labs64/netlicensing-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "32ef8148a2c08f58", + "pin": "0d20f584197dbc456788c812bc0534ccdc0dd364", + "pin_role": "fixed", + "repo": "labs64/netlicensing-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "2fb2c9314a483787168a450f50430721f9527f913aa0eae07298d5334cf4f137" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "labs64/netlicensing-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "32ef8148a2c08f58", + "pin": "2640cfc7e0825dd9cd6ddcb10e72d188f1e5431a", + "pin_role": "vulnerable", + "repo": "labs64/netlicensing-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "78dd291bb2ef83ea3a87948c0ac0027c6d667b9044093e766e2bc91bebe83936" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "langchain-ai/langchain-nvidia", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "54586b5a24655adf", + "pin": "4b4033aaaea9a12d51a65ffd7c8b9d367a30fa22", + "pin_role": "fixed", + "repo": "langchain-ai/langchain-nvidia", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "2ece75a0240ed36a811c381841aa6d440af2b9774ddacb1d7a31a67ec267b0b2" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "langchain-ai/langchain-nvidia", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "54586b5a24655adf", + "pin": "191d816eca4163b0e9ba082ffc6e1bf10552e109", + "pin_role": "vulnerable", + "repo": "langchain-ai/langchain-nvidia", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "e60f6b788a196db9bb671d621189b79a5526302a6d09c2396d67fbe0b9ab3c24" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "langflow-ai/langflow", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "474f96e2a9b3d202", + "pin": "1f68c8a38c25d70174882632d94813716239f46e", + "pin_role": "fixed", + "repo": "langflow-ai/langflow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "4a5e8e8ebd7ecb0e252280af0cb38a1d7794757728b912525322ac26df5ee223" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "langflow-ai/langflow", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "474f96e2a9b3d202", + "pin": "d94b122886b5fbda0fbc11fec0b978e29eef8af4", + "pin_role": "vulnerable", + "repo": "langflow-ai/langflow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6a888540443061d3b37c06f0cebc70cffdfa70e0aa940626e86cbff9829310fe" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "laravel/reverb", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "a09692dc94164db8", + "pin": "5b0b7a08ccd4a0b9c35389372a408d78467ab7b9", + "pin_role": "vulnerable", + "repo": "laravel/reverb", + "sanitized": 0, + "shortest_path_steps": 10, + "sink_kind": "unserialize", + "source": "advisory-fixes-2", + "status": "path", + "unit": "139cf84e79c4efd026a064b2ca0a3d7ffff87b54eae1275a07c0d69ef4981e27" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "laravel/reverb", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "a09692dc94164db8", + "pin": "a9ccfb80eaaf4415057783c1a7133a79c3e27f1c", + "pin_role": "fixed", + "repo": "laravel/reverb", + "sanitized": 0, + "shortest_path_steps": 10, + "sink_kind": "unserialize", + "source": "advisory-fixes-2", + "status": "path", + "unit": "828e88b656245a1d0865c79b2ed023a49e78607a4ac81d70ccd3690f4419d2d1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "73b3cbceef8669056e9da5e2f2c78944eb139af5", + "pin_role": "vulnerable", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "6cce78d7569ad8db7ca0a61d7078198f666502d26ea6c0afb03173a8a4bb16ef" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "82047c0513e43a83", + "pin": "73b3cbceef8669056e9da5e2f2c78944eb139af5", + "pin_role": "vulnerable", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "6d2dbed1ab1c9d8ac259dd4227be69641fa59d52e816a8dc547ade01d0b9b0c4" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "98ee23cd6bd31cd3", + "pin": "73b3cbceef8669056e9da5e2f2c78944eb139af5", + "pin_role": "vulnerable", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "ab4bb39be535d70cd95e9035bb958bfc7418576a6ff40a47551894dd140317bb" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "98ee23cd6bd31cd3", + "pin": "aaf42fe0c6bf05dcf2ff125750b7bd836e76fa3c", + "pin_role": "fixed", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "b70068cbc646bd01d3e10986e002f648a74e9d798900dc59cf3039b749c95c18" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ff168d95d8d9496e", + "pin": "73b3cbceef8669056e9da5e2f2c78944eb139af5", + "pin_role": "vulnerable", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "c6ec9478c125ed780d7013c2807f2cec1878f44253667dfed319c28cbfd17d4d" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b1bfef46dcd3b9a5", + "pin": "aaf42fe0c6bf05dcf2ff125750b7bd836e76fa3c", + "pin_role": "fixed", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "cd4d095d8380a2fb7ca02fc6abdbae5249cc06455db2929875533f4aa8b886dc" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "82047c0513e43a83", + "pin": "aaf42fe0c6bf05dcf2ff125750b7bd836e76fa3c", + "pin_role": "fixed", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "d1bade217be8d345cf5d0f0442ee31924187acbb98779dada95274a77462f696" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ff168d95d8d9496e", + "pin": "aaf42fe0c6bf05dcf2ff125750b7bd836e76fa3c", + "pin_role": "fixed", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "d561db250b892b91feed7ae877900e1e25963444f73c7699576e010f06da73cf" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "learnpress/learnpress", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b1bfef46dcd3b9a5", + "pin": "73b3cbceef8669056e9da5e2f2c78944eb139af5", + "pin_role": "vulnerable", + "repo": "github.com/LearnPress/learnpress", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "ed78fd5a7ab30bcd6e8ddd27c706a19cfd89750de4fbf81c0b567946eb94db83" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "lepture/mistune", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "25f75d77a669b54e", + "pin": "6d64da0a2db1efba00d1571f10facf6782c55231", + "pin_role": "fixed", + "repo": "lepture/mistune", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "0f2825568461562f2a915a4f16ef8a4931290fd20a9801470aeb12677e66e3f1" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-0", + "group": "lepture/mistune", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "25f75d77a669b54e", + "pin": "b1b3da35657871d79bb9157089b90e9702b419bd", + "pin_role": "vulnerable", + "repo": "lepture/mistune", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "bf22bb44bcff4a5baf5d550c9d3e83e5f3ca607475fb51deaf4fb6fccff3d73a" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "linuxfabrik/lib", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "47069df6bfb3dc00", + "pin": "e6783b9508f84c2f861fac2e5d4226ab4b980d8f", + "pin_role": "fixed", + "repo": "linuxfabrik/lib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "444c1f41fc23ad656a8bf98dae58b36d0f1daa214ab030682f26111dd389e58d" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "linuxfabrik/lib", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "47069df6bfb3dc00", + "pin": "4d0615edb1c506f36b8324d4f0bf1de259c9023e", + "pin_role": "vulnerable", + "repo": "linuxfabrik/lib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "c0c8b5cca070673ea4b4bb8f08dfff86b7781780e300720c4051aded035052fe" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "linuxuser255/vulnerable_python_apps", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "91008bf44ec058c811f5c7b71fe35ecfa5ef5893", + "pin_role": "vulnerable", + "repo": "LinuxUser255/Vulnerable_Python_Apps", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "cd80750447cf7af67ad809279718d98106c71705fef9ff7254728bfff4ece5b1" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "linuxuser255/vulnerable_python_apps", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "cedd734d0e28cf81fc0bf9316969aa29c15be9fa", + "pin_role": "vulnerable", + "repo": "LinuxUser255/Vulnerable_Python_Apps", + "sanitized": 0, + "shortest_path_steps": 9, + "sink_kind": "open", + "source": "vibe-py", + "status": "path", + "unit": "2ce605ab5ce7ad3a1fb983cd6bddf3924e5da3010d2252a0a4640aab4e5921a0" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-0", + "group": "litedb-org/litedb", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b0a899116dc36b85", + "pin": "e5883578c1c1fb4bd66e6f48ee5b155a6f49cd5a", + "pin_role": "vulnerable", + "repo": "litedb-org/LiteDB", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "510ad48af03ba4a1a2a06dd254b135311dddb62d9fe5a2e8e8b12627586e6b13" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-0", + "group": "litedb-org/litedb", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b0a899116dc36b85", + "pin": "2d794c48ed68aaa28cdc2464da3843c5edabdb4c", + "pin_role": "fixed", + "repo": "litedb-org/LiteDB", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b414718a8a5f79739b88db24da6ad9da8e48bcb6b5e2dc99158848cdaa226767" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "manuelz120/extremely-vulnerable-flask-app", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "2e3206b4615be707feddfe4ab7106286bb7a436c", + "pin_role": "vulnerable", + "repo": "manuelz120/extremely-vulnerable-flask-app", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "8e22ee30441b20484090659b0c97423c711f5d10219041bf3a399623fc056a07" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "manuelz120/extremely-vulnerable-flask-app", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "315885053574fc1dce4bdd8d67c860ac915c1bc1", + "pin_role": "vulnerable", + "repo": "manuelz120/extremely-vulnerable-flask-app", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "session.execute", + "source": "vibe-py", + "status": "path", + "unit": "0f9070df9dc334f981cb01008c260b8bff78dbdeb48ce672830ed95caa8406fb" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "manuelz120/extremely-vulnerable-flask-app", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "b115bf009649608aac3b3c01d0995a8d1d21db02", + "pin_role": "vulnerable", + "repo": "manuelz120/extremely-vulnerable-flask-app", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "text", + "source": "vibe-py", + "status": "path", + "unit": "5e352f797b1422b0df477bce4730a9ce33cbd0837c3d63da94e4d8801a9a4b64" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "medplum/medplum", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "dadccb128ac0e120", + "pin": "5d4a8654b02aa67c444f96ae1eb5663c09854006", + "pin_role": "vulnerable", + "repo": "github.com/medplum/medplum", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "505097494da5939404ad7d5b4af2b1c4a10efe94048084492d6ce60ebaa04c97" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "medplum/medplum", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "dadccb128ac0e120", + "pin": "7ae10035ddadde4dba7b18d3156553940465b3a1", + "pin_role": "fixed", + "repo": "github.com/medplum/medplum", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "unsupported", + "unit": "84ff8ca2d98a1b5d1ca4bfaabe7d19e03a396042b228c8d18d1185a178389702" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "medplum/medplum", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "5d4a8654b02aa67c444f96ae1eb5663c09854006", + "pin_role": "vulnerable", + "repo": "github.com/medplum/medplum", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "91e261c54bd2c3c3a9ac04e48894ecabaca5b13e7db4fbd5578f9d266098117a" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "medplum/medplum", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "5d4a8654b02aa67c444f96ae1eb5663c09854006", + "pin_role": "vulnerable", + "repo": "github.com/medplum/medplum", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "a308dfd59bc398824e2454bf6cf6cfd5b7880e5b948a82424f14753d2b6fcdbe" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "medplum/medplum", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "5d4a8654b02aa67c444f96ae1eb5663c09854006", + "pin_role": "vulnerable", + "repo": "github.com/medplum/medplum", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "unsupported", + "unit": "ba24eb554458bc97314ed561a7b2f4a4e643dde1205c32de4c8fcdd8c46e575b" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "mganss/htmlsanitizer", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "24d8f1840b67fbe5", + "pin": "43890d5d892845fc71cbfc96beb57185ab11fa42", + "pin_role": "fixed", + "repo": "mganss/HtmlSanitizer", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "7ffa4a229a62266788fbf64890f81f20358b3eb8c35d3ab87d0c339d5bb4b507" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "mganss/htmlsanitizer", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "24d8f1840b67fbe5", + "pin": "998c251fccba0a02cb359cb5a55207ce57848c4a", + "pin_role": "vulnerable", + "repo": "mganss/HtmlSanitizer", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "d19493ed7941e1cd25a76dc50504d97398770d07ebc302dd66d83441e946c468" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "mguinness/elfinder.aspnet", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9f8a60eb48d74bc8", + "pin": "5dbc737bc58c2a5d1b9abf023fd9d75dc59649b8", + "pin_role": "fixed", + "repo": "mguinness/elFinder.AspNet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "80fce34f2377731e3de4355c7ea33bb20fc2fc00a5f388565b23018c7a3ed008" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "mguinness/elfinder.aspnet", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9f8a60eb48d74bc8", + "pin": "f4d2ee59e825eee99b8b1f4caf821a3b7150b353", + "pin_role": "vulnerable", + "repo": "mguinness/elFinder.AspNet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b68e62722a327c9d5ce6774eb96527451729410768efc0b5c7ba604ec468052d" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "microsoft/prompty", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2c857235d0764986", + "pin": "52e7d12e4ab69de948b63ffaf8e872d8e9fd7591", + "pin_role": "fixed", + "repo": "microsoft/prompty", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "33bdfe911cd1b512e5994ee7a3e3ab2ad1f302cab29df3b011c0d825c23536a3" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "microsoft/prompty", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2c857235d0764986", + "pin": "a72fe980155a4d77b006e8dd4acc1e1fcfe540de", + "pin_role": "vulnerable", + "repo": "microsoft/prompty", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b5efdcb84a057f3cd9fd3a30a32239dc06c13536a4e84a66c7a17cb372050c97" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "middleapi/orpc", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9e84429d629c0b6b", + "pin": "ca0993659be6d40d22c100ab1e430f7f03565254", + "pin_role": "vulnerable", + "repo": "middleapi/orpc", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "774cfdecac67499bb35a872931d4698d1b92ebeeb42d21790469e418889954e5" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-0", + "group": "middleapi/orpc", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9e84429d629c0b6b", + "pin": "d19070b299a2422d63034ad0f05427f421447521", + "pin_role": "fixed", + "repo": "middleapi/orpc", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "a6c5c15ca1815f83dfb47428c4a8afd4e60fa1c027b9f33c668cb9a0d77c18af" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "mixxorz/slippers", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "8e6b4b4e28981590", + "pin": "fa7e3cd4cb496e69fb2426e1d1784181a259bf1d", + "pin_role": "fixed", + "repo": "mixxorz/slippers", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "3cce3e8f9ff3f1d261f9b96c844c1e4da07bae72d5393897b3a929be25372edc" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "mixxorz/slippers", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "8e6b4b4e28981590", + "pin": "8b54c15a2c0479421e62551e123a0af18c25c0b9", + "pin_role": "vulnerable", + "repo": "mixxorz/slippers", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "b105689ac24ed334294c434a77bb6d56d5d598830ffe8a5d60ab3be5290b47ad" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "0a36cd5177f3b2c20b433db6bfffe5ec5b7e74cacc34a86ac581f7a0a559432a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e7fc97d83013c9ff", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "5ab444e64297fc19065478104c7ebdabe23cc415f22adafd0cf82c98e4c5cae3" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e7fc97d83013c9ff", + "pin": "d8c9bda46a204ecba1d35558452685cd0674e6f2", + "pin_role": "fixed", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "6b462ea30c1afda572600a10324249223932d36a032eacafac8c837bccbdce87" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "84d6a4202a082e0d", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "8175082f40d8d61d44b54579c84a808e25b89110be5d8fd82feedf7dd5e0d5ab" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "8abefca43ee4ae2c797033da31f85c17bfa7be6b35413d70b0216415c5db9a09" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "91d213946859f33d3f243c43aa8285cc6e8ecb3db1de938f32af775a70607f8e" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "a244d9f010ddb43a09e82363dfabb0e406d411fb5de08ab7d6c9ee367f2a15c3" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "ea02b364d43f179f191fc91fb9962efdb0843a8d", + "pin_role": "vulnerable", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "d27d174d6e8e5f1682a1c42723705e89f0d18c95ecedd0567e313daa9a0aae44" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "mongo-express/mongo-express", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "84d6a4202a082e0d", + "pin": "d8c9bda46a204ecba1d35558452685cd0674e6f2", + "pin_role": "fixed", + "repo": "github.com/mongo-express/mongo-express", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "asked-nothing", + "unit": "f45608ed47fa11ca25093641f6021ec06076c18676abac9b809f31b3b7713de8" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "moquette-io/moquette", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "55d1ce4f29dd1583", + "pin": "4e0ebd996e6166c5dd2ec54d17c2f4f8dd5acc26", + "pin_role": "fixed", + "repo": "moquette-io/moquette", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "a877ce3462da316bcdd82ce9db1d9887e887eaa83157922edb1663413edae1d6" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "moquette-io/moquette", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "55d1ce4f29dd1583", + "pin": "ebfcd892293bcbc12b04cd47b8320c75572d8500", + "pin_role": "vulnerable", + "repo": "moquette-io/moquette", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "aee67be0ba31f99c7a24faa1bad6178c6d37361a308cf5aa10138e6ce4bbcfeb" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "naorsabag/openhop", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "16e529fe8c5486b2", + "pin": "11f6d83576c3ef6c8ccd1d17b7f91f0f71f33e21", + "pin_role": "vulnerable", + "repo": "naorsabag/openhop", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1d21acd0171726775d3da4589b660645fcd43cc026042a2b27e0e0e8374eceb7" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-4", + "group": "naorsabag/openhop", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "16e529fe8c5486b2", + "pin": "adf012493149c497b841815a2ddb74aa55a3b727", + "pin_role": "fixed", + "repo": "naorsabag/openhop", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "f8e004b67ac98dc3392ea4115051e6bd10ce22eb638a762f0f16e1d4200bf129" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "nextauthjs/next-auth", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "0b34438e6e0ba63d", + "pin": "61fc8552f222928d593432cdc08a8d50ed304ffc", + "pin_role": "vulnerable", + "repo": "nextauthjs/next-auth", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "bf2608b00f0f784cc42e4c607f0b1ef50903283779bfb2eec91d2ec187856d14" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "nextauthjs/next-auth", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "0b34438e6e0ba63d", + "pin": "ebe0f1eaf6aeef8ddddfb30adce80b124ce602fb", + "pin_role": "fixed", + "repo": "nextauthjs/next-auth", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "c5104cbf723fa0d55675963d8aa6802780ce3d274efe0012290fc49164c3fcc4" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "nuxt-content/mdc", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b0210cd069757ad2", + "pin": "89a3fd6d7efb78334b9c264fa4e2a1134b6eef1a", + "pin_role": "fixed", + "repo": "nuxt-content/mdc", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "d1d40c8b48d039c1999ff957a015273c30652ca0c45c4eb088052991a2a92f28" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "nuxt-content/mdc", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b0210cd069757ad2", + "pin": "ec176f4c24c9434c513a7b1d2b162ee54d961533", + "pin_role": "vulnerable", + "repo": "nuxt-content/mdc", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "e2e804652a885f640ebf341627f3279d6c965b47ee2ce792e55045ab4d1e1dee" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "nuxt-modules/og-image", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ef603436079b0005", + "pin": "af1e387338b96ab8892b4ac7ff75c768c8438b56", + "pin_role": "vulnerable", + "repo": "nuxt-modules/og-image", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "77f843b5044bb5da935df4b2620bf2abe9e7dceb3147439e883927112eaec22f" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "nuxt-modules/og-image", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ef603436079b0005", + "pin": "959f9ce21abe266f2edf45437c5de6a9d3cfcb6c", + "pin_role": "fixed", + "repo": "nuxt-modules/og-image", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "f2ce95f0e44e73986784b63a702ffa4035c423056cac3667a63140a7e8d795c2" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-2", + "group": "nuxt/nuxt", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a023056d2704c727", + "pin": "cfb8e750292174246120378a6bdef89f63162cc2", + "pin_role": "fixed", + "repo": "nuxt/nuxt", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6028fe87bea019646fff2b31c1b2d7bd0a95eb9214fe437e2008bc5d2dfabb7d" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-2", + "group": "nuxt/nuxt", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a023056d2704c727", + "pin": "d5322a5effb15522e5bef7fce43a2f678093c09c", + "pin_role": "vulnerable", + "repo": "nuxt/nuxt", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "dd93069189c5f242db611e4bfba4341c22f283b65af666fc31343854358de87e" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "oauthlib/oauthlib", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "abc80e34d5f72367", + "pin": "72397e5c08952b47d352521c76692c7d0d98247b", + "pin_role": "fixed", + "repo": "oauthlib/oauthlib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "87d4a5b81bbfdd9628109a5f820895b6fddb00eb96b0f7bbe30a8d640457bcc2" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "oauthlib/oauthlib", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "abc80e34d5f72367", + "pin": "02bdf07fdc4fe970d048ca1a75d30cfa08cdd743", + "pin_role": "vulnerable", + "repo": "oauthlib/oauthlib", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "b171c77b52637bc84c487d7f8bce9a54229f9dbd6605e5089e1e88943ced989c" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "opensearch-project/opensearch-ruby", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1945f28a3fc5bd55", + "pin": "33c6341a79bd604726df3a750a0880f2a45df876", + "pin_role": "vulnerable", + "repo": "opensearch-project/opensearch-ruby", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "64c0b7ccad09192eeaf590befe0de0087d5b48a65a4f6cef41415f3f54a8f536" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "opensearch-project/opensearch-ruby", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1945f28a3fc5bd55", + "pin": "5a3be651ab603de1048c9fbb1c0d6696a0a25d38", + "pin_role": "fixed", + "repo": "opensearch-project/opensearch-ruby", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b55cd6759d4b7861e589052aa534bd0554586db46a329ed3beed7244d579e8c4" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "openssl/openssl", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1c9e47835232f644", + "pin": "5bee1baa3ac17b5f1a5de0aa80c636ba4a7b3e51", + "pin_role": "fixed", + "repo": "openssl/openssl", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc", + "status": "unsupported", + "unit": "90e220d3540b88dd9efc8e66c8ab519d4cc78805f16bed585b795c78cfbb4d58" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-4", + "group": "openssl/openssl", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1c9e47835232f644", + "pin": "c98f542a335c08304db882222a6514264595f47b", + "pin_role": "vulnerable", + "repo": "openssl/openssl", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc", + "status": "unsupported", + "unit": "b5a185b05235f70f6cf27e2adba919f4d8393dbdf2d99de095548a21946aeaf3" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "openwisp/openwisp-ipam", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9b2b34cf62a76ea3", + "pin": "a67282bcc4303ac3adab541de0e30e7f0738d351", + "pin_role": "vulnerable", + "repo": "openwisp/openwisp-ipam", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "91a3984e47f17512db8523e04f863525c67db18631d8f11776cf61ca7221c91b" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "openwisp/openwisp-ipam", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9b2b34cf62a76ea3", + "pin": "8829edf294b3272df3c3ebceeb9b5c1c10503b1c", + "pin_role": "fixed", + "repo": "openwisp/openwisp-ipam", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "d91f1e14282a0c3c8da57c6935a1625e881374bd205b5baa9e4a341d9109ae21" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "oqtane/oqtane.framework", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a20cdf9dd208720d", + "pin": "0a16f81013c7aba0730e8f61f8df73cf45545fd2", + "pin_role": "fixed", + "repo": "oqtane/oqtane.framework", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "18a26df68e4b81d411cfbcc8155a7e6f382753d6e1ad95eece7ed24fa8c44324" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "oqtane/oqtane.framework", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a20cdf9dd208720d", + "pin": "7bb42499c00b6eb682b7be4623a3c1227c204e67", + "pin_role": "vulnerable", + "repo": "oqtane/oqtane.framework", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "e6fb74441fb585d7ef5855317fba795ef0f0a0e6eae9970a49556ce3070c3254" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "oscal-compass/compliance-trestle", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b2e833b60a0fa396", + "pin": "0ae8d31277045e4d689971bda4fc4f10b093f55e", + "pin_role": "fixed", + "repo": "oscal-compass/compliance-trestle", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "08ccacb7434e9f8b8b05c7bb0996be0609e34860d8fc418db329aaf8d7910f2f" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "oscal-compass/compliance-trestle", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b2e833b60a0fa396", + "pin": "e1c2e63ddfccb42836e1f0f9643b372432adff54", + "pin_role": "vulnerable", + "repo": "oscal-compass/compliance-trestle", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "2ca7f80f0badc049ce725718e49bd60da72d316589399126a5f4c5308cf83868" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-0", + "group": "owen2345/camaleon-cms", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d6930fe7e752b7ec", + "pin": "91e578e4daa292679058d319aaf9cab3bb37b252", + "pin_role": "vulnerable", + "repo": "owen2345/camaleon-cms", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "06f0341dfbf1aa9504083737df5d9be3cedfd4e3a198799d8075a29990776800" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-0", + "group": "owen2345/camaleon-cms", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d6930fe7e752b7ec", + "pin": "e81e05b1b9036b7ed07d0c519a897abe9bfa2ca0", + "pin_role": "fixed", + "repo": "owen2345/camaleon-cms", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "30e2cd8bd381d7568b78eaf982f562d278a6a8d942d5282466532c1441bdf0ad" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "patriksimek/vm2", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "e9c34a6a4bf2d333", + "pin": "95aa7fae038bba9321e8000f0ec83435f8059631", + "pin_role": "fixed", + "repo": "patriksimek/vm2", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "0ae20c7334fb27889ef8551f34c65a847dffd6b37f84f722f7e8ed64fd82e95b" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-4", + "group": "patriksimek/vm2", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "e9c34a6a4bf2d333", + "pin": "16229185a5b08fba3ed96bfaa4b9c0345b545097", + "pin_role": "vulnerable", + "repo": "patriksimek/vm2", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "59ab1924056704605b22b7c8360f40f745e7f488450be3647a632bf9a3b22699" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "pdfminer/pdfminer.six", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "053a9e02feda3960", + "pin": "ab70b8f4c3a778e04a9cd9f954259d3d4e344a1d", + "pin_role": "fixed", + "repo": "pdfminer/pdfminer.six", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "34e18fe343b5c25ec582fc05ab091fd9ba160f658ba7678066c56db4991a951b" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "pdfminer/pdfminer.six", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "053a9e02feda3960", + "pin": "bf6ac5896ba6ad22c64d5fbc3c3b044c81edc99c", + "pin_role": "vulnerable", + "repo": "pdfminer/pdfminer.six", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "8fcb18a2a8654b6594cb2ec078e2a018d20f73d2b69a2e625338ffa80b3f72c3" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "perses/perses", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2d482951d7380c4f", + "pin": "7bb8027949f4ef2f8745034df167a9bd327f0872", + "pin_role": "fixed", + "repo": "perses/perses", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "5c1a721da6f85d1d5dfc8cbe5e9809b093a09c059e5abeebed2cbbee55fbd498" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "perses/perses", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2d482951d7380c4f", + "pin": "97cd61a70a51b92a74b2240e15aba7ce3f21201d", + "pin_role": "vulnerable", + "repo": "perses/perses", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "6cabd1c4b5aa94cafdd07c0c6a3f9abfdc03761ddc5b0a2bebc72a508d020b8b" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "pgadmin-org/pgadmin4", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "d112dc3b962218efc3613fa727d54f0fc5b1d527", + "pin_role": "vulnerable", + "repo": "github.com/pgadmin-org/pgadmin4", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "2300c097374b9098671dcbcd42d02d08172e0f3064a8323223d0fe79a6106aab" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "pgadmin-org/pgadmin4", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "0664148b0b192456", + "pin": "d112dc3b962218efc3613fa727d54f0fc5b1d527", + "pin_role": "vulnerable", + "repo": "github.com/pgadmin-org/pgadmin4", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "failed", + "unit": "d702617aaf4d19811baaa18386a3c8b0eb35cd3fd72e8d90611d34850e990858" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "pgadmin-org/pgadmin4", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "0664148b0b192456", + "pin": "cf53953d9ad66c182a08e662c1ba29c5831b486b", + "pin_role": "fixed", + "repo": "github.com/pgadmin-org/pgadmin4", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "f5ed13d811c5b16d46cbd4a3b9edb8f7d2db49acbd49d95f39f33eaab38f58f5" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "phpcsstandards/php_codesniffer", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "fd5781ba332ab81e", + "pin": "f504d8c2eb6549db75b7d7a2e52e81e4c066b065", + "pin_role": "fixed", + "repo": "phpcsstandards/php_codesniffer", + "sanitized": 1, + "shortest_path_steps": 7, + "sink_kind": "popen", + "source": "advisory-fixes-2", + "status": "path", + "unit": "59eca69b2bd99ba282eb8056d7bc789e9c691eebf62a4b42594e34f5516833ae" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "phpcsstandards/php_codesniffer", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "fd5781ba332ab81e", + "pin": "422aab14e4e0765faab44330a51e9e3fa08b25aa", + "pin_role": "vulnerable", + "repo": "phpcsstandards/php_codesniffer", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "popen", + "source": "advisory-fixes-2", + "status": "path", + "unit": "7a7d774a6de9e4a95fe97fff822652f1f1383922f2f0a4dcb12b8e964ca330f5" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "phpoffice/phpspreadsheet", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "366dc5ddcfe598dd", + "pin": "035dfbde3f38baafdda9d7ec96c45c976e4671bd", + "pin_role": "fixed", + "repo": "phpoffice/phpspreadsheet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "0053d866cec1e99f8a4a8754cf8ece3c46df16e002c86703c68937d5f3a09b08" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-3", + "group": "phpoffice/phpspreadsheet", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "366dc5ddcfe598dd", + "pin": "511806f8448696bb769abb559d2351ef68ba1037", + "pin_role": "vulnerable", + "repo": "phpoffice/phpspreadsheet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "027dbc5b9245fb804a1e2ba4445b8afa180aa2c2b3293db107ffe0ca4900ebb4" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "postcss/postcss", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d0a34bf90e99e794", + "pin": "f12af0afc88074250700f9a28109000dcc4454f5", + "pin_role": "fixed", + "repo": "postcss/postcss", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "4efbb75cc4105149522d2b2220987fd4373a8ef645c2c544546da540f14109eb" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "postcss/postcss", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d0a34bf90e99e794", + "pin": "43b7274a0503870090522893e4d6ac86241615f4", + "pin_role": "vulnerable", + "repo": "postcss/postcss", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "fd790f533103fd1a5646a9374ae895cf6e36d578fc747db2b0d0249a54a85e9f" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "powsybl/powsybl-core", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a697aa902d141a6a", + "pin": "eacafd860c6cb49affa1dd200819e36c8dd8653c", + "pin_role": "fixed", + "repo": "powsybl/powsybl-core", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "341e8fbb46f00167a32a2d653ba09a205794084eff65afddb70f9cfff42d697e" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "powsybl/powsybl-core", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a697aa902d141a6a", + "pin": "2eda6e8f949fbb81a977e7cff355b1c65cef06ea", + "pin_role": "vulnerable", + "repo": "powsybl/powsybl-core", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "e29414494b275afc15f3a028f62402161df7f6da5123c302149e23845177f7f6" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "prowler-cloud/prowler", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "8c1fc8417190a134", + "pin": "d61a532bb7c2e32ec1bbb02cb40cc5c23cc3d532", + "pin_role": "fixed", + "repo": "prowler-cloud/prowler", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "2125fb101d6108627e77f61c05cadddddfebd1cddce0e66376d9b822a2eecbb4" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-4", + "group": "prowler-cloud/prowler", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "8c1fc8417190a134", + "pin": "dcdd5092fab0a28690e6e244ddac71b5dd8766da", + "pin_role": "vulnerable", + "repo": "prowler-cloud/prowler", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ae7bbc58026fb71f91b477946a27bbe3599be90501da9237755f3cf0fb289794" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "publify/publify", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1972ea9f72b178b6", + "pin": "b14de6fea45145da35b93aa6ebe529750ae15f6b", + "pin_role": "fixed", + "repo": "publify/publify", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "3ddabb356d78e7c65ec8f88b6da8e4fcabc055ae73f2f6d92c50efddc5d4fcbe" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-3", + "group": "publify/publify", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1972ea9f72b178b6", + "pin": "110f984b90b87d20a1bb4cede06a255c32627ed6", + "pin_role": "vulnerable", + "repo": "publify/publify", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "6875dd5e9c0ff8a1b693d29a109cb2e62e6ff4081df40868aca70e4770476757" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "pypa/pip", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2b007a2377d633dd", + "pin": "9799a0e314fd488d4ab72d4091b7c57ae1eb30fa", + "pin_role": "vulnerable", + "repo": "pypa/pip", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "bdd71a783efb4eda9a82afbd30a16bd7608153830dbc599e65c453c18d1644b2" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-0", + "group": "pypa/pip", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2b007a2377d633dd", + "pin": "bc61767a9695d1304c19ccbedebc401fa8392840", + "pin_role": "fixed", + "repo": "pypa/pip", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "f398ef33900624219e59de08e1cc101c43082a81c37d6d03a916cc220727ca67" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "04aa777130c02a06", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "16aa43c87956c44a4b115245140eefed704095d37cec0cc6410377403cd2fa7a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 12, + "sink_kind": "session.exec", + "source": "adjudications", + "status": "path", + "unit": "23744137e0485a36f686f5f1b5666780fbed3ca522e8c6d35687a391ef504498" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "67565d99fe28c68f", + "pin": "6066b68c0c4f4cc2c3771824822aaa864d082ef8", + "pin_role": "fixed", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "2692316792e6f02fb51578cf30d71bba6c73bf5420c36f709681c8eaa69807d4" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "session.exec", + "source": "adjudications", + "status": "path", + "unit": "2e36f73002c416a68d077bffb0335d82346c7507f2478353aeac005fce5a9cbc" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "04aa777130c02a06", + "pin": "6066b68c0c4f4cc2c3771824822aaa864d082ef8", + "pin_role": "fixed", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "67721f67055eb6fed955ff22bfe4060344662eccb369431835a2116ad120c4f8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "8fc1c96fa6faa4d3966ecc42876189b18ddab779d58f47cdf28a1155f48a6ac4" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "67565d99fe28c68f", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "ab535098a8e709b022afee1da15dd1fc371d389056938ee4fa4971b2966c823a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "session.exec", + "source": "adjudications", + "status": "path", + "unit": "d46f94235bc462360097e7a22e1d442d95f049306631489a4d8b25f647a95bbe" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 3, + "sink_kind": "session.exec", + "source": "adjudications", + "status": "path", + "unit": "edd6dd4364442f66384d14e9317ef2f6234e32ab78327a45741b8a816b4332ee" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "qwed-ai/qwed-verification", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26", + "pin_role": "vulnerable", + "repo": "github.com/QWED-AI/qwed-verification", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "fc7df6887ac719d4615934c0e8c3296728c2f6089f233158c59989027c802d72" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "rack/rack", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c0412509f15fe3e1", + "pin": "bef6314dbea4ecc48aa9d43d772ef9281000fa4e", + "pin_role": "vulnerable", + "repo": "rack/rack", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "63bda2a71ad7155ad2f59aa9086efef3fd3710dc82c57f4b32ec8bf561460239" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "rack/rack", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c0412509f15fe3e1", + "pin": "0e72d72b16eca7c49b3db4e6417b269804e07dee", + "pin_role": "fixed", + "repo": "rack/rack", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b1c9a070c93764655786c3de5fde536c150e319efe47548614cc544b73a8ee2b" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "rails/kredis", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "feed5f7de11289a4", + "pin": "06a661d88355f3500815bb2adebfa484d752e8dc", + "pin_role": "vulnerable", + "repo": "rails/kredis", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "71531567b2b8609ae0d31cb177b8faea4f5fc61923e513b0154a2c941287ce2b" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-4", + "group": "rails/kredis", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "feed5f7de11289a4", + "pin": "d81af574ffddf32a4c563cf4452e86ba1c79e022", + "pin_role": "fixed", + "repo": "rails/kredis", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "d6be6d397a301a07faa761163d3d9e270d71d23d3bdfd084eeafb1e62b91dd71" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "redf0x1/camofox-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "31c259b4e9dccd82", + "pin": "49a20f15c291bd28374cf89905274004d65aa5e8", + "pin_role": "vulnerable", + "repo": "redf0x1/camofox-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "1f1ddb8a5b415461638056c70756d2d0e836de71e824c0e46474f20646eaa4d5" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-1", + "group": "redf0x1/camofox-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "31c259b4e9dccd82", + "pin": "f51d59675a57a88660041bd0220593152f003760", + "pin_role": "fixed", + "repo": "redf0x1/camofox-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "a6ec568d4eef212a842dded7fdef2284524d367e5d24473ddb34e6374be9fad7" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "redisson/redisson", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ffd4b04a7bebfaf8", + "pin": "1af3f126c033abdc937c55fd2c990d1083ccff46", + "pin_role": "vulnerable", + "repo": "redisson/redisson", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "54f7519d3d59b6d8d69a5f8f7bd78e360d3fabaae00b7587c37e388719169370" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-0", + "group": "redisson/redisson", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ffd4b04a7bebfaf8", + "pin": "a9e0b6bf824fa233555958077cf4e08208585256", + "pin_role": "fixed", + "repo": "redisson/redisson", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c5e42c9ab2ee54e46700ab0b64e239b567fbc75ccaceaf6cbf20687813663332" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "redocly/redocly-cli", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2ffec9490ef1d482", + "pin": "a03b3d4e207c41eeb03710d538905488a944ceea", + "pin_role": "vulnerable", + "repo": "redocly/redocly-cli", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "0ab883d3561162b75ad9d161f79c0d17521a23317f2f574c910465f288119483" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-3", + "group": "redocly/redocly-cli", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2ffec9490ef1d482", + "pin": "c28064b54b1f85af6cf7b3f5c783c3f150977dd2", + "pin_role": "fixed", + "repo": "redocly/redocly-cli", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b0af86c1642c14047248f1134181be0ec3839900917dffa360c5014119f8632c" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-2", + "group": "remix-run/react-router", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "73f2a014c6a699ed", + "pin": "77d00c8b4bc2bb648113d30f5654c7d972100dbf", + "pin_role": "vulnerable", + "repo": "remix-run/react-router", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "44ba9d9d8e75769c1444ebf37a64941a845b4bcae678ec79d64dc84e5cc067a0" + }, + { + "asked": 0, + "family": "deserialization", + "fold": "outer-2", + "group": "remix-run/react-router", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "73f2a014c6a699ed", + "pin": "3b3b80ae987a695ef0d5959d3c9b8b52a35d2e9b", + "pin_role": "fixed", + "repo": "remix-run/react-router", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "b430d488c486cef26b1c661f773e7e9e4a177eeea73537a033eec98d532e4eed" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "remorses/genql", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "738e4c22edb32172", + "pin": "6dbd48a77f396503c5caa2d378c7b936c1f7585a", + "pin_role": "fixed", + "repo": "remorses/genql", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "932d7312b2bb4b830179104bca076f587505c2d4ce881b2f04f992defba6dd9e" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-3", + "group": "remorses/genql", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "738e4c22edb32172", + "pin": "2c2509e9760daf6d1ff422a4a2f84f5fc5f426bd", + "pin_role": "vulnerable", + "repo": "remorses/genql", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "eee5136489c3baa3653ededbf6385d0237e2bd8b5384286780646b88ed34fb91" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "remram44/taguette", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "cb0c638282db0d37", + "pin": "9abf82aeb9e4a59b0bda192e920c73e2bf071b9a", + "pin_role": "vulnerable", + "repo": "remram44/taguette", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "a49e6ad2e7c2a5ad0d68d5d69c263306b501fc0dc9382e701fb5fe680611196b" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "remram44/taguette", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "cb0c638282db0d37", + "pin": "08c6985d904e216eb540068844e34dbec310b017", + "pin_role": "fixed", + "repo": "remram44/taguette", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "dee28099d3b37cbd0ee14412122ecc5f8488ed6bec01863520b87706a040fba1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "roest01/node-pdf-image", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "09bce271e8530fbc", + "pin": "f6f4d6b204e8488a4ca22548d7c5690a357f8efb", + "pin_role": "fixed", + "repo": "roest01/node-pdf-image", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "35eb19b4c6176b37287e2123bb98ec4045ce6bde7cc3864dde317c024b0935d8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "roest01/node-pdf-image", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "09bce271e8530fbc", + "pin": "159b6b88c8d70f58702d9079b1b7537cc8aaa91f", + "pin_role": "vulnerable", + "repo": "roest01/node-pdf-image", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "dd33291cc494bbc77d44e9b13d16f171d32c9746637506f315f375e8a9ddee95" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-0", + "group": "roomi-fields/notebooklm-mcp", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a856cd13668353a6", + "pin": "39da17a7dcd53ccde18f5b148d11249ae611e64d", + "pin_role": "vulnerable", + "repo": "roomi-fields/notebooklm-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6149fb0132b981620a90a23a9af8d4656d0d827403e63b48258443cacd0a9c81" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-0", + "group": "roomi-fields/notebooklm-mcp", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a856cd13668353a6", + "pin": "4b8baffad3214bf8ff987014176599582238a49b", + "pin_role": "fixed", + "repo": "roomi-fields/notebooklm-mcp", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b5aecdd6a87f8d57d28f54a013b1f96332460fe1bb44bff4ed28e166f18f9abe" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "rrainn/portprocesses", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "40d8d81a764c508f", + "pin": "9485088ccf30c32ae27caaaed525c283f7ecbe95", + "pin_role": "vulnerable", + "repo": "rrainn/PortProcesses", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "7deeed73c29c74ccbed29be049e109d363d41e4b5eea245ee57780b85f0e137a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "rrainn/portprocesses", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "40d8d81a764c508f", + "pin": "0f251eb47527e189d7971bc2aaf35fe6a7d1473a", + "pin_role": "fixed", + "repo": "rrainn/PortProcesses", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "b5cdadf848e67910550666ba2a6ac67b24112e501c02dba1865766a316317a23" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "failed", + "unit": "15dbea384b3255457a44d9382efc6944dd27f1d411d903344a5d5e5fd194b72f" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "b2ac284bd70dd684", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "225890ba6694dc8f4fbab46e9c851dff8c095e906cf14db15d01ebce0891aaab" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "b6eca35de93a5be8", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 19, + "sink_kind": "db.query", + "source": "population-v1", + "status": "path", + "unit": "42eb8427415704e060e73b5ce0943b014ddf380ca756d5ec47c558e59a79895a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "b6eca35de93a5be8", + "pin": "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5", + "pin_role": "fixed", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 21, + "sink_kind": "db.query", + "source": "population-v1", + "status": "path", + "unit": "4c9cdcc11a18641ef41e9308712c5e8b830ec9ad5ebc3a956c8701e4f77b39c0" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6a53939838afbdd7", + "pin": "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5", + "pin_role": "fixed", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "5794809e595311c86909d673a570d003aa025e4dcd6abc5641b641d935beb0b1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "46d3ec7d49cb8ca7", + "pin": "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5", + "pin_role": "fixed", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 25, + "sink_kind": "db.query", + "source": "population-v1", + "status": "path", + "unit": "5f7a63ec650915962ee5255f5416df63ab882d6107f3b540be36d481798a8944" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6a53939838afbdd7", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "97a7018535ab511622e3ade9e53d570ffb1c80633eaa372fb76e749b3a586c8f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "46d3ec7d49cb8ca7", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 21, + "sink_kind": "db.query", + "source": "population-v1", + "status": "path", + "unit": "a84e9ab47f4f2b584684dbb81575758d9032fe3f2ed53bef478cb9dcfedaf677" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "b2ac284bd70dd684", + "pin": "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5", + "pin_role": "fixed", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "aeceb1ebc863ebbc3b69ae56c5b78d2dba005132b75cbd6af929bb0bfe25da9b" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f42cab375ace1739", + "pin": "e7e09254a3c69dc6582eda9e5b5769935db108af", + "pin_role": "vulnerable", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "e329d4a6ac757680bf3d292a81f1f74f8a8a9b482d1651efe9f503f6a4de8796" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "saltcorn/saltcorn", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f42cab375ace1739", + "pin": "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5", + "pin_role": "fixed", + "repo": "github.com/saltcorn/saltcorn", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "e73c5aac41c0b93072223a3097fb175548ce893e0678ff3a22bc7571745a17e0" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "sebhildebrandt/systeminformation", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1041a18cd1aec5f8", + "pin": "bb4d47dae2fdd9601af6c29ae9cba030b0a84df1", + "pin_role": "vulnerable", + "repo": "sebhildebrandt/systeminformation", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "c301b8c362aee3fe5ea38e18f858166bc4162ad8ace44c5fb2df192afc81da2a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-1", + "group": "sebhildebrandt/systeminformation", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1041a18cd1aec5f8", + "pin": "81fbf388a83e88508f1d7723aaef60d1349c1301", + "pin_role": "fixed", + "repo": "sebhildebrandt/systeminformation", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ca8e58ffcfd60bdc8626db8b9eb4f253c1b8b8affcb793c6d963b7a3ec91906b" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "sgabe/dsvpwa", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "1a7b336172aa414472cbab3a1be357d175549e58", + "pin_role": "vulnerable", + "repo": "sgabe/DSVPWA", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "52354ccdbc16f209e4692d97d5237e04ed030cf4a5e71f77b5a767962b355b4a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "sgabe/dsvpwa", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "7d23be667536afff", + "pin": "f04e846632b5c1921b6aa1d4faa2c0b154fff600", + "pin_role": "vulnerable", + "repo": "sgabe/DSVPWA", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "b5016a5a53409491ba805ed8718599b84250b7b6914da0434b0882b0b3578dc8" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "sgabe/dsvpwa", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "7d23be667536afff", + "pin": "0d4f868f4dcb8778303080cddf02dcf205bc5fa8", + "pin_role": "fixed", + "repo": "sgabe/DSVPWA", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vibe-py", + "status": "asked-nothing", + "unit": "f1b01102968568d3ba1b2fdc70f4ae281f433fb20d29eff2a55fc45555ddbfcd" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "shepherdwind/velocity.js", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f21df949f8aca4fa", + "pin": "0b79b5eeaf4b634d58d10eb8d578ee3b650780de", + "pin_role": "fixed", + "repo": "shepherdwind/velocity.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "15d23ab3aea4c878dd73bbae579f3ab473e8363477a97d28164ed5e1b94cb510" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "shepherdwind/velocity.js", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f21df949f8aca4fa", + "pin": "430716f450fe25ab805c36536cc93c3c2fcc5821", + "pin_role": "vulnerable", + "repo": "shepherdwind/velocity.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "787bc98c651ed3db21be4c28e9c560c366ffd6ca508823d21e5d83eeaf1269db" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "signalk/signalk-server", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1199de75f426940b", + "pin": "2816b0dda1bdde893d85c969a9c5950e7825eee7", + "pin_role": "fixed", + "repo": "github.com/SignalK/signalk-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "10fdc236f43a02b7e291eb8bf6ada297a2ae98086a63b171057bc7bfc37a3377" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "signalk/signalk-server", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "22112c31603bbe9f", + "pin": "2816b0dda1bdde893d85c969a9c5950e7825eee7", + "pin_role": "fixed", + "repo": "github.com/SignalK/signalk-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "5eb3b7523b5a196dcaacba08d68457f9a45e31503ea02745ca3a7d0542f9881c" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "signalk/signalk-server", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "22112c31603bbe9f", + "pin": "1c479cc0d2d26d14ed74416cff36fa7336c7bf9e", + "pin_role": "vulnerable", + "repo": "github.com/SignalK/signalk-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "6bd5bdfd81b0a3374d59cfb2c1f7fa2b27887f4672f4485e77eb5234b569983f" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "signalk/signalk-server", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1199de75f426940b", + "pin": "1c479cc0d2d26d14ed74416cff36fa7336c7bf9e", + "pin_role": "vulnerable", + "repo": "github.com/SignalK/signalk-server", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v1", + "status": "unsupported", + "unit": "c09dffd04708540845c8d1dd77a2bd989bd35f264abf652a2db55f8cb1faf7a9" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "silverstripe/silverstripe-versioned", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "7aab025ea7b97019", + "pin": "b8e2a76bdcc98af3f467556c8564d6d39b897881", + "pin_role": "fixed", + "repo": "silverstripe/silverstripe-versioned", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "7487a34cdfdb532a5096764a47a3e565fa509605c1df0e2b105eb9c751fc5307" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "silverstripe/silverstripe-versioned", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "7aab025ea7b97019", + "pin": "5d01ae27ca815720870ca2e05af8fe745fb3f0bc", + "pin_role": "vulnerable", + "repo": "silverstripe/silverstripe-versioned", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "9c0be2a58741f095fd0a9cdc60d4ca4039de1529699d5701dc4d0bcf7d5bf90c" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "simonh1000/angular-http-server", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "4de5441f1776f083", + "pin": "026e042ad8cfc05edf06d89eddcdff9aedebb47c", + "pin_role": "fixed", + "repo": "simonh1000/angular-http-server", + "sanitized": 1, + "shortest_path_steps": 30, + "sink_kind": "fs.readFileSync", + "source": "vfc-js", + "status": "path", + "unit": "a3a35d573da308cd1d0614a26616bbd37b360d9ea416894cdeffdb59abd691d4" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-2", + "group": "simonh1000/angular-http-server", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "4de5441f1776f083", + "pin": "e76f630d9bf06cd272f4903b464335aac1901948", + "pin_role": "vulnerable", + "repo": "simonh1000/angular-http-server", + "sanitized": 0, + "shortest_path_steps": 18, + "sink_kind": "fs.readFileSync", + "source": "vfc-js", + "status": "path", + "unit": "dc33fc26c1bf7c67e5439ddfdad06c0faf16c796e0fe8a46b6e6a541e708676d" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "skops-dev/skops", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1972a9a06d7585ad", + "pin": "3ccb43c946687b711ee8459e327bbfc57da7e346", + "pin_role": "fixed", + "repo": "skops-dev/skops", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "1f472e842e894c9907536c6eb6c9c922bbb3b21c27999114588ec2a4345ab665" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-3", + "group": "skops-dev/skops", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1972a9a06d7585ad", + "pin": "7dc9b5c509d8f9675ba424b511e52862fdac95de", + "pin_role": "vulnerable", + "repo": "skops-dev/skops", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "7e38e24f1cc4d287627b7cd6cb870888865bb87fa87bba1c4fbf84eabb213121" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "smithyhq/sqladmin", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d76d5232a8587127", + "pin": "f9e13f831a36b9289dc36809ee3eb256f518ebb5", + "pin_role": "vulnerable", + "repo": "smithyhq/sqladmin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1ec32d427822d1ddd3b0d7245f5771ddeb56c146ac8ff9959dd85760ff659a20" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-2", + "group": "smithyhq/sqladmin", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d76d5232a8587127", + "pin": "68e8557e0c6e95d4d55aafedab54012719deb508", + "pin_role": "fixed", + "repo": "smithyhq/sqladmin", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "5143b19a1a1e6b9162b80594ed7fb5c0c57ed0b8abfd793bfc71089552d57638" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "soyuka/pidusage", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "5f6e814444b4acd8", + "pin": "c1f07302aeb103266cf510e69656aac846fb7fb8", + "pin_role": "fixed", + "repo": "soyuka/pidusage", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "2e8aa07b1aa4bfc5349b0d4464f3f2a6500aa55ff765b0139e9901ed34151ffa" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "soyuka/pidusage", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "5f6e814444b4acd8", + "pin": "7b953b473eaedacfaaf6ff74e83687ba37821f72", + "pin_role": "vulnerable", + "repo": "soyuka/pidusage", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "e26c726c08be761b22fcc6ec17fc1fa7aba4769f08957f024e5545906df62797" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "spatie/schema-org", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "888e955fb6cfb4fd", + "pin": "8edcd0f12336f3167e62380a2d857a115e2919a7", + "pin_role": "vulnerable", + "repo": "spatie/schema-org", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "6f1a431ca97afc34ceec48393eb134a8928a312e6f761eb907c6b5855cac6208" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-3", + "group": "spatie/schema-org", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "888e955fb6cfb4fd", + "pin": "f2013207928eca09cd6bbb749fdc63f1e20b1cb7", + "pin_role": "fixed", + "repo": "spatie/schema-org", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "7b62415d17569924d16238a4aa28ab1af2db6561f56be9f59d8075fd1bc4a941" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "spring-projects/spring-data-mongodb", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "a5691395e641fd4c", + "pin": "994aaac74b5be89b8543d76d516d4137a1a9c1af", + "pin_role": "vulnerable", + "repo": "spring-projects/spring-data-mongodb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "40339c123107f1231d6aa58de876cded1dfefd5b31dadc4fc86eedc6a687165f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "spring-projects/spring-data-mongodb", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a5691395e641fd4c", + "pin": "01a81bef657d7e6a301dd668fbc9d1476c82b17f", + "pin_role": "fixed", + "repo": "spring-projects/spring-data-mongodb", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "ea3828e2f59cc6f7b415a101532b566ecbd47ab123c3c7593c23c52f6773a2e3" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "spring-projects/spring-graphql", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f1ebdacbd647e39d", + "pin": "f83d3fb94c29728163ac9a08dafda755fa74f289", + "pin_role": "vulnerable", + "repo": "spring-projects/spring-graphql", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "79628ef3d6c9e12a94922cdca548ff77d3dbdd6b595c1fec5958fcf23b609095" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "spring-projects/spring-graphql", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f1ebdacbd647e39d", + "pin": "36c89bfb748d914c2bdece914ef89befd52c66f4", + "pin_role": "fixed", + "repo": "spring-projects/spring-graphql", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "f910e010c3ff2c8c17f0f80fbe89a934e4f792b601febbf318359e6dc3afc18e" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "squidfunk/mkdocs-material", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "2dd5384f097711b5", + "pin": "f27d775a4052690b5795abe15d6150e938d08243", + "pin_role": "fixed", + "repo": "squidfunk/mkdocs-material", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "212fba6b5e50db045114af369a03ffbdf09ec898c10eeff3c45bfc01a5017b4c" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "squidfunk/mkdocs-material", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "2dd5384f097711b5", + "pin": "a20e3873d8618da31fdd3466796955bcbbe69c94", + "pin_role": "vulnerable", + "repo": "squidfunk/mkdocs-material", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "370ba3a1d0e354e882b7be92c1ebbf2e2903bdf29d442048ea3dc1f80922467f" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-4", + "group": "strangerstudios/paid-memberships-pro", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "", + "pin": "1a900be3f09f243876150fc3c04a97bcb24ef84b", + "pin_role": "vulnerable", + "repo": "github.com/strangerstudios/paid-memberships-pro", + "sanitized": 0, + "shortest_path_steps": 5, + "sink_kind": "$wpdb->get_var", + "source": "dev-php", + "status": "path", + "unit": "ac905d12b92954263c046bd0138a682cea86cf8476336d6baa664ade28d34ac6" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "sulu/sulu", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "218a45d869bd7e39", + "pin": "d061094f5b7bb1d5e974544fce30bede9c7adf8e", + "pin_role": "vulnerable", + "repo": "github.com/sulu/sulu", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "309ebac468b7ab054c8396ed495770385ae3590caba43709745ba2d1db4b6d54" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "sulu/sulu", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "", + "pin": "d061094f5b7bb1d5e974544fce30bede9c7adf8e", + "pin_role": "vulnerable", + "repo": "github.com/sulu/sulu", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "3cc8613813dec13cb1b7b45b296688da883f0b36cd2c4fc1da6e81703fb59ab9" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "sulu/sulu", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "218a45d869bd7e39", + "pin": "d19c01487af8c3de2fb3aa145856707a6367392c", + "pin_role": "fixed", + "repo": "github.com/sulu/sulu", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "9bd2331dbc260451355307e4c37bae17ad6676654c66181934e1b35fb174cc5a" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-0", + "group": "sulu/sulu", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "d061094f5b7bb1d5e974544fce30bede9c7adf8e", + "pin_role": "vulnerable", + "repo": "github.com/sulu/sulu", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "b087ac4d0989e0b72698a9644ef4eac8073b4a15bb21730d63e4730b5cc58a60" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-0", + "group": "sulu/sulu", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "d061094f5b7bb1d5e974544fce30bede9c7adf8e", + "pin_role": "vulnerable", + "repo": "github.com/sulu/sulu", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "failed", + "unit": "c5d1e8d19560c997018fdca12eb60f1799be76c33be058b88472f5a2fc6709be" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "svg/svgo", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c863054be488a284", + "pin": "4bbf456e8e22d5b6354381a2f03517b3ce640487", + "pin_role": "fixed", + "repo": "svg/svgo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "425e1d9961b79bbc011c447cd050910dd796a32b248962a5b0acc3f5f19b7345" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-2", + "group": "svg/svgo", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c863054be488a284", + "pin": "a59823aadc0be52b6d57433f7c2048d0e497b419", + "pin_role": "vulnerable", + "repo": "svg/svgo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "552925bba199119c7db5457b9d3c535bc9f6061cecfd2ab2f72cde690a536e1e" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "themegrill/user-registration", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "", + "pin": "e52cf151cb229852e6209fb3a627aa51485139c1", + "pin_role": "vulnerable", + "repo": "github.com/themegrill/user-registration", + "sanitized": 0, + "shortest_path_steps": 18, + "sink_kind": "header", + "source": "adjudications", + "status": "path", + "unit": "22befc17a75a688e2f9358d2ddf9a7b197da44cd95dbdeae5e0191b113ee54d3" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "themegrill/user-registration", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "63f496d9ff53e39b", + "pin": "75c940dab15fd54d5a3fbb9f2213767b89467b08", + "pin_role": "fixed", + "repo": "github.com/themegrill/user-registration", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "6a98f8145776c78793b37156e9a81757841bb6de80016ab4fa575209d724db3f" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "themegrill/user-registration", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "63f496d9ff53e39b", + "pin": "e52cf151cb229852e6209fb3a627aa51485139c1", + "pin_role": "vulnerable", + "repo": "github.com/themegrill/user-registration", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "population-v2", + "status": "asked-nothing", + "unit": "7ac60c96c15f8517e089cc2240aedcf1fc30e54a41e35fe03c6b965bc393fbd6" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "themegrill/user-registration", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "", + "pin": "e52cf151cb229852e6209fb3a627aa51485139c1", + "pin_role": "vulnerable", + "repo": "github.com/themegrill/user-registration", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "adjudications", + "status": "asked-nothing", + "unit": "ae39cb55ef2a87c5347e0ddc40975f142450e82de4909e93ba62a7ed0efb4134" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "thenables/thenify", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d1b19898f8deaa41", + "pin": "4f838d96ac46809df025ba11037c35426d5cb904", + "pin_role": "vulnerable", + "repo": "thenables/thenify", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "3763c7b407ad471820b5f8fa25bde0ba6d91e15c07c56681de4b41add418b0b1" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "thenables/thenify", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d1b19898f8deaa41", + "pin": "4bd4d6711895fd2809ad85693dd51eebe1711180", + "pin_role": "fixed", + "repo": "thenables/thenify", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "bc8b934938c30687f3d4f982392d2cfa9504a916b463ccb5c46fe8a30eede488" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "thumbor/thumbor", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f5f33fa6fe7b8492", + "pin": "19e3d57beeb64380261da1f1ef17c1715a063eeb", + "pin_role": "vulnerable", + "repo": "thumbor/thumbor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "938bbf146a9037e687190bcee82c047492dffbe90efea40a49a647f81a0f1ed0" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "thumbor/thumbor", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f5f33fa6fe7b8492", + "pin": "2dd06f09f95e06648e2eb3dfb2080ece0bd603be", + "pin_role": "fixed", + "repo": "thumbor/thumbor", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "b90c9f7e0011685f1a8e853a9ed0ae37fd437ef6d6eb0ba17c240aec2c22b603" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "tomasnorre/crawler", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f74364dc8e35c8ba", + "pin": "2f6c3f2ae1b9a068ee4b82fe63129563b3db056b", + "pin_role": "fixed", + "repo": "tomasnorre/crawler", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "11e760e99c5c852676c9288e18a250febb3854e9047b51e8b9ecc9f3b423b6f5" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "tomasnorre/crawler", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "f74364dc8e35c8ba", + "pin": "c4c782bc5c772b69cb4c8f9cf0fd2f4c94e1d9f7", + "pin_role": "vulnerable", + "repo": "tomasnorre/crawler", + "sanitized": 0, + "shortest_path_steps": 19, + "sink_kind": "unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "5fc980194040f4c4d803075d4085618cc0260ae8f3454b26b9b704d30200ffea" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "tornadoweb/tornado", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "db1c51833994ec55", + "pin": "278c7fe385703dd47375c33c5ee557699dcfcc59", + "pin_role": "fixed", + "repo": "tornadoweb/tornado", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c2ce8320c778dd55434d7413844797b68e6fcabc4dc509458a9d60ca70b88c60" + }, + { + "asked": 1, + "family": "output_encoding", + "fold": "outer-1", + "group": "tornadoweb/tornado", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "db1c51833994ec55", + "pin": "35391b344cc2a684d1afd1c4d44903ae5f4fba18", + "pin_role": "vulnerable", + "repo": "tornadoweb/tornado", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "f2d6843547af1276ae8a4dff3a7786913fa79dc69540d4fbb95c4c091e27c7f2" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "truelayer/truelayer-dotnet", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "f4690679bf9d80aa", + "pin": "ec3acee7d38e03abda2c1d3edc3ca92862f8086e", + "pin_role": "vulnerable", + "repo": "truelayer/truelayer-dotnet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "1a4e24df8d08672ecde4709a77ea5c437b2198fecff8bfff373b63c9eaed6e63" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "truelayer/truelayer-dotnet", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "f4690679bf9d80aa", + "pin": "836256dbd6206feef2608b6c8f549d771b04fd91", + "pin_role": "fixed", + "repo": "truelayer/truelayer-dotnet", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "78711973ec84867671314dd7878769092b32f59860eafed50a0f6979daee76fc" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-2", + "group": "typeorm/typeorm", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d6a42c18151efb48", + "pin": "5002f4f39d5df44351363efd12980becad790e6e", + "pin_role": "vulnerable", + "repo": "typeorm/typeorm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "01ae2279707361bfc06a005335d41b85066d0a163802ca81c031f5dbded5bb46" + }, + { + "asked": 0, + "family": "injection", + "fold": "outer-2", + "group": "typeorm/typeorm", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d6a42c18151efb48", + "pin": "1b775580999b023b73a31bfe893be287ae9c6560", + "pin_role": "fixed", + "repo": "typeorm/typeorm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "a50dc15c313a9078badea01365987c66c5cee1ad48cea65c35c8bc2cbba25e8e" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "ultimatemember/ultimatemember", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "85c15e3fc2b370b2", + "pin": "476de92f4c9aaa56c3e2f5527b242ce0476f4655", + "pin_role": "fixed", + "repo": "github.com/ultimatemember/ultimatemember", + "sanitized": 1, + "shortest_path_steps": 8, + "sink_kind": "$wpdb->get_var", + "source": "population-v1", + "status": "path", + "unit": "0990d8f41cb07c1cf217812e51a7025381de4ba68d1be3799e26241d81dcea67" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "ultimatemember/ultimatemember", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "85c15e3fc2b370b2", + "pin": "a49b3061ded1630e4f6860b4ebece5ccf0a493d2", + "pin_role": "vulnerable", + "repo": "github.com/ultimatemember/ultimatemember", + "sanitized": 0, + "shortest_path_steps": 6, + "sink_kind": "$wpdb->get_col", + "source": "population-v1", + "status": "path", + "unit": "9da1d63f0c4da270f66eb87bf9c342ace883a0aef78c4643e254159b5da8fce3" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "unjs/ufo", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c7f4f4ebebfae831", + "pin": "9f4b5de30aa1cff3a1d9abda089fe66be6195817", + "pin_role": "vulnerable", + "repo": "unjs/ufo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "b5cbc1490bca76679adfbe5e4d9f8067d27a226d595ba401b551b00c3ce4d45a" + }, + { + "asked": 0, + "family": "untrusted_destination", + "fold": "outer-1", + "group": "unjs/ufo", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c7f4f4ebebfae831", + "pin": "69d466032729be20bf289b323b0b0fe815340851", + "pin_role": "fixed", + "repo": "unjs/ufo", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "ba2c1808eebdbe3f54c488b09bcb3d69e521916d1a3a0b5b14e02d5bc88bf016" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-1", + "group": "vercel/next.js", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "1507c8e00ed4b859", + "pin": "30d181290a0ccff82a3bceb308cdd6aa52033beb", + "pin_role": "vulnerable", + "repo": "vercel/next.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "620e9b5ed143c0bcec178db359fa601acb1d3a134b3e85c2e838b7dcf3892d85" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-1", + "group": "vercel/next.js", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "1507c8e00ed4b859", + "pin": "29cd13d396f0f1948a742af263229f2c0e61cb0b", + "pin_role": "fixed", + "repo": "vercel/next.js", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "6f5ce4008dac0471260310c60e1e2a9f76a7e4eec6ebd039835f0488cf3b19aa" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "viewcomponent/view_component", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "8f5a6abedd742bbe", + "pin": "1d94e44e8fe70a720fd8b195a974b62931e3fdd9", + "pin_role": "fixed", + "repo": "ViewComponent/view_component", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "71e3ced643a244100cc3fde234f5b4b27655214c7ae0ff67ab61e3e48a8fdf78" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-1", + "group": "viewcomponent/view_component", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "8f5a6abedd742bbe", + "pin": "908858bd33a58e18b374496edf433b272706f290", + "pin_role": "vulnerable", + "repo": "ViewComponent/view_component", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "7c8cbfae87127042f9f43621345b4f7958bde27a3ff9db76254063e80735f3ce" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "vincentmorneau/apex-publish-static-files", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "c9538342f2d7efca", + "pin": "9a8a3e30e63fa9e97f54a63027d9ba54d2b2b446", + "pin_role": "vulnerable", + "repo": "vincentmorneau/apex-publish-static-files", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "2b8db57d65ef1d67c457ff5a336e8a542d03387395d69d5e16815c4f00f40723" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-3", + "group": "vincentmorneau/apex-publish-static-files", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "c9538342f2d7efca", + "pin": "feebf6889cf9185a47536df61547ebf4f31d59b9", + "pin_role": "fixed", + "repo": "vincentmorneau/apex-publish-static-files", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "e2ed113dc21ad5f7caa71ba4a5ece8f8f900a97fd0d00dc85f7ac79ff5bed19a" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-2", + "group": "vitest-dev/vitest", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "494dd5d5e5cdf4b8", + "pin": "055b0916f12e7c6e6b5669b2ad0e98510703c784", + "pin_role": "fixed", + "repo": "vitest-dev/vitest", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "3b8011f94ec721f68dd29afc6c8b01117c86a8b0c31f3650a6ce0a8d7c0739ff" + }, + { + "asked": 0, + "family": "path", + "fold": "outer-2", + "group": "vitest-dev/vitest", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "494dd5d5e5cdf4b8", + "pin": "8d55f8f459538be8b263b85ff63fa7bfdf4b020a", + "pin_role": "vulnerable", + "repo": "vitest-dev/vitest", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "f7e2280574e9ae51daa64d8adb2955407ff6d1e156f0e2854b6c047e0a733c78" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "vllm-project/vllm", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "51eae488182a123a", + "pin": "b1ac0b8ca1d16e27d57cf52987513b038e544773", + "pin_role": "vulnerable", + "repo": "vllm-project/vllm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "20b039866ba796c34efa0e92468fb49a314ad7fe2914d9ff8b823e3e35ab26f9" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-4", + "group": "vllm-project/vllm", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "51eae488182a123a", + "pin": "dc4b8bb7af7270a2918f3a8832ac18d2449409af", + "pin_role": "fixed", + "repo": "vllm-project/vllm", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "2ab3fef05def768ef7b4165bcedcf7d200282dba78a32e19b90a0df3aee7e3e5" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "vuejs/vue-cli", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "6f5a650865e08571", + "pin": "2ea1dd9211c04ea6d40140cc6dca031434fcaa7b", + "pin_role": "vulnerable", + "repo": "vuejs/vue-cli", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "e2051cc42e4f8b026c7807f966d492367310c90326e60fef1b0ee8c509c805a9" + }, + { + "asked": 1, + "family": "untrusted_destination", + "fold": "outer-2", + "group": "vuejs/vue-cli", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "6f5a650865e08571", + "pin": "73951b4f2a25b399fdbf668cb4d9a3493bb2d551", + "pin_role": "fixed", + "repo": "vuejs/vue-cli", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "asked-nothing", + "unit": "f5364d68ffe80b578e788f37f08784b0162826393b49b4a3affd70d7cc4c9e01" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "vvo/node-whereis", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "8acd426c5771b37c", + "pin": "e07f171e5db4262dc95e5d3ee439d6fc83919237", + "pin_role": "vulnerable", + "repo": "vvo/node-whereis", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "983e146a60e061254b15dc8dd573cbba57f8dd0358f23ea1b9c313ef69069af5" + }, + { + "asked": 1, + "family": "injection", + "fold": "outer-2", + "group": "vvo/node-whereis", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "8acd426c5771b37c", + "pin": "0a1da86cd9731f447693a8919184980cc106821e", + "pin_role": "fixed", + "repo": "vvo/node-whereis", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "vfc-js", + "status": "asked-nothing", + "unit": "f80dfec45231e4778078cb10f00128ed445177cac0a062fc2df5ced5c0171f21" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "waterfutures/epyt-flow", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "9b84800ce5c395cb", + "pin": "c5c7728cad871a38d2940a40719964e6e0e9f693", + "pin_role": "fixed", + "repo": "WaterFutures/EPyT-Flow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "9b7dfdceae03fd86ad3260a03f85bcdcff8f32f10c265d23743ff8dc98eeefb8" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-2", + "group": "waterfutures/epyt-flow", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "9b84800ce5c395cb", + "pin": "bafc24ab74e0a37910f7b551a014f1d5db9ba9c6", + "pin_role": "vulnerable", + "repo": "WaterFutures/EPyT-Flow", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "b99dda150c0da3defa5f4c527ef6c402f5589dfb2f2f03f3e5e424910eb48c53" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "webpack/webpack-dev-middleware", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "ad64e8fac4ac3ee0", + "pin": "94357efa8cb37e7a0c5a660efc4dc741bbda4c34", + "pin_role": "vulnerable", + "repo": "webpack/webpack-dev-middleware", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "36dfd01915a553d86576e8ecd3b737b8e2b297aa542f58cc83b448060e74398a" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-1", + "group": "webpack/webpack-dev-middleware", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "ad64e8fac4ac3ee0", + "pin": "46b66a702fd6550679a8ef1dbfb124d2c019ff91", + "pin_role": "fixed", + "repo": "webpack/webpack-dev-middleware", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "c2b6d40f130d35bbfc16fab9411c664fa06321c59fb1d901a1987a69cb09c72e" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "wintercms/winter", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "d48c08b19f560848", + "pin": "ed5860ad2ae456d31195b35d4e883c5f3375b124", + "pin_role": "fixed", + "repo": "wintercms/winter", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "03d02c9e25eec0f380b125279fce35e8867065bf6e1ec75f9f39729ce6efdc77" + }, + { + "asked": 0, + "family": "access_control", + "fold": "outer-0", + "group": "wintercms/winter", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "d48c08b19f560848", + "pin": "ed3e24995b7b22671752140e8f23f67e76f9b26e", + "pin_role": "vulnerable", + "repo": "wintercms/winter", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "abbea69b7d0fa68c3ace442c25597e128cde354b417787b5913fd10d666c0d19" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "xdan/jodit", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "bfc8188bbb673e3b", + "pin": "d984e3d606786787be3fa8dd6342b0d03fa6e8fc", + "pin_role": "fixed", + "repo": "xdan/jodit", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "a7cff0da55c0cc1d5c838e11fc6ce6c4b22c54b9f8e101688b218d6928eca504" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-2", + "group": "xdan/jodit", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "bfc8188bbb673e3b", + "pin": "853a2bc8af5de0d8c33982bd241108da6f9217d1", + "pin_role": "vulnerable", + "repo": "xdan/jodit", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes-2", + "status": "unsupported", + "unit": "f741c56815230b9c30e2c8ef8952b895e9480e4780a89ff2cf6daf60d1fce7b6" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "xyproto/algernon", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "3844ed3d703d7ef4", + "pin": "6d9fa02be2d19a978f941190545b679f1774d8d4", + "pin_role": "fixed", + "repo": "xyproto/algernon", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "445efda074e4d9f6c1634225eb08a3c3eb1257311c995ce891df2c791a6f5c8b" + }, + { + "asked": 0, + "family": "output_encoding", + "fold": "outer-4", + "group": "xyproto/algernon", + "guard_present": 0, + "has_path": 0, + "label": 1, + "pair": "3844ed3d703d7ef4", + "pin": "7a874bd0c233f166825ea7ec2237e17b505392b9", + "pin_role": "vulnerable", + "repo": "xyproto/algernon", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "unsupported", + "unit": "8ac27b08549353ada819caaf99a5180d2f2f515b03aa8cd99a5d37b527ea3a5c" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "yiisoft/yii2", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "a63eae7d621a985e", + "pin": "9da69753dde2e0accfd0d7801924852320ac2278", + "pin_role": "vulnerable", + "repo": "yiisoft/yii2", + "sanitized": 0, + "shortest_path_steps": 2, + "sink_kind": "unknown", + "source": "advisory-fixes", + "status": "path", + "unit": "04ca0b583b09c3b4f67bd2496a4607ecb134d24b7bdaf8960fa151e40ebcc447" + }, + { + "asked": 1, + "family": "path", + "fold": "outer-3", + "group": "yiisoft/yii2", + "guard_present": 0, + "has_path": 0, + "label": 0, + "pair": "a63eae7d621a985e", + "pin": "aeaf218d44ca35f5a15269d59867c273b4f0cae1", + "pin_role": "fixed", + "repo": "yiisoft/yii2", + "sanitized": 0, + "shortest_path_steps": 0, + "sink_kind": "no-path", + "source": "advisory-fixes", + "status": "asked-nothing", + "unit": "ecfa2a67726ca9d3e2621a4d8be60145095b76aa18ecf0268212341d63752871" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "zumba/json-serializer", + "guard_present": 0, + "has_path": 1, + "label": 0, + "pair": "0d9f529b7f0084b6", + "pin": "e1173901434e8c71c4ffbc9951dd5f367e568dba", + "pin_role": "fixed", + "repo": "zumba/json-serializer", + "sanitized": 0, + "shortest_path_steps": 17, + "sink_kind": "unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "35aa369236f510634b3aa7b54b04e9da0f80877e515786a888e760f8fe33c524" + }, + { + "asked": 1, + "family": "deserialization", + "fold": "outer-1", + "group": "zumba/json-serializer", + "guard_present": 0, + "has_path": 1, + "label": 1, + "pair": "0d9f529b7f0084b6", + "pin": "f6488e9fafe65fcab84b7f2ac132f4212600f74b", + "pin_role": "vulnerable", + "repo": "zumba/json-serializer", + "sanitized": 0, + "shortest_path_steps": 16, + "sink_kind": "unserialize", + "source": "advisory-fixes", + "status": "path", + "unit": "ef4f8613c0914eb815504e00cd6ee05df38352fd3b27826798e6623594017042" + } + ], + "units_input": { + "bytes": 98598, + "path": "/home/mc/Source/OpenUltraSAST/plane/experiments/exp-005-graph-slice.units.jsonl", + "sha256": "240a44e1ca640cc1481a16abd598e645d310cc068d975b6c81821e2ea5951201" + } +} diff --git a/benchmarks/pairs/advisory-fixes-3/catalog.toml b/benchmarks/pairs/advisory-fixes-3/catalog.toml new file mode 100644 index 0000000..00cf6a0 --- /dev/null +++ b/benchmarks/pairs/advisory-fixes-3/catalog.toml @@ -0,0 +1,9057 @@ +# Advisory-fix pairs, batch 3 (2026-10-04): more (vulnerable function, fixed function) pairs where the function +# SURVIVES the fix, to roughly double the decision engine's paired data. +# +# Same rules as batch 2 (benchmarks/pairs/advisory-fixes-2/catalog.toml): a reviewed GHSA advisory (pip, npm, maven, +# composer) whose single fix commit (one parent) is linked from the advisory -- or, new here, the single commit of a +# merged pull request the advisory links (its only commit, or its squash/rebase merge commit); at most 4 non-test source +# files and 120 changed source lines, or up to 6 files / 240 lines in a second pass (`fix_lines.source_total` records +# the size, and the function's diff was read either way); the function holding the changed code lines is declared +# exactly once on both sides (the label builder's matcher, learn.excerpt.function_bounds) and its body differs. The positive is that function at `parent`, +# the negative the same function at `commit`. The function is chosen by changed lines, then its diff was read and +# kept only when the named function itself holds the fix: `provenance = "agent"`, `fix_lines` records the counts. +# Advisories whose CWEs span two families (second pass) carry the family the function's diff shows (agent-chosen). +# Weighted toward the weak families (injection, untrusted_destination); enumeration reached back to 2023 for them, +# newest first, so `post_cutoff` (published on or after 2026-06-01) is recorded per pair. +# Repositories: permissive licences only (SPDX from the API), none named anywhere else under benchmarks/ (populations +# v1/v2, every pair corpus including batches 1 and 2), no WordPress plugin, and the reserved-population test passes. +# +# Pointer pairs (vendored = false), the advisory-fixes slice and cache layout: materialize.py --catalog +# verifies the cached excerpts (verification.json beside this file). Screening record: +# benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json. `split` alternates train/holdout by fix +# date within each family; one pair per repository. + +[[pair]] +name = "fosuserbundle-refreshuser-5a36e29" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "friendsofsymfony/fosuserbundle" +cve = "GHSA-8wx3-8m4x-g5h4" +cwe = "CWE-285" +ecosystem = "composer" +published_at = "2024-05-15T21:43:23Z" +post_cutoff = false +commit = "5a36e2958068d1e6501dc8cf39bbae3ebb859d9f" +parent = "b3dc5faf0017a621537dd5ec44047be5ad5bb82e" +commit_url = "https://github.com/friendsofsymfony/fosuserbundle/commit/5a36e2958068d1e6501dc8cf39bbae3ebb859d9f" +vendored = false +host = "github" +path = "Model/UserManager.php" +mode = "name" +relpath = "Model/UserManager.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-07-10" +fix_lines = { in_function = 9, in_file = 9, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "Model/UserManager.php" +function = "refreshUser" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-8wx3-8m4x-g5h4: FOSUserBundle User Identity Validation Vulnerability" + +[[pair]] +name = "security-getresolvedindexpattern-f7cc569" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "opensearch-project/security" +cve = "CVE-2022-41918 GHSA-wmx7-x4jp-9jgg" +cwe = "CWE-863" +ecosystem = "maven" +published_at = "2023-03-07T20:04:42Z" +post_cutoff = false +commit = "f7cc569c9d3fa5d5432c76c854eed280d45ce6f4" +parent = "f75be3edaf900df6f42aec2fd41175e66af06f3b" +commit_url = "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4" +vendored = false +host = "github" +path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +mode = "name" +relpath = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-11-07" +fix_lines = { in_function = 14, in_file = 9, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +function = "getResolvedIndexPattern" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-wmx7-x4jp-9jgg: OpenSearch has issue with fine-grained access control of indices backing data streams" + +[[pair]] +name = "orocalendarbundle-checkpermissions-460a8ff" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "oroinc/orocalendarbundle" +cve = "CVE-2023-32062 GHSA-x2xm-p6vq-482g" +cwe = "CWE-284" +ecosystem = "composer" +published_at = "2023-11-27T23:29:11Z" +post_cutoff = false +commit = "460a8ffb63b10c76f2fa26d53512164851c4909b" +parent = "fa001c6b6dfbd4bd0ef7e72bd168bc978226e90a" +commit_url = "https://github.com/oroinc/orocalendarbundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b" +vendored = false +host = "github" +path = "Controller/SystemCalendarEventController.php" +mode = "name" +relpath = "Controller/SystemCalendarEventController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-01" +fix_lines = { in_function = 6, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "Controller/SystemCalendarEventController.php" +function = "checkPermissions" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-x2xm-p6vq-482g: OroCalendarBundle has incorrect system calendar events visibility" + +[[pair]] +name = "remult-doonid-6892ae9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "remult/remult" +cve = "CVE-2023-35167 GHSA-7hh3-3x64-v2g9" +cwe = "CWE-284" +ecosystem = "npm" +published_at = "2023-06-20T18:50:15Z" +post_cutoff = false +commit = "6892ae97134126d8710ef7302bb2fc37730994c5" +parent = "5341348ebc7b65859bfd02baf750bd999778e155" +commit_url = "https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5" +vendored = false +host = "github" +path = "projects/core/src/data-api.ts" +mode = "name" +relpath = "projects/core/src/data-api.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-19" +fix_lines = { in_function = 9, in_file = 8, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "projects/core/src/data-api.ts" +function = "doOnId" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-7hh3-3x64-v2g9: When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id" + +[[pair]] +name = "micronaut-security-parseaudiences-9728b92" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "micronaut-projects/micronaut-security" +cve = "CVE-2023-36820 GHSA-qw22-8w9r-864h" +cwe = "CWE-284" +ecosystem = "maven" +published_at = "2023-10-05T20:55:14Z" +post_cutoff = false +commit = "9728b925221a0d87798ccf250657a3c214b7e980" +parent = "c3eeb1957a1e3d5a6b60042a349bbc93cd0809fc" +commit_url = "https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980" +vendored = false +host = "github" +path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +mode = "name" +relpath = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-23" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +function = "parseAudiences" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-qw22-8w9r-864h: io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud" + +[[pair]] +name = "servicenow-devops-plugin-dochecktoolid-67192e2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/servicenow-devops-plugin" +cve = "CVE-2023-3442 GHSA-cj2x-r74q-vcx9" +cwe = "CWE-862" +ecosystem = "maven" +published_at = "2023-07-26T21:30:19Z" +post_cutoff = false +commit = "67192e24099787ad732b41d581f20714d4253921" +parent = "d7d2422b016995402dd245d9c9c5c2f4cf00c691" +commit_url = "https://github.com/jenkinsci/servicenow-devops-plugin/commit/67192e24099787ad732b41d581f20714d4253921" +vendored = false +host = "github" +path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +mode = "name" +relpath = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-30" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +function = "doCheckToolId" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-cj2x-r74q-vcx9: Missing authorization in Jenkins Plug-in for ServiceNow " + +[[pair]] +name = "synapse-received-remote-receipt-63d28a8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/synapse" +cve = "CVE-2023-42453 GHSA-7565-cq32-vx2x" +cwe = "CWE-285" +ecosystem = "pip" +published_at = "2023-09-26T19:20:38Z" +post_cutoff = false +commit = "63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881" +parent = "4663d555021ce53c57e418eb1ee4445eab276bc4" +commit_url = "https://github.com/matrix-org/synapse/commit/63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881" +vendored = false +host = "github" +path = "synapse/handlers/receipts.py" +mode = "name" +relpath = "synapse/handlers/receipts.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-09-18" +fix_lines = { in_function = 10, in_file = 24, source_total = 30 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "synapse/handlers/receipts.py" +function = "_received_remote_receipt" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-7565-cq32-vx2x: matrix-synapse vulnerable to improper validation of receipts allows forged read receipts" + +[[pair]] +name = "strapi-plugin-protected-populate-protectpopulate-0544106" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "strapi-community/strapi-plugin-protected-populate" +cve = "CVE-2023-48218 GHSA-6h67-934r-82g7" +cwe = "CWE-863" +ecosystem = "npm" +published_at = "2023-11-20T21:01:43Z" +post_cutoff = false +commit = "05441066d64e09dd55937d9f089962e9ebe2fb39" +parent = "14f392f4d07bfaa7c28c63153a0f369d563f7360" +commit_url = "https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39" +vendored = false +host = "github" +path = "server/middlewares/helpers/protect-route.js" +mode = "name" +relpath = "server/middlewares/helpers/protect-route.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-11-13" +fix_lines = { in_function = 8, in_file = 6, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "server/middlewares/helpers/protect-route.js" +function = "protectPopulate" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-6h67-934r-82g7: Bypass of field access control in strapi-plugin-protected-populate" + +[[pair]] +name = "scriptler-plugin-doshowscript-5addb5f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/scriptler-plugin" +cve = "CVE-2023-50765 GHSA-4j42-6xfx-h754" +cwe = "CWE-862" +ecosystem = "maven" +published_at = "2023-12-13T18:31:04Z" +post_cutoff = false +commit = "5addb5f9e68596abdba216e61cf714c2767b874b" +parent = "bfa9b3085865d1cb9dce714770e87c4f2651fbf6" +commit_url = "https://github.com/jenkinsci/scriptler-plugin/commit/5addb5f9e68596abdba216e61cf714c2767b874b" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-12-12" +fix_lines = { in_function = 5, in_file = 8, source_total = 46 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +function = "doShowScript" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-4j42-6xfx-h754: Missing permission check in Jenkins Scriptler Plugin" + +[[pair]] +name = "undici-shouldremoveheader-6805746" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "nodejs/undici" +cve = "CVE-2024-30260 GHSA-m4v8-wqvr-p9f7" +cwe = "CWE-285" +ecosystem = "npm" +published_at = "2024-04-04T14:20:39Z" +post_cutoff = false +commit = "6805746680d27a5369d7fb67bc05f95a28247d75" +parent = "ee5f892f3955eaca37730ed30349153ba203e9cd" +commit_url = "https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75" +vendored = false +host = "github" +path = "lib/handler/redirect-handler.js" +mode = "name" +relpath = "lib/handler/redirect-handler.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-04-02" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "lib/handler/redirect-handler.js" +function = "shouldRemoveHeader" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-m4v8-wqvr-p9f7: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline" + +[[pair]] +name = "silverstripe-reports-handleaction-0351106" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "silverstripe/silverstripe-reports" +cve = "CVE-2024-29885 GHSA-89q6-98xx-4ffw" +cwe = "CWE-863" +ecosystem = "composer" +published_at = "2024-07-17T14:26:31Z" +post_cutoff = false +commit = "0351106c18ad4246d983b5f4e082c09c382121f4" +parent = "2b55d91bb307ee6b542136d5cc7c9524e2385cc4" +commit_url = "https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4" +vendored = false +host = "github" +path = "code/ReportAdmin.php" +mode = "name" +relpath = "code/ReportAdmin.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-16" +fix_lines = { in_function = 3, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "code/ReportAdmin.php" +function = "handleAction" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-89q6-98xx-4ffw: Silverstripe Reports are still accessible even when `canView()` returns false" + +[[pair]] +name = "flask-cors-get-cors-headers-7ae310c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "corydolphin/flask-cors" +cve = "CVE-2024-6221 GHSA-hxwh-jpp2-84pm" +cwe = "CWE-284" +ecosystem = "pip" +published_at = "2024-08-18T21:31:07Z" +post_cutoff = false +commit = "7ae310c56ac30e0b94fb42129aa377bf633256ec" +parent = "f25c6b2ed243457a64567a8fe40e5df6da0cb3dc" +commit_url = "https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec" +vendored = false +host = "github" +path = "flask_cors/core.py" +mode = "name" +relpath = "flask_cors/core.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-08-30" +fix_lines = { in_function = 3, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "flask_cors/core.py" +function = "get_cors_headers" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-hxwh-jpp2-84pm: Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default" + +[[pair]] +name = "matrix-js-sdk-getvisiblerooms-43c72d5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/matrix-js-sdk" +cve = "CVE-2025-59160 GHSA-mp7c-m3rh-r56v" +cwe = "CWE-862" +ecosystem = "npm" +published_at = "2025-09-16T20:18:57Z" +post_cutoff = false +commit = "43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4" +parent = "ff89c9ec426939530a9df3bc8112ecca4b3f4e52" +commit_url = "https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4" +vendored = false +host = "github" +path = "src/client.ts" +mode = "name" +relpath = "src/client.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-16" +fix_lines = { in_function = 18, in_file = 14, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/client.ts" +function = "getVisibleRooms" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-mp7c-m3rh-r56v: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another" + +[[pair]] +name = "strimzi-kafka-operator-generaterolebindingforrole-c8a1493" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "strimzi/strimzi-kafka-operator" +cve = "CVE-2025-66623 GHSA-xrhh-hx36-485q" +cwe = "CWE-863" +ecosystem = "maven" +published_at = "2025-12-05T22:02:37Z" +post_cutoff = false +commit = "c8a14935e99c91eb0dd865431f46515da9f82ccc" +parent = "e90f2b08c4ff711b2d90581b6bcdf0f59af28d98" +commit_url = "https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc" +vendored = false +host = "github" +path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +mode = "name" +relpath = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-12-02" +fix_lines = { in_function = 26, in_file = 48, source_total = 90 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +function = "generateRoleBindingForRole" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-xrhh-hx36-485q: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands" + +[[pair]] +name = "bagisto-reorder-b2b1cf6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "bagisto/bagisto" +cve = "CVE-2026-21447 GHSA-x5rw-qvvp-5cgm" +cwe = "CWE-284" +ecosystem = "composer" +published_at = "2026-01-02T22:50:47Z" +post_cutoff = false +commit = "b2b1cf62577245d03a68532478cffbe321df74d3" +parent = "349062ce772d8ac79bc2cd817c43d626efa71907" +commit_url = "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3" +vendored = false +host = "github" +path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +mode = "name" +relpath = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-23" +fix_lines = { in_function = 6, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +function = "reorder" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-x5rw-qvvp-5cgm: Bagisto has IDOR in Customer Order Reorder Functionality" + +[[pair]] +name = "froshplatformadminer-index-c4dd6c3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "friendsofshopware/froshplatformadminer" +cve = "CVE-2026-25878 GHSA-f339-246p-wwjp" +cwe = "CWE-306" +ecosystem = "composer" +published_at = "2026-02-10T00:22:05Z" +post_cutoff = false +commit = "c4dd6c3462af178b3a7d146d3c651c2c253e902b" +parent = "b1d5b0e41b4bef17171b11f05379cac002b4dc77" +commit_url = "https://github.com/friendsofshopware/froshplatformadminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b" +vendored = false +host = "github" +path = "src/Controller/AdminerController.php" +mode = "name" +relpath = "src/Controller/AdminerController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-07" +fix_lines = { in_function = 8, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-306" +class = "missing-authentication" +path = "src/Controller/AdminerController.php" +function = "index" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-f339-246p-wwjp: FroshAdminer Adminer UI is accessible without admin session" + +[[pair]] +name = "azure-blob-actionloadcontainerdata-cf69db4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "craftcms/azure-blob" +cve = "CVE-2026-32268 GHSA-q6fm-p73f-x862" +cwe = "CWE-862" +ecosystem = "composer" +published_at = "2026-03-16T18:44:38Z" +post_cutoff = false +commit = "cf69db45f393b3508a32f89ac8235554a2f026ff" +parent = "5f21c2694cb10f791ac5bf2834b122053d856020" +commit_url = "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff" +vendored = false +host = "github" +path = "src/controllers/DefaultController.php" +mode = "name" +relpath = "src/controllers/DefaultController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-18" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/controllers/DefaultController.php" +function = "actionLoadContainerData" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-q6fm-p73f-x862: Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability" + +[[pair]] +name = "connect-cms-update-7c99517" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "opensource-workshop/connect-cms" +cve = "CVE-2026-32300 GHSA-qr6x-wvxr-8hm9" +cwe = "CWE-285" +ecosystem = "composer" +published_at = "2026-03-23T20:39:10Z" +post_cutoff = false +commit = "7c9951738c62a1d51b91e9956d1eb756c5d52cce" +parent = "c04dc40f814eff891915752ef1ec00ba6612441c" +commit_url = "https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce" +vendored = false +host = "github" +path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +mode = "name" +relpath = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-20" +fix_lines = { in_function = 9, in_file = 9, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +function = "update" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-qr6x-wvxr-8hm9: Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information" + +[[pair]] +name = "parse-server-gethandler-053109b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "parse-community/parse-server" +cve = "CVE-2026-34784 GHSA-hpm8-9qx6-jvwv" +cwe = "CWE-285" +ecosystem = "npm" +published_at = "2026-04-01T23:09:14Z" +post_cutoff = false +commit = "053109b3ee71815bc39ed84116c108ff9edbf337" +parent = "83e794919635ff8b6c86bed8b640222d1c973e03" +commit_url = "https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337" +vendored = false +host = "github" +path = "src/Routers/FilesRouter.js" +mode = "name" +relpath = "src/Routers/FilesRouter.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-30" +fix_lines = { in_function = 14, in_file = 32, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "src/Routers/FilesRouter.js" +function = "getHandler" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-hpm8-9qx6-jvwv: Parser Server's streaming file download bypasses afterFind file trigger authorization" + +[[pair]] +name = "openclaw-resolvecommandauthorization-2aa93d4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "openclaw/openclaw" +cve = "GHSA-p3pv-c954-9m6f" +cwe = "CWE-863" +ecosystem = "npm" +published_at = "2026-05-11T18:31:46Z" +post_cutoff = false +commit = "2aa93d44a1b2c7058c371f261fda2b5d4de4a882" +parent = "4fdd005b88967a2eca5e20b600b8ffae3ce57b39" +commit_url = "https://github.com/openclaw/openclaw/commit/2aa93d44a1b2c7058c371f261fda2b5d4de4a882" +vendored = false +host = "github" +path = "src/auto-reply/command-auth.ts" +mode = "name" +relpath = "src/auto-reply/command-auth.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-21" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "src/auto-reply/command-auth.ts" +function = "resolveCommandAuthorization" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-p3pv-c954-9m6f: Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners" + +[[pair]] +name = "snappy-prepareoutput-1ee6360" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "knplabs/snappy" +cve = "CVE-2023-28115 GHSA-gq6w-q6wh-jggc" +cwe = "CWE-502" +ecosystem = "composer" +published_at = "2023-03-17T18:24:24Z" +post_cutoff = false +commit = "1ee6360cbdbea5d09705909a150df7963a88efd6" +parent = "cef6d3fd349236312e822e99957a0fbbac3f2cba" +commit_url = "https://github.com/knplabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6" +vendored = false +host = "github" +path = "src/Knp/Snappy/AbstractGenerator.php" +mode = "name" +relpath = "src/Knp/Snappy/AbstractGenerator.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-17" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "src/Knp/Snappy/AbstractGenerator.php" +function = "prepareOutput" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-gq6w-q6wh-jggc: PHAR deserialization allowing remote code execution" + +[[pair]] +name = "llama-hub-init-c01416e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "run-llama/llama-hub" +cve = "CVE-2024-23730 GHSA-297x-2qf3-jrj3" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2024-01-21T18:30:34Z" +post_cutoff = false +commit = "c01416e737c7747a213a79881b8308c41d043515" +parent = "2247b1b14cd2f4f54c7d95e46bada2d51371e786" +commit_url = "https://github.com/run-llama/llama-hub/commit/c01416e737c7747a213a79881b8308c41d043515" +vendored = false +host = "github" +path = "llama_hub/tools/openapi/base.py" +mode = "name" +relpath = "llama_hub/tools/openapi/base.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-07" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "llama_hub/tools/openapi/base.py" +function = "__init__" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-297x-2qf3-jrj3: Unsafe yaml deserialization in llama-hub" + +[[pair]] +name = "ngrinder-read-85efa4a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "naver/ngrinder" +cve = "CVE-2024-28213 GHSA-j7jm-8gf5-frcm" +cwe = "CWE-502" +ecosystem = "maven" +published_at = "2024-03-07T06:30:31Z" +post_cutoff = false +commit = "85efa4a075354e077a700262ef78e2e9119881bf" +parent = "1c6ba7ca5d9d2976cca7829f69c7d2b3e8ab3d51" +commit_url = "https://github.com/naver/ngrinder/commit/85efa4a075354e077a700262ef78e2e9119881bf" +vendored = false +host = "github" +path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +mode = "name" +relpath = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-02-23" +fix_lines = { in_function = 14, in_file = 20, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +function = "read" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-j7jm-8gf5-frcm: nGrinder vulnerable to unsafe Java objects deserialization" + +[[pair]] +name = "qiskit-ibm-runtime-object-hook-b78fca1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "qiskit/qiskit-ibm-runtime" +cve = "CVE-2024-29032 GHSA-x4x5-jv3x-9c7m" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2024-03-20T15:44:22Z" +post_cutoff = false +commit = "b78fca114133051805d00043a404b25a33835f4d" +parent = "1cba6967e7af156e9d9f610db7753419138c732a" +commit_url = "https://github.com/qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d" +vendored = false +host = "github" +path = "qiskit_ibm_runtime/utils/json.py" +mode = "name" +relpath = "qiskit_ibm_runtime/utils/json.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-03-18" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "qiskit_ibm_runtime/utils/json.py" +function = "object_hook" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-x4x5-jv3x-9c7m: `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code" + +[[pair]] +name = "invokeai-torch-load-file-756008d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "invoke-ai/invokeai" +cve = "CVE-2024-12029 GHSA-mcrp-whpw-jp68" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-03-21T15:32:15Z" +post_cutoff = false +commit = "756008dc5899081c5aa51e5bd8f24c1b3975a59e" +parent = "965cd76e338e1959efd0eea3d760846e86c6e1e5" +commit_url = "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e" +vendored = false +host = "github" +path = "invokeai/app/services/model_load/model_load_default.py" +mode = "name" +relpath = "invokeai/app/services/model_load/model_load_default.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "invokeai/app/services/model_load/model_load_default.py" +function = "torch_load_file" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-mcrp-whpw-jp68: InvokeAI Deserialization of Untrusted Data vulnerability" + +[[pair]] +name = "jackrabbit-getrepository-7a31909" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/jackrabbit" +cve = "CVE-2025-58782 GHSA-cxvc-g8f2-4gmm" +cwe = "CWE-502" +ecosystem = "maven" +published_at = "2025-09-08T09:31:09Z" +post_cutoff = false +commit = "7a319093c9864111bb86c9895148e580e0f8259a" +parent = "5fb875247f2c859ca72114c0ecd22a70192045a3" +commit_url = "https://github.com/apache/jackrabbit/commit/7a319093c9864111bb86c9895148e580e0f8259a" +vendored = false +host = "github" +path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +mode = "name" +relpath = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-08" +fix_lines = { in_function = 35, in_file = 34, source_total = 138 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +function = "getRepository" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-cxvc-g8f2-4gmm: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data" + +[[pair]] +name = "inspiremusic-load-784cbf8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "funaudiollm/inspiremusic" +cve = "CVE-2025-5148 GHSA-pgp9-g5q8-j3wp" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-05-25T12:30:24Z" +post_cutoff = false +commit = "784cbf8dde2cf1456ff808aeba23177e1810e7a9" +parent = "bf32364bcb0d136497ca69f9db622e9216b029dd" +commit_url = "https://github.com/funaudiollm/inspiremusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9" +vendored = false +host = "github" +path = "inspiremusic/cli/model.py" +mode = "name" +relpath = "inspiremusic/cli/model.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-09" +fix_lines = { in_function = 4, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "inspiremusic/cli/model.py" +function = "load" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-pgp9-g5q8-j3wp: FunAudioLLM InspireMusic deserialization vulnerability" + +[[pair]] +name = "datachain-deserialize-914b956" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "iterative/datachain" +cve = "CVE-2025-61677 GHSA-6px8-mr29-cj4r" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-10-02T16:24:46Z" +post_cutoff = false +commit = "914b95610620d50c8d9bee506ccbfa7d4d57fdc0" +parent = "de34d6cb19b3c0a17fff03318d2c6dd53ec960bf" +commit_url = "https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0" +vendored = false +host = "github" +path = "src/datachain/data_storage/serializer.py" +mode = "name" +relpath = "src/datachain/data_storage/serializer.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-10-01" +fix_lines = { in_function = 30, in_file = 106, source_total = 169 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "src/datachain/data_storage/serializer.py" +function = "deserialize" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-6px8-mr29-cj4r: DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables" + +[[pair]] +name = "ray-deserialize-with-fallback-c02bd31" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "ray-project/ray" +cve = "CVE-2026-41486 GHSA-mw35-8rx3-xf9r" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2026-04-24T16:15:00Z" +post_cutoff = false +commit = "c02bd31ae31996805868baa446a131a8d304525f" +parent = "ba6fbf1c8328b56d454ed1b875abe1c197afefd7" +commit_url = "https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f" +vendored = false +host = "github" +path = "python/ray/data/_internal/tensor_extensions/arrow.py" +mode = "name" +relpath = "python/ray/data/_internal/tensor_extensions/arrow.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-27" +fix_lines = { in_function = 20, in_file = 30, source_total = 47 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "python/ray/data/_internal/tensor_extensions/arrow.py" +function = "_deserialize_with_fallback" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-mw35-8rx3-xf9r: Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization" + +[[pair]] +name = "yii2-jqgrid-widget-addsearchoptionsrecursively-a117e0f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "himiklab/yii2-jqgrid-widget" +cve = "CVE-2014-125051 GHSA-7mg5-rw39-q67f" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2023-01-06T18:30:19Z" +post_cutoff = false +commit = "a117e0f2df729e3ff726968794d9a5ac40e660b9" +parent = "55460df283454951c257411d563b2b8118d6b299" +commit_url = "https://github.com/himiklab/yii2-jqgrid-widget/commit/a117e0f2df729e3ff726968794d9a5ac40e660b9" +vendored = false +host = "github" +path = "JqGridAction.php" +mode = "name" +relpath = "JqGridAction.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2014-10-06" +fix_lines = { in_function = 3, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "JqGridAction.php" +function = "addSearchOptionsRecursively" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7mg5-rw39-q67f: himiklab yii2-jqgrid-widget vulnerable to SQL Injection" + +[[pair]] +name = "postgraas-server-create-postgres-db-7cd8d01" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "blue-yonder/postgraas_server" +cve = "CVE-2018-25088 GHSA-vghm-8cjp-hjw6" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2023-07-18T15:30:36Z" +post_cutoff = false +commit = "7cd8d016edc74a78af0d81c948bfafbcc93c937c" +parent = "bd4f1b88e7008a3abd4dbe05c26e7b20bbb99649" +commit_url = "https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c" +vendored = false +host = "github" +path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +mode = "name" +relpath = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2018-02-01" +fix_lines = { in_function = 26, in_file = 26, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +function = "create_postgres_db" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-vghm-8cjp-hjw6: postgraas-server vulnerable to SQL injection" + +[[pair]] +name = "xmlseclibs-processrefnode-6490326" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "robrichards/xmlseclibs" +cve = "GHSA-2g98-f9jv-w8c5" +cwe = "CWE-91" +ecosystem = "composer" +published_at = "2024-05-20T18:06:52Z" +post_cutoff = false +commit = "649032643f7aac493e91ca318da0339aec72aa4a" +parent = "222303db07bef97b948f4882d98294d9facaddb4" +commit_url = "https://github.com/robrichards/xmlseclibs/commit/649032643f7aac493e91ca318da0339aec72aa4a" +vendored = false +host = "github" +path = "src/XMLSecurityDSig.php" +mode = "name" +relpath = "src/XMLSecurityDSig.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2018-02-15" +fix_lines = { in_function = 4, in_file = 3, source_total = 40 } + +[[pair.expected]] +cwe = "CWE-91" +class = "xml-injection" +path = "src/XMLSecurityDSig.php" +function = "processRefNode" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2g98-f9jv-w8c5: robrichards/xmlseclibs XPath injection" + +[[pair]] +name = "propel2-applylimit-cd23d73" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "propelorm/propel2" +cve = "GHSA-7vw7-qx38-37vr" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-20T17:34:33Z" +post_cutoff = false +commit = "cd23d7384a15cfe203e23b3a835c8ab1d81d9246" +parent = "c64c0d61a36544c8f7cb9073c039715ba9cc343a" +commit_url = "https://github.com/propelorm/propel2/commit/cd23d7384a15cfe203e23b3a835c8ab1d81d9246" +vendored = false +host = "github" +path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +mode = "name" +relpath = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2018-02-16" +fix_lines = { in_function = 2, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +function = "applyLimit" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7vw7-qx38-37vr: Propel2 SQL injection possible with limit() on MySQL" + +[[pair]] +name = "propel-applylimit-b720932" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "propelorm/propel" +cve = "GHSA-7g7c-qhf3-x59p" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-20T17:36:28Z" +post_cutoff = false +commit = "b72093201f8e225410f62a246653ac039e31c90a" +parent = "3f7a284906ce3e402bcb101938270842fdad71fa" +commit_url = "https://github.com/propelorm/propel/commit/b72093201f8e225410f62a246653ac039e31c90a" +vendored = false +host = "github" +path = "runtime/lib/adapter/DBMySQL.php" +mode = "name" +relpath = "runtime/lib/adapter/DBMySQL.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2019-11-04" +fix_lines = { in_function = 2, in_file = 3, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "runtime/lib/adapter/DBMySQL.php" +function = "applyLimit" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7g7c-qhf3-x59p: propel/propel1 SQL injection possible with limit() on MySQL" + +[[pair]] +name = "node-gry-exec-5108446" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ionicabizau/node-gry" +cve = "CVE-2020-36650 GHSA-w5mw-f2hq-5fw8" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-01-11T18:30:27Z" +post_cutoff = false +commit = "5108446c1e23960d65e8b973f1d9486f9f9dbd6c" +parent = "e6eea8e6ef0a72e144d3ce3eb883bd5940be0886" +commit_url = "https://github.com/ionicabizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c" +vendored = false +host = "github" +path = "lib/index.js" +mode = "name" +relpath = "lib/index.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2020-04-03" +fix_lines = { in_function = 8, in_file = 17, source_total = 25 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "lib/index.js" +function = "exec" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-w5mw-f2hq-5fw8: gry vulnerable to Command Injection" + +[[pair]] +name = "json-logic-js-arrayunique-c1dd82f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jwadhams/json-logic-js" +cve = "CVE-2021-4329 GHSA-67j4-2mh6-8627" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-03-05T21:30:15Z" +post_cutoff = false +commit = "c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227" +parent = "17e9fedcd6864aa94d5ae48eca259a9677d4dfe2" +commit_url = "https://github.com/jwadhams/json-logic-js/commit/c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227" +vendored = false +host = "github" +path = "logic.js" +mode = "name" +relpath = "logic.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2021-03-30" +fix_lines = { in_function = 6, in_file = 6, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "logic.js" +function = "arrayUnique" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-67j4-2mh6-8627: json-logic-js Command Injection vulnerability" + +[[pair]] +name = "yii2-gii-validatemessagecategory-ed61e0d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "yiisoft/yii2-gii" +cve = "CVE-2020-36655 GHSA-3mpg-q26j-83j5" +cwe = "CWE-94" +ecosystem = "composer" +published_at = "2023-01-21T03:30:28Z" +post_cutoff = false +commit = "ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b" +parent = "94f9c6d24c42137ca53f51bb023b19c1fd19bedf" +commit_url = "https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b" +vendored = false +host = "github" +path = "src/Generator.php" +mode = "name" +relpath = "src/Generator.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-05-06" +fix_lines = { in_function = 8, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/Generator.php" +function = "validateMessageCategory" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-3mpg-q26j-83j5: Command injection in yiisoft/yii2-gii" + +[[pair]] +name = "contao-tablelookupwizard-preparewhere-a5e723a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "terminal42/contao-tablelookupwizard" +cve = "GHSA-7fpj-wc8v-9cgc" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-30T13:12:13Z" +post_cutoff = false +commit = "a5e723a28f110b7df8ffc4175cef9b061d3cc717" +parent = "ae6c82f10b0f1e87226079ebaa78ac630b05279a" +commit_url = "https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717" +vendored = false +host = "github" +path = "TableLookupWizard.php" +mode = "name" +relpath = "TableLookupWizard.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-02-04" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "TableLookupWizard.php" +function = "prepareWhere" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7fpj-wc8v-9cgc: Duplicate Advisory: terminal42/contao-tablelookupwizard possible SQL injection in widget field value" + +[[pair]] +name = "spring-module-core-getschema-d374a5f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "folio-org/spring-module-core" +cve = "CVE-2022-4963 GHSA-4h5h-p23f-hjqf" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2024-03-21T03:36:44Z" +post_cutoff = false +commit = "d374a5f77e6b58e36f0e0e4419be18b95edcd7ff" +parent = "e93b5ddd3022b81abf8ae81da8d3a740186f456e" +commit_url = "https://github.com/folio-org/spring-module-core/commit/d374a5f77e6b58e36f0e0e4419be18b95edcd7ff" +vendored = false +host = "github" +path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +mode = "name" +relpath = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-11-21" +fix_lines = { in_function = 6, in_file = 8, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +function = "getSchema" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-4h5h-p23f-hjqf: SQL injection in Folio Spring Module Core" + +[[pair]] +name = "window-control-sendkeys-075c854" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "bruno-robert/window-control" +cve = "CVE-2022-25926 GHSA-9mjx-wfqp-j5ph" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-01-04T18:30:59Z" +post_cutoff = false +commit = "075c854534a749d887655a906759f5a7eee95173" +parent = "3954822ef3f0307745cdbff21a965278dd0a357b" +commit_url = "https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-01-02" +fix_lines = { in_function = 6, in_file = 10, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "index.js" +function = "sendKeys" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-9mjx-wfqp-j5ph: window-control vulnerable to Command Injection due to improper input sanitization" + +[[pair]] +name = "snowflake-connector-nodejs-convertrawvariant-0c9622a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "snowflakedb/snowflake-connector-nodejs" +cve = "CVE-2023-34232 GHSA-h53w-7qw7-vh5c" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-06-09T22:53:51Z" +post_cutoff = false +commit = "0c9622ae12cd7d627df404b73a783b4a5f60728a" +parent = "ca2f5e6e49caeafb1f882ab873c3dbab5dde67dc" +commit_url = "https://github.com/snowflakedb/snowflake-connector-nodejs/commit/0c9622ae12cd7d627df404b73a783b4a5f60728a" +vendored = false +host = "github" +path = "lib/connection/result/column.js" +mode = "name" +relpath = "lib/connection/result/column.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-04-17" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "lib/connection/result/column.js" +function = "convertRawVariant" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-h53w-7qw7-vh5c: Snowflake NodeJS Driver vulnerable to Command Injection" + +[[pair]] +name = "node-git-commit-info-gitcommitinfo-f7c491e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "jpeer264/node-git-commit-info" +cve = "CVE-2023-26134 GHSA-h42j-mrmp-9369" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-06-28T06:30:22Z" +post_cutoff = false +commit = "f7c491ede51f886a988af9b266797cb24591d18c" +parent = "8b456acbc919e98a9f04b399c1581bbf213d83bd" +commit_url = "https://github.com/jpeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c" +vendored = false +host = "github" +path = "index.ts" +mode = "name" +relpath = "index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-08" +fix_lines = { in_function = 3, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "index.ts" +function = "gitCommitInfo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-h42j-mrmp-9369: git-commit-info vulnerable to Command Injection" + +[[pair]] +name = "numexpr-stringtoexpression-4b2d89c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pydata/numexpr" +cve = "CVE-2023-39631 GHSA-f73w-4m7g-ch9x" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2023-09-01T18:30:41Z" +post_cutoff = false +commit = "4b2d89cf14e75030d27629925b9998e1e91d23c7" +parent = "74d597398ba3c379c196e469d40f516de110eaa5" +commit_url = "https://github.com/pydata/numexpr/commit/4b2d89cf14e75030d27629925b9998e1e91d23c7" +vendored = false +host = "github" +path = "numexpr/necompiler.py" +mode = "name" +relpath = "numexpr/necompiler.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-07-22" +fix_lines = { in_function = 2, in_file = 22, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "numexpr/necompiler.py" +function = "stringToExpression" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-f73w-4m7g-ch9x: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library" + +[[pair]] +name = "scancode-io-fetch-docker-image-07ec0de" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "nexb/scancode.io" +cve = "CVE-2023-39523 GHSA-2ggp-cmvm-f62f" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2023-08-09T14:41:23Z" +post_cutoff = false +commit = "07ec0de1964b14bf085a1c9a27ece2b61ab6105c" +parent = "2f5a6cce23058684633326fc27b0f052a218b64e" +commit_url = "https://github.com/nexb/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c" +vendored = false +host = "github" +path = "scanpipe/pipes/fetch.py" +mode = "name" +relpath = "scanpipe/pipes/fetch.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-07" +fix_lines = { in_function = 3, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "scanpipe/pipes/fetch.py" +function = "fetch_docker_image" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2ggp-cmvm-f62f: ScanCode.io command injection in docker image fetch process" + +[[pair]] +name = "dcnnt-py-main-b4021d7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "cyanomiko/dcnnt-py" +cve = "CVE-2023-1000 GHSA-8p42-7597-p2f6" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2024-04-27T09:30:33Z" +post_cutoff = false +commit = "b4021d784a97e25151a5353aa763a741e9a148f5" +parent = "4084ea18f96d9a953315f5555fca45f26639b8be" +commit_url = "https://github.com/cyanomiko/dcnnt-py/commit/b4021d784a97e25151a5353aa763a741e9a148f5" +vendored = false +host = "github" +path = "dcnnt/plugins/notifications.py" +mode = "name" +relpath = "dcnnt/plugins/notifications.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-14" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "dcnnt/plugins/notifications.py" +function = "main" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8p42-7597-p2f6: dcnnt-py is vulnerable to command injection via Notification Handler" + +[[pair]] +name = "find-exec-isexec-74fb108" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "shime/find-exec" +cve = "CVE-2023-40582 GHSA-95rp-6gqp-6622" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2023-08-30T20:08:58Z" +post_cutoff = false +commit = "74fb108097c229b03d6dba4cce81e36aa364b51c" +parent = "934ae934713bcb7bb9d6264030672d0c974cb541" +commit_url = "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-24" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "index.js" +function = "isExec" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-95rp-6gqp-6622: Command Injection Vulnerability in find-exec" + +[[pair]] +name = "blamer-git-0965877" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "kucherenko/blamer" +cve = "CVE-2023-26143 GHSA-6f9p-g466-f8v8" +cwe = "CWE-88" +ecosystem = "npm" +published_at = "2023-09-19T06:30:17Z" +post_cutoff = false +commit = "0965877f115753371a2570f10a63c455d2b2cde3" +parent = "530d2152bb96a6ac240f47f78d9dccd2e84487b9" +commit_url = "https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3" +vendored = false +host = "github" +path = "src/vcs/git.ts" +mode = "name" +relpath = "src/vcs/git.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-09-17" +fix_lines = { in_function = 3, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-88" +class = "argument-injection" +path = "src/vcs/git.ts" +function = "git" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-6f9p-g466-f8v8: blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API" + +[[pair]] +name = "php-heic-to-jpg-convert-852bc21" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "maestroerror/php-heic-to-jpg" +cve = "CVE-2024-48514 GHSA-g8v9-c8m3-942v" +cwe = "CWE-94" +ecosystem = "composer" +published_at = "2024-10-24T18:30:44Z" +post_cutoff = false +commit = "852bc210d302884e2635ba60b1b460b53afe5463" +parent = "5cfd76452915aad37666ecba7b67087aab9268cf" +commit_url = "https://github.com/maestroerror/php-heic-to-jpg/commit/852bc210d302884e2635ba60b1b460b53afe5463" +vendored = false +host = "github" +path = "src/HeicToJpg.php" +mode = "name" +relpath = "src/HeicToJpg.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-02-09" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/HeicToJpg.php" +function = "convert" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-g8v9-c8m3-942v: Remote code execution in php-heic-to-jpg" + +[[pair]] +name = "pyansys-geometry-start-program-f82346b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "ansys/pyansys-geometry" +cve = "CVE-2024-29189 GHSA-38jr-29fh-w9vm" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2024-03-25T19:37:46Z" +post_cutoff = false +commit = "f82346b9432b06532e84f3278125f5879b4e9f3f" +parent = "138ae18f810b3e556f90ca12164fc68bc76f063c" +commit_url = "https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f" +vendored = false +host = "github" +path = "src/ansys/geometry/core/connection/product_instance.py" +mode = "name" +relpath = "src/ansys/geometry/core/connection/product_instance.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-03-21" +fix_lines = { in_function = 1, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/ansys/geometry/core/connection/product_instance.py" +function = "_start_program" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-38jr-29fh-w9vm: ansys-geometry-core OS Command Injection vulnerability" + +[[pair]] +name = "sagemaker-python-sdk-capture-dependencies-2d873d5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/sagemaker-python-sdk" +cve = "CVE-2024-34073 GHSA-7pc3-pr3q-58vg" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2024-05-03T20:26:03Z" +post_cutoff = false +commit = "2d873d53f708ea570fc2e2a6974f8c3097fe9df5" +parent = "d27836eab1575d90db676ab2667b4816eaf45af0" +commit_url = "https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5" +vendored = false +host = "github" +path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +mode = "name" +relpath = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-04-02" +fix_lines = { in_function = 6, in_file = 4, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +function = "capture_dependencies" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7pc3-pr3q-58vg: sagemaker-python-sdk Command Injection vulnerability" + +[[pair]] +name = "node-mysql2-readcodefor-7d4b098" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sidorares/node-mysql2" +cve = "CVE-2024-21511 GHSA-4rch-2fh8-94vw" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2024-04-23T06:30:47Z" +post_cutoff = false +commit = "7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713" +parent = "2efd6ab397a1af0ae2b198c6761473ccfbcd8da5" +commit_url = "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713" +vendored = false +host = "github" +path = "lib/parsers/binary_parser.js" +mode = "name" +relpath = "lib/parsers/binary_parser.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-04-21" +fix_lines = { in_function = 4, in_file = 2, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "lib/parsers/binary_parser.js" +function = "readCodeFor" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-4rch-2fh8-94vw: MySQL2 for Node Arbitrary Code Injection" + +[[pair]] +name = "pymysql-escape-dict-521e400" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pymysql/pymysql" +cve = "CVE-2024-36039 GHSA-v9hf-5j83-6xpp" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2024-05-21T18:31:23Z" +post_cutoff = false +commit = "521e40050cb386a499f68f483fefd144c493053c" +parent = "7f032a699d55340f05101deb4d7d4f63db4adc11" +commit_url = "https://github.com/pymysql/pymysql/commit/521e40050cb386a499f68f483fefd144c493053c" +vendored = false +host = "github" +path = "pymysql/converters.py" +mode = "name" +relpath = "pymysql/converters.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-05-21" +fix_lines = { in_function = 6, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "pymysql/converters.py" +function = "escape_dict" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-v9hf-5j83-6xpp: PyMySQL SQL Injection vulnerability" + +[[pair]] +name = "mindsdb-dispatch-update-11a4db7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "mindsdb/mindsdb" +cve = "CVE-2024-45851 GHSA-wf9g-c67g-h4ch" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2024-09-12T15:33:01Z" +post_cutoff = false +commit = "11a4db792ad36cf704f7307c7602128b17752c80" +parent = "ff120b08f45a4b15a313f7723ea0f2d8aa4be87c" +commit_url = "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" +vendored = false +host = "github" +path = "mindsdb/integrations/libs/vectordatabase_handler.py" +mode = "name" +relpath = "mindsdb/integrations/libs/vectordatabase_handler.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-07-24" +fix_lines = { in_function = 2, in_file = 1, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "mindsdb/integrations/libs/vectordatabase_handler.py" +function = "_dispatch_update" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wf9g-c67g-h4ch: MindsDB Eval Injection vulnerability" + +[[pair]] +name = "haystack-validate-template-6c25a5c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "deepset-ai/haystack" +cve = "CVE-2024-41950 GHSA-hx9v-6r9f-w677" +cwe = "CWE-1336" +ecosystem = "pip" +published_at = "2024-07-31T18:50:41Z" +post_cutoff = false +commit = "6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e" +parent = "c077f4cc79a009d72a59399478f9cc78202c8ef5" +commit_url = "https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e" +vendored = false +host = "github" +path = "haystack/components/builders/dynamic_chat_prompt_builder.py" +mode = "name" +relpath = "haystack/components/builders/dynamic_chat_prompt_builder.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-26" +fix_lines = { in_function = 6, in_file = 5, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "haystack/components/builders/dynamic_chat_prompt_builder.py" +function = "_validate_template" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-hx9v-6r9f-w677: Insecure Jinja2 templates rendered in Haystack Components can lead to RCE" + +[[pair]] +name = "fides-render-829cbd9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "ethyca/fides" +cve = "CVE-2024-45053 GHSA-c34r-238x-f7qx" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2024-09-04T18:07:17Z" +post_cutoff = false +commit = "829cbd9cb5ef9c814fbac1ed6800e8d939d359c5" +parent = "e9174b771155abc0ff3faf1fb7b8b76836788617" +commit_url = "https://github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5" +vendored = false +host = "github" +path = "src/fides/api/service/messaging/message_dispatch_service.py" +mode = "name" +relpath = "src/fides/api/service/messaging/message_dispatch_service.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-03" +fix_lines = { in_function = 6, in_file = 6, source_total = 64 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/fides/api/service/messaging/message_dispatch_service.py" +function = "_render" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-c34r-238x-f7qx: Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine" + +[[pair]] +name = "torchgeo-get-weight-1a98078" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "torchgeo/torchgeo" +cve = "CVE-2024-49048 GHSA-ghq9-vc6f-8qjf" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2026-04-01T00:03:56Z" +post_cutoff = false +commit = "1a980788cb7089a1115f3b786c7daa9dd47d7d7a" +parent = "da691c4568b0ab98ea74bb736081622fb98d23c9" +commit_url = "https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a" +vendored = false +host = "github" +path = "torchgeo/models/api.py" +mode = "name" +relpath = "torchgeo/models/api.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-28" +fix_lines = { in_function = 9, in_file = 11, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "torchgeo/models/api.py" +function = "get_weight" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-ghq9-vc6f-8qjf: TorchGeo Remote Code Execution Vulnerability" + +[[pair]] +name = "plotai-run-bdcfb13" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "mljar/plotai" +cve = "CVE-2025-1497 GHSA-2hmp-5wqg-f24h" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2025-03-10T15:30:47Z" +post_cutoff = false +commit = "bdcfb13484f0b85703a4c1ddfd71cb21840e7fde" +parent = "7a95b06812af120141c84f6bc28551ac5586f9b9" +commit_url = "https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde" +vendored = false +host = "github" +path = "plotai/code/executor.py" +mode = "name" +relpath = "plotai/code/executor.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 1, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "plotai/code/executor.py" +function = "run" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2hmp-5wqg-f24h: PlotAI eval vulnerability" + +[[pair]] +name = "matrix-appservice-irc-settopic-74f02c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/matrix-appservice-irc" +cve = "CVE-2025-27146 GHSA-5mvm-89c9-9gm5" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-02-25T18:29:34Z" +post_cutoff = false +commit = "74f02c8e11f16ed1b355700092c1aa9c036a11bd" +parent = "062f3ace8b08e86e9f63c004ffdb85942af1b94e" +commit_url = "https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd" +vendored = false +host = "github" +path = "src/irc/BridgedClient.ts" +mode = "name" +relpath = "src/irc/BridgedClient.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-25" +fix_lines = { in_function = 5, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/irc/BridgedClient.ts" +function = "setTopic" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-5mvm-89c9-9gm5: Matrix IRC Bridge allows IRC command injection to own puppeted user" + +[[pair]] +name = "conductor-initengine-e981650" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "conductor-oss/conductor" +cve = "CVE-2025-26074 GHSA-8gqp-hr9g-pg62" +cwe = "CWE-78" +ecosystem = "maven" +published_at = "2025-06-30T18:31:50Z" +post_cutoff = false +commit = "e9816501df1e364a3d39d7fe37d6e167c40eaa1b" +parent = "5976cad67bab4204e3ec4b2edd6f6831623c7c9a" +commit_url = "https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b" +vendored = false +host = "github" +path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +mode = "name" +relpath = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-01" +fix_lines = { in_function = 6, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +function = "initEngine" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8gqp-hr9g-pg62: Conductor vulnerable to OS command injection through unrestricted access to Java classes" + +[[pair]] +name = "amplify-codegen-ui-buildbindingexpression-ca98c38" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws-amplify/amplify-codegen-ui" +cve = "CVE-2025-4318 GHSA-hf3j-86p7-mfw8" +cwe = "CWE-95" +ecosystem = "npm" +published_at = "2026-07-30T20:57:24Z" +post_cutoff = true +commit = "ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6" +parent = "bbc3435e592aaf9a96ad231d5468784d8e95f4c9" +commit_url = "https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6" +vendored = false +host = "github" +path = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +mode = "name" +relpath = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-10" +fix_lines = { in_function = 19, in_file = 103, source_total = 157 } + +[[pair.expected]] +cwe = "CWE-95" +class = "code-injection" +path = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +function = "buildBindingExpression" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-hf3j-86p7-mfw8: AWS Amplify Studio UI Component Properties Has an Input Validation Issue" + +[[pair]] +name = "jeecgboot-ispass-ddf0f61" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jeecgboot/jeecgboot" +cve = "CVE-2025-51825 GHSA-gj8w-ffq9-6828" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-08-22T15:33:05Z" +post_cutoff = false +commit = "ddf0f61ae59d217b59884921a98a0bc69b143f41" +parent = "4042579167ed2760b43fabc0fc03dc4e9b9ce767" +commit_url = "https://github.com/jeecgboot/jeecgboot/commit/ddf0f61ae59d217b59884921a98a0bc69b143f41" +vendored = false +host = "github" +path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +mode = "name" +relpath = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-27" +fix_lines = { in_function = 10, in_file = 24, source_total = 72 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +function = "isPass" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-gj8w-ffq9-6828: JeecgBoot SQL Injection Vulnerability" + +[[pair]] +name = "larecipe-replacelinks-c1d0d56" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "saleem-hadad/larecipe" +cve = "CVE-2025-53833 GHSA-jv7x-xhv2-p5v2" +cwe = "CWE-1336" +ecosystem = "composer" +published_at = "2025-07-14T21:22:01Z" +post_cutoff = false +commit = "c1d0d56889655ce5f2645db5acf0e78d5fc3b36b" +parent = "a5bd62b9ee2c9e15dee97a5cb7026736c8467269" +commit_url = "https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b" +vendored = false +host = "github" +path = "src/Models/Documentation.php" +mode = "name" +relpath = "src/Models/Documentation.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-07-14" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "src/Models/Documentation.php" +function = "replaceLinks" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-jv7x-xhv2-p5v2: LaRecipe is vulnerable to Server-Side Template Injection attacks" + +[[pair]] +name = "sequa-mcp-redirecttoauthorization-e569815" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "sequa-ai/sequa-mcp" +cve = "CVE-2025-10619 GHSA-9pw5-wx67-q964" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-09-17T21:30:43Z" +post_cutoff = false +commit = "e569815854166db5f71c2e722408f8957fb9e804" +parent = "aa343a5013d274c88eca48be703531ea8d621195" +commit_url = "https://github.com/sequa-ai/sequa-mcp/commit/e569815854166db5f71c2e722408f8957fb9e804" +vendored = false +host = "github" +path = "src/helpers/node-oauth-client-provider.ts" +mode = "name" +relpath = "src/helpers/node-oauth-client-provider.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-09-09" +fix_lines = { in_function = 6, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/helpers/node-oauth-client-provider.ts" +function = "redirectToAuthorization" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-9pw5-wx67-q964: @sequa-ai/sequa-mcp has Command Injection vulnerability" + +[[pair]] +name = "flink-cdc-tableexists-d576618" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/flink-cdc" +cve = "CVE-2025-62228 GHSA-wqm3-w3p6-xjgm" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-10-09T15:31:03Z" +post_cutoff = false +commit = "d5766187a9a4b191820e10238d4594ae665cdb89" +parent = "85a79aae2676d571fa952377055edcfafabd973e" +commit_url = "https://github.com/apache/flink-cdc/commit/d5766187a9a4b191820e10238d4594ae665cdb89" +vendored = false +host = "github" +path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +mode = "name" +relpath = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-18" +fix_lines = { in_function = 21, in_file = 51, source_total = 77 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +function = "tableExists" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wqm3-w3p6-xjgm: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers" + +[[pair]] +name = "hive-deletetablecolumnstatistics-c18d0df" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/hive" +cve = "CVE-2025-62728 GHSA-932v-x9x2-vq29" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-11-26T09:31:22Z" +post_cutoff = false +commit = "c18d0df2702130cf5d0f050e516eb8999aa56301" +parent = "770e70c98360ac0b029db46675e0dc5cd0e9040c" +commit_url = "https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301" +vendored = false +host = "github" +path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +mode = "name" +relpath = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-03" +fix_lines = { in_function = 17, in_file = 32, source_total = 44 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +function = "deleteTableColumnStatistics" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-932v-x9x2-vq29: Hive Metastore Server is vulnerable to SQL Injection" + +[[pair]] +name = "mcp-server-kubernetes-execinpod-d091107" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "flux159/mcp-server-kubernetes" +cve = "CVE-2025-66404 GHSA-wvxp-jp4w-w8wg" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-12-03T20:44:45Z" +post_cutoff = false +commit = "d091107ff92d9ffad1b3c295092f142d6578c48b" +parent = "0ab947f41c81a6a553f1c2acd733321d7a35f129" +commit_url = "https://github.com/flux159/mcp-server-kubernetes/commit/d091107ff92d9ffad1b3c295092f142d6578c48b" +vendored = false +host = "github" +path = "src/tools/exec_in_pod.ts" +mode = "name" +relpath = "src/tools/exec_in_pod.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-11-30" +fix_lines = { in_function = 30, in_file = 48, source_total = 65 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/tools/exec_in_pod.ts" +function = "execInPod" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wvxp-jp4w-w8wg: mcp-server-kubernetes has potential security issue in exec_in_pod tool" + +[[pair]] +name = "mcp-watch-clonerepo-e7da78c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "kapilduraphe/mcp-watch" +cve = "CVE-2025-66401 GHSA-27m7-ffhq-jqrm" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2025-12-02T00:38:14Z" +post_cutoff = false +commit = "e7da78c5b4b960f8b66c254059ad9ebc544a91a6" +parent = "0fca7228bd313ae5aa938d61311377e88ce6e682" +commit_url = "https://github.com/kapilduraphe/mcp-watch/commit/e7da78c5b4b960f8b66c254059ad9ebc544a91a6" +vendored = false +host = "github" +path = "src/scanner/McpScanner.ts" +mode = "name" +relpath = "src/scanner/McpScanner.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-30" +fix_lines = { in_function = 8, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/scanner/McpScanner.ts" +function = "cloneRepo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-27m7-ffhq-jqrm: MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL" + +[[pair]] +name = "elysia-get-26935bf" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "elysiajs/elysia" +cve = "CVE-2025-66457 GHSA-8vch-m3f4-q8jf" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2025-12-09T17:12:05Z" +post_cutoff = false +commit = "26935bf76ebc43b4a43d48b173fc853de43bb51e" +parent = "94f8528e0e093028868877e215f79f5ca21c519b" +commit_url = "https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e" +vendored = false +host = "github" +path = "src/compose.ts" +mode = "name" +relpath = "src/compose.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-01" +fix_lines = { in_function = 20, in_file = 20, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/compose.ts" +function = "get" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8vch-m3f4-q8jf: Elysia affected by arbitrary code injection through cookie config" + +[[pair]] +name = "parsl-workflow-resources-013a928" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "parsl/parsl" +cve = "CVE-2026-21892 GHSA-f2mf-q878-gh58" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-01-06T18:04:21Z" +post_cutoff = false +commit = "013a928461e70f38a33258bd525a351ed828e974" +parent = "2c37ae3e75137095302dac5f9cd3ca956cb51a47" +commit_url = "https://github.com/parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974" +vendored = false +host = "github" +path = "parsl/monitoring/visualization/views.py" +mode = "name" +relpath = "parsl/monitoring/visualization/views.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-05" +fix_lines = { in_function = 8, in_file = 8, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "parsl/monitoring/visualization/views.py" +function = "workflow_resources" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-f2mf-q878-gh58: Parsl Monitoring Visualization Vulnerable to SQL Injection" + +[[pair]] +name = "workers-sdk-handler-99b1f32" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cloudflare/workers-sdk" +cve = "CVE-2026-0933 GHSA-36p8-mvp6-cv38" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2026-01-21T23:00:35Z" +post_cutoff = false +commit = "99b1f328a9afe181b49f1114ed47f15f6d25f0be" +parent = "e98c95aa22938f5ab6c3c1befe91350b9dc2ba0c" +commit_url = "https://github.com/cloudflare/workers-sdk/commit/99b1f328a9afe181b49f1114ed47f15f6d25f0be" +vendored = false +host = "github" +path = "packages/wrangler/src/pages/deploy.ts" +mode = "name" +relpath = "packages/wrangler/src/pages/deploy.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-13" +fix_lines = { in_function = 7, in_file = 7, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "packages/wrangler/src/pages/deploy.ts" +function = "handler" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-36p8-mvp6-cv38: Wrangler affected by OS Command Injection in `wrangler pages deploy`" + +[[pair]] +name = "django-add-filtered-relation-005d60d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "django/django" +cve = "CVE-2026-1312 GHSA-6426-9fv3-65x8" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-02-03T15:30:24Z" +post_cutoff = false +commit = "005d60d97c4dfb117503bdb6f2facfcaf9315d84" +parent = "69065ca869b0970dff8fdd8fafb390bf8b3bf222" +commit_url = "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84" +vendored = false +host = "github" +path = "django/db/models/sql/query.py" +mode = "name" +relpath = "django/db/models/sql/query.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-03" +fix_lines = { in_function = 5, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "django/db/models/sql/query.py" +function = "add_filtered_relation" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-6426-9fv3-65x8: Django has an SQL Injection issue" + +[[pair]] +name = "webhooks-init-8834499" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "craftcms/webhooks" +cve = "CVE-2026-32261 GHSA-8wg7-wm29-2rvg" +cwe = "CWE-1336" +ecosystem = "composer" +published_at = "2026-03-16T18:11:23Z" +post_cutoff = false +commit = "88344991a68b07145567c46dfd0ae3328c521f62" +parent = "d7904f55b8e53286b620cf7257e8a39d120a61ad" +commit_url = "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62" +vendored = false +host = "github" +path = "src/Plugin.php" +mode = "name" +relpath = "src/Plugin.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-13" +fix_lines = { in_function = 8, in_file = 4, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "src/Plugin.php" +function = "init" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8wg7-wm29-2rvg: RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin" + +[[pair]] +name = "git-js-preventuploadpack-1effd8e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "steveukx/git-js" +cve = "CVE-2026-28291 GHSA-jcxm-m3jx-f287" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2026-04-13T16:35:37Z" +post_cutoff = false +commit = "1effd8e5012a5da05a9776512fac3e39b11f2d2d" +parent = "1402490d14f4125b08f3b2d6c86d3baa0feae6fb" +commit_url = "https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d" +vendored = false +host = "github" +path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +mode = "name" +relpath = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-21" +fix_lines = { in_function = 2, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +function = "preventUploadPack" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-jcxm-m3jx-f287: simple-git Affected by Command Execution via Option-Parsing Bypass" + +[[pair]] +name = "ormar-query-aggr-function-a03bae1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "collerek/ormar" +cve = "CVE-2026-26198 GHSA-xxh2-68g9-8jqr" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-02-23T22:12:17Z" +post_cutoff = false +commit = "a03bae14fe01358d3eaf7e319fcd5db2e4956b16" +parent = "ef95d3214daf9ccfd5591ae51d8b2fbe4b66c633" +commit_url = "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16" +vendored = false +host = "github" +path = "ormar/queryset/queryset.py" +mode = "name" +relpath = "ormar/queryset/queryset.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-22" +fix_lines = { in_function = 7, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "ormar/queryset/queryset.py" +function = "_query_aggr_function" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-xxh2-68g9-8jqr: ormar is vulnerable to SQL Injection through aggregate functions min() and max()" + +[[pair]] +name = "intake-expand-defaults-d0c0b6b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "intake/intake" +cve = "CVE-2026-33310 GHSA-37g4-qqqv-7m99" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-03-19T17:46:54Z" +post_cutoff = false +commit = "d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b" +parent = "67e0303735a60cf0f261e34c68139d0d3aa48c87" +commit_url = "https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b" +vendored = false +host = "github" +path = "intake/catalog/utils.py" +mode = "name" +relpath = "intake/catalog/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-09" +fix_lines = { in_function = 4, in_file = 8, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "intake/catalog/utils.py" +function = "expand_defaults" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-37g4-qqqv-7m99: Intake has a Command Injection via shell() Expansion in Parameter Defaults" + +[[pair]] +name = "openhands-get-git-diff-698cfc2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "openhands/openhands" +cve = "CVE-2026-33718 GHSA-7h8w-hj9j-8rjw" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-03-25T21:54:55Z" +post_cutoff = false +commit = "698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13" +parent = "83561701939fe70577e74c4aeb5acd2f7f8f7da3" +commit_url = "https://github.com/openhands/openhands/commit/698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13" +vendored = false +host = "github" +path = "openhands/runtime/utils/git_diff.py" +mode = "name" +relpath = "openhands/runtime/utils/git_diff.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-09" +fix_lines = { in_function = 18, in_file = 17, source_total = 35 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "openhands/runtime/utils/git_diff.py" +function = "get_git_diff" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7h8w-hj9j-8rjw: OpenHands is Vulnerable to Command Injection through its Git Diff Handler" + +[[pair]] +name = "scitokens-getkeyinfo-3dba108" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "scitokens/scitokens" +cve = "CVE-2026-32714 GHSA-rh5m-2482-966c" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-03-31T22:49:15Z" +post_cutoff = false +commit = "3dba108853f2f4a6c0f2325c03779bf083c41cf2" +parent = "66b075c35da18f8364276553513a53c596b4b8e3" +commit_url = "https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2" +vendored = false +host = "github" +path = "src/scitokens/utils/keycache.py" +mode = "name" +relpath = "src/scitokens/utils/keycache.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-13" +fix_lines = { in_function = 12, in_file = 18, source_total = 31 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "src/scitokens/utils/keycache.py" +function = "getkeyinfo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-rh5m-2482-966c: SciTokens is vulnerable to SQL Injection in KeyCache" + +[[pair]] +name = "langchain-get-template-variables-6bab0ba" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "langchain-ai/langchain" +cve = "CVE-2026-40087 GHSA-926x-3r5x-gfhw" +cwe = "CWE-1336" +ecosystem = "pip" +published_at = "2026-04-08T21:51:32Z" +post_cutoff = false +commit = "6bab0ba3c12328008ddca3e0d54ff5a6151cd27b" +parent = "4fe869f1c336e1df9fe3a6bd37f39a4d354a8608" +commit_url = "https://github.com/langchain-ai/langchain/commit/6bab0ba3c12328008ddca3e0d54ff5a6151cd27b" +vendored = false +host = "github" +path = "libs/core/langchain_core/prompts/string.py" +mode = "name" +relpath = "libs/core/langchain_core/prompts/string.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-08" +fix_lines = { in_function = 23, in_file = 71, source_total = 95 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "libs/core/langchain_core/prompts/string.py" +function = "get_template_variables" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-926x-3r5x-gfhw: LangChain has incomplete f-string validation in prompt templates" + +[[pair]] +name = "math-codegen-interpreter-4bb52d3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mauriciopoppe/math-codegen" +cve = "CVE-2026-41507 GHSA-p6x5-p4xf-cc4r" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2026-04-17T22:31:45Z" +post_cutoff = false +commit = "4bb52d3030683362b3559ee8dd91350555a05f6b" +parent = "abfc95c214245b06f3ceb2583393b003d1cd13eb" +commit_url = "https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b" +vendored = false +host = "github" +path = "lib/Interpreter.js" +mode = "name" +relpath = "lib/Interpreter.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-09" +fix_lines = { in_function = 4, in_file = 5, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "lib/Interpreter.js" +function = "Interpreter" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-p6x5-p4xf-cc4r: Remote Code Execution (RCE) via String Literal Injection into math-codegen" + +[[pair]] +name = "amazon-redshift-python-driver-vector-in-69a69df" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/amazon-redshift-python-driver" +cve = "CVE-2026-8838 GHSA-29h4-r29x-hchv" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2026-05-29T19:32:28Z" +post_cutoff = false +commit = "69a69dfdead75918e20384da52bcd760ded8dbca" +parent = "2c1dd5b9aca1945a1b8e01b2359075d9e8b0e77c" +commit_url = "https://github.com/aws/amazon-redshift-python-driver/commit/69a69dfdead75918e20384da52bcd760ded8dbca" +vendored = false +host = "github" +path = "redshift_connector/utils/type_utils.py" +mode = "name" +relpath = "redshift_connector/utils/type_utils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-18" +fix_lines = { in_function = 5, in_file = 24, source_total = 25 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "redshift_connector/utils/type_utils.py" +function = "vector_in" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-29h4-r29x-hchv: amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection" + +[[pair]] +name = "yt-dlp-prepare-outtmpl-5faffa9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Unlicense" +repo = "yt-dlp/yt-dlp" +cve = "GHSA-69qj-pvh9-c5wg" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-06-16T22:29:14Z" +post_cutoff = true +commit = "5faffa999fd33b373d47773e8ee639d072accec2" +parent = "7aac95eae663be82cffeaf2a8c1193a5e349e401" +commit_url = "https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2" +vendored = false +host = "github" +path = "yt_dlp/YoutubeDL.py" +mode = "name" +relpath = "yt_dlp/YoutubeDL.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-06-06" +fix_lines = { in_function = 10, in_file = 22, source_total = 53 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "yt_dlp/YoutubeDL.py" +function = "prepare_outtmpl" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-69qj-pvh9-c5wg: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp" + +[[pair]] +name = "wsgidav-exists-record-by-primary-key-6f35776" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "mar10/wsgidav" +cve = "CVE-2026-55509 GHSA-p6gw-4frg-j7jw" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-08-28T18:12:17Z" +post_cutoff = true +commit = "6f35776c9188f130ab044ce557015d51aaa83500" +parent = "67abdbd7d622fcf29aefdfbd0c9910de9e0c8b3d" +commit_url = "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500" +vendored = false +host = "github" +path = "wsgidav/samples/mysql_dav_provider.py" +mode = "name" +relpath = "wsgidav/samples/mysql_dav_provider.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-27" +fix_lines = { in_function = 40, in_file = 112, source_total = 140 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "wsgidav/samples/mysql_dav_provider.py" +function = "_exists_record_by_primary_key" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-p6gw-4frg-j7jw: WsgiDAV MySQL provider has a blind SQL injection" + +[[pair]] +name = "dynatrace-mcp-generatedqlsearchentitycommand-15d3546" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "dynatrace-oss/dynatrace-mcp" +cve = "GHSA-pqh8-p93p-2rx7" +cwe = "CWE-943" +ecosystem = "npm" +published_at = "2026-07-31T15:56:12Z" +post_cutoff = true +commit = "15d3546c0618ffbaeaeca477337e08e92f2151bc" +parent = "35db4695ce24f19d5326edee5a86e9ba39e13f69" +commit_url = "https://github.com/dynatrace-oss/dynatrace-mcp/commit/15d3546c0618ffbaeaeca477337e08e92f2151bc" +vendored = false +host = "github" +path = "src/capabilities/find-monitored-entity-by-name.ts" +mode = "name" +relpath = "src/capabilities/find-monitored-entity-by-name.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-07-14" +fix_lines = { in_function = 3, in_file = 6, source_total = 82 } + +[[pair.expected]] +cwe = "CWE-943" +class = "query-injection" +path = "src/capabilities/find-monitored-entity-by-name.ts" +function = "generateDqlSearchEntityCommand" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-pqh8-p93p-2rx7: @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL" + +[[pair]] +name = "agno-delete-by-metadata-6780513" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "agno-agi/agno" +cve = "CVE-2026-10105 GHSA-82m5-3pcp-hccq" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-05-29T18:31:34Z" +post_cutoff = false +commit = "678051366f14fe21de347b58a400bd707d5bebea" +parent = "f2fdceeb735f68bf750aae9b4bc4de9ebde7e0fa" +commit_url = "https://github.com/agno-agi/agno/commit/678051366f14fe21de347b58a400bd707d5bebea" +vendored = false +host = "github" +path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +mode = "name" +relpath = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-07-27" +fix_lines = { in_function = 20, in_file = 21, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +function = "delete_by_metadata" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-82m5-3pcp-hccq: agno contains a SQL injection vulnerability" + +[[pair]] +name = "virtualenv-quote-d721ff1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/virtualenv" +cve = "CVE-2026-102937 GHSA-x78j-v8h9-3j2q" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-10-01T15:08:29Z" +post_cutoff = true +commit = "d721ff140ce4afdc2a9b76751e4584e25d9fbea6" +parent = "087a2ef8bd3aa15b562a3558b1068f603e50f77a" +commit_url = "https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6" +vendored = false +host = "github" +path = "src/virtualenv/activation/batch/__init__.py" +mode = "name" +relpath = "src/virtualenv/activation/batch/__init__.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-09-18" +fix_lines = { in_function = 10, in_file = 63, source_total = 127 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/virtualenv/activation/batch/__init__.py" +function = "quote" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-x78j-v8h9-3j2q: virtualenv: Command injection via --prompt in activate.bat (batch activator)" + +[[pair]] +name = "zend-form-createattributesstring-6fe4031" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "zendframework/zend-form" +cve = "GHSA-gvpp-6jrj-5pqc" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-06-07T21:58:34Z" +post_cutoff = false +commit = "6fe40314e8e3477494aadd03d62573bd1c212bd1" +parent = "6afef49dae54bf68330825f6f6f3463a7bb992e9" +commit_url = "https://github.com/zendframework/zend-form/commit/6fe40314e8e3477494aadd03d62573bd1c212bd1" +vendored = false +host = "github" +path = "src/View/Helper/AbstractHelper.php" +mode = "name" +relpath = "src/View/Helper/AbstractHelper.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2014-04-15" +fix_lines = { in_function = 7, in_file = 8, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/View/Helper/AbstractHelper.php" +function = "createAttributesString" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-gvpp-6jrj-5pqc: Zend-Form vulnerable to Cross-site Scripting" + +[[pair]] +name = "zendframework-htmlattribs-1dd4f8c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "zendframework/zendframework" +cve = "GHSA-8q77-cv62-jj38" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-06-07T20:04:04Z" +post_cutoff = false +commit = "1dd4f8cede07469390eef1e629f808349fa1b5ea" +parent = "692a9d1f8f0d6b30bfd848241febd9d5e180d93a" +commit_url = "https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea" +vendored = false +host = "github" +path = "library/Zend/View/Helper/AbstractHtmlElement.php" +mode = "name" +relpath = "library/Zend/View/Helper/AbstractHtmlElement.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2014-04-15" +fix_lines = { in_function = 8, in_file = 11, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "library/Zend/View/Helper/AbstractHtmlElement.php" +function = "htmlAttribs" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8q77-cv62-jj38: Zendframework has potential Cross-site Scripting vector in multiple view helpers" + +[[pair]] +name = "scnsocialauth-invoke-4a00966" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "socalnick/scnsocialauth" +cve = "GHSA-g6f5-4w43-2x63" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-05-29T13:04:32Z" +post_cutoff = false +commit = "4a00966c41bc37251586d007564c5c891eba3700" +parent = "d255c32fe80c30bf936164736e6e7c1bf72773cf" +commit_url = "https://github.com/socalnick/scnsocialauth/commit/4a00966c41bc37251586d007564c5c891eba3700" +vendored = false +host = "github" +path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +mode = "name" +relpath = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2015-01-16" +fix_lines = { in_function = 17, in_file = 15, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +function = "__invoke" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-g6f5-4w43-2x63: ScnSocialAuth Cross-site Scripting vulnerability in login redirect param" + +[[pair]] +name = "ldapcherry-check-auth-6f98076" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "kakwa/ldapcherry" +cve = "CVE-2019-25095 GHSA-vq8w-x8v7-f88m" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-01-05T09:30:28Z" +post_cutoff = false +commit = "6f98076281e9452fdb1adcd1bcbb70a6f968ade9" +parent = "1ed654c91bf2caeedbad34944bf837b6c21a2292" +commit_url = "https://github.com/kakwa/ldapcherry/commit/6f98076281e9452fdb1adcd1bcbb70a6f968ade9" +vendored = false +host = "github" +path = "ldapcherry/__init__.py" +mode = "name" +relpath = "ldapcherry/__init__.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2019-01-02" +fix_lines = { in_function = 10, in_file = 12, source_total = 23 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "ldapcherry/__init__.py" +function = "_check_auth" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vq8w-x8v7-f88m: LdapCherry Cross-site Scripting vulnerbaility" + +[[pair]] +name = "framework-attributestostring-ae4d790" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "laravel/framework" +cve = "GHSA-vr95-p7q6-8m9q" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-05-15T22:16:06Z" +post_cutoff = false +commit = "ae4d790e99f3b743bc49984d37c9ca70adc62cd7" +parent = "bd67cc22af6fbc1f5745b0e3ce79e0a12b092048" +commit_url = "https://github.com/laravel/framework/commit/ae4d790e99f3b743bc49984d37c9ca70adc62cd7" +vendored = false +host = "github" +path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +mode = "name" +relpath = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-03-13" +fix_lines = { in_function = 6, in_file = 21, source_total = 40 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +function = "attributesToString" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vr95-p7q6-8m9q: Laravel Cross-site Scripting (XSS) vulnerability in blade templating" + +[[pair]] +name = "vditor-fixfirefoxarrowuptable-1b2382d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vanessa219/vditor" +cve = "CVE-2021-32855 GHSA-vfmp-9999-6wqj" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T15:30:23Z" +post_cutoff = false +commit = "1b2382d7f8a4ee509d9245db4450d926a0b24146" +parent = "30891f9bac9d0c3571fd16c58065a14c7f0bc90c" +commit_url = "https://github.com/vanessa219/vditor/commit/1b2382d7f8a4ee509d9245db4450d926a0b24146" +vendored = false +host = "github" +path = "src/ts/util/fixBrowserBehavior.ts" +mode = "name" +relpath = "src/ts/util/fixBrowserBehavior.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-09-21" +fix_lines = { in_function = 1, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ts/util/fixBrowserBehavior.ts" +function = "fixFirefoxArrowUpTable" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vfmp-9999-6wqj: Vditor Cross-site Scripting vulnerability" + +[[pair]] +name = "jquery-minicolors-init-ef13482" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "claviska/jquery-minicolors" +cve = "CVE-2021-32850 GHSA-crh5-vv2v-c82q" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T00:30:20Z" +post_cutoff = false +commit = "ef134824a7f4110ada53ea6c173111a4fa2f48f3" +parent = "707b80383c192250772386e7f590abc0835cd510" +commit_url = "https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3" +vendored = false +host = "github" +path = "jquery.minicolors.js" +mode = "name" +relpath = "jquery.minicolors.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2021-11-24" +fix_lines = { in_function = 3, in_file = 2, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "jquery.minicolors.js" +function = "init" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-crh5-vv2v-c82q: @claviska/jquery-minicolors vulnerable to Cross-site Scripting" + +[[pair]] +name = "mind-elixir-core-creatediv-0734852" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "ssshooter/mind-elixir-core" +cve = "CVE-2021-32851 GHSA-m22q-97p5-79v2" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T00:30:20Z" +post_cutoff = false +commit = "073485269ac83af24371f35bd08507defa885655" +parent = "6d5c5c66d583d9b486b03c4b56e026c6fdd1d69b" +commit_url = "https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655" +vendored = false +host = "github" +path = "src/plugin/nodeMenu.ts" +mode = "name" +relpath = "src/plugin/nodeMenu.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-11-25" +fix_lines = { in_function = 15, in_file = 11, source_total = 42 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/plugin/nodeMenu.ts" +function = "createDiv" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-m22q-97p5-79v2: Mind-elixir Cross-site Scripting vulnerability" + +[[pair]] +name = "eslint-detailed-reporter-renderissue-505c190" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mportuga/eslint-detailed-reporter" +cve = "CVE-2022-4942 GHSA-4xr4-89m5-46c7" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-04-20T06:30:17Z" +post_cutoff = false +commit = "505c190efd4905990db6207863bdcbd9b1d7e1bd" +parent = "f19967fb85454b3ded7e89cd27b0826a40f45283" +commit_url = "https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd" +vendored = false +host = "github" +path = "lib/template-generator.js" +mode = "name" +relpath = "lib/template-generator.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-06-02" +fix_lines = { in_function = 2, in_file = 12, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "lib/template-generator.js" +function = "renderIssue" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-4xr4-89m5-46c7: eslint-detailed-reporter vulnerable to cross-site scripting" + +[[pair]] +name = "sanitize-url-decodehtmlcharacters-d4bdc89" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "braintree/sanitize-url" +cve = "CVE-2022-48345 GHSA-q8gg-vj6m-hgmj" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-24T06:30:16Z" +post_cutoff = false +commit = "d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c" +parent = "b70161daebd9523590fc6feda017d0489a8f6002" +commit_url = "https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c" +vendored = false +host = "github" +path = "src/index.ts" +mode = "name" +relpath = "src/index.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-10-20" +fix_lines = { in_function = 1, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/index.ts" +function = "decodeHtmlCharacters" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q8gg-vj6m-hgmj: @braintree/sanitize-url Cross-site Scripting vulnerability" + +[[pair]] +name = "modoboa-identities-eef9ab7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "ISC" +repo = "modoboa/modoboa" +cve = "CVE-2023-0519 GHSA-jm3m-wr3p-hjrq" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-01-27T00:30:18Z" +post_cutoff = false +commit = "eef9ab72b5305578a3ad7a7463bd284aa645e98b" +parent = "718ee4370701c715a62edab3b206ed1b469f73d4" +commit_url = "https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b" +vendored = false +host = "github" +path = "modoboa/admin/static/admin/js/admin.js" +mode = "name" +relpath = "modoboa/admin/static/admin/js/admin.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-01-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "modoboa/admin/static/admin/js/admin.js" +function = "Identities" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-jm3m-wr3p-hjrq: Cross-site Scripting in modoboa" + +[[pair]] +name = "jquery-validation-delegate-7a490d8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jquery-validation/jquery-validation" +cve = "CVE-2025-3573 GHSA-rrj2-ph5q-jxw2" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-04-15T06:30:34Z" +post_cutoff = false +commit = "7a490d8f39bd988027568ddcf51755e1f4688902" +parent = "cfe74a19b671b0983b3b13dbf959619cfe926de9" +commit_url = "https://github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902" +vendored = false +host = "github" +path = "src/core.js" +mode = "name" +relpath = "src/core.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-02-01" +fix_lines = { in_function = 14, in_file = 12, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/core.js" +function = "delegate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-rrj2-ph5q-jxw2: jquery-validation vulnerable to Cross-site Scripting" + +[[pair]] +name = "email-ext-plugin-rendertemplate-7b2bd25" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/email-ext-plugin" +cve = "CVE-2023-25764 GHSA-p2fr-mq9m-6w6p" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2023-02-15T15:30:41Z" +post_cutoff = false +commit = "7b2bd251aa0193d009d85b713362d965dab262d0" +parent = "f715c42d186f363f64b64a6a6ed76ed241e702c9" +commit_url = "https://github.com/jenkinsci/email-ext-plugin/commit/7b2bd251aa0193d009d85b713362d965dab262d0" +vendored = false +host = "github" +path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +mode = "name" +relpath = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-02-08" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +function = "renderTemplate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin" + +[[pair]] +name = "archiva-checkparamchars-d62e81c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/archiva" +cve = "CVE-2023-28158 GHSA-qf34-f43r-gv9p" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2023-03-29T15:30:17Z" +post_cutoff = false +commit = "d62e81c7e75f617cf01d2a75952a2c857758f8c4" +parent = "4d93c1f457e3a285e84a46f25fceee1c0d2bd615" +commit_url = "https://github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4" +vendored = false +host = "github" +path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +mode = "name" +relpath = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-03-14" +fix_lines = { in_function = 10, in_file = 19, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +function = "checkParamChars" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-qf34-f43r-gv9p: Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)" + +[[pair]] +name = "silverstripe-form-capture-details-5b3aa39" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "bigfork/silverstripe-form-capture" +cve = "CVE-2023-28851 GHSA-38h6-gmr2-j4wx" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2023-04-03T21:06:31Z" +post_cutoff = false +commit = "5b3aa39dd1eef042f173167b0fa4d3f717971772" +parent = "9da789e26e38cac8f09d20fca7b36f7b3678a28c" +commit_url = "https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772" +vendored = false +host = "github" +path = "src/Model/CapturedFormSubmission.php" +mode = "name" +relpath = "src/Model/CapturedFormSubmission.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-31" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Model/CapturedFormSubmission.php" +function = "Details" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-38h6-gmr2-j4wx: Silverstripe Form Capture vulnerable to stored cross-site-scripting" + +[[pair]] +name = "whatsapp-chat-exporter-create-html-bfdc68c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "knugihk/whatsapp-chat-exporter" +cve = "GHSA-8c6x-g4fw-8rf4" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-07-10T21:54:36Z" +post_cutoff = false +commit = "bfdc68cd6ad53ceecf132773f9aaba50dd80fe79" +parent = "594a04adbcfbf7b4e6185348fd77cb7ae77f4452" +commit_url = "https://github.com/knugihk/whatsapp-chat-exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79" +vendored = false +host = "github" +path = "Whatsapp_Chat_Exporter/extract.py" +mode = "name" +relpath = "Whatsapp_Chat_Exporter/extract.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-15" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "Whatsapp_Chat_Exporter/extract.py" +function = "create_html" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8c6x-g4fw-8rf4: Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats." + +[[pair]] +name = "ckeditor-wordcount-plugin-strip-0f03b3e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "w8tcha/ckeditor-wordcount-plugin" +cve = "CVE-2023-37905 GHSA-q9w4-w667-qqj4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-07-10T21:54:03Z" +post_cutoff = false +commit = "0f03b3e5b7c1409998a13aba3a95396e6fa349d8" +parent = "d5a876dcb3093539f1b0a3270b640cf93fe78cf0" +commit_url = "https://github.com/w8tcha/ckeditor-wordcount-plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8" +vendored = false +host = "github" +path = "wordcount/plugin.js" +mode = "name" +relpath = "wordcount/plugin.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-07-08" +fix_lines = { in_function = 5, in_file = 5, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "wordcount/plugin.js" +function = "strip" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q9w4-w667-qqj4: ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor" + +[[pair]] +name = "critters-createdocument-7757902" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "googlechromelabs/critters" +cve = "CVE-2023-3481 GHSA-cx3j-qqxj-9597" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-08-11T18:57:53Z" +post_cutoff = false +commit = "7757902c9e0b3285d516359b3cb602cd9d50d80e" +parent = "c663a2431a9956d7f7c2be2554f4c0d82f32999a" +commit_url = "https://github.com/googlechromelabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e" +vendored = false +host = "github" +path = "packages/critters/src/dom.js" +mode = "name" +relpath = "packages/critters/src/dom.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-04" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/critters/src/dom.js" +function = "createDocument" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cx3j-qqxj-9597: Critters Cross-site Scripting Vulnerability" + +[[pair]] +name = "mjml-python-parse-84c495d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "felixschwarz/mjml-python" +cve = "CVE-2024-26151 GHSA-578p-fxmm-6229" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2024-02-22T21:40:59Z" +post_cutoff = false +commit = "84c495da20a91640a1ca551ace17df7f3be644aa" +parent = "3308bbae0d36b048f89eb5057d2c2a6a87e868da" +commit_url = "https://github.com/felixschwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa" +vendored = false +host = "github" +path = "mjml/mjml2html.py" +mode = "name" +relpath = "mjml/mjml2html.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-11-17" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "mjml/mjml2html.py" +function = "parse" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-578p-fxmm-6229: Potentially untrusted input is rendered as HTML in final output" + +[[pair]] +name = "apollo-client-nextjs-transportdatatojs-b92bc42" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "apollographql/apollo-client-nextjs" +cve = "CVE-2024-23841 GHSA-rv8p-rr2h-fgpg" +cwe = "CWE-80" +ecosystem = "npm" +published_at = "2024-01-30T20:57:45Z" +post_cutoff = false +commit = "b92bc42abd5f8e17d4db361c36bd08e4f541a46b" +parent = "4271a8c1d06ba089b5de4da59ff8258f7528ede3" +commit_url = "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b" +vendored = false +host = "github" +path = "package/src/ssr/dataTransport.ts" +mode = "name" +relpath = "package/src/ssr/dataTransport.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-30" +fix_lines = { in_function = 4, in_file = 3, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-80" +class = "xss" +path = "package/src/ssr/dataTransport.ts" +function = "transportDataToJS" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-rv8p-rr2h-fgpg: @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability" + +[[pair]] +name = "urql-transportdatatojs-4b7011b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "urql-graphql/urql" +cve = "CVE-2024-24556 GHSA-qhjf-hm5j-335w" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-01-30T20:57:28Z" +post_cutoff = false +commit = "4b7011b70d5718728ff912d02a4dbdc7f703540d" +parent = "b4c46f2dd8eb43186ac21861a5ce6df958463479" +commit_url = "https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d" +vendored = false +host = "github" +path = "packages/next-urql/src/DataHydrationContext.ts" +mode = "name" +relpath = "packages/next-urql/src/DataHydrationContext.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-01-30" +fix_lines = { in_function = 2, in_file = 2, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/next-urql/src/DataHydrationContext.ts" +function = "transportDataToJS" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-qhjf-hm5j-335w: @urql/next Cross-site Scripting vulnerability" + +[[pair]] +name = "dependency-check-plugin-transform-b3b286a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jenkinsci/dependency-check-plugin" +cve = "CVE-2024-28153 GHSA-9pp4-mx6x-xh36" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2024-03-06T18:30:38Z" +post_cutoff = false +commit = "b3b286a9615603f0294eb740193d153d843fae3a" +parent = "20f4e50e9576b8a08d6b71782334a31c961d684b" +commit_url = "https://github.com/jenkinsci/dependency-check-plugin/commit/b3b286a9615603f0294eb740193d153d843fae3a" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-02-05" +fix_lines = { in_function = 32, in_file = 65, source_total = 86 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +function = "transform" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9pp4-mx6x-xh36: Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability" + +[[pair]] +name = "send-sendstream-ae4f298" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "pillarjs/send" +cve = "CVE-2024-43799 GHSA-m6fv-jmcg-4jfg" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-10T19:42:41Z" +post_cutoff = false +commit = "ae4f2989491b392ae2ef3b0015a019770ae65d35" +parent = "b69cbb3dc4c09c37917d08a4c13fcd1bac97ade5" +commit_url = "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-10" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "SendStream" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-m6fv-jmcg-4jfg: send vulnerable to template injection that can lead to XSS" + +[[pair]] +name = "serve-static-createredirectdirectorylistener-0c11fad" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "expressjs/serve-static" +cve = "CVE-2024-43800 GHSA-cm22-4g7w-348p" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-10T19:42:33Z" +post_cutoff = false +commit = "0c11fad159898cdc69fd9ab63269b72468ecaf6b" +parent = "9b5a12a76f4d70530d2d2a8c7742e9158ed3c0a4" +commit_url = "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-10" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "createRedirectDirectoryListener" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cm22-4g7w-348p: serve-static vulnerable to template injection that can lead to XSS" + +[[pair]] +name = "layui-getpath-f756b41" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "layui/layui" +cve = "CVE-2024-47075 GHSA-j827-6rgf-9629" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-26T17:54:24Z" +post_cutoff = false +commit = "f756b41d63bf3d488a2cb042918638c9851bf2b0" +parent = "5e707cec12b4a52dfb2057b662e8bf4edd3693f3" +commit_url = "https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0" +vendored = false +host = "github" +path = "src/layui.js" +mode = "name" +relpath = "src/layui.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-23" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/layui.js" +function = "getPath" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-j827-6rgf-9629: Layui has DOM Clobbering gadgets that leads to Cross-site Scripting" + +[[pair]] +name = "vue-i18n-ismessageast-72f0d32" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "intlify/vue-i18n" +cve = "CVE-2024-52809 GHSA-9r9m-ffp6-9x4v" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-12-02T17:26:20Z" +post_cutoff = false +commit = "72f0d323006fc7363b18cab62d4522dadd874411" +parent = "554cc24818179588f77a6d92071ad91b24fd46a3" +commit_url = "https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411" +vendored = false +host = "github" +path = "packages/core-base/src/compilation.ts" +mode = "name" +relpath = "packages/core-base/src/compilation.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-11-28" +fix_lines = { in_function = 9, in_file = 17, source_total = 201 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/core-base/src/compilation.ts" +function = "isMessageAST" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9r9m-ffp6-9x4v: vue-i18n has cross-site scripting vulnerability with prototype pollution" + +[[pair]] +name = "simplexlsx-readthemecolors-71a5e3d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "shuchkin/simplexlsx" +cve = "CVE-2024-56364 GHSA-r87q-fj25-f8jf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-12-23T18:18:54Z" +post_cutoff = false +commit = "71a5e3d40d14e33161f8a40b3fd02de542218ef0" +parent = "0044a4c917037f7613bcd81c7766339a35b9832a" +commit_url = "https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0" +vendored = false +host = "github" +path = "src/SimpleXLSXEx.php" +mode = "name" +relpath = "src/SimpleXLSXEx.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-12-21" +fix_lines = { in_function = 8, in_file = 5, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/SimpleXLSXEx.php" +function = "readThemeColors" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-r87q-fj25-f8jf: Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx" + +[[pair]] +name = "dom-expressions-replace-521f75d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ryansolid/dom-expressions" +cve = "CVE-2025-27108 GHSA-hw62-58pr-7wc5" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-02-25T17:49:57Z" +post_cutoff = false +commit = "521f75dfa89ed24161646e7007d9d7d21da07767" +parent = "828f9e9cef5e0482d904ae4f6ec1069dba378a44" +commit_url = "https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767" +vendored = false +host = "github" +path = "packages/dom-expressions/src/server.js" +mode = "name" +relpath = "packages/dom-expressions/src/server.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-01-07" +fix_lines = { in_function = 5, in_file = 8, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/dom-expressions/src/server.js" +function = "replace" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-hw62-58pr-7wc5: DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace" + +[[pair]] +name = "jte-javascriptblock-a6fb00d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "casid/jte" +cve = "CVE-2025-23026 GHSA-vh22-6c6h-rm8q" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-01-13T16:57:59Z" +post_cutoff = false +commit = "a6fb00d53c7b8dbb86de933215dbe1b9191a57f1" +parent = "0c7d4ad7a135d169b2db85062d827279e6d86aaf" +commit_url = "https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1" +vendored = false +host = "github" +path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +mode = "name" +relpath = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-01-13" +fix_lines = { in_function = 2, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +function = "javaScriptBlock" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vh22-6c6h-rm8q: jte's HTML templates containing Javascript template strings are subject to XSS" + +[[pair]] +name = "felix-dev-rendercontent-87513ea" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/felix-dev" +cve = "CVE-2025-25247 GHSA-4c37-7m5h-c8m9" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-02-10T12:30:45Z" +post_cutoff = false +commit = "87513ea3533fdb79d9e2b251410bf2bfbd63941e" +parent = "c9df37190eddd3a8af4262956436880a3acb8c90" +commit_url = "https://github.com/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e" +vendored = false +host = "github" +path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +mode = "name" +relpath = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-02" +fix_lines = { in_function = 2, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +function = "renderContent" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-4c37-7m5h-c8m9: Apache Felix Webconsole: XSS in services console" + +[[pair]] +name = "label-studio-upload-example-using-config-8cf6958" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "humansignal/label-studio" +cve = "CVE-2025-25296 GHSA-wpq5-3366-mqw4" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-02-14T15:23:03Z" +post_cutoff = false +commit = "8cf6958e1e27ef6a03ed287e674470975d340885" +parent = "54f454e3abfe919b3016f369582da6aff1440aea" +commit_url = "https://github.com/humansignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885" +vendored = false +host = "github" +path = "label_studio/projects/views.py" +mode = "name" +relpath = "label_studio/projects/views.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-04" +fix_lines = { in_function = 4, in_file = 4, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "label_studio/projects/views.py" +function = "upload_example_using_config" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-wpq5-3366-mqw4: Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint" + +[[pair]] +name = "vega-replace-694560c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "vega/vega" +cve = "CVE-2025-27793 GHSA-963h-3v39-3pqf" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-03-27T18:00:24Z" +post_cutoff = false +commit = "694560c0aa576df8b6c5f0f7d202ac82233e6966" +parent = "560aeecbbe99edb3022071fbe8c756d04f2e57bc" +commit_url = "https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966" +vendored = false +host = "github" +path = "packages/vega-functions/src/functions/sequence.js" +mode = "name" +relpath = "packages/vega-functions/src/functions/sequence.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 1, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/vega-functions/src/functions/sequence.js" +function = "replace" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-963h-3v39-3pqf: Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]" + +[[pair]] +name = "htmlsanitizer-makesanitizedcopy-af6d2a7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jitbit/htmlsanitizer" +cve = "CVE-2025-29771 GHSA-vhv4-fh94-jm5x" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-03-14T19:54:52Z" +post_cutoff = false +commit = "af6d2a78877e7277cd01c825b7fb50edb5956963" +parent = "79975a1defa648f40625100cf68462d74d6d5ec7" +commit_url = "https://github.com/jitbit/htmlsanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963" +vendored = false +host = "github" +path = "HtmlSanitizer.js" +mode = "name" +relpath = "HtmlSanitizer.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-03-12" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "HtmlSanitizer.js" +function = "makeSanitizedCopy" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vhv4-fh94-jm5x: JS Html Sanitizer allows XSS when used with contentEditable" + +[[pair]] +name = "jsondiffpatch-typeformatttererrorformatter-0e374b5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "benjamine/jsondiffpatch" +cve = "CVE-2025-9910 GHSA-33vc-wfww-vjfv" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-09-11T06:30:23Z" +post_cutoff = false +commit = "0e374b5dd8d7879b329a9fc18affbd46ad50dd14" +parent = "3cb442637b156eaab4a7f3c9f342c0b9168030aa" +commit_url = "https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14" +vendored = false +host = "github" +path = "packages/jsondiffpatch/src/formatters/html.ts" +mode = "name" +relpath = "packages/jsondiffpatch/src/formatters/html.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-03-24" +fix_lines = { in_function = 11, in_file = 15, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/jsondiffpatch/src/formatters/html.ts" +function = "typeFormattterErrorFormatter" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-33vc-wfww-vjfv: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin" + +[[pair]] +name = "django-tomselect-prepare-results-0990ed3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "omenapps/django-tomselect" +cve = "GHSA-785h-76cm-cpmf" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-03-26T20:34:02Z" +post_cutoff = false +commit = "0990ed36c8874f9d42fa9deff7734bf8dcd46d40" +parent = "d9859b2e7c10a9af29a9f4fe676b6967cd6ca1a3" +commit_url = "https://github.com/omenapps/django-tomselect/commit/0990ed36c8874f9d42fa9deff7734bf8dcd46d40" +vendored = false +host = "github" +path = "src/django_tomselect/autocompletes.py" +mode = "name" +relpath = "src/django_tomselect/autocompletes.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-03-26" +fix_lines = { in_function = 7, in_file = 12, source_total = 157 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/django_tomselect/autocompletes.py" +function = "prepare_results" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-785h-76cm-cpmf: Django TomSelect incomplete escaping of dangerous characters in widget attributes" + +[[pair]] +name = "unopim-getrules-49d5f6a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "unopim/unopim" +cve = "CVE-2025-55742 GHSA-xr97-25v7-hc2q" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2025-08-21T14:25:23Z" +post_cutoff = false +commit = "49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75" +parent = "b5e169e65725e0d80b6c79d57e62a25e1af6a3c3" +commit_url = "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75" +vendored = false +host = "github" +path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +mode = "name" +relpath = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-01" +fix_lines = { in_function = 10, in_file = 9, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +function = "getRules" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xr97-25v7-hc2q: UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality" + +[[pair]] +name = "cloudbees-jenkins-advisor-plugin-executeinternal-4b456b3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/cloudbees-jenkins-advisor-plugin" +cve = "CVE-2025-47885 GHSA-xrpq-4g9w-qrwj" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-05-14T21:31:20Z" +post_cutoff = false +commit = "4b456b3110d1504d7dce8e7fca84c4e8793650e6" +parent = "4a0914b416ad664bb3b9b07505d0d657b0d32d31" +commit_url = "https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6" +vendored = false +host = "github" +path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +mode = "name" +relpath = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-05" +fix_lines = { in_function = 6, in_file = 7, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +function = "executeInternal" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xrpq-4g9w-qrwj: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting" + +[[pair]] +name = "clevertap-web-sdk-handlemessageevent-84695b7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "clevertap/clevertap-web-sdk" +cve = "CVE-2026-26861 GHSA-j5mf-6rh3-rhgg" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-27T18:31:06Z" +post_cutoff = false +commit = "84695b726a751614ddc3a4f71382c239c5833e03" +parent = "5e4504572136c9b918f3fe084303bd5f73d3f008" +commit_url = "https://github.com/clevertap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03" +vendored = false +host = "github" +path = "src/modules/visualBuilder/pageBuilder.js" +mode = "name" +relpath = "src/modules/visualBuilder/pageBuilder.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-28" +fix_lines = { in_function = 6, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/modules/visualBuilder/pageBuilder.js" +function = "handleMessageEvent" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-j5mf-6rh3-rhgg: CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function" + +[[pair]] +name = "mezzanine-displayable-links-js-898630d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "stephenmcd/mezzanine" +cve = "CVE-2025-6050 GHSA-7pr5-w74r-jjj7" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-06-17T12:31:15Z" +post_cutoff = false +commit = "898630d8df48cf3ddb8b9942f59168b93216e3f8" +parent = "245473493057c08911852ea8c82db4818ad6c9be" +commit_url = "https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8" +vendored = false +host = "github" +path = "mezzanine/core/views.py" +mode = "name" +relpath = "mezzanine/core/views.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-04" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "mezzanine/core/views.py" +function = "displayable_links_js" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-7pr5-w74r-jjj7: Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function" + +[[pair]] +name = "cadwyn-swagger-dashboard-b424ecd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zmievsa/cadwyn" +cve = "CVE-2025-53528 GHSA-2gxp-6r36-m97r" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-07-21T14:08:40Z" +post_cutoff = false +commit = "b424ecd57cd8dabbc8fe39b8f8ccafea629c7728" +parent = "5a6e2b7f009f33d93ea26a50156523ba3e4c42ca" +commit_url = "https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728" +vendored = false +host = "github" +path = "cadwyn/applications.py" +mode = "name" +relpath = "cadwyn/applications.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-07-05" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "cadwyn/applications.py" +function = "swagger_dashboard" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-2gxp-6r36-m97r: Cadwyn vulnerable to XSS on the docs page" + +[[pair]] +name = "webssh-log-status-a7a704f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "huashengdun/webssh" +cve = "CVE-2025-7885 GHSA-9cg4-9hv5-3376" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-07-20T12:30:27Z" +post_cutoff = false +commit = "a7a704f111391c82efc1bacf89693ff45bda7f5f" +parent = "1cf19c71861a0df4dcbad67b6544224bbe616be1" +commit_url = "https://github.com/huashengdun/webssh/commit/a7a704f111391c82efc1bacf89693ff45bda7f5f" +vendored = false +host = "github" +path = "webssh/static/js/main.js" +mode = "name" +relpath = "webssh/static/js/main.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-07-27" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "webssh/static/js/main.js" +function = "log_status" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9cg4-9hv5-3376: WebSSH Cross-site Scripting vulnerability" + +[[pair]] +name = "core-index-e984870" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "gp247net/core" +cve = "CVE-2025-57407 GHSA-46v4-5mc8-q2cf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2025-09-23T18:30:22Z" +post_cutoff = false +commit = "e9848706b41d835ca3d668cb1554650403e86da1" +parent = "8c2d98e786ec01cd1841a9ccaa083f7e0e9a0f20" +commit_url = "https://github.com/gp247net/core/commit/e9848706b41d835ca3d668cb1554650403e86da1" +vendored = false +host = "github" +path = "src/Controllers/AdminLogController.php" +mode = "name" +relpath = "src/Controllers/AdminLogController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-05" +fix_lines = { in_function = 2, in_file = 1, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Controllers/AdminLogController.php" +function = "index" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-46v4-5mc8-q2cf: GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability" + +[[pair]] +name = "mesh-web-sdk-openlink-7f22148" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "frontfin/mesh-web-sdk" +cve = "CVE-2025-59430 GHSA-vh3f-qppr-j97f" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-09-22T21:09:27Z" +post_cutoff = false +commit = "7f22148516d58e21a8b7670dde927d614c0d15c2" +parent = "cf013b85ab95d64c63cbe46d6cb14695474924e7" +commit_url = "https://github.com/frontfin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2" +vendored = false +host = "github" +path = "packages/link/src/Link.ts" +mode = "name" +relpath = "packages/link/src/Link.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-10" +fix_lines = { in_function = 6, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/link/src/Link.ts" +function = "openLink" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vh3f-qppr-j97f: Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink" + +[[pair]] +name = "fastmcp-create-detail-box-2a20f54" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jlowin/fastmcp" +cve = "CVE-2025-62800 GHSA-mxxr-jv3v-6pgc" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-10-29T15:38:29Z" +post_cutoff = false +commit = "2a20f54617a37213ed83894a8c2f0ac38a2e83a3" +parent = "541822f07ff28b196bde09d3818fea0579becd86" +commit_url = "https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3" +vendored = false +host = "github" +path = "src/fastmcp/utilities/ui.py" +mode = "name" +relpath = "src/fastmcp/utilities/ui.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-10-14" +fix_lines = { in_function = 4, in_file = 7, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/fastmcp/utilities/ui.py" +function = "create_detail_box" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-mxxr-jv3v-6pgc: FastMCP vulnerable to reflected XSS in client's callback page" + +[[pair]] +name = "mailgen-setupbuttonfallbacktext-7a791a4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "eladnava/mailgen" +cve = "CVE-2025-62380 GHSA-q4w9-x3rv-4c8j" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-10-15T19:29:36Z" +post_cutoff = false +commit = "7a791a424ff3a3f7783f8750919f1e98639924a8" +parent = "cedddb6a672bf047d98b0053677310583d55ea45" +commit_url = "https://github.com/eladnava/mailgen/commit/7a791a424ff3a3f7783f8750919f1e98639924a8" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-10-15" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "setupButtonFallbackText" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q4w9-x3rv-4c8j: Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails" + +[[pair]] +name = "spotipy-do-get-880b92d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "spotipy-dev/spotipy" +cve = "CVE-2025-66040 GHSA-r77h-rpp9-w2xm" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-12-01T19:07:26Z" +post_cutoff = false +commit = "880b92d7243dcf2b83bf31dc365a858d8b5e6767" +parent = "a91d9feb516a4360503dca9cfe63a35927b9befa" +commit_url = "https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767" +vendored = false +host = "github" +path = "spotipy/oauth2.py" +mode = "name" +relpath = "spotipy/oauth2.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-26" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "spotipy/oauth2.py" +function = "do_GET" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-r77h-rpp9-w2xm: Spotipy has a XSS vulnerability in its OAuth callback server" + +[[pair]] +name = "java-html-sanitizer-stripdisallowedtags-4149cf0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "owasp/java-html-sanitizer" +cve = "CVE-2025-66021 GHSA-g9gq-3pfx-2gw2" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-11-25T22:10:17Z" +post_cutoff = false +commit = "4149cf02ba84db13e8e9d7ee1b01b3f47238e072" +parent = "b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e" +commit_url = "https://github.com/owasp/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072" +vendored = false +host = "github" +path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +mode = "name" +relpath = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-22" +fix_lines = { in_function = 26, in_file = 19, source_total = 31 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +function = "stripDisallowedTags" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-g9gq-3pfx-2gw2: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization " + +[[pair]] +name = "html2pdf-js-createelement-988826e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ekoopmans/html2pdf.js" +cve = "CVE-2026-22787 GHSA-w8x4-x68c-m6fc" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-01-14T16:53:10Z" +post_cutoff = false +commit = "988826e336035b39a8608182d7b73c0e3cd78c7b" +parent = "f6dc70fdaa814f7b83d1e8059279814d5b46013e" +commit_url = "https://github.com/ekoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b" +vendored = false +host = "github" +path = "src/utils.js" +mode = "name" +relpath = "src/utils.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-12" +fix_lines = { in_function = 10, in_file = 10, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/utils.js" +function = "createElement" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-w8x4-x68c-m6fc: html2pdf.js contains a cross-site scripting vulnerability" + +[[pair]] +name = "distributed-http-get-ab72092" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "dask/distributed" +cve = "CVE-2026-23528 GHSA-c336-7962-wfj2" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-01-16T16:58:16Z" +post_cutoff = false +commit = "ab72092a8a938923c2bb51a2cd14ca26614827fa" +parent = "f4cfecc48856d5f0fbf7f840fbecdb17544fd30e" +commit_url = "https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa" +vendored = false +host = "github" +path = "distributed/http/proxy.py" +mode = "name" +relpath = "distributed/http/proxy.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-16" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "distributed/http/proxy.py" +function = "http_get" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-c336-7962-wfj2: Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard" + +[[pair]] +name = "beautiful-mermaid-rendernodeshape-68f3ab8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "lukilabs/beautiful-mermaid" +cve = "CVE-2026-26226 GHSA-cgmm-x5ww-q5cr" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-13T18:31:25Z" +post_cutoff = false +commit = "68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1" +parent = "83ab883b6826aa5c9df26843883bdbe89ceae7cf" +commit_url = "https://github.com/lukilabs/beautiful-mermaid/commit/68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1" +vendored = false +host = "github" +path = "src/renderer.ts" +mode = "name" +relpath = "src/renderer.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-29" +fix_lines = { in_function = 6, in_file = 4, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/renderer.ts" +function = "renderNodeShape" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cgmm-x5ww-q5cr: beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)" + +[[pair]] +name = "isso-moderate-0afbfe0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "isso-comments/isso" +cve = "CVE-2026-27469 GHSA-9fww-8cpr-q66r" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-02-24T16:03:04Z" +post_cutoff = false +commit = "0afbfe0691ee237963e8fb0b2ee01c9e55ca2144" +parent = "09cddc1940c837cbd46559db49459d20f670cd16" +commit_url = "https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144" +vendored = false +host = "github" +path = "isso/views/comments.py" +mode = "name" +relpath = "isso/views/comments.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-19" +fix_lines = { in_function = 10, in_file = 26, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "isso/views/comments.py" +function = "moderate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9fww-8cpr-q66r: Isso affected by Stored XSS via comment website field" + +[[pair]] +name = "pannellum-createhotspot-9391ef8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mpetroff/pannellum" +cve = "CVE-2026-27210 GHSA-8423-w5wx-h2r6" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-19T20:44:48Z" +post_cutoff = false +commit = "9391ef8da6a6a98c6a9f8c97f101adb900523681" +parent = "bb19235ac074df05c545c8d2d2235916d2aef0b8" +commit_url = "https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681" +vendored = false +host = "github" +path = "src/js/pannellum.js" +mode = "name" +relpath = "src/js/pannellum.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-19" +fix_lines = { in_function = 8, in_file = 13, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/js/pannellum.js" +function = "createHotSpot" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8423-w5wx-h2r6: Pannellum has a XSS vulnerability in hot spot attributes" + +[[pair]] +name = "lxml-html-clean-call-9c5612c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "fedora-python/lxml_html_clean" +cve = "CVE-2026-28350 GHSA-xvp8-3mhv-424c" +cwe = "CWE-116" +ecosystem = "pip" +published_at = "2026-03-02T19:35:52Z" +post_cutoff = false +commit = "9c5612ca33b941eec4178abf8a5294b103403f34" +parent = "2ef732667ddbc74ea59847bcf24b75809aaeed3b" +commit_url = "https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34" +vendored = false +host = "github" +path = "lxml_html_clean/clean.py" +mode = "name" +relpath = "lxml_html_clean/clean.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-27" +fix_lines = { in_function = 2, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-116" +class = "improper-encoding" +path = "lxml_html_clean/clean.py" +function = "__call__" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xvp8-3mhv-424c: lxml-html-clean has tag injection through default Cleaner configuration" + +[[pair]] +name = "nicknames-invoke-4dde997" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "flarum/nicknames" +cve = "CVE-2026-30913 GHSA-3c4m-j3g4-hh25" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-03-10T00:56:30Z" +post_cutoff = false +commit = "4dde99729abdce8f6e2a7437c86e38735fdcca28" +parent = "7985676fea59adc4628a1f0ba42ea93afc9be498" +commit_url = "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28" +vendored = false +host = "github" +path = "src/AddNicknameValidation.php" +mode = "name" +relpath = "src/AddNicknameValidation.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-06" +fix_lines = { in_function = 5, in_file = 7, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/AddNicknameValidation.php" +function = "__invoke" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3c4m-j3g4-hh25: flarum/nicknames extension has display name injection in notification emails (autolink & markdown)" + +[[pair]] +name = "vscode-lean4-replaceat-14b7a10" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "leanprover/vscode-lean4" +cve = "CVE-2026-32732 GHSA-6ggm-pwr9-r5h2" +cwe = "CWE-80" +ecosystem = "npm" +published_at = "2026-03-16T16:39:55Z" +post_cutoff = false +commit = "14b7a105c89d2819c5e78970fd258393f76453bb" +parent = "a884fa075489c3401e3702ad78aaa45a98a0841a" +commit_url = "https://github.com/leanprover/vscode-lean4/commit/14b7a105c89d2819c5e78970fd258393f76453bb" +vendored = false +host = "github" +path = "lean4-unicode-input-component/src/index.ts" +mode = "name" +relpath = "lean4-unicode-input-component/src/index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-11" +fix_lines = { in_function = 4, in_file = 13, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-80" +class = "xss" +path = "lean4-unicode-input-component/src/index.ts" +function = "replaceAt" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-6ggm-pwr9-r5h2: XSS in @leanprover/unicode-input-component" + +[[pair]] +name = "express-xss-sanitizer-initializeoptions-5623009" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ahmedadelfahim/express-xss-sanitizer" +cve = "CVE-2026-33979 GHSA-3843-rr4g-m8jq" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-03-27T17:56:45Z" +post_cutoff = false +commit = "5623009ef11dcf095c163a38dea07b9cc22ad19f" +parent = "62d6542a2a57298da7a2e02de623454007e4f6d6" +commit_url = "https://github.com/ahmedadelfahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f" +vendored = false +host = "github" +path = "lib/sanitize.js" +mode = "name" +relpath = "lib/sanitize.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-25" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "lib/sanitize.js" +function = "initializeOptions" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3843-rr4g-m8jq: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)" + +[[pair]] +name = "graby-cleanupxss-0295d82" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "j0k3r/graby" +cve = "GHSA-3h6j-9x8m-rg3g" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-03-31T23:12:36Z" +post_cutoff = false +commit = "0295d828822f7a59c5751a8199973a4f965a99b0" +parent = "5c5870bd0e8b03c9ea3e7c056d013cd9e4ab2f9a" +commit_url = "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0" +vendored = false +host = "github" +path = "src/Graby.php" +mode = "name" +relpath = "src/Graby.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-27" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Graby.php" +function = "cleanupXss" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3h6j-9x8m-rg3g: Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config" + +[[pair]] +name = "unhead-getstreamkey-64b5ac0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "unjs/unhead" +cve = "GHSA-x7mm-9vvv-64w8" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-04-10T22:09:39Z" +post_cutoff = false +commit = "64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6" +parent = "17c123eb9e8974bf72973246efdf26a199fd11bd" +commit_url = "https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6" +vendored = false +host = "github" +path = "packages/unhead/src/stream/server.ts" +mode = "name" +relpath = "packages/unhead/src/stream/server.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-10" +fix_lines = { in_function = 4, in_file = 20, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/unhead/src/stream/server.ts" +function = "getStreamKey" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-x7mm-9vvv-64w8: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation" + +[[pair]] +name = "ipl-web-postdispatch-f387e92" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "icinga/ipl-web" +cve = "CVE-2026-42224 GHSA-55wf-5m3q-6jjf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-04-29T21:01:55Z" +post_cutoff = false +commit = "f387e92504d7a03bb857d1aee9b7410e06dd065d" +parent = "b0fa6ea09f7269b7616e0ae6c9ec50035679bb23" +commit_url = "https://github.com/icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d" +vendored = false +host = "github" +path = "src/Compat/CompatController.php" +mode = "name" +relpath = "src/Compat/CompatController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-21" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Compat/CompatController.php" +function = "postDispatch" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-55wf-5m3q-6jjf: ipl/web is vulnerable to reflected XSS by malformed search requests" + +[[pair]] +name = "livewire-markdown-editor-updatedattachments-1e60eaa" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "mckenziearts/livewire-markdown-editor" +cve = "GHSA-gxxh-8vcj-w2mh" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-05-04T22:11:05Z" +post_cutoff = false +commit = "1e60eaa5781e89704e112425f832774be85cd71f" +parent = "cfd07048019694d2aaeaa9247a63991703173858" +commit_url = "https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f" +vendored = false +host = "github" +path = "src/Livewire/MarkdownEditor.php" +mode = "name" +relpath = "src/Livewire/MarkdownEditor.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-24" +fix_lines = { in_function = 11, in_file = 43, source_total = 73 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Livewire/MarkdownEditor.php" +function = "updatedAttachments" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-gxxh-8vcj-w2mh: livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler" + +[[pair]] +name = "microdot-set-cookie-99b281b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "miguelgrinberg/microdot" +cve = "CVE-2026-42874 GHSA-7wc8-wvc4-m498" +cwe = "CWE-113" +ecosystem = "pip" +published_at = "2026-05-05T18:35:20Z" +post_cutoff = false +commit = "99b281b45faef8472410f2d56bfef496dfbd95d5" +parent = "da91d4272aa2fb5efcc81bf823947737e031d0f8" +commit_url = "https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5" +vendored = false +host = "github" +path = "src/microdot/microdot.py" +mode = "name" +relpath = "src/microdot/microdot.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-24" +fix_lines = { in_function = 2, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-113" +class = "header-injection" +path = "src/microdot/microdot.py" +function = "set_cookie" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-7wc8-wvc4-m498: Microdot has HTTP response splitting in Response.set_cookie()" + +[[pair]] +name = "liquidjs-strip-html-26ea285" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "harttle/liquidjs" +cve = "CVE-2026-44644 GHSA-2qv6-9wx5-cwv4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-27T00:09:12Z" +post_cutoff = false +commit = "26ea2856c7a90aec892b98d94a9b7a3e18539045" +parent = "a55f543f49aea8f769e680b0d115aa903952efd0" +commit_url = "https://github.com/harttle/liquidjs/commit/26ea2856c7a90aec892b98d94a9b7a3e18539045" +vendored = false +host = "github" +path = "src/filters/html.ts" +mode = "name" +relpath = "src/filters/html.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-03" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/filters/html.ts" +function = "strip_html" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-2qv6-9wx5-cwv4: LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS" + +[[pair]] +name = "sveltia-cms-sanitizeentrysummary-43a6ac5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sveltia/sveltia-cms" +cve = "GHSA-97r8-rf7q-wmjw" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-18T13:43:50Z" +post_cutoff = false +commit = "43a6ac5d0182a503400d8ce1ac156e08f537b1b2" +parent = "bb403947508f0070a93938878153530771c1b405" +commit_url = "https://github.com/sveltia/sveltia-cms/commit/43a6ac5d0182a503400d8ce1ac156e08f537b1b2" +vendored = false +host = "github" +path = "src/lib/services/contents/entry/summary.js" +mode = "name" +relpath = "src/lib/services/contents/entry/summary.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-11" +fix_lines = { in_function = 7, in_file = 9, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/lib/services/contents/entry/summary.js" +function = "sanitizeEntrySummary" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-97r8-rf7q-wmjw: Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML" + +[[pair]] +name = "svelte-encode-a16ebc6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sveltejs/svelte" +cve = "GHSA-f3cj-j4f6-wq85" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-14T20:30:09Z" +post_cutoff = false +commit = "a16ebc67bbcf8f708360195687e1b2719463e1a4" +parent = "d2375e2ebcab5c88feb5652f1a9d621b8f06b259" +commit_url = "https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4" +vendored = false +host = "github" +path = "packages/svelte/src/internal/server/hydratable.js" +mode = "name" +relpath = "packages/svelte/src/internal/server/hydratable.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-14" +fix_lines = { in_function = 5, in_file = 8, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/svelte/src/internal/server/hydratable.js" +function = "encode" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable" + +[[pair]] +name = "marimo-inject-service-worker-fdd55c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "marimo-team/marimo" +cve = "CVE-2026-54386 GHSA-8m59-7xv8-735h" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-06-18T00:32:36Z" +post_cutoff = true +commit = "fdd55c8cf6260ae23bb411dc9d9269def5cf75d6" +parent = "dc35cdfecf4f9b918d9c40faa92e2ad0d71501c4" +commit_url = "https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6" +vendored = false +host = "github" +path = "marimo/_server/api/endpoints/assets.py" +mode = "name" +relpath = "marimo/_server/api/endpoints/assets.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-04" +fix_lines = { in_function = 2, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "marimo/_server/api/endpoints/assets.py" +function = "_inject_service_worker" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8m59-7xv8-735h: marimo contains a reflected cross-site scripting vulnerability in the notebook page" + +[[pair]] +name = "jupyterlab-git-diffheader-c6d37b8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyterlab/jupyterlab-git" +cve = "CVE-2026-54527 GHSA-f962-v9hr-pfg5" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-06-19T19:36:04Z" +post_cutoff = true +commit = "c6d37b88f36aa59aee317930b95e427fb9d6b09b" +parent = "af267598e7437993c02a14101db41c75809a7f88" +commit_url = "https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b" +vendored = false +host = "github" +path = "src/components/diff/NotebookDiff.ts" +mode = "name" +relpath = "src/components/diff/NotebookDiff.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-06-17" +fix_lines = { in_function = 23, in_file = 14, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/components/diff/NotebookDiff.ts" +function = "diffHeader" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-f962-v9hr-pfg5: jupyterlab-git extension: Stored XSS leading to RCE" + +[[pair]] +name = "appium-mcp-createlocatorgeneratorui-e222bbb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "appium/appium-mcp" +cve = "GHSA-x975-rgx4-5fh4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-06-19T21:43:14Z" +post_cutoff = true +commit = "e222bbbd6fe2b656a320efcd143563f08061a83d" +parent = "1655fbd41f462f43dc49fd78f15727db0e2fb6c3" +commit_url = "https://github.com/appium/appium-mcp/commit/e222bbbd6fe2b656a320efcd143563f08061a83d" +vendored = false +host = "github" +path = "src/ui/mcp-ui-utils.ts" +mode = "name" +relpath = "src/ui/mcp-ui-utils.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-18" +fix_lines = { in_function = 14, in_file = 26, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ui/mcp-ui-utils.ts" +function = "createLocatorGeneratorUI" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-x975-rgx4-5fh4: appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)" + +[[pair]] +name = "jupyterlab-updateconfig-be9303f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyterlab/jupyterlab" +cve = "CVE-2026-73417 GHSA-pppj-hq3g-57pj" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-07-22T23:16:18Z" +post_cutoff = true +commit = "be9303f5bcd5308eaeae953c5a3c903046682c2c" +parent = "a555fe1dcb4a4d6b135236ae89319a9f303780d9" +commit_url = "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c" +vendored = false +host = "github" +path = "packages/notebook-extension/src/index.ts" +mode = "name" +relpath = "packages/notebook-extension/src/index.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-07-21" +fix_lines = { in_function = 13, in_file = 7, source_total = 87 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/notebook-extension/src/index.ts" +function = "updateConfig" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-pppj-hq3g-57pj: JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)" + +[[pair]] +name = "file-viewer-render-ef04568" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "flyfish-dev/file-viewer" +cve = "CVE-2026-91127 GHSA-3753-m2x2-q623" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-09-18T17:19:42Z" +post_cutoff = true +commit = "ef045680f8d9830a3eee9612f7df46a734361b07" +parent = "772ae40de07e48134de0449997cb4924b0cde3e4" +commit_url = "https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07" +vendored = false +host = "github" +path = "packages/renderers/word/src/wordDoc.ts" +mode = "name" +relpath = "packages/renderers/word/src/wordDoc.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-08-24" +fix_lines = { in_function = 14, in_file = 13, source_total = 160 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/renderers/word/src/wordDoc.ts" +function = "render" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3753-m2x2-q623: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer" + +[[pair]] +name = "twig-validatename-3d19a2e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "fabpot/twig" +cve = "GHSA-7cvr-xhm5-x998" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2024-05-30T13:42:49Z" +post_cutoff = false +commit = "3d19a2eed53570776af313593aaeb5ad62cf4980" +parent = "481abb83323f4dcabadc9292b0e9f104df0719de" +commit_url = "https://github.com/fabpot/twig/commit/3d19a2eed53570776af313593aaeb5ad62cf4980" +vendored = false +host = "github" +path = "lib/Twig/Loader/Filesystem.php" +mode = "name" +relpath = "lib/Twig/Loader/Filesystem.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2013-04-08" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/Twig/Loader/Filesystem.php" +function = "validateName" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-7cvr-xhm5-x998: Twig Path Traversal vulnerability in the filesystem loader" + +[[pair]] +name = "bazingajstranslationbundle-getlocales-7accee9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "willdurand/bazingajstranslationbundle" +cve = "GHSA-x86x-qhf8-f37w" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2024-06-07T22:20:27Z" +post_cutoff = false +commit = "7accee93569c3f3d2379f035a41ece66522801fc" +parent = "df6c0fd603c0192ebc5584991a52a1092c5f60bd" +commit_url = "https://github.com/willdurand/bazingajstranslationbundle/commit/7accee93569c3f3d2379f035a41ece66522801fc" +vendored = false +host = "github" +path = "Controller/Controller.php" +mode = "name" +relpath = "Controller/Controller.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2014-07-29" +fix_lines = { in_function = 3, in_file = 4, source_total = 22 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "Controller/Controller.php" +function = "getLocales" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-x86x-qhf8-f37w: willdurand/js-translation-bundle potential path traversal attack and remote code injection" + +[[pair]] +name = "nodeserver-onrequest-c4c0f01" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "youngerheart/nodeserver" +cve = "CVE-2020-36651 GHSA-3fwq-qv5v-2wxf" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-01-18T03:31:17Z" +post_cutoff = false +commit = "c4c0f0138ab5afbac58e03915d446680421bde28" +parent = "56b51bd4bdff640a4eb2e16e8558ce7b709a95b6" +commit_url = "https://github.com/youngerheart/nodeserver/commit/c4c0f0138ab5afbac58e03915d446680421bde28" +vendored = false +host = "github" +path = "nodeserver.js" +mode = "name" +relpath = "nodeserver.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-08-21" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "nodeserver.js" +function = "onRequest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3fwq-qv5v-2wxf: Path Traversal in web-node-server" + +[[pair]] +name = "microweber-download-572bdc3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "microweber/microweber" +cve = "CVE-2025-34076 GHSA-j64v-xh5w-8hqj" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-07-02T21:32:00Z" +post_cutoff = false +commit = "572bdc36b5b47923790016f6b961c8df53226855" +parent = "b71f9e2a2c8b1f96ea54d6d894452585f424e509" +commit_url = "https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855" +vendored = false +host = "github" +path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +mode = "name" +relpath = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-02-03" +fix_lines = { in_function = 7, in_file = 11, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +function = "download" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j64v-xh5w-8hqj: Microweber CMS API has authenticated local file inclusion vulnerability" + +[[pair]] +name = "binwalk-extractor-696fe34" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "refirmlabs/binwalk" +cve = "CVE-2022-4510 GHSA-3cm8-v4mc-gppg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2023-01-26T21:30:20Z" +post_cutoff = false +commit = "696fe34ed680ffd951bfeca737feb4a0b98dde5c" +parent = "a555eb1fa6ed0073c36b3493fba7a463a98eaa97" +commit_url = "https://github.com/refirmlabs/binwalk/commit/696fe34ed680ffd951bfeca737feb4a0b98dde5c" +vendored = false +host = "github" +path = "src/binwalk/plugins/unpfs.py" +mode = "name" +relpath = "src/binwalk/plugins/unpfs.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-10-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/binwalk/plugins/unpfs.py" +function = "extractor" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3cm8-v4mc-gppg: Path traversal in binwalk" + +[[pair]] +name = "gatsby-onoperation-ae5a654" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "gatsbyjs/gatsby" +cve = "CVE-2023-34238 GHSA-c6f8-8r25-c4gc" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-06-09T22:52:01Z" +post_cutoff = false +commit = "ae5a654eb346b2e7a9d341b809b2f82d34c0f17c" +parent = "18a47dadfdb0e38daf4371739ebaeb2593d3e6f6" +commit_url = "https://github.com/gatsbyjs/gatsby/commit/ae5a654eb346b2e7a9d341b809b2f82d34c0f17c" +vendored = false +host = "github" +path = "packages/gatsby/src/utils/start-server.ts" +mode = "name" +relpath = "packages/gatsby/src/utils/start-server.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-05-05" +fix_lines = { in_function = 26, in_file = 33, source_total = 102 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/gatsby/src/utils/start-server.ts" +function = "onOperation" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-c6f8-8r25-c4gc: Gatsby develop server has Local File Inclusion vulnerability" + +[[pair]] +name = "codedx-plugin-checkcsvfilematches-138932b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jenkinsci/codedx-plugin" +cve = "CVE-2023-2196 GHSA-5gjq-5339-x5cv" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2023-05-16T18:30:16Z" +post_cutoff = false +commit = "138932b362c7da3c310b1f34fc854c5bf5f52458" +parent = "0214f30488ea8481f01e4b14a861e13d75bebb8b" +commit_url = "https://github.com/jenkinsci/codedx-plugin/commit/138932b362c7da3c310b1f34fc854c5bf5f52458" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-05-10" +fix_lines = { in_function = 4, in_file = 3, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +function = "checkCSVFileMatches" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5gjq-5339-x5cv: Jenkins Code Dx Plugin missing permission checks" + +[[pair]] +name = "php-imap-fetch-88aaafb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "webklex/php-imap" +cve = "CVE-2023-35169 GHSA-47p7-xfcc-4pv9" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2023-06-21T21:58:58Z" +post_cutoff = false +commit = "88aaafbd881f09c3ec174f7417d36a8dedbd1b37" +parent = "6ea5a94f2f8936ac5c2c40a46fbbd88f2bdeb16b" +commit_url = "https://github.com/webklex/php-imap/commit/88aaafbd881f09c3ec174f7417d36a8dedbd1b37" +vendored = false +host = "github" +path = "src/Attachment.php" +mode = "name" +relpath = "src/Attachment.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-20" +fix_lines = { in_function = 6, in_file = 20, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Attachment.php" +function = "fetch" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-47p7-xfcc-4pv9: php-imap vulnerable to RCE through a directory traversal vulnerability" + +[[pair]] +name = "cypress-image-snapshot-removesnapshot-ef49519" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "simonsmith/cypress-image-snapshot" +cve = "CVE-2023-38695 GHSA-vxjg-hchx-cc4g" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-08-01T16:59:40Z" +post_cutoff = false +commit = "ef49519795daf5183f4fac6f3136e194f20f39f4" +parent = "b64bdc31943c3eb862efadef32586f96fbf787f5" +commit_url = "https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4" +vendored = false +host = "github" +path = "src/plugin.ts" +mode = "name" +relpath = "src/plugin.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-07-31" +fix_lines = { in_function = 2, in_file = 2, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/plugin.ts" +function = "removeSnapshot" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vxjg-hchx-cc4g: @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names" + +[[pair]] +name = "pf4j-extract-8e0aa19" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "pf4j/pf4j" +cve = "CVE-2023-40828 GHSA-cj8w-v588-p8wx" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2023-08-29T00:32:04Z" +post_cutoff = false +commit = "8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72" +parent = "c1c9c982dc372d1027468e166c3e0675d6890e2a" +commit_url = "https://github.com/pf4j/pf4j/commit/8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72" +vendored = false +host = "github" +path = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +mode = "name" +relpath = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-16" +fix_lines = { in_function = 5, in_file = 14, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +function = "extract" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cj8w-v588-p8wx: pf4j vulnerable to remote code execution via expandIfZip method in the extract function" + +[[pair]] +name = "aws-sdk-php-buildendpoint-aebc9f8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/aws-sdk-php" +cve = "CVE-2023-51651 GHSA-557v-xcg6-rm5m" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2023-12-21T23:16:13Z" +post_cutoff = false +commit = "aebc9f801438746ac4ade327551576cb75f635f2" +parent = "3daedce00e450411630528245d83f734651b5dda" +commit_url = "https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2" +vendored = false +host = "github" +path = "src/Api/Serializer/RestSerializer.php" +mode = "name" +relpath = "src/Api/Serializer/RestSerializer.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-11-22" +fix_lines = { in_function = 6, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Api/Serializer/RestSerializer.php" +function = "buildEndpoint" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-557v-xcg6-rm5m: Potential URI resolution path traversal in the AWS SDK for PHP" + +[[pair]] +name = "arrp-dumpdirect-7ea80db" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MPL-2.0" +repo = "devan-kerman/arrp" +cve = "CVE-2024-24042 GHSA-cg24-jjr5-rxmf" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-03-19T09:30:32Z" +post_cutoff = false +commit = "7ea80db462c8bf66a0565e84fa49c1f2ecb9287b" +parent = "3a685438960b7fa64adaf71f7f13fba30d9b60f7" +commit_url = "https://github.com/devan-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b" +vendored = false +host = "github" +path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +mode = "name" +relpath = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-09" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +function = "dumpDirect" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cg24-jjr5-rxmf: Path traversal in flaskcode Devan-Kerman ARRP" + +[[pair]] +name = "paddle-download-5c50d1a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "paddlepaddle/paddle" +cve = "CVE-2024-0818 GHSA-2rp8-hff9-c5wr" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-03-07T15:30:38Z" +post_cutoff = false +commit = "5c50d1a8b97b310cbc36560ec36d8377d6f29d7c" +parent = "62a1261328c6bc165d2cfaea1338b74b5801104f" +commit_url = "https://github.com/paddlepaddle/paddle/commit/5c50d1a8b97b310cbc36560ec36d8377d6f29d7c" +vendored = false +host = "github" +path = "python/paddle/dataset/common.py" +mode = "name" +relpath = "python/paddle/dataset/common.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-01-31" +fix_lines = { in_function = 5, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "python/paddle/dataset/common.py" +function = "download" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-2rp8-hff9-c5wr: PaddlePaddle Path Traversal vulnerability" + +[[pair]] +name = "lektor-untrusted-to-os-path-7393d87" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "lektor/lektor" +cve = "CVE-2024-28335 GHSA-wv28-7fpw-fj49" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-03-27T06:30:33Z" +post_cutoff = false +commit = "7393d87bd354e43120937789956175064e4610a0" +parent = "4b5731226f5e2a3f70ecf258d6718e99a962921c" +commit_url = "https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0" +vendored = false +host = "github" +path = "lektor/utils.py" +mode = "name" +relpath = "lektor/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-02-27" +fix_lines = { in_function = 5, in_file = 4, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lektor/utils.py" +function = "untrusted_to_os_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-wv28-7fpw-fj49: Lektor does not sanitize database path traversal" + +[[pair]] +name = "unzip-stream-unzipstream-ab67989" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mhr3/unzip-stream" +cve = "GHSA-6jrj-vc65-c983" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-08-26T15:17:40Z" +post_cutoff = false +commit = "ab67989719abb4dcc774d02de266151905b8d45a" +parent = "4a4be03d5e13ce5408b8be3dee970d15212ca532" +commit_url = "https://github.com/mhr3/unzip-stream/commit/ab67989719abb4dcc774d02de266151905b8d45a" +vendored = false +host = "github" +path = "lib/unzip-stream.js" +mode = "name" +relpath = "lib/unzip-stream.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-04-20" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/unzip-stream.js" +function = "UnzipStream" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-6jrj-vc65-c983: unzip-stream allows Arbitrary File Write via artifact extraction" + +[[pair]] +name = "openapi-generator-generate-edbb021" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "openapitools/openapi-generator" +cve = "CVE-2024-35219 GHSA-g3hr-p86p-593h" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-05-28T15:47:57Z" +post_cutoff = false +commit = "edbb021aadae47dcfe690313ce5119faf77f800d" +parent = "4a872a8d697fbcfb8fd115bfaf10c00c2e3e3e06" +commit_url = "https://github.com/openapitools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d" +vendored = false +host = "github" +path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +mode = "name" +relpath = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-05-14" +fix_lines = { in_function = 8, in_file = 8, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +function = "generate" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-g3hr-p86p-593h: OpenAPI Generator Online - Arbitrary File Read/Delete" + +[[pair]] +name = "weave-send-local-file-f43d5fb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "wandb/weave" +cve = "CVE-2024-7340 GHSA-r49h-6qxq-624f" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-07-31T15:31:19Z" +post_cutoff = false +commit = "f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f" +parent = "c28d8d5bd811c33fd7b75663482447be9120299d" +commit_url = "https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f" +vendored = false +host = "github" +path = "weave/weave_server.py" +mode = "name" +relpath = "weave/weave_server.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-02" +fix_lines = { in_function = 18, in_file = 26, source_total = 28 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "weave/weave_server.py" +function = "send_local_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-r49h-6qxq-624f: Weave server API vulnerable to arbitrary file leak" + +[[pair]] +name = "solara-get-from-cache-df2fd66" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "widgetti/solara" +cve = "CVE-2024-39903 GHSA-9794-pc4r-438w" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-07-12T21:00:21Z" +post_cutoff = false +commit = "df2fd66a7f4e8ffd36e8678697a8a4f76760dc54" +parent = "681f69b7779da2bd3586d6e9fd0b21d36e6fb124" +commit_url = "https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54" +vendored = false +host = "github" +path = "solara/server/cdn_helper.py" +mode = "name" +relpath = "solara/server/cdn_helper.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-07-11" +fix_lines = { in_function = 10, in_file = 18, source_total = 41 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "solara/server/cdn_helper.py" +function = "get_from_cache" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-9794-pc4r-438w: Local File Inclusion in Solara" + +[[pair]] +name = "url-to-png-handleextractqueryparamsmiddleware-e4eaeca" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "jasonraimondi/url-to-png" +cve = "CVE-2024-39918 GHSA-vvmv-wrvp-9gjr" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-07-15T17:46:57Z" +post_cutoff = false +commit = "e4eaeca6493b21cd515b582fd6c0af09ede54507" +parent = "ef8391480c25332fc74d6cf841eab2969e18db27" +commit_url = "https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507" +vendored = false +host = "github" +path = "src/middlewares/extract_query_params.ts" +mode = "name" +relpath = "src/middlewares/extract_query_params.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-13" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/middlewares/extract_query_params.ts" +function = "handleExtractQueryParamsMiddleware" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vvmv-wrvp-9gjr: @jmondi/url-to-png contains a Path Traversal vulnerability" + +[[pair]] +name = "df-core-handleservicerequest-5435460" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dreamfactorysoftware/df-core" +cve = "CVE-2025-55988 GHSA-gv7f-w92j-383q" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2026-03-20T21:31:28Z" +post_cutoff = false +commit = "54354605b2ec9afe6ee96756a5a22f6f56828950" +parent = "64ff000d125e55678a2cf909b157c2f5fd4b109c" +commit_url = "https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950" +vendored = false +host = "github" +path = "src/Http/Controllers/RestController.php" +mode = "name" +relpath = "src/Http/Controllers/RestController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-02" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Http/Controllers/RestController.php" +function = "handleServiceRequest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gv7f-w92j-383q: DreamFactory has a directory traversal" + +[[pair]] +name = "simile-butterfly-getresource-537f64b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "openrefine/simile-butterfly" +cve = "CVE-2024-47883 GHSA-3p8v-w8mr-m3x8" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-10-24T18:16:43Z" +post_cutoff = false +commit = "537f64bfa72746f8b21d4bda461fad843435319c" +parent = "2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e" +commit_url = "https://github.com/openrefine/simile-butterfly/commit/537f64bfa72746f8b21d4bda461fad843435319c" +vendored = false +host = "github" +path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +mode = "name" +relpath = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-10-19" +fix_lines = { in_function = 12, in_file = 13, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +function = "getResource" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3p8v-w8mr-m3x8: Butterfly has path/URL confusion in resource handling leading to multiple weaknesses" + +[[pair]] +name = "oak-send-4b2f27e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "oakserver/oak" +cve = "CVE-2024-49770 GHSA-qm92-93fv-vh7m" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-11-01T21:37:10Z" +post_cutoff = false +commit = "4b2f27efd5cba5a45b2c3982e610da3af0869209" +parent = "3896fe568b25ac0b4c5afbf822ff8344c3d1712a" +commit_url = "https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209" +vendored = false +host = "github" +path = "send.ts" +mode = "name" +relpath = "send.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-11-01" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "send.ts" +function = "send" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-qm92-93fv-vh7m: Path traversal in oak allows transfer of hidden files within the served root directory" + +[[pair]] +name = "agentscope-delete-workflow-7d285e8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "modelscope/agentscope" +cve = "CVE-2024-8537 GHSA-c4cc-w454-4634" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-03-20T12:32:48Z" +post_cutoff = false +commit = "7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a" +parent = "6178c29bcbff044c5bab788c0eb364c0fe84baec" +commit_url = "https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a" +vendored = false +host = "github" +path = "src/agentscope/studio/_app.py" +mode = "name" +relpath = "src/agentscope/studio/_app.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-28" +fix_lines = { in_function = 3, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/agentscope/studio/_app.py" +function = "_delete_workflow" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-c4cc-w454-4634: AgentScope path traversal vulnerability" + +[[pair]] +name = "djl-unzip-7415cc5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "deepjavalibrary/djl" +cve = "CVE-2025-0851 GHSA-jcrp-x7w3-ffmg" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2025-01-29T22:21:33Z" +post_cutoff = false +commit = "7415cc5f72aae69ea9716a5e4f709af03a77a619" +parent = "503289a69c581e2373e12cff78ea2adc03a8d86f" +commit_url = "https://github.com/deepjavalibrary/djl/commit/7415cc5f72aae69ea9716a5e4f709af03a77a619" +vendored = false +host = "github" +path = "api/src/main/java/ai/djl/util/ZipUtils.java" +mode = "name" +relpath = "api/src/main/java/ai/djl/util/ZipUtils.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-12-06" +fix_lines = { in_function = 10, in_file = 20, source_total = 34 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "api/src/main/java/ai/djl/util/ZipUtils.java" +function = "unzip" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-jcrp-x7w3-ffmg: Deep Java Library path traversal issue" + +[[pair]] +name = "carbon-resetmessages-129700e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "briannesbitt/carbon" +cve = "CVE-2025-22145 GHSA-j3f9-p6hm-5w6q" +cwe = "CWE-98" +ecosystem = "composer" +published_at = "2025-01-08T21:03:28Z" +post_cutoff = false +commit = "129700ed449b1f02d70272d2ac802357c8c30c58" +parent = "f01cfa96468f4c38325f507ab81a4f1d2cd93cfe" +commit_url = "https://github.com/briannesbitt/carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58" +vendored = false +host = "github" +path = "src/Carbon/AbstractTranslator.php" +mode = "name" +relpath = "src/Carbon/AbstractTranslator.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-12-27" +fix_lines = { in_function = 1, in_file = 2, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-98" +class = "file-inclusion" +path = "src/Carbon/AbstractTranslator.php" +function = "resetMessages" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j3f9-p6hm-5w6q: Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale" + +[[pair]] +name = "browsershot-seturl-e327397" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "spatie/browsershot" +cve = "CVE-2025-1026 GHSA-f2q5-6mx7-q9qq" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-02-05T06:30:26Z" +post_cutoff = false +commit = "e3273974506865a24fbb5b65b534d8d4b8dfbf72" +parent = "bcfd608b264fab654bf78e199bdfbb03e9323eb7" +commit_url = "https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72" +vendored = false +host = "github" +path = "src/Browsershot.php" +mode = "name" +relpath = "src/Browsershot.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-12-30" +fix_lines = { in_function = 3, in_file = 5, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Browsershot.php" +function = "setUrl" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-f2q5-6mx7-q9qq: Browsershot Local File Inclusion" + +[[pair]] +name = "aws-sam-cli-copytree-462b4e0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/aws-sam-cli" +cve = "CVE-2025-3048 GHSA-pp64-wj43-xqcr" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-03-31T22:36:52Z" +post_cutoff = false +commit = "462b4e07b873035c25e8abc9068bb3b76e06314c" +parent = "42ba2f712a8f5084d6da9677febdcdf495d816e7" +commit_url = "https://github.com/aws/aws-sam-cli/commit/462b4e07b873035c25e8abc9068bb3b76e06314c" +vendored = false +host = "github" +path = "samcli/lib/utils/osutils.py" +mode = "name" +relpath = "samcli/lib/utils/osutils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "samcli/lib/utils/osutils.py" +function = "copytree" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp64-wj43-xqcr: AWS SAM CLI Path Traversal allows file copy to local cache" + +[[pair]] +name = "solon-find-f46e47f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "opensolon/solon" +cve = "CVE-2025-1584 GHSA-x8q6-cchr-p7m6" +cwe = "CWE-23" +ecosystem = "maven" +published_at = "2025-02-23T15:30:58Z" +post_cutoff = false +commit = "f46e47fd1f8455b9467d7ead3cdb0509115b2ef1" +parent = "87474726f1e496b381ce9d5ebbadabd0e04c2d75" +commit_url = "https://github.com/opensolon/solon/commit/f46e47fd1f8455b9467d7ead3cdb0509115b2ef1" +vendored = false +host = "github" +path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +mode = "name" +relpath = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-21" +fix_lines = { in_function = 26, in_file = 27, source_total = 39 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +function = "find" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-x8q6-cchr-p7m6: Solon Path Traversal" + +[[pair]] +name = "setuptools-resolve-download-filename-250a6d1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/setuptools" +cve = "CVE-2025-47273 GHSA-5rjg-fvgr-3xxf" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-05-19T16:52:43Z" +post_cutoff = false +commit = "250a6d17978f9f6ac3ac887091f2d32886fbbb0b" +parent = "d8390feaa99091d1ba9626bec0e4ba7072fc507a" +commit_url = "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b" +vendored = false +host = "github" +path = "setuptools/package_index.py" +mode = "name" +relpath = "setuptools/package_index.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-19" +fix_lines = { in_function = 13, in_file = 17, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "setuptools/package_index.py" +function = "_resolve_download_filename" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5rjg-fvgr-3xxf: setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write" + +[[pair]] +name = "dagster-get-notebook-data-3a3cec2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dagster-io/dagster" +cve = "CVE-2025-51481 GHSA-h7x8-jv97-fvvm" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-07-22T18:30:42Z" +post_cutoff = false +commit = "3a3cec2b51577c4970e6fc4c199cda6418c09a9d" +parent = "cb0f186667b55086346165fc8c00defa1f44a9c2" +commit_url = "https://github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d" +vendored = false +host = "github" +path = "python_modules/dagster/dagster/_grpc/impl.py" +mode = "name" +relpath = "python_modules/dagster/dagster/_grpc/impl.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-19" +fix_lines = { in_function = 9, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "python_modules/dagster/dagster/_grpc/impl.py" +function = "get_notebook_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-h7x8-jv97-fvvm: Dagster Local File Inclusion vulnerability" + +[[pair]] +name = "llama-index-load-data-a86c96a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "run-llama/llama_index" +cve = "CVE-2025-6210 GHSA-3j8r-jf9w-5cmh" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-07-07T12:30:23Z" +post_cutoff = false +commit = "a86c96ae0e662492eeb471b658ae849a93f628ff" +parent = "1359a5300b15216766aa0ac0db0173d2016e03bf" +commit_url = "https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff" +vendored = false +host = "github" +path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +mode = "name" +relpath = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-03" +fix_lines = { in_function = 5, in_file = 17, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +function = "load_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3j8r-jf9w-5cmh: LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit" + +[[pair]] +name = "salt-file-recv-c4ad23f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "saltstack/salt" +cve = "CVE-2024-38824 GHSA-8pcp-r83j-fc92" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-06-13T09:30:34Z" +post_cutoff = false +commit = "c4ad23f0f3132d8d8a88f19fa537dc42cf21b215" +parent = "5ff18fd0ececdfd083ddce693c3ccef30e44f155" +commit_url = "https://github.com/saltstack/salt/commit/c4ad23f0f3132d8d8a88f19fa537dc42cf21b215" +vendored = false +host = "github" +path = "salt/master.py" +mode = "name" +relpath = "salt/master.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-06-06" +fix_lines = { in_function = 7, in_file = 4, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "salt/master.py" +function = "_file_recv" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8pcp-r83j-fc92: Salt vulnerable to directory traversal attack in file receiving method" + +[[pair]] +name = "ignite-gridlogcommandhandler-5c42c7a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/ignite" +cve = "CVE-2025-48977 GHSA-v45h-mqf4-6939" +cwe = "CWE-23" +ecosystem = "maven" +published_at = "2026-05-28T12:30:28Z" +post_cutoff = false +commit = "5c42c7a303937844179ad470edb35c1ad1cee6ab" +parent = "98550a68b8eb034fd0346b4f4798c9465d8aa7c6" +commit_url = "https://github.com/apache/ignite/commit/5c42c7a303937844179ad470edb35c1ad1cee6ab" +vendored = false +host = "github" +path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +mode = "name" +relpath = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-13" +fix_lines = { in_function = 4, in_file = 12, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +function = "GridLogCommandHandler" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-v45h-mqf4-6939: Apache Ignite REST API Has a Relative Path Traversal Vulnerability" + +[[pair]] +name = "ipx-resolvefile-81693dd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "unjs/ipx" +cve = "CVE-2025-54387 GHSA-mm3p-j368-7jcr" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-08-04T14:48:25Z" +post_cutoff = false +commit = "81693ddbfc062cc922e4e2406e8427ab4e3ad214" +parent = "df55edb9c49bb56536cc9277efb24557edacd747" +commit_url = "https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214" +vendored = false +host = "github" +path = "src/storage/node-fs.ts" +mode = "name" +relpath = "src/storage/node-fs.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-07-24" +fix_lines = { in_function = 2, in_file = 1, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/storage/node-fs.ts" +function = "resolveFile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-mm3p-j368-7jcr: IPX Allows Path Traversal via Prefix Matching Bypass" + +[[pair]] +name = "core-download-file-fe95f6e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "home-assistant/core" +cve = "CVE-2025-65713 GHSA-pp3g-xmm4-5cw9" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-12-23T18:30:27Z" +post_cutoff = false +commit = "fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf" +parent = "37510aa316bd46dbbd8f983fbfcec543eac7c704" +commit_url = "https://github.com/home-assistant/core/commit/fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf" +vendored = false +host = "github" +path = "homeassistant/components/downloader/services.py" +mode = "name" +relpath = "homeassistant/components/downloader/services.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-08-05" +fix_lines = { in_function = 28, in_file = 38, source_total = 41 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "homeassistant/components/downloader/services.py" +function = "download_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp3g-xmm4-5cw9: Home Assistant Core before is vulnerable to Directory Traversal" + +[[pair]] +name = "auth0-php-fileexists-9026da5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "auth0/auth0-php" +cve = "CVE-2025-58769 GHSA-9mh6-g99m-ppcw" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-10-01T21:20:45Z" +post_cutoff = false +commit = "9026da58f5c381cd4cb5932de829eff6eacbb65c" +parent = "7f4414045fc7dc257baf8451a9cda2aacb7ed03b" +commit_url = "https://github.com/auth0/auth0-php/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c" +vendored = false +host = "github" +path = "src/Utility/Assert.php" +mode = "name" +relpath = "src/Utility/Assert.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-07" +fix_lines = { in_function = 6, in_file = 9, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Utility/Assert.php" +function = "fileExists" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-9mh6-g99m-ppcw: auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import" + +[[pair]] +name = "tiny-scientist-review-paper-7fd4287" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "ulab-uiuc/tiny-scientist" +cve = "CVE-2025-55149 GHSA-rrgf-hcr9-jq6h" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-08-11T13:38:14Z" +post_cutoff = false +commit = "7fd42873603012acb8c55a4fc3eaac9ab18e6559" +parent = "d0d4d6ed91c378d5201ac60dcd8e7c3303412d66" +commit_url = "https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559" +vendored = false +host = "github" +path = "backend/app.py" +mode = "name" +relpath = "backend/app.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-08-08" +fix_lines = { in_function = 8, in_file = 10, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "backend/app.py" +function = "review_paper" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-rrgf-hcr9-jq6h: TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)" + +[[pair]] +name = "vite-plugin-static-copy-vialocal-0bc6b49" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "sapphi-red/vite-plugin-static-copy" +cve = "CVE-2025-57753 GHSA-pp7p-q8fx-2968" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-08-21T14:53:52Z" +post_cutoff = false +commit = "0bc6b49ed72b46eecfc9682045f4b46a19694969" +parent = "14895079087ea926826baf62cabb4ec31cbe758a" +commit_url = "https://github.com/sapphi-red/vite-plugin-static-copy/commit/0bc6b49ed72b46eecfc9682045f4b46a19694969" +vendored = false +host = "github" +path = "src/middleware.ts" +mode = "name" +relpath = "src/middleware.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-21" +fix_lines = { in_function = 6, in_file = 15, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/middleware.ts" +function = "viaLocal" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp7p-q8fx-2968: vite-plugin-static-copy files not included in `src` are possible to access with a crafted request" + +[[pair]] +name = "tar-fs-incwd-0bd54cd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mafintosh/tar-fs" +cve = "CVE-2025-59343 GHSA-vj76-c3g6-qr5v" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-09-24T18:57:04Z" +post_cutoff = false +commit = "0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09" +parent = "cb1c571fba8ec6dd56340f55dcd5d284372a8249" +commit_url = "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-16" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "index.js" +function = "inCwd" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vj76-c3g6-qr5v: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball" + +[[pair]] +name = "dosage-connect-336a968" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "webcomics/dosage" +cve = "CVE-2025-64184 GHSA-4vcx-3pj3-44m7" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-11-04T15:31:48Z" +post_cutoff = false +commit = "336a9684191604bc49eed7296b74bd582151181e" +parent = "8af120b2473c63fc582b9b545c86efe4369f2301" +commit_url = "https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e" +vendored = false +host = "github" +path = "dosagelib/comic.py" +mode = "name" +relpath = "dosagelib/comic.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-01" +fix_lines = { in_function = 11, in_file = 12, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "dosagelib/comic.py" +function = "connect" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-4vcx-3pj3-44m7: Dosage vulnerable to a Directory Traversal through crafted HTTP responses" + +[[pair]] +name = "unstructured-attachment-file-name-b01d35b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "unstructured-io/unstructured" +cve = "CVE-2025-64712 GHSA-gm8q-m8mv-jj5m" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-02-03T17:43:56Z" +post_cutoff = false +commit = "b01d35b2373fd087d2e15162b9c021663c97155d" +parent = "1c519efef5f888ae02ee4621b213eda527662d5f" +commit_url = "https://github.com/unstructured-io/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d" +vendored = false +host = "github" +path = "unstructured/partition/msg.py" +mode = "name" +relpath = "unstructured/partition/msg.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-11-06" +fix_lines = { in_function = 8, in_file = 16, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "unstructured/partition/msg.py" +function = "_attachment_file_name" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gm8q-m8mv-jj5m: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write" + +[[pair]] +name = "pebble-getfile-b3451c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "pebbletemplates/pebble" +cve = "CVE-2025-1686 GHSA-p75g-cxfj-7wrx" +cwe = "CWE-73" +ecosystem = "maven" +published_at = "2025-02-28T19:45:03Z" +post_cutoff = false +commit = "b3451c8f305a1a248fbcc2363fd307d0baaee329" +parent = "a5a38beb9cee15546b03f0d74ff3facf51b2d181" +commit_url = "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329" +vendored = false +host = "github" +path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +mode = "name" +relpath = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-12-11" +fix_lines = { in_function = 23, in_file = 96, source_total = 135 } + +[[pair.expected]] +cwe = "CWE-73" +class = "path-traversal" +path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +function = "getFile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-p75g-cxfj-7wrx: Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro" + +[[pair]] +name = "vite-plugin-react-findsourcemapurl-582fba0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vitejs/vite-plugin-react" +cve = "CVE-2025-68155 GHSA-g239-q96q-x4qm" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-12-16T22:32:26Z" +post_cutoff = false +commit = "582fba0b9a52b13fcff6beaaa3bfbd532bc5359d" +parent = "329c40a600dedc790fca36f2d460dc3d40186f7c" +commit_url = "https://github.com/vitejs/vite-plugin-react/commit/582fba0b9a52b13fcff6beaaa3bfbd532bc5359d" +vendored = false +host = "github" +path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +mode = "name" +relpath = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-16" +fix_lines = { in_function = 5, in_file = 10, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +function = "findSourceMapURL" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-g239-q96q-x4qm: @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint" + +[[pair]] +name = "bodyparser-markasmoved-143a16f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "adonisjs/bodyparser" +cve = "CVE-2026-21440 GHSA-gvq6-hvvp-h34h" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-01-02T18:58:32Z" +post_cutoff = false +commit = "143a16f35602be8561215611582211dec280cae6" +parent = "890b2c9820f9fdf2b2b0eaa709fecd920087e96c" +commit_url = "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6" +vendored = false +host = "github" +path = "src/multipart/file.ts" +mode = "name" +relpath = "src/multipart/file.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-02" +fix_lines = { in_function = 5, in_file = 5, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/multipart/file.ts" +function = "markAsMoved" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gvq6-hvvp-h34h: AdonisJS Path Traversal in Multipart File Handling" + +[[pair]] +name = "pnpm-getbinsfrompackagemanifest-17432ad" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "pnpm/pnpm" +cve = "CVE-2026-24131 GHSA-v253-rj99-jwpq" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-01-26T21:29:58Z" +post_cutoff = false +commit = "17432ad5bbed5c2e77255ca6d56a1449bbcfd943" +parent = "b277b45bc35ae77ca72d7634d144bbd58a48b70f" +commit_url = "https://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943" +vendored = false +host = "github" +path = "pkg-manager/package-bins/src/index.ts" +mode = "name" +relpath = "pkg-manager/package-bins/src/index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-21" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pkg-manager/package-bins/src/index.ts" +function = "getBinsFromPackageManifest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-v253-rj99-jwpq: pnpm has Path Traversal via arbitrary file permission modification " + +[[pair]] +name = "wheel-unpack-7a7d2de" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/wheel" +cve = "CVE-2026-24049 GHSA-8rrh-rw8j-w5fx" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-01-22T18:02:56Z" +post_cutoff = false +commit = "7a7d2de96b22a9adf9208afcc9547e1001569fef" +parent = "41418fac233d6973ea8798d620df4aa5b3aa1b66" +commit_url = "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef" +vendored = false +host = "github" +path = "src/wheel/_commands/unpack.py" +mode = "name" +relpath = "src/wheel/_commands/unpack.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-21" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/wheel/_commands/unpack.py" +function = "unpack" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8rrh-rw8j-w5fx: Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack" + +[[pair]] +name = "openchatbi-save-report-372a7e8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zhongyu09/openchatbi" +cve = "CVE-2026-28795 GHSA-vmwq-8g8c-jm79" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-02T21:47:32Z" +post_cutoff = false +commit = "372a7e861da5159c3106d64d6f6edf8284db8c75" +parent = "235291864f2d4aa0b40e445a00c3766001d6f3bf" +commit_url = "https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75" +vendored = false +host = "github" +path = "openchatbi/tool/save_report.py" +mode = "name" +relpath = "openchatbi/tool/save_report.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-27" +fix_lines = { in_function = 6, in_file = 10, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "openchatbi/tool/save_report.py" +function = "save_report" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vmwq-8g8c-jm79: OpenChatBI has a Path Traversal Vulnerability in save_report Tool" + +[[pair]] +name = "clasp-fetchremote-ba6bd66" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "google/clasp" +cve = "CVE-2026-4092 GHSA-hqjg-pww4-pcgq" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-03-13T20:57:29Z" +post_cutoff = false +commit = "ba6bd666fe74de54950122b5d92ecf1dcc02a9d3" +parent = "56f0e6274c2daa2c0928d44fe50c517b188c11f5" +commit_url = "https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3" +vendored = false +host = "github" +path = "src/core/files.ts" +mode = "name" +relpath = "src/core/files.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-31" +fix_lines = { in_function = 17, in_file = 49, source_total = 54 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/core/files.ts" +function = "fetchRemote" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-hqjg-pww4-pcgq: @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script" + +[[pair]] +name = "basic-ftp-downloadfromworkingdir-2a2a0e6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "patrickjuchli/basic-ftp" +cve = "CVE-2026-27699 GHSA-5rq4-664w-9x2c" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-02-25T22:34:26Z" +post_cutoff = false +commit = "2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9" +parent = "65c90d949c0f8a9709759dff9e76bbe07061812b" +commit_url = "https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9" +vendored = false +host = "github" +path = "src/Client.ts" +mode = "name" +relpath = "src/Client.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-23" +fix_lines = { in_function = 6, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Client.ts" +function = "_downloadFromWorkingDir" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5rq4-664w-9x2c: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method" + +[[pair]] +name = "mcp-atlassian-download-attachment-52b9b09" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "sooperset/mcp-atlassian" +cve = "CVE-2026-27825 GHSA-xjgw-4wvw-rgm4" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-10T18:56:07Z" +post_cutoff = false +commit = "52b9b0997681e87244b20d58034deae89c91631e" +parent = "ab36f8161bba807b16964f2c6124174c9eca1acf" +commit_url = "https://github.com/sooperset/mcp-atlassian/commit/52b9b0997681e87244b20d58034deae89c91631e" +vendored = false +host = "github" +path = "src/mcp_atlassian/jira/attachments.py" +mode = "name" +relpath = "src/mcp_atlassian/jira/attachments.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-24" +fix_lines = { in_function = 6, in_file = 13, source_total = 68 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/mcp_atlassian/jira/attachments.py" +function = "download_attachment" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-xjgw-4wvw-rgm4: MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment" + +[[pair]] +name = "bentoml-safe-extract-tarfile-4e0eb00" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "bentoml/bentoml" +cve = "CVE-2026-27905 GHSA-m6w7-qv66-g3mf" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-03T17:46:47Z" +post_cutoff = false +commit = "4e0eb007765ac04c7924220d643f264715cc9670" +parent = "3ba9d54637312aa2a9c7c35540c18c30317cac3f" +commit_url = "https://github.com/bentoml/bentoml/commit/4e0eb007765ac04c7924220d643f264715cc9670" +vendored = false +host = "github" +path = "src/bentoml/_internal/utils/filesystem.py" +mode = "name" +relpath = "src/bentoml/_internal/utils/filesystem.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-25" +fix_lines = { in_function = 24, in_file = 22, source_total = 24 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/bentoml/_internal/utils/filesystem.py" +function = "safe_extract_tarfile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-m6w7-qv66-g3mf: BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction" + +[[pair]] +name = "dbt-common-safe-extract-e547954" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dbt-labs/dbt-common" +cve = "CVE-2026-29790 GHSA-w75w-9qv4-j5xj" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-05T00:59:10Z" +post_cutoff = false +commit = "e547954a48bac9394ef6eb98432e429dce9a7709" +parent = "e10b8aca2164c632cf0ab5fdbb16db0ec9176189" +commit_url = "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709" +vendored = false +host = "github" +path = "dbt_common/clients/system.py" +mode = "name" +relpath = "dbt_common/clients/system.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-27" +fix_lines = { in_function = 10, in_file = 9, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "dbt_common/clients/system.py" +function = "safe_extract" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w75w-9qv4-j5xj: dbt-common's commonprefix() doesn't protect against path traversal" + +[[pair]] +name = "black-get-cache-key-4937fe6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "psf/black" +cve = "CVE-2026-32274 GHSA-3936-cmfr-pm3m" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-12T18:33:10Z" +post_cutoff = false +commit = "4937fe6cf241139ddbfc16b0bdbb5b422798909d" +parent = "2e641d174469c505d5ae905e75d4c769597e681f" +commit_url = "https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d" +vendored = false +host = "github" +path = "src/black/mode.py" +mode = "name" +relpath = "src/black/mode.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-12" +fix_lines = { in_function = 7, in_file = 4, source_total = 28 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/black/mode.py" +function = "get_cache_key" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3936-cmfr-pm3m: Black: Arbitrary file writes from unsanitized user input in cache file name" + +[[pair]] +name = "agixt-safe-join-2079ea5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "josh-xt/agixt" +cve = "CVE-2026-39981 GHSA-5gfj-64gh-mgmw" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-08T20:02:01Z" +post_cutoff = false +commit = "2079ea5a88fa671a921bf0b5eba887a5a1b73d5f" +parent = "872f519fcc75eb574d717ea10ca91fc089718ffe" +commit_url = "https://github.com/josh-xt/agixt/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f" +vendored = false +host = "github" +path = "agixt/extensions/essential_abilities.py" +mode = "name" +relpath = "agixt/extensions/essential_abilities.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-15" +fix_lines = { in_function = 14, in_file = 14, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "agixt/extensions/essential_abilities.py" +function = "safe_join" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5gfj-64gh-mgmw: AGiXT Vulnerable to Path Traversal in safe_join()" + +[[pair]] +name = "mesop-make-file-path-c6b382f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "mesop-dev/mesop" +cve = "CVE-2026-33054 GHSA-8qvf-mr4w-9x2c" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-18T20:01:21Z" +post_cutoff = false +commit = "c6b382f363b73ac32c402a2db3aadc7784f66a5b" +parent = "712aafffd458def75e2f2fe4bd94d430436921e3" +commit_url = "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b" +vendored = false +host = "github" +path = "mesop/server/state_session.py" +mode = "name" +relpath = "mesop/server/state_session.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-15" +fix_lines = { in_function = 7, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "mesop/server/state_session.py" +function = "_make_file_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8qvf-mr4w-9x2c: Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion" + +[[pair]] +name = "kedro-plugins-partition-to-path-65115f7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "kedro-org/kedro-plugins" +cve = "CVE-2026-35492 GHSA-cjg8-h5qc-hrjv" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-06T17:55:14Z" +post_cutoff = false +commit = "65115f76b872217317734b6bde8927170c98fc4b" +parent = "df4b6a65ca75dbd3efed38362d2a045c746ab9ad" +commit_url = "https://github.com/kedro-org/kedro-plugins/commit/65115f76b872217317734b6bde8927170c98fc4b" +vendored = false +host = "github" +path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +mode = "name" +relpath = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-18" +fix_lines = { in_function = 9, in_file = 51, source_total = 55 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +function = "_partition_to_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cjg8-h5qc-hrjv: kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write" + +[[pair]] +name = "anthropic-sdk-typescript-validatenosymlinkescape-0ac69b3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "anthropics/anthropic-sdk-typescript" +cve = "CVE-2026-34451 GHSA-5474-4w2j-mq4c" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-01T21:16:49Z" +post_cutoff = false +commit = "0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9" +parent = "284561fe36b244f5b6ab624ec2608c07f71f476e" +commit_url = "https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9" +vendored = false +host = "github" +path = "src/tools/memory/node.ts" +mode = "name" +relpath = "src/tools/memory/node.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-31" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/tools/memory/node.ts" +function = "validateNoSymlinkEscape" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5474-4w2j-mq4c: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories" + +[[pair]] +name = "copier-external-data-5413062" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "copier-org/copier" +cve = "CVE-2026-34730 GHSA-hgjq-p8cr-gg4h" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-01T22:38:39Z" +post_cutoff = false +commit = "5413062eb17b73dc885f5e645cdc161e69ef641b" +parent = "cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df" +commit_url = "https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b" +vendored = false +host = "github" +path = "copier/_main.py" +mode = "name" +relpath = "copier/_main.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-31" +fix_lines = { in_function = 22, in_file = 22, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "copier/_main.py" +function = "_external_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-hgjq-p8cr-gg4h: Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode" + +[[pair]] +name = "vite-transformmiddleware-79f002f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vitejs/vite" +cve = "CVE-2026-39365 GHSA-4w7w-66w2-5vf9" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-06T18:03:46Z" +post_cutoff = false +commit = "79f002f2286c03c88c7b74c511c7f9fc6dc46694" +parent = "a9a3df299378d9cbc5f069e3536a369f8188c8ff" +commit_url = "https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694" +vendored = false +host = "github" +path = "packages/vite/src/node/server/middlewares/transform.ts" +mode = "name" +relpath = "packages/vite/src/node/server/middlewares/transform.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-06" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/vite/src/node/server/middlewares/transform.ts" +function = "transformMiddleware" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-4w7w-66w2-5vf9: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling" + +[[pair]] +name = "nicegui-create-file-upload-d38a702" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zauberzeug/nicegui" +cve = "CVE-2026-39844 GHSA-w8wv-vfpc-hw2w" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-08T15:04:13Z" +post_cutoff = false +commit = "d38a702e3af2da5b0708f689be8d71413fc77056" +parent = "2580928afff6e34d31b77ff22769d773feb817a8" +commit_url = "https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056" +vendored = false +host = "github" +path = "nicegui/elements/upload_files.py" +mode = "name" +relpath = "nicegui/elements/upload_files.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-07" +fix_lines = { in_function = 2, in_file = 7, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "nicegui/elements/upload_files.py" +function = "create_file_upload" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w8wv-vfpc-hw2w: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows" + +[[pair]] +name = "quarkus-openapi-generator-unzip-08b4064" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "quarkiverse/quarkus-openapi-generator" +cve = "CVE-2026-40180 GHSA-jx2w-vp7f-456q" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2026-04-08T19:14:32Z" +post_cutoff = false +commit = "08b406414ff30ed192e86c7fa924e57565534ff0" +parent = "e062c8c9fff0ff9d4f025bb77101155acf786232" +commit_url = "https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0" +vendored = false +host = "github" +path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +mode = "name" +relpath = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-07" +fix_lines = { in_function = 7, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +function = "unzip" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-jx2w-vp7f-456q: quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class" + +[[pair]] +name = "excel-mcp-server-get-excel-path-f51340e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "haris-musa/excel-mcp-server" +cve = "CVE-2026-40576 GHSA-j98m-w3xp-9f56" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-14T00:03:17Z" +post_cutoff = false +commit = "f51340ecd5778952405044b203d3a2d4c8a46833" +parent = "de4dc75f6ba629ccd2e097f5963235846be622e6" +commit_url = "https://github.com/haris-musa/excel-mcp-server/commit/f51340ecd5778952405044b203d3a2d4c8a46833" +vendored = false +host = "github" +path = "src/excel_mcp/server.py" +mode = "name" +relpath = "src/excel_mcp/server.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-12" +fix_lines = { in_function = 16, in_file = 31, source_total = 39 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/excel_mcp/server.py" +function = "get_excel_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j98m-w3xp-9f56: excel-mcp-server has a Path Traversal issue" + +[[pair]] +name = "psitransfer-getfilename-8b547bf" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "psi-4ward/psitransfer" +cve = "CVE-2026-41180 GHSA-533q-w4g6-5586" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-16T21:13:40Z" +post_cutoff = false +commit = "8b547bf3e09757122efa00aab90281e3915aa0c6" +parent = "22ec552e6d579c1c859a9523810153289f3fb43b" +commit_url = "https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6" +vendored = false +host = "github" +path = "lib/store.js" +mode = "name" +relpath = "lib/store.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-14" +fix_lines = { in_function = 11, in_file = 10, source_total = 121 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/store.js" +function = "getFilename" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-533q-w4g6-5586: PsiTransfer: Upload PATCH path traversal can create `config..js` and lead to code execution on restart" + +[[pair]] +name = "pptagent-get-html-table-image-418491a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "icip-cas/pptagent" +cve = "CVE-2026-42080 GHSA-pxhg-7xr2-w7xg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-05T18:57:31Z" +post_cutoff = false +commit = "418491a9a1c02d9d93194b5973bb58df35cf9d00" +parent = "858da237342f4fdf9e6c3e47baaef6f44647c8f0" +commit_url = "https://github.com/icip-cas/pptagent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00" +vendored = false +host = "github" +path = "pptagent/utils.py" +mode = "name" +relpath = "pptagent/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-19" +fix_lines = { in_function = 5, in_file = 25, source_total = 35 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pptagent/utils.py" +function = "get_html_table_image" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pxhg-7xr2-w7xg: PPTAgent: Arbitrary File Write via `save_generated_slides`" + +[[pair]] +name = "pygeoapi-get-data-path-bf25b86" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "geopython/pygeoapi" +cve = "CVE-2026-42351 GHSA-f6pr-83pg-ghh6" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-29T22:18:02Z" +post_cutoff = false +commit = "bf25b8695edbdd5476eeffc102b633d1d3e45f52" +parent = "e80347d782ca4a076a2825920b0082701ceef909" +commit_url = "https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52" +vendored = false +host = "github" +path = "pygeoapi/provider/filesystem.py" +mode = "name" +relpath = "pygeoapi/provider/filesystem.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-20" +fix_lines = { in_function = 6, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pygeoapi/provider/filesystem.py" +function = "get_data_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-f6pr-83pg-ghh6: pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider" + +[[pair]] +name = "grav-plugin-form-uploadfiles-48bacc4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "getgrav/grav-plugin-form" +cve = "CVE-2026-42845 GHSA-w4rc-p66m-x6qq" +cwe = "CWE-73" +ecosystem = "composer" +published_at = "2026-05-06T23:03:13Z" +post_cutoff = false +commit = "48bacc4187e1cff815000e526d5ca2878484867f" +parent = "2032e77857e4fd1662357a9411b490c6c725da43" +commit_url = "https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca2878484867f" +vendored = false +host = "github" +path = "classes/Form.php" +mode = "name" +relpath = "classes/Form.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-29" +fix_lines = { in_function = 10, in_file = 20, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-73" +class = "path-traversal" +path = "classes/Form.php" +function = "uploadFiles" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w4rc-p66m-x6qq: Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override" + +[[pair]] +name = "taipy-get-resource-129fd40" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "avaiga/taipy" +cve = "CVE-2026-48544 GHSA-28gh-q3gw-pvx8" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-27T15:33:26Z" +post_cutoff = false +commit = "129fd407ffca49ee4ab853772c88d0c873e038dd" +parent = "d8556b92128defb4ea079e8776b1385cdc17e3fa" +commit_url = "https://github.com/avaiga/taipy/commit/129fd407ffca49ee4ab853772c88d0c873e038dd" +vendored = false +host = "github" +path = "taipy/gui/extension/library.py" +mode = "name" +relpath = "taipy/gui/extension/library.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-30" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "taipy/gui/extension/library.py" +function = "get_resource" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-28gh-q3gw-pvx8: Taipy contains a path traversal vulnerability" + +[[pair]] +name = "jupyter-server-get-os-path-0d829f2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyter-server/jupyter_server" +cve = "CVE-2026-5422 GHSA-gf7q-q4j7-hp7c" +cwe = "CWE-23" +ecosystem = "pip" +published_at = "2026-06-02T12:31:26Z" +post_cutoff = true +commit = "0d829f2c35a481c3b24ecbe1e25a6f79954e88f2" +parent = "5869e779566352371904d0aed9407265148c0f78" +commit_url = "https://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2" +vendored = false +host = "github" +path = "jupyter_server/services/contents/fileio.py" +mode = "name" +relpath = "jupyter_server/services/contents/fileio.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-06" +fix_lines = { in_function = 5, in_file = 4, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "jupyter_server/services/contents/fileio.py" +function = "_get_os_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gf7q-q4j7-hp7c: Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() " + +[[pair]] +name = "apm-looks-like-legacy-apm-bundle-77d1dda" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "microsoft/apm" +cve = "CVE-2026-46383 GHSA-mq5j-pw29-jcv3" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-15T18:25:34Z" +post_cutoff = false +commit = "77d1dda8303c8d7ccb6148788a6274fdece98499" +parent = "f85b9f54ad303159f9c448268eb7005c319fe02a" +commit_url = "https://github.com/microsoft/apm/commit/77d1dda8303c8d7ccb6148788a6274fdece98499" +vendored = false +host = "github" +path = "src/apm_cli/bundle/local_bundle.py" +mode = "name" +relpath = "src/apm_cli/bundle/local_bundle.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-11" +fix_lines = { in_function = 13, in_file = 12, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/apm_cli/bundle/local_bundle.py" +function = "_looks_like_legacy_apm_bundle" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-mq5j-pw29-jcv3: Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`" + +[[pair]] +name = "pdm-write-to-fs-41aa5f9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pdm-project/pdm" +cve = "CVE-2026-47764 GHSA-78v8-vpjp-cjqh" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-06-10T20:33:13Z" +post_cutoff = true +commit = "41aa5f94a30e51b1a460af27312dd9dc532aad5a" +parent = "904e1dded8f36fc21373db5b731a5801a6a1f2d9" +commit_url = "https://github.com/pdm-project/pdm/commit/41aa5f94a30e51b1a460af27312dd9dc532aad5a" +vendored = false +host = "github" +path = "src/pdm/installers/installers.py" +mode = "name" +relpath = "src/pdm/installers/installers.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-20" +fix_lines = { in_function = 12, in_file = 14, source_total = 24 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/pdm/installers/installers.py" +function = "write_to_fs" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-78v8-vpjp-cjqh: PDM wheel installation leads to Path Traversal via overridden write_to_fs" + +[[pair]] +name = "xiaomusic-music-file-88404da" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "hanxi/xiaomusic" +cve = "CVE-2026-10108 GHSA-5j8p-5rrj-8wjg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-29T18:31:35Z" +post_cutoff = false +commit = "88404da7a283f2c0a796a4cd16bbb6e6aa1f4722" +parent = "c6679a69e4295a7e508f5ec157b60c5ac5b8a041" +commit_url = "https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722" +vendored = false +host = "github" +path = "xiaomusic/api/routers/file.py" +mode = "name" +relpath = "xiaomusic/api/routers/file.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-26" +fix_lines = { in_function = 4, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "xiaomusic/api/routers/file.py" +function = "music_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5j8p-5rrj-8wjg: xiaomusic contains an unauthenticated path traversal vulnerability" + +[[pair]] +name = "serializer-decode-0943a06" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/serializer" +cve = "GHSA-j68w-pg49-f6vx" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-30T00:52:20Z" +post_cutoff = false +commit = "0943a06a663b573d7319fc1acd56d3484eaaa430" +parent = "d89f7d242d1bdf0c281bb498c840538c8071ec10" +commit_url = "https://github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430" +vendored = false +host = "github" +path = "Encoder/XmlEncoder.php" +mode = "name" +relpath = "Encoder/XmlEncoder.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-02-24" +fix_lines = { in_function = 8, in_file = 11, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Encoder/XmlEncoder.php" +function = "decode" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-j68w-pg49-f6vx: Symfony XML decoding attack vector through external entities" + +[[pair]] +name = "dependency-injection-parsefile-5c5040c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/dependency-injection" +cve = "GHSA-c636-cg5r-2498" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-29T19:59:13Z" +post_cutoff = false +commit = "5c5040c890a8e4085dcd6fa3827f574ab5f71f4c" +parent = "e2f9fee8ec36209fee64ee15a73fd5e0e8372652" +commit_url = "https://github.com/symfony/dependency-injection/commit/5c5040c890a8e4085dcd6fa3827f574ab5f71f4c" +vendored = false +host = "github" +path = "Loader/XmlFileLoader.php" +mode = "name" +relpath = "Loader/XmlFileLoader.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2012-08-28" +fix_lines = { in_function = 5, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Loader/XmlFileLoader.php" +function = "parseFile" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-c636-cg5r-2498: Symfony XML Entity Expansion security vulnerability" + +[[pair]] +name = "routing-loadfile-769e8e6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/routing" +cve = "GHSA-rjpm-qmq7-q85w" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-30T00:49:54Z" +post_cutoff = false +commit = "769e8e6584c5d13e7c6f51aa77a9d5f977fec463" +parent = "4ff9294af0ce24d40aec58ef39b1550732586bd8" +commit_url = "https://github.com/symfony/routing/commit/769e8e6584c5d13e7c6f51aa77a9d5f977fec463" +vendored = false +host = "github" +path = "Loader/XmlFileLoader.php" +mode = "name" +relpath = "Loader/XmlFileLoader.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-08-28" +fix_lines = { in_function = 5, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Loader/XmlFileLoader.php" +function = "loadFile" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-rjpm-qmq7-q85w: Symfony XXE security vulnerability" + +[[pair]] +name = "silverstripe-seed-onbeforesecuritylogin-b065ebd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "symbiote/silverstripe-seed" +cve = "CVE-2017-20164 GHSA-wm32-3r4m-jvcc" +cwe = "CWE-601" +ecosystem = "composer" +published_at = "2023-01-07T21:30:38Z" +post_cutoff = false +commit = "b065ebd82da53009d273aa7e989191f701485244" +parent = "573d695aa7ed4d68c70cc3d2de3728051b4b495d" +commit_url = "https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244" +vendored = false +host = "github" +path = "code/extensions/SecurityLoginExtension.php" +mode = "name" +relpath = "code/extensions/SecurityLoginExtension.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2017-02-16" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "code/extensions/SecurityLoginExtension.php" +function = "onBeforeSecurityLogin" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-wm32-3r4m-jvcc: Symbiote Seed Open Redirect vulnerability" + +[[pair]] +name = "urllib3-init-adb358f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "urllib3/urllib3" +cve = "CVE-2018-25091 GHSA-gwvm-45gx-3cf8" +cwe = "CWE-601" +ecosystem = "pip" +published_at = "2023-10-15T21:30:26Z" +post_cutoff = false +commit = "adb358f8e06865406d1f05e581a16cbea2136fbc" +parent = "a252e2549ff797fe13e688f05296fa496e0c469a" +commit_url = "https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc" +vendored = false +host = "github" +path = "src/urllib3/util/retry.py" +mode = "name" +relpath = "src/urllib3/util/retry.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2018-12-29" +fix_lines = { in_function = 3, in_file = 2, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/urllib3/util/retry.py" +function = "__init__" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-gwvm-45gx-3cf8: Authorization Header forwarded on redirect" + +[[pair]] +name = "seotools-maketag-ca27cd0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "artesaos/seotools" +cve = "CVE-2020-36665 GHSA-w2x5-hpmg-j98h" +cwe = "CWE-601" +ecosystem = "composer" +published_at = "2023-07-06T19:24:11Z" +post_cutoff = false +commit = "ca27cd0edf917e0bc805227013859b8b5a1f01fb" +parent = "445c0bf0ddbd7cdc271d2887d25009a0e1ff2cb6" +commit_url = "https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb" +vendored = false +host = "github" +path = "src/SEOTools/OpenGraph.php" +mode = "name" +relpath = "src/SEOTools/OpenGraph.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2020-04-02" +fix_lines = { in_function = 1, in_file = 1, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/SEOTools/OpenGraph.php" +function = "makeTag" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-w2x5-hpmg-j98h: Artesãos SEOTools Open Redirect vulnerability" + +[[pair]] +name = "axmlrpc-parse-ad6615b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "gturri/axmlrpc" +cve = "CVE-2020-36641 GHSA-g4r8-28fp-f255" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-01-05T12:30:27Z" +post_cutoff = false +commit = "ad6615b3ec41353e614f6ea5fdd5b046442a832b" +parent = "2e59d03c961607d32bc9dc5e7aba931338907603" +commit_url = "https://github.com/gturri/axmlrpc/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b" +vendored = false +host = "github" +path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +mode = "name" +relpath = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-10-15" +fix_lines = { in_function = 6, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +function = "parse" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-g4r8-28fp-f255: aXMLRPC XML External Entity vulnerability" + +[[pair]] +name = "neo4j-apoc-procedures-parsexml-c3e2a29" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "neo4j-contrib/neo4j-apoc-procedures" +cve = "GHSA-9vx8-f5c4-862x" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-02-24T17:39:18Z" +post_cutoff = false +commit = "c3e2a29020497acf9417879f38e8af4e8c6d5783" +parent = "1b60237168679daed62edcdb1260d5fc790329ab" +commit_url = "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/c3e2a29020497acf9417879f38e8af4e8c6d5783" +vendored = false +host = "github" +path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +mode = "name" +relpath = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-02-13" +fix_lines = { in_function = 9, in_file = 13, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +function = "parseXML" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-9vx8-f5c4-862x: XML External Entity (XXE) vulnerability in apoc.import.graphml" + +[[pair]] +name = "keycloak-nodejs-connect-forcechecksso-190a947" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "keycloak/keycloak-nodejs-connect" +cve = "CVE-2022-2237 GHSA-59fq-727j-hm3f" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2023-03-02T23:21:02Z" +post_cutoff = false +commit = "190a9470e234bbd9ac5d5de43f5a19aead9a2c21" +parent = "e4bd6b7bc8116432bf8fde87c5f06417005f88ea" +commit_url = "https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21" +vendored = false +host = "github" +path = "middleware/check-sso.js" +mode = "name" +relpath = "middleware/check-sso.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-01" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "middleware/check-sso.js" +function = "forceCheckSSO" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-59fq-727j-hm3f: keycloak-connect contains Open redirect vulnerability in the Node.js adapter" + +[[pair]] +name = "mstest-plugin-containsdata-f9b9b0c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/mstest-plugin" +cve = "CVE-2023-24441 GHSA-3ppr-72x5-x67q" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-01-26T21:30:18Z" +post_cutoff = false +commit = "f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67" +parent = "3870f53d9d1ab5759ab82a44c8d6b4ca9d933923" +commit_url = "https://github.com/jenkinsci/mstest-plugin/commit/f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67" +vendored = false +host = "github" +path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +mode = "name" +relpath = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-16" +fix_lines = { in_function = 6, in_file = 15, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +function = "containsData" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-3ppr-72x5-x67q: XML external entity vulnerability on agents in Jenkins MSTest Plugin " + +[[pair]] +name = "request-redirect-c5bcf21" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cypress-io/request" +cve = "CVE-2023-28155 GHSA-p8p7-x288-28g6" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2023-03-16T15:30:19Z" +post_cutoff = false +commit = "c5bcf21d40fb61feaff21a0e5a2b3934a440024f" +parent = "0664780557c95610eafeedff6067bacac6783705" +commit_url = "https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f" +vendored = false +host = "github" +path = "lib/redirect.js" +mode = "name" +relpath = "lib/redirect.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-08" +fix_lines = { in_function = 4, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "lib/redirect.js" +function = "Redirect" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request" + +[[pair]] +name = "drill-xmlreader-0e88b7a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/drill" +cve = "CVE-2023-48362 GHSA-v62g-jwj9-rfvx" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2024-07-24T09:30:40Z" +post_cutoff = false +commit = "0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3" +parent = "097da744ff416bda7bd6e83df3d7b3f31369c42e" +commit_url = "https://github.com/apache/drill/commit/0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3" +vendored = false +host = "github" +path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +mode = "name" +relpath = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-11-06" +fix_lines = { in_function = 1, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +function = "XMLReader" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-v62g-jwj9-rfvx: XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill" + +[[pair]] +name = "axis-axis1-java-getservice-685c309" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/axis-axis1-java" +cve = "CVE-2023-51441 GHSA-hr2c-p8rh-238h" +cwe = "CWE-918" +ecosystem = "maven" +published_at = "2024-01-06T12:30:34Z" +post_cutoff = false +commit = "685c309febc64aa393b2d64a05f90e7eb9f73e06" +parent = "e84c60c1f0764b01577d62c9e6453457d523ee77" +commit_url = "https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06" +vendored = false +host = "github" +path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +mode = "name" +relpath = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-12-18" +fix_lines = { in_function = 3, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +function = "getService" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-hr2c-p8rh-238h: Apache Axis Improper Input Validation vulnerability" + +[[pair]] +name = "cyclonedx-javascript-library-getparser-5e5e1e0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cyclonedx/cyclonedx-javascript-library" +cve = "CVE-2024-34345 GHSA-38gf-rh2w-gmj7" +cwe = "CWE-611" +ecosystem = "npm" +published_at = "2024-05-08T19:55:37Z" +post_cutoff = false +commit = "5e5e1e0b9422f47d2de81c7c4064b803a01e7203" +parent = "974c5585dac0428f2863459b215a3dc2951421a6" +commit_url = "https://github.com/cyclonedx/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203" +vendored = false +host = "github" +path = "src/validation/xmlValidator.node.ts" +mode = "name" +relpath = "src/validation/xmlValidator.node.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-05-07" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/validation/xmlValidator.node.ts" +function = "getParser" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-38gf-rh2w-gmj7: @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability" + +[[pair]] +name = "fhir-ig-publisher-loadmappingspaces-3560de2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "hl7/fhir-ig-publisher" +cve = "CVE-2024-52807 GHSA-8c3x-hq82-gjcm" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-01-24T18:33:29Z" +post_cutoff = false +commit = "3560de2f486d688a3ddcf4aa54d8bdacea380c3d" +parent = "ba0b48d4ddb4dbffb45e0d45c43069e99a038385" +commit_url = "https://github.com/hl7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d" +vendored = false +host = "github" +path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +mode = "name" +relpath = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-19" +fix_lines = { in_function = 2, in_file = 1, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +function = "loadMappingSpaces" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-8c3x-hq82-gjcm: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`" + +[[pair]] +name = "fedify-lookupwebfinger-8be3c20" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "dahlia/fedify" +cve = "CVE-2025-23221 GHSA-c59p-wq67-24wx" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2025-01-21T19:58:29Z" +post_cutoff = false +commit = "8be3c2038eebf4ae12481683a1e809b314be3151" +parent = "c505eb82fcd6b5b17174c6659c29721bc801ab9a" +commit_url = "https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151" +vendored = false +host = "github" +path = "src/webfinger/lookup.ts" +mode = "name" +relpath = "src/webfinger/lookup.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-01-18" +fix_lines = { in_function = 1, in_file = 2, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "src/webfinger/lookup.ts" +function = "lookupWebFinger" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-c59p-wq67-24wx: Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify" + +[[pair]] +name = "local-s3-createservicefactory-d6ed756" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "robothy/local-s3" +cve = "GHSA-47qw-ccjm-9c2c" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-03-10T18:29:36Z" +post_cutoff = false +commit = "d6ed756ceb30c1eb9d4263321ac683d734f8836f" +parent = "009901882be8b543e85b67c5ec2e9f30d83d62ef" +commit_url = "https://github.com/robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f" +vendored = false +host = "github" +path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +mode = "name" +relpath = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-24" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +function = "createServiceFactory" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-47qw-ccjm-9c2c: LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection" + +[[pair]] +name = "webdrivermanager-loadxml-125646b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "bonigarcia/webdrivermanager" +cve = "CVE-2025-4641 GHSA-pwm3-776c-8q7q" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-05-14T21:31:18Z" +post_cutoff = false +commit = "125646bd53855cf5de99fd4bc501b3604c151c9b" +parent = "0f14b3fc93cdfb58b24f419ce28ca08955aac964" +commit_url = "https://github.com/bonigarcia/webdrivermanager/commit/125646bd53855cf5de99fd4bc501b3604c151c9b" +vendored = false +host = "github" +path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +mode = "name" +relpath = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-07" +fix_lines = { in_function = 3, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +function = "loadXML" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-pwm3-776c-8q7q: BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference" + +[[pair]] +name = "workers-oauth-provider-parseauthrequest-66de8d8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "cloudflare/workers-oauth-provider" +cve = "CVE-2025-4143 GHSA-4pc9-x2fx-p7vj" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2025-05-01T17:00:29Z" +post_cutoff = false +commit = "66de8d802c1d7c468887906ea1a0769a975ff1e3" +parent = "3e3d0bfea19a5bf444423fc88622e65d6c14fad0" +commit_url = "https://github.com/cloudflare/workers-oauth-provider/commit/66de8d802c1d7c468887906ea1a0769a975ff1e3" +vendored = false +host = "github" +path = "src/oauth-provider.ts" +mode = "name" +relpath = "src/oauth-provider.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-30" +fix_lines = { in_function = 10, in_file = 34, source_total = 50 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/oauth-provider.ts" +function = "parseAuthRequest" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-4pc9-x2fx-p7vj: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint" + +[[pair]] +name = "langroid-extract-field-values-36e7e7d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "langroid/langroid" +cve = "CVE-2025-46726 GHSA-pw95-88fg-3j6f" +cwe = "CWE-611" +ecosystem = "pip" +published_at = "2025-05-05T20:40:44Z" +post_cutoff = false +commit = "36e7e7db4dd1636de225c2c66c84052b1e9ac3c3" +parent = "eca5c0677ee27acf71b7ff68e69576135769a2fb" +commit_url = "https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3" +vendored = false +host = "github" +path = "langroid/agent/xml_tool_message.py" +mode = "name" +relpath = "langroid/agent/xml_tool_message.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-03" +fix_lines = { in_function = 7, in_file = 11, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "langroid/agent/xml_tool_message.py" +function = "extract_field_values" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-pw95-88fg-3j6f: Langroid Allows XXE Injection via XMLToolMessage" + +[[pair]] +name = "math-read-fc31c8f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "phpoffice/math" +cve = "CVE-2025-48882 GHSA-42hm-pq2f-3r7m" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2025-05-29T17:27:39Z" +post_cutoff = false +commit = "fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a" +parent = "6ea0c8140b9597b11127233c381f2d5d90f01265" +commit_url = "https://github.com/phpoffice/math/commit/fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a" +vendored = false +host = "github" +path = "src/Math/Reader/MathML.php" +mode = "name" +relpath = "src/Math/Reader/MathML.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-29" +fix_lines = { in_function = 3, in_file = 11, source_total = 96 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/Math/Reader/MathML.php" +function = "read" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-42hm-pq2f-3r7m: PHPOffice Math allows XXE when processing an XML file in the MathML format " + +[[pair]] +name = "datasette-handle-404-f257ca6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "simonw/datasette" +cve = "CVE-2025-64481 GHSA-w832-gg5g-x44m" +cwe = "CWE-601" +ecosystem = "pip" +published_at = "2025-11-06T15:13:33Z" +post_cutoff = false +commit = "f257ca6edb64848c3b04b54d41e347c54fe57c05" +parent = "295e4a2e87464fc1838d6278308bf151bc14ba73" +commit_url = "https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05" +vendored = false +host = "github" +path = "datasette/app.py" +mode = "name" +relpath = "datasette/app.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-05" +fix_lines = { in_function = 1, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "datasette/app.py" +function = "handle_404" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-w832-gg5g-x44m: Open redirect endpoint in Datasette" + +[[pair]] +name = "fastify-reply-from-buildurl-4d9795c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "fastify/fastify-reply-from" +cve = "CVE-2025-66415 GHSA-2q7r-29rg-6m5h" +cwe = "CWE-441" +ecosystem = "npm" +published_at = "2025-12-02T00:38:57Z" +post_cutoff = false +commit = "4d9795cd5b57a36756d37b7f036eae369f69fa66" +parent = "79ff1d2496d9496c59d5b392a18ce220c2d82b3f" +commit_url = "https://github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66" +vendored = false +host = "github" +path = "lib/utils.js" +mode = "name" +relpath = "lib/utils.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-01" +fix_lines = { in_function = 5, in_file = 6, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-441" +class = "ssrf" +path = "lib/utils.js" +function = "buildURL" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-2q7r-29rg-6m5h: fastify-reply-from affected by bypass of reply forwarding" + +[[pair]] +name = "angular-cli-joinurlparts-f086ecc" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "angular/angular-cli" +cve = "CVE-2026-27738 GHSA-xh43-g2fq-wjrj" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2026-02-25T22:41:57Z" +post_cutoff = false +commit = "f086eccc36d10cf01c426e35864bc32e1e292323" +parent = "6cf621c905de4815b1e12964fb909876ca6e3ea3" +commit_url = "https://github.com/angular/angular-cli/commit/f086eccc36d10cf01c426e35864bc32e1e292323" +vendored = false +host = "github" +path = "packages/angular/ssr/src/utils/url.ts" +mode = "name" +relpath = "packages/angular/ssr/src/utils/url.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-23" +fix_lines = { in_function = 19, in_file = 15, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "packages/angular/ssr/src/utils/url.ts" +function = "joinUrlParts" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-xh43-g2fq-wjrj: Angular SSR has an Open Redirect via X-Forwarded-Prefix" + +[[pair]] +name = "backstage-fetchcimdmetadata-17038ab" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "backstage/backstage" +cve = "CVE-2026-32236 GHSA-qp4c-xg64-7c6x" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2026-03-12T14:51:02Z" +post_cutoff = false +commit = "17038abf2dfdb4abc08a59b1c95af39851de0e07" +parent = "3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce" +commit_url = "https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07" +vendored = false +host = "github" +path = "plugins/auth-backend/src/service/CimdClient.ts" +mode = "name" +relpath = "plugins/auth-backend/src/service/CimdClient.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-11" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "plugins/auth-backend/src/service/CimdClient.ts" +function = "fetchCimdMetadata" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-qp4c-xg64-7c6x: @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch" + +[[pair]] +name = "core-bundle-dev-app-fromurl-7904f69" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "roadiz/core-bundle-dev-app" +cve = "CVE-2026-33486 GHSA-rc55-58f4-687g" +cwe = "CWE-918" +ecosystem = "composer" +published_at = "2026-03-23T21:43:14Z" +post_cutoff = false +commit = "7904f690a51b88b1c72c02149ebdf85fa81f19f2" +parent = "17ddb5934cdfe9aa617707081ca4765dc988b1d6" +commit_url = "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2" +vendored = false +host = "github" +path = "lib/Documents/src/DownloadedFile.php" +mode = "name" +relpath = "lib/Documents/src/DownloadedFile.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-19" +fix_lines = { in_function = 17, in_file = 74, source_total = 75 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "lib/Documents/src/DownloadedFile.php" +function = "fromUrl" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-rc55-58f4-687g: Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents" diff --git a/benchmarks/pairs/advisory-fixes-3/verification.json b/benchmarks/pairs/advisory-fixes-3/verification.json new file mode 100644 index 0000000..70ece08 --- /dev/null +++ b/benchmarks/pairs/advisory-fixes-3/verification.json @@ -0,0 +1,1261 @@ +{ + "pairs": [ + { + "name": "fosuserbundle-refreshuser-5a36e29", + "ok": true, + "bytes_read": 2129 + }, + { + "name": "security-getresolvedindexpattern-f7cc569", + "ok": true, + "bytes_read": 4417 + }, + { + "name": "orocalendarbundle-checkpermissions-460a8ff", + "ok": true, + "bytes_read": 2232 + }, + { + "name": "remult-doonid-6892ae9", + "ok": true, + "bytes_read": 2158 + }, + { + "name": "micronaut-security-parseaudiences-9728b92", + "ok": true, + "bytes_read": 8471 + }, + { + "name": "servicenow-devops-plugin-dochecktoolid-67192e2", + "ok": true, + "bytes_read": 6385 + }, + { + "name": "synapse-received-remote-receipt-63d28a8", + "ok": true, + "bytes_read": 5591 + }, + { + "name": "strapi-plugin-protected-populate-protectpopulate-0544106", + "ok": true, + "bytes_read": 8740 + }, + { + "name": "scriptler-plugin-doshowscript-5addb5f", + "ok": true, + "bytes_read": 2627 + }, + { + "name": "undici-shouldremoveheader-6805746", + "ok": true, + "bytes_read": 1789 + }, + { + "name": "silverstripe-reports-handleaction-0351106", + "ok": true, + "bytes_read": 2239 + }, + { + "name": "flask-cors-get-cors-headers-7ae310c", + "ok": true, + "bytes_read": 5392 + }, + { + "name": "matrix-js-sdk-getvisiblerooms-43c72d5", + "ok": true, + "bytes_read": 2268 + }, + { + "name": "strimzi-kafka-operator-generaterolebindingforrole-c8a1493", + "ok": true, + "bytes_read": 2461 + }, + { + "name": "bagisto-reorder-b2b1cf6", + "ok": true, + "bytes_read": 1991 + }, + { + "name": "froshplatformadminer-index-c4dd6c3", + "ok": true, + "bytes_read": 1432 + }, + { + "name": "azure-blob-actionloadcontainerdata-cf69db4", + "ok": true, + "bytes_read": 1760 + }, + { + "name": "connect-cms-update-7c99517", + "ok": true, + "bytes_read": 17367 + }, + { + "name": "parse-server-gethandler-053109b", + "ok": true, + "bytes_read": 5755 + }, + { + "name": "openclaw-resolvecommandauthorization-2aa93d4", + "ok": true, + "bytes_read": 7580 + }, + { + "name": "snappy-prepareoutput-1ee6360", + "ok": true, + "bytes_read": 3052 + }, + { + "name": "llama-hub-init-c01416e", + "ok": true, + "bytes_read": 1774 + }, + { + "name": "ngrinder-read-85efa4a", + "ok": true, + "bytes_read": 2562 + }, + { + "name": "qiskit-ibm-runtime-object-hook-b78fca1", + "ok": true, + "bytes_read": 8563 + }, + { + "name": "invokeai-torch-load-file-756008d", + "ok": true, + "bytes_read": 1511 + }, + { + "name": "jackrabbit-getrepository-7a31909", + "ok": true, + "bytes_read": 2868 + }, + { + "name": "inspiremusic-load-784cbf8", + "ok": true, + "bytes_read": 3453 + }, + { + "name": "datachain-deserialize-914b956", + "ok": true, + "bytes_read": 2419 + }, + { + "name": "ray-deserialize-with-fallback-c02bd31", + "ok": true, + "bytes_read": 2259 + }, + { + "name": "yii2-jqgrid-widget-addsearchoptionsrecursively-a117e0f", + "ok": true, + "bytes_read": 5372 + }, + { + "name": "postgraas-server-create-postgres-db-7cd8d01", + "ok": true, + "bytes_read": 3719 + }, + { + "name": "xmlseclibs-processrefnode-6490326", + "ok": true, + "bytes_read": 5722 + }, + { + "name": "propel2-applylimit-cd23d73", + "ok": true, + "bytes_read": 1558 + }, + { + "name": "propel-applylimit-b720932", + "ok": true, + "bytes_read": 1530 + }, + { + "name": "node-gry-exec-5108446", + "ok": true, + "bytes_read": 2212 + }, + { + "name": "json-logic-js-arrayunique-c1dd82f", + "ok": true, + "bytes_read": 27341 + }, + { + "name": "yii2-gii-validatemessagecategory-ed61e0d", + "ok": true, + "bytes_read": 1699 + }, + { + "name": "contao-tablelookupwizard-preparewhere-a5e723a", + "ok": true, + "bytes_read": 3698 + }, + { + "name": "spring-module-core-getschema-d374a5f", + "ok": true, + "bytes_read": 1294 + }, + { + "name": "window-control-sendkeys-075c854", + "ok": true, + "bytes_read": 4823 + }, + { + "name": "snowflake-connector-nodejs-convertrawvariant-0c9622a", + "ok": true, + "bytes_read": 2617 + }, + { + "name": "node-git-commit-info-gitcommitinfo-f7c491e", + "ok": true, + "bytes_read": 2105 + }, + { + "name": "numexpr-stringtoexpression-4b2d89c", + "ok": true, + "bytes_read": 3809 + }, + { + "name": "scancode-io-fetch-docker-image-07ec0de", + "ok": true, + "bytes_read": 4194 + }, + { + "name": "dcnnt-py-main-b4021d7", + "ok": true, + "bytes_read": 3551 + }, + { + "name": "find-exec-isexec-74fb108", + "ok": true, + "bytes_read": 905 + }, + { + "name": "blamer-git-0965877", + "ok": true, + "bytes_read": 1716 + }, + { + "name": "php-heic-to-jpg-convert-852bc21", + "ok": true, + "bytes_read": 1237 + }, + { + "name": "pyansys-geometry-start-program-f82346b", + "ok": true, + "bytes_read": 2182 + }, + { + "name": "sagemaker-python-sdk-capture-dependencies-2d873d5", + "ok": true, + "bytes_read": 3061 + }, + { + "name": "node-mysql2-readcodefor-7d4b098", + "ok": true, + "bytes_read": 5834 + }, + { + "name": "pymysql-escape-dict-521e400", + "ok": true, + "bytes_read": 929 + }, + { + "name": "mindsdb-dispatch-update-11a4db7", + "ok": true, + "bytes_read": 2751 + }, + { + "name": "haystack-validate-template-6c25a5c", + "ok": true, + "bytes_read": 3638 + }, + { + "name": "fides-render-829cbd9", + "ok": true, + "bytes_read": 1395 + }, + { + "name": "torchgeo-get-weight-1a98078", + "ok": true, + "bytes_read": 1527 + }, + { + "name": "plotai-run-bdcfb13", + "ok": true, + "bytes_read": 1555 + }, + { + "name": "matrix-appservice-irc-settopic-74f02c8", + "ok": true, + "bytes_read": 1838 + }, + { + "name": "conductor-initengine-e981650", + "ok": true, + "bytes_read": 2880 + }, + { + "name": "amplify-codegen-ui-buildbindingexpression-ca98c38", + "ok": true, + "bytes_read": 1920 + }, + { + "name": "jeecgboot-ispass-ddf0f61", + "ok": true, + "bytes_read": 4642 + }, + { + "name": "larecipe-replacelinks-c1d0d56", + "ok": true, + "bytes_read": 1703 + }, + { + "name": "sequa-mcp-redirecttoauthorization-e569815", + "ok": true, + "bytes_read": 1181 + }, + { + "name": "flink-cdc-tableexists-d576618", + "ok": true, + "bytes_read": 3958 + }, + { + "name": "hive-deletetablecolumnstatistics-c18d0df", + "ok": true, + "bytes_read": 2951 + }, + { + "name": "mcp-server-kubernetes-execinpod-d091107", + "ok": true, + "bytes_read": 2948 + }, + { + "name": "mcp-watch-clonerepo-e7da78c", + "ok": true, + "bytes_read": 1918 + }, + { + "name": "elysia-get-26935bf", + "ok": true, + "bytes_read": 8518 + }, + { + "name": "parsl-workflow-resources-013a928", + "ok": true, + "bytes_read": 4881 + }, + { + "name": "workers-sdk-handler-99b1f32", + "ok": true, + "bytes_read": 25234 + }, + { + "name": "django-add-filtered-relation-005d60d", + "ok": true, + "bytes_read": 4651 + }, + { + "name": "webhooks-init-8834499", + "ok": true, + "bytes_read": 14129 + }, + { + "name": "git-js-preventuploadpack-1effd8e", + "ok": true, + "bytes_read": 2294 + }, + { + "name": "ormar-query-aggr-function-a03bae1", + "ok": true, + "bytes_read": 3084 + }, + { + "name": "intake-expand-defaults-d0c0b6b", + "ok": true, + "bytes_read": 3836 + }, + { + "name": "openhands-get-git-diff-698cfc2", + "ok": true, + "bytes_read": 2482 + }, + { + "name": "scitokens-getkeyinfo-3dba108", + "ok": true, + "bytes_read": 9088 + }, + { + "name": "langchain-get-template-variables-6bab0ba", + "ok": true, + "bytes_read": 3833 + }, + { + "name": "math-codegen-interpreter-4bb52d3", + "ok": true, + "bytes_read": 2493 + }, + { + "name": "amazon-redshift-python-driver-vector-in-69a69df", + "ok": true, + "bytes_read": 1142 + }, + { + "name": "yt-dlp-prepare-outtmpl-5faffa9", + "ok": true, + "bytes_read": 22948 + }, + { + "name": "wsgidav-exists-record-by-primary-key-6f35776", + "ok": true, + "bytes_read": 3327 + }, + { + "name": "dynatrace-mcp-generatedqlsearchentitycommand-15d3546", + "ok": true, + "bytes_read": 2785 + }, + { + "name": "agno-delete-by-metadata-6780513", + "ok": true, + "bytes_read": 4686 + }, + { + "name": "virtualenv-quote-d721ff1", + "ok": true, + "bytes_read": 1608 + }, + { + "name": "zend-form-createattributesstring-6fe4031", + "ok": true, + "bytes_read": 3696 + }, + { + "name": "zendframework-htmlattribs-1dd4f8c", + "ok": true, + "bytes_read": 3492 + }, + { + "name": "scnsocialauth-invoke-4a00966", + "ok": true, + "bytes_read": 1624 + }, + { + "name": "ldapcherry-check-auth-6f98076", + "ok": true, + "bytes_read": 5981 + }, + { + "name": "framework-attributestostring-ae4d790", + "ok": true, + "bytes_read": 1755 + }, + { + "name": "vditor-fixfirefoxarrowuptable-1b2382d", + "ok": true, + "bytes_read": 22562 + }, + { + "name": "jquery-minicolors-init-ef13482", + "ok": true, + "bytes_read": 8119 + }, + { + "name": "mind-elixir-core-creatediv-0734852", + "ok": true, + "bytes_read": 4928 + }, + { + "name": "eslint-detailed-reporter-renderissue-505c190", + "ok": true, + "bytes_read": 2077 + }, + { + "name": "sanitize-url-decodehtmlcharacters-d4bdc89", + "ok": true, + "bytes_read": 1066 + }, + { + "name": "modoboa-identities-eef9ab7", + "ok": true, + "bytes_read": 23675 + }, + { + "name": "jquery-validation-delegate-7a490d8", + "ok": true, + "bytes_read": 77807 + }, + { + "name": "email-ext-plugin-rendertemplate-7b2bd25", + "ok": true, + "bytes_read": 3416 + }, + { + "name": "archiva-checkparamchars-d62e81c", + "ok": true, + "bytes_read": 6429 + }, + { + "name": "silverstripe-form-capture-details-5b3aa39", + "ok": true, + "bytes_read": 1904 + }, + { + "name": "whatsapp-chat-exporter-create-html-bfdc68c", + "ok": true, + "bytes_read": 10510 + }, + { + "name": "ckeditor-wordcount-plugin-strip-0f03b3e", + "ok": true, + "bytes_read": 2367 + }, + { + "name": "critters-createdocument-7757902", + "ok": true, + "bytes_read": 2436 + }, + { + "name": "mjml-python-parse-84c495d", + "ok": true, + "bytes_read": 5827 + }, + { + "name": "apollo-client-nextjs-transportdatatojs-b92bc42", + "ok": true, + "bytes_read": 1585 + }, + { + "name": "urql-transportdatatojs-4b7011b", + "ok": true, + "bytes_read": 2015 + }, + { + "name": "dependency-check-plugin-transform-b3b286a", + "ok": true, + "bytes_read": 11799 + }, + { + "name": "send-sendstream-ae4f298", + "ok": true, + "bytes_read": 28326 + }, + { + "name": "serve-static-createredirectdirectorylistener-0c11fad", + "ok": true, + "bytes_read": 2576 + }, + { + "name": "layui-getpath-f756b41", + "ok": true, + "bytes_read": 1666 + }, + { + "name": "vue-i18n-ismessageast-72f0d32", + "ok": true, + "bytes_read": 1058 + }, + { + "name": "simplexlsx-readthemecolors-71a5e3d", + "ok": true, + "bytes_read": 2394 + }, + { + "name": "dom-expressions-replace-521f75d", + "ok": true, + "bytes_read": 1522 + }, + { + "name": "jte-javascriptblock-a6fb00d", + "ok": true, + "bytes_read": 3549 + }, + { + "name": "felix-dev-rendercontent-87513ea", + "ok": true, + "bytes_read": 2737 + }, + { + "name": "label-studio-upload-example-using-config-8cf6958", + "ok": true, + "bytes_read": 2425 + }, + { + "name": "vega-replace-694560c", + "ok": true, + "bytes_read": 1146 + }, + { + "name": "htmlsanitizer-makesanitizedcopy-af6d2a7", + "ok": true, + "bytes_read": 4555 + }, + { + "name": "jsondiffpatch-typeformatttererrorformatter-0e374b5", + "ok": true, + "bytes_read": 1411 + }, + { + "name": "django-tomselect-prepare-results-0990ed3", + "ok": true, + "bytes_read": 5287 + }, + { + "name": "unopim-getrules-49d5f6a", + "ok": true, + "bytes_read": 2882 + }, + { + "name": "cloudbees-jenkins-advisor-plugin-executeinternal-4b456b3", + "ok": true, + "bytes_read": 4881 + }, + { + "name": "clevertap-web-sdk-handlemessageevent-84695b7", + "ok": true, + "bytes_read": 3219 + }, + { + "name": "mezzanine-displayable-links-js-898630d", + "ok": true, + "bytes_read": 3117 + }, + { + "name": "cadwyn-swagger-dashboard-b424ecd", + "ok": true, + "bytes_read": 2383 + }, + { + "name": "webssh-log-status-a7a704f", + "ok": true, + "bytes_read": 1491 + }, + { + "name": "core-index-e984870", + "ok": true, + "bytes_read": 11919 + }, + { + "name": "mesh-web-sdk-openlink-7f22148", + "ok": true, + "bytes_read": 2996 + }, + { + "name": "fastmcp-create-detail-box-2a20f54", + "ok": true, + "bytes_read": 1769 + }, + { + "name": "mailgen-setupbuttonfallbacktext-7a791a4", + "ok": true, + "bytes_read": 12373 + }, + { + "name": "spotipy-do-get-880b92d", + "ok": true, + "bytes_read": 2157 + }, + { + "name": "java-html-sanitizer-stripdisallowedtags-4149cf0", + "ok": true, + "bytes_read": 9885 + }, + { + "name": "html2pdf-js-createelement-988826e", + "ok": true, + "bytes_read": 1621 + }, + { + "name": "distributed-http-get-ab72092", + "ok": true, + "bytes_read": 2426 + }, + { + "name": "beautiful-mermaid-rendernodeshape-68f3ab8", + "ok": true, + "bytes_read": 4416 + }, + { + "name": "isso-moderate-0afbfe0", + "ok": true, + "bytes_read": 5202 + }, + { + "name": "pannellum-createhotspot-9391ef8", + "ok": true, + "bytes_read": 7861 + }, + { + "name": "lxml-html-clean-call-9c5612c", + "ok": true, + "bytes_read": 16471 + }, + { + "name": "nicknames-invoke-4dde997", + "ok": true, + "bytes_read": 3206 + }, + { + "name": "vscode-lean4-replaceat-14b7a10", + "ok": true, + "bytes_read": 6711 + }, + { + "name": "express-xss-sanitizer-initializeoptions-5623009", + "ok": true, + "bytes_read": 2205 + }, + { + "name": "graby-cleanupxss-0295d82", + "ok": true, + "bytes_read": 1678 + }, + { + "name": "unhead-getstreamkey-64b5ac0", + "ok": true, + "bytes_read": 1908 + }, + { + "name": "ipl-web-postdispatch-f387e92", + "ok": true, + "bytes_read": 2430 + }, + { + "name": "livewire-markdown-editor-updatedattachments-1e60eaa", + "ok": true, + "bytes_read": 2505 + }, + { + "name": "microdot-set-cookie-99b281b", + "ok": true, + "bytes_read": 4187 + }, + { + "name": "liquidjs-strip-html-26ea285", + "ok": true, + "bytes_read": 1138 + }, + { + "name": "sveltia-cms-sanitizeentrysummary-43a6ac5", + "ok": true, + "bytes_read": 4591 + }, + { + "name": "svelte-encode-a16ebc6", + "ok": true, + "bytes_read": 3716 + }, + { + "name": "marimo-inject-service-worker-fdd55c8", + "ok": true, + "bytes_read": 5331 + }, + { + "name": "jupyterlab-git-diffheader-c6d37b8", + "ok": true, + "bytes_read": 2572 + }, + { + "name": "appium-mcp-createlocatorgeneratorui-e222bbb", + "ok": true, + "bytes_read": 9904 + }, + { + "name": "jupyterlab-updateconfig-be9303f", + "ok": true, + "bytes_read": 14052 + }, + { + "name": "file-viewer-render-ef04568", + "ok": true, + "bytes_read": 2858 + }, + { + "name": "twig-validatename-3d19a2e", + "ok": true, + "bytes_read": 1956 + }, + { + "name": "bazingajstranslationbundle-getlocales-7accee9", + "ok": true, + "bytes_read": 1647 + }, + { + "name": "nodeserver-onrequest-c4c0f01", + "ok": true, + "bytes_read": 1694 + }, + { + "name": "microweber-download-572bdc3", + "ok": true, + "bytes_read": 3554 + }, + { + "name": "binwalk-extractor-696fe34", + "ok": true, + "bytes_read": 3078 + }, + { + "name": "gatsby-onoperation-ae5a654", + "ok": true, + "bytes_read": 41337 + }, + { + "name": "codedx-plugin-checkcsvfilematches-138932b", + "ok": true, + "bytes_read": 2205 + }, + { + "name": "php-imap-fetch-88aaafb", + "ok": true, + "bytes_read": 3974 + }, + { + "name": "cypress-image-snapshot-removesnapshot-ef49519", + "ok": true, + "bytes_read": 6420 + }, + { + "name": "pf4j-extract-8e0aa19", + "ok": true, + "bytes_read": 3587 + }, + { + "name": "aws-sdk-php-buildendpoint-aebc9f8", + "ok": true, + "bytes_read": 5394 + }, + { + "name": "arrp-dumpdirect-7ea80db", + "ok": true, + "bytes_read": 2961 + }, + { + "name": "paddle-download-5c50d1a", + "ok": true, + "bytes_read": 5661 + }, + { + "name": "lektor-untrusted-to-os-path-7393d87", + "ok": true, + "bytes_read": 1112 + }, + { + "name": "unzip-stream-unzipstream-ab67989", + "ok": true, + "bytes_read": 51321 + }, + { + "name": "openapi-generator-generate-edbb021", + "ok": true, + "bytes_read": 9579 + }, + { + "name": "weave-send-local-file-f43d5fb", + "ok": true, + "bytes_read": 2171 + }, + { + "name": "solara-get-from-cache-df2fd66", + "ok": true, + "bytes_read": 2363 + }, + { + "name": "url-to-png-handleextractqueryparamsmiddleware-e4eaeca", + "ok": true, + "bytes_read": 5600 + }, + { + "name": "df-core-handleservicerequest-5435460", + "ok": true, + "bytes_read": 2927 + }, + { + "name": "simile-butterfly-getresource-537f64b", + "ok": true, + "bytes_read": 3893 + }, + { + "name": "oak-send-4b2f27e", + "ok": true, + "bytes_read": 10510 + }, + { + "name": "agentscope-delete-workflow-7d285e8", + "ok": true, + "bytes_read": 2366 + }, + { + "name": "djl-unzip-7415cc5", + "ok": true, + "bytes_read": 3927 + }, + { + "name": "carbon-resetmessages-129700e", + "ok": true, + "bytes_read": 2295 + }, + { + "name": "browsershot-seturl-e327397", + "ok": true, + "bytes_read": 1559 + }, + { + "name": "aws-sam-cli-copytree-462b4e0", + "ok": true, + "bytes_read": 4404 + }, + { + "name": "solon-find-f46e47f", + "ok": true, + "bytes_read": 3309 + }, + { + "name": "setuptools-resolve-download-filename-250a6d1", + "ok": true, + "bytes_read": 2761 + }, + { + "name": "dagster-get-notebook-data-3a3cec2", + "ok": true, + "bytes_read": 1861 + }, + { + "name": "llama-index-load-data-a86c96a", + "ok": true, + "bytes_read": 8354 + }, + { + "name": "salt-file-recv-c4ad23f", + "ok": true, + "bytes_read": 6854 + }, + { + "name": "ignite-gridlogcommandhandler-5c42c7a", + "ok": true, + "bytes_read": 8687 + }, + { + "name": "ipx-resolvefile-81693dd", + "ok": true, + "bytes_read": 2929 + }, + { + "name": "core-download-file-fe95f6e", + "ok": true, + "bytes_read": 8816 + }, + { + "name": "auth0-php-fileexists-9026da5", + "ok": true, + "bytes_read": 2059 + }, + { + "name": "tiny-scientist-review-paper-7fd4287", + "ok": true, + "bytes_read": 5297 + }, + { + "name": "vite-plugin-static-copy-vialocal-0bc6b49", + "ok": true, + "bytes_read": 3657 + }, + { + "name": "tar-fs-incwd-0bd54cd", + "ok": true, + "bytes_read": 789 + }, + { + "name": "dosage-connect-336a968", + "ok": true, + "bytes_read": 3509 + }, + { + "name": "unstructured-attachment-file-name-b01d35b", + "ok": true, + "bytes_read": 1962 + }, + { + "name": "pebble-getfile-b3451c8", + "ok": true, + "bytes_read": 2376 + }, + { + "name": "vite-plugin-react-findsourcemapurl-582fba0", + "ok": true, + "bytes_read": 5438 + }, + { + "name": "bodyparser-markasmoved-143a16f", + "ok": true, + "bytes_read": 4853 + }, + { + "name": "pnpm-getbinsfrompackagemanifest-17432ad", + "ok": true, + "bytes_read": 1830 + }, + { + "name": "wheel-unpack-7a7d2de", + "ok": true, + "bytes_read": 2468 + }, + { + "name": "openchatbi-save-report-372a7e8", + "ok": true, + "bytes_read": 4169 + }, + { + "name": "clasp-fetchremote-ba6bd66", + "ok": true, + "bytes_read": 4560 + }, + { + "name": "basic-ftp-downloadfromworkingdir-2a2a0e6", + "ok": true, + "bytes_read": 2528 + }, + { + "name": "mcp-atlassian-download-attachment-52b9b09", + "ok": true, + "bytes_read": 4661 + }, + { + "name": "bentoml-safe-extract-tarfile-4e0eb00", + "ok": true, + "bytes_read": 4817 + }, + { + "name": "dbt-common-safe-extract-e547954", + "ok": true, + "bytes_read": 2831 + }, + { + "name": "black-get-cache-key-4937fe6", + "ok": true, + "bytes_read": 3165 + }, + { + "name": "agixt-safe-join-2079ea5", + "ok": true, + "bytes_read": 2308 + }, + { + "name": "mesop-make-file-path-c6b382f", + "ok": true, + "bytes_read": 1147 + }, + { + "name": "kedro-plugins-partition-to-path-65115f7", + "ok": true, + "bytes_read": 1461 + }, + { + "name": "anthropic-sdk-typescript-validatenosymlinkescape-0ac69b3", + "ok": true, + "bytes_read": 2121 + }, + { + "name": "copier-external-data-5413062", + "ok": true, + "bytes_read": 3396 + }, + { + "name": "vite-transformmiddleware-79f002f", + "ok": true, + "bytes_read": 17975 + }, + { + "name": "nicegui-create-file-upload-d38a702", + "ok": true, + "bytes_read": 3759 + }, + { + "name": "quarkus-openapi-generator-unzip-08b4064", + "ok": true, + "bytes_read": 3177 + }, + { + "name": "excel-mcp-server-get-excel-path-f51340e", + "ok": true, + "bytes_read": 2299 + }, + { + "name": "psitransfer-getfilename-8b547bf", + "ok": true, + "bytes_read": 1356 + }, + { + "name": "pptagent-get-html-table-image-418491a", + "ok": true, + "bytes_read": 2513 + }, + { + "name": "pygeoapi-get-data-path-bf25b86", + "ok": true, + "bytes_read": 11141 + }, + { + "name": "grav-plugin-form-uploadfiles-48bacc4", + "ok": true, + "bytes_read": 17482 + }, + { + "name": "taipy-get-resource-129fd40", + "ok": true, + "bytes_read": 2241 + }, + { + "name": "jupyter-server-get-os-path-0d829f2", + "ok": true, + "bytes_read": 3868 + }, + { + "name": "apm-looks-like-legacy-apm-bundle-77d1dda", + "ok": true, + "bytes_read": 3893 + }, + { + "name": "pdm-write-to-fs-41aa5f9", + "ok": true, + "bytes_read": 3554 + }, + { + "name": "xiaomusic-music-file-88404da", + "ok": true, + "bytes_read": 5275 + }, + { + "name": "serializer-decode-0943a06", + "ok": true, + "bytes_read": 2202 + }, + { + "name": "dependency-injection-parsefile-5c5040c", + "ok": true, + "bytes_read": 3045 + }, + { + "name": "routing-loadfile-769e8e6", + "ok": true, + "bytes_read": 2825 + }, + { + "name": "silverstripe-seed-onbeforesecuritylogin-b065ebd", + "ok": true, + "bytes_read": 1468 + }, + { + "name": "urllib3-init-adb358f", + "ok": true, + "bytes_read": 2866 + }, + { + "name": "seotools-maketag-ca27cd0", + "ok": true, + "bytes_read": 1512 + }, + { + "name": "axmlrpc-parse-ad6615b", + "ok": true, + "bytes_read": 4161 + }, + { + "name": "neo4j-apoc-procedures-parsexml-c3e2a29", + "ok": true, + "bytes_read": 14813 + }, + { + "name": "keycloak-nodejs-connect-forcechecksso-190a947", + "ok": true, + "bytes_read": 4514 + }, + { + "name": "mstest-plugin-containsdata-f9b9b0c", + "ok": true, + "bytes_read": 3652 + }, + { + "name": "request-redirect-c5bcf21", + "ok": true, + "bytes_read": 5438 + }, + { + "name": "drill-xmlreader-0e88b7a", + "ok": true, + "bytes_read": 1872 + }, + { + "name": "axis-axis1-java-getservice-685c309", + "ok": true, + "bytes_read": 12130 + }, + { + "name": "cyclonedx-javascript-library-getparser-5e5e1e0", + "ok": true, + "bytes_read": 4751 + }, + { + "name": "fhir-ig-publisher-loadmappingspaces-3560de2", + "ok": true, + "bytes_read": 3636 + }, + { + "name": "fedify-lookupwebfinger-8be3c20", + "ok": true, + "bytes_read": 6166 + }, + { + "name": "local-s3-createservicefactory-d6ed756", + "ok": true, + "bytes_read": 3529 + }, + { + "name": "webdrivermanager-loadxml-125646b", + "ok": true, + "bytes_read": 1919 + }, + { + "name": "workers-oauth-provider-parseauthrequest-66de8d8", + "ok": true, + "bytes_read": 3595 + }, + { + "name": "langroid-extract-field-values-36e7e7d", + "ok": true, + "bytes_read": 6933 + }, + { + "name": "math-read-fc31c8f", + "ok": true, + "bytes_read": 1783 + }, + { + "name": "datasette-handle-404-f257ca6", + "ok": true, + "bytes_read": 9516 + }, + { + "name": "fastify-reply-from-buildurl-4d9795c", + "ok": true, + "bytes_read": 2471 + }, + { + "name": "angular-cli-joinurlparts-f086ecc", + "ok": true, + "bytes_read": 3234 + }, + { + "name": "backstage-fetchcimdmetadata-17038ab", + "ok": true, + "bytes_read": 3856 + }, + { + "name": "core-bundle-dev-app-fromurl-7904f69", + "ok": true, + "bytes_read": 4668 + } + ], + "verified": 251, + "bytes_read": 1297516 +} diff --git a/docs/deployment.md b/docs/deployment.md index 2e1d645..e022e8e 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -17,6 +17,21 @@ This page uses two words strictly: been made.** Section B is guidance, not a record. (kind runs a Kubernetes cluster inside Docker containers on one machine.) +The kind profile runs on a 7.7 GB server VM. Observability is off by default +(`kind_observability = false` in `ops/k8s/profiles/kind.toml`). This saves the measured +930 MiB used by `otel-system`, about 40% of the cluster's 2.3 GB. The smoke Run still +completes with those deployments stopped. To enable the stack, run +`OUSAST_KIND_OBSERVABILITY=1 ops/ax/up.sh` or set `kind_observability = true` in the profile. + +`up.sh` stages copied Substrate manifests in a temporary checkout view and installs through +`hack/install-ate-kind.sh`. The local `ops/ax/substrate-kind-lean/` overlay removes the collector, +Prometheus, Jaeger and their supporting resources before installation. This preserves the +installer's secret, CRD and image setup. The upstream checkout is unchanged. The shared +`ate-otel-config` disables trace, metric and log export and the OTEL SDK; it removes the old +collector endpoint and metric timing keys. On an existing cluster, `up.sh` scales the three +observability deployments to zero, replaces the ConfigMap data and rolls its consumers when +the configuration changes. Opting in restores the upstream ConfigMap and observability manifests. + ## What runs where today (implemented) ```mermaid @@ -357,7 +372,7 @@ This section answers the maintainer's questions from the code and the upstream c The decisions of 2026-10-02 set the target: **two profiles of one code base**. -- `kind` is this laptop. It stays a first-class local execution mode. Every change is proven here first. +- `kind` is this server VM. It stays a first-class local execution mode. Every change is proven here first. - `k3s` is production. (k3s is a small Kubernetes distribution.) Everything marked **planned** is not built. The rest is what runs on this host today. @@ -368,7 +383,7 @@ flowchart LR hook["ousast pre-push: local, 30 s deadline"] cli["ousast plane run, remote mode (planned)"] end - subgraph k3s ["k3s cluster (the kind profile is the same picture on one laptop)"] + subgraph k3s ["k3s cluster (the kind profile is the same picture on one server VM)"] subgraph axns ["Namespace ax-system"] axs["ax-server Deployment + Redis"] end @@ -403,7 +418,7 @@ This picture has no inbound path: - the tasks push their artifacts to the store through the egress gateway; - the CLI reads the store. -Today's EndpointSlice back to a laptop (`ops/ax/receiver-service.yaml.tmpl`) belongs to the kind +Today's EndpointSlice back to the server VM (`ops/ax/receiver-service.yaml.tmpl`) belongs to the kind profile only. It does not appear in production. ### ax, Kubernetes and Agent Substrate in three sentences diff --git a/docs/plane.md b/docs/plane.md index 45b15c1..84aec7d 100644 --- a/docs/plane.md +++ b/docs/plane.md @@ -159,7 +159,7 @@ flowchart LR ax is a Kubernetes application over Agent Substrate. Every Task runs the one runner image as an actor. Each actor occupies a whole worker. This code base targets two profiles: -- `kind` on a laptop (today). +- `kind` on a server VM (today). - `k3s` in production (planned). There the same CLI submits Runs remotely, and the tasks deliver to the S3 store. [Production topology: ax on a Kubernetes cluster](deployment.md#production-topology-ax-on-a-kubernetes-cluster) diff --git a/docs/rustfs.md b/docs/rustfs.md index 6fb7d8b..3fa2dca 100644 --- a/docs/rustfs.md +++ b/docs/rustfs.md @@ -214,3 +214,42 @@ bucket `OUSAST_MEMORY_TEST_BUCKET`, else `S3_BUCKET`. The tests: - never configure the bucket. More on the host setup: [ax on this host](ops/ax/README.md). + +## Scoped account for engine workers + +Create a **new account** for the k3s engine Deployment. Attach only this policy. +Do not give it the existing memory-store account's policies. + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "ListEnginePrefixes", + "Effect": "Allow", + "Action": "s3:ListBucket", + "Resource": "arn:aws:s3:::sast-memory", + "Condition": { + "StringLike": { + "s3:prefix": ["engine-queue/", "engine-queue/*", "engine-results/", "engine-results/*"] + } + } + }, + { + "Sid": "EngineObjectsOnly", + "Effect": "Allow", + "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"], + "Resource": [ + "arn:aws:s3:::sast-memory/engine-queue/*", + "arn:aws:s3:::sast-memory/engine-results/*" + ] + } + ] +} +``` + +The cluster can read and write only queued engine inputs, claims, and results. +It cannot list or read the rest of the memory store. It cannot change bucket +settings. The host queue dispatcher can use the same scoped account. Store its +keys in the `ousast-engine-s3` Secret; no key values belong in manifests. +Deployment and coordinator commands are in `ops/k8s/engine/README.md`. diff --git a/ops/ax/README.md b/ops/ax/README.md index 44bfad3..31b78e6 100644 --- a/ops/ax/README.md +++ b/ops/ax/README.md @@ -17,6 +17,21 @@ in `~/.cache/ousast/ax-src/`. The cluster's context, registry and pool sizes com (`ops/k8s/profiles/kind-images.json`), which the templates are re-pinned from and which is committed with them. `up.sh` and `smoke-run.sh` run the checkout's code with `OUSAST_PYTHON` (default `.venv/bin/python`). +The kind profile runs on a 7.7 GB server VM. Observability is off by default +(`kind_observability = false` in `ops/k8s/profiles/kind.toml`). This saves the measured +930 MiB used by `otel-system`, about 40% of the cluster's 2.3 GB. The smoke Run still +completes with those deployments stopped. To enable the stack, run +`OUSAST_KIND_OBSERVABILITY=1 ops/ax/up.sh` or set `kind_observability = true` in the profile. + +`up.sh` stages copied Substrate manifests in a temporary checkout view and installs through +`hack/install-ate-kind.sh`. The local `ops/ax/substrate-kind-lean/` overlay removes the collector, +Prometheus, Jaeger and their supporting resources before installation. This preserves the +installer's secret, CRD and image setup. The upstream checkout is unchanged. The shared +`ate-otel-config` disables trace, metric and log export and the OTEL SDK; it removes the old +collector endpoint and metric timing keys. On an existing cluster, `up.sh` scales the three +observability deployments to zero, replaces the ConfigMap data and rolls its consumers when +the configuration changes. Opting in restores the upstream ConfigMap and observability manifests. + ## How a Run executes A Run (`plane/runs/*.yaml`, kind `openultrasast.io/v1alpha1 Run`) is a DAG of steps; each step names an ax Task @@ -191,7 +206,7 @@ configure the bucket. No deployment outside this host's kind cluster has been made. The step-by-step guidance, with what is implemented and what is planned, is `docs/deployment.md` (the site page "Deployment"). The Model and Workspace manifests under `plane/` move as they are and the Task templates need their image reference re-pinned to your registry; these parts -assume this laptop and must change first (checked 2026-10-02): +assume this server VM and must change first (checked 2026-10-02): | Assumption | Where | Needed in a real cluster | |---|---|---| diff --git a/ops/ax/prepare-substrate.py b/ops/ax/prepare-substrate.py new file mode 100644 index 0000000..c89f9fc --- /dev/null +++ b/ops/ax/prepare-substrate.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python3 +"""Stage an installer checkout with lean kind manifests; never modify the source checkout. + +Usage: python ops/ax/prepare-substrate.py SOURCE EMPTY_DESTINATION +The destination lives only for an install/render. Source/build inputs are symlinked; +manifests are copied because the installer uses fixed paths (including the OTEL ConfigMap). +""" + +from __future__ import annotations + +import shutil +import sys +from pathlib import Path + +import yaml + + +def prepare(source: Path, destination: Path) -> None: + source = source.resolve() + destination.mkdir(parents=True, exist_ok=True) + if any(destination.iterdir()): + raise ValueError(f"staging directory must be empty: {destination}") + for entry in source.iterdir(): + if entry.name != "manifests": + (destination / entry.name).symlink_to(entry, target_is_directory=entry.is_dir()) + shutil.copytree(source / "manifests", destination / "manifests") + install = destination / "manifests/ate-install" + shutil.copytree(install / "kind", install / "kind-upstream") + overlay = Path(__file__).resolve().parent / "substrate-kind-lean" + shutil.copytree(overlay, install / "kind", dirs_exist_ok=True) + # The installer applies this file directly before it renders the bundle. + # Keep the strategic-merge directive only in the overlay's patch file. + config = yaml.safe_load((overlay / "ate-otel-config.yaml").read_text()) + config["data"].pop("$patch") + (install / "kind/disabled-otel-config.yaml").write_text(yaml.safe_dump(config)) + (install / "kind/ate-otel-config.yaml").rename(install / "kind/otel-config-patch.yaml") + (install / "kind/disabled-otel-config.yaml").rename(install / "kind/ate-otel-config.yaml") + kustomization = install / "kind/kustomization.yaml" + kustomization.write_text(kustomization.read_text().replace("path: ate-otel-config.yaml", "path: otel-config-patch.yaml")) + + +if __name__ == "__main__": + prepare(Path(sys.argv[1]), Path(sys.argv[2])) diff --git a/ops/ax/substrate-kind-lean/ate-otel-config.yaml b/ops/ax/substrate-kind-lean/ate-otel-config.yaml new file mode 100644 index 0000000..505018b --- /dev/null +++ b/ops/ax/substrate-kind-lean/ate-otel-config.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: ate-otel-config + namespace: ate-system +data: + $patch: replace + OTEL_TRACES_EXPORTER: none + OTEL_METRICS_EXPORTER: none + OTEL_LOGS_EXPORTER: none + OTEL_SDK_DISABLED: "true" diff --git a/ops/ax/substrate-kind-lean/kustomization.yaml b/ops/ax/substrate-kind-lean/kustomization.yaml new file mode 100644 index 0000000..ef1f71c --- /dev/null +++ b/ops/ax/substrate-kind-lean/kustomization.yaml @@ -0,0 +1,44 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +# prepare-substrate.py stages the upstream kind overlay beside this directory. +resources: + - ../kind-upstream +patches: + - target: + namespace: otel-system + patch: |- + $patch: delete + apiVersion: v1 + kind: ConfigMap + metadata: + name: unused + - target: + kind: Namespace + name: otel-system + patch: |- + $patch: delete + apiVersion: v1 + kind: Namespace + metadata: + name: otel-system + - target: + kind: ClusterRole + name: ate-prometheus + patch: |- + $patch: delete + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: ate-prometheus + - target: + kind: RoleBinding + name: ate-prometheus + namespace: ate-system + patch: |- + $patch: delete + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: ate-prometheus + namespace: ate-system + - path: ate-otel-config.yaml diff --git a/ops/ax/up.sh b/ops/ax/up.sh index 2d2af49..aeb3bd4 100755 --- a/ops/ax/up.sh +++ b/ops/ax/up.sh @@ -15,6 +15,7 @@ profile() { PYTHONPATH="$REPO_ROOT/src" "$PY" -m openultrasast.plane.profile --p CTX="$(profile kube_context)" # kind names its context kind- export KIND_CLUSTER_NAME="${CTX#kind-}" export KO_DOCKER_REPO="${KO_DOCKER_REPO:-$(profile registry)}" +OBSERVABILITY="$(profile kind_observability)" IMAGES_FILE="$(profile images)" # the digest pins the reconciler and the templates read SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}" @@ -37,9 +38,68 @@ else fi step "agent substrate (ate-system)" +# The upstream installer has fixed manifest paths and also creates secrets/CRDs. +# Give it a temporary checkout view so it never installs the observability resources. +install_substrate() ( + if [ "$OBSERVABILITY" = true ]; then + cd "$SRC/substrate" + else + # Symlinked build inputs must not make the staged view a different binary version. + export VERSION="${VERSION:-$(git -C "$SRC/substrate" describe --tags --always --dirty)}" + staged="$(mktemp -d)" + trap 'rm -rf "$staged"' EXIT + "$PY" "$REPO_ROOT/ops/ax/prepare-substrate.py" "$SRC/substrate" "$staged" + cd "$staged" + fi + KUBECTL_CONTEXT="$CTX" hack/install-ate-kind.sh --deploy-ate-system +) if ready ate-system; then echo "substrate ready; kept"; else - (cd "$SRC/substrate" && hack/install-ate-kind.sh --deploy-ate-system) + install_substrate fi +# Reconcile the choice even when the existing control plane is already ready. +if [ "$OBSERVABILITY" = true ]; then + for manifest in otel-collector prometheus; do + kubectl --context "$CTX" apply -f "$SRC/substrate/manifests/ate-install/kind/$manifest.yaml" + done + otel_config="$SRC/substrate/manifests/ate-install/kind/ate-otel-config.yaml" +else + otel_config="$REPO_ROOT/ops/ax/substrate-kind-lean/ate-otel-config.yaml" + for deployment in opentelemetry-collector prometheus jaeger; do + existing="$(kubectl --context "$CTX" -n otel-system get deployment "$deployment" --ignore-not-found -o name)" + if [ -n "$existing" ]; then + kubectl --context "$CTX" -n otel-system scale "$existing" --replicas=0 + fi + done + echo "kind observability off: existing otel-system deployments scaled to 0; opt in with OUSAST_KIND_OBSERVABILITY=1 ops/ax/up.sh" +fi +# Replace data to remove stale exporter/endpoint keys in either direction. ConfigMap +# envFrom is read at pod start; a content annotation triggers only changed rollouts. +otel_data="$("$PY" - "$otel_config" <<'PYCONFIG' +import json +import sys +import yaml +config = yaml.safe_load(open(sys.argv[1])) +config["data"].pop("$patch", None) +print(json.dumps(config["data"], sort_keys=True)) +PYCONFIG +)" +kubectl --context "$CTX" -n ate-system patch configmap ate-otel-config --type=json \ + -p "[{\"op\":\"replace\",\"path\":\"/data\",\"value\":$otel_data}]" +otel_hash="$(printf '%s' "$otel_data" | sha256sum | cut -d ' ' -f1)" +otel_workloads="$(kubectl --context "$CTX" -n ate-system get deployments,daemonsets -o json | "$PY" -c ' +import json, sys +for item in json.load(sys.stdin)["items"]: + spec = item["spec"]["template"]["spec"] + containers = spec.get("containers", []) + spec.get("initContainers", []) + if any(env.get("configMapRef", {}).get("name") == "ate-otel-config" + for container in containers for env in container.get("envFrom", [])): + print(item["kind"].lower() + "/" + item["metadata"]["name"]) +')" +for workload in $otel_workloads; do + kubectl --context "$CTX" -n ate-system patch "$workload" --type=merge \ + -p "{\"spec\":{\"template\":{\"metadata\":{\"annotations\":{\"ousast.io/otel-config\":\"$otel_hash\"}}}}}" + kubectl --context "$CTX" -n ate-system rollout status "$workload" --timeout=300s +done kubectl --context "$CTX" -n ate-system get pods step "egress gateway (atenet-egress, agentgateway variant: one prebuilt image, nothing built)" diff --git a/ops/k8s/engine/README.md b/ops/k8s/engine/README.md new file mode 100644 index 0000000..09fa086 --- /dev/null +++ b/ops/k8s/engine/README.md @@ -0,0 +1,85 @@ +# Engine workers on k3s + +Build the new **Engine image** workflow on main (or dispatch it), then copy its +`ghcr.io//openultrasast@sha256:...` job-summary value. The old September +image does not include boto3 or this service. The release workflow still builds +version tags. The Dockerfile copies the worker and parser under `/app/benchmarks/learn` +and installs `.[semantic,s3]`; no analyzer tarball is sent by the dispatcher. + +Use two schedulable nodes with at least 3 GiB available each. Required hostname +anti-affinity places one worker on each node. Updates use Recreate so a third +worker does not wait forever for a third node. Local scratch uses the container's +filesystem, with no host mount or Kubernetes API access. + +Create a **new scoped account** using the policy in `docs/rustfs.md`. Export its +`S3_ENDPOINT`, `S3_BUCKET=sast-memory`, `AWS_ACCESS_KEY_ID`, and +`AWS_SECRET_ACCESS_KEY` in the coordinator shell. Do not use the memory-store +account. The following commands are for the coordinator; they were not run by the +implementation agent. + +```sh +export ENGINE_IMAGE='ghcr.io//openultrasast@sha256:' +# From the repository root, edit the digest parameter without changing the template: +export ENGINE_OVERLAY="$(mktemp -d /tmp/ousast-engine.XXXXXX)" +cp ops/k8s/engine/{namespace,deployment,kustomization}.yaml "$ENGINE_OVERLAY/" +python - <<'PY' +import os +from pathlib import Path +image, digest = os.environ['ENGINE_IMAGE'].split('@', 1) +p = Path(os.environ['ENGINE_OVERLAY']) / 'kustomization.yaml' +p.write_text(p.read_text().replace('ghcr.io/OWNER/openultrasast', image) + .replace('sha256:REPLACE_WITH_ENGINE_IMAGE_DIGEST', digest)) +PY +kubectl apply -f ops/k8s/engine/namespace.yaml +kubectl -n ousast-engine create secret generic ousast-engine-s3 \ + --from-literal=S3_ENDPOINT="$S3_ENDPOINT" \ + --from-literal=S3_BUCKET="$S3_BUCKET" \ + --from-literal=AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" \ + --from-literal=AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" +kubectl apply -k "$ENGINE_OVERLAY" +kubectl -n ousast-engine rollout status deployment/ousast-engine-worker +kubectl -n ousast-engine get pods -o wide + +export PATH=/home/mc/Source/OpenUltraSAST/.venv/bin:$PATH +export PYTHONPATH="$PWD/src" +python benchmarks/learn/engine_trace.py --queue-status +python benchmarks/learn/engine_trace.py --executor queue \ + --image "$ENGINE_IMAGE" --parallel 2 --deadline 900 --queue-timeout 3600 \ + --units plane/experiments/exp-005-graph-slice.units.jsonl \ + --out "$HOME/ousast-results/plane/engine-trace-queue" +``` + +The dispatcher uses the existing local memory examples by default. Add +`--examples /path/to/examples.jsonl` for a frozen example snapshot. Materialization +uses locally cached source pins, just as the Docker executor does. `--executor +k8s-jobs` preserves the old Job lane (`k8s` is its legacy alias); `queue` requires +no kubectl access. Resume skips completed local units and retries failed or timed +out units. `progress.json`, `STOP`, filtering, and `--summary` retain their existing +meaning. Each invocation uses a new run ID, so an old remote result cannot satisfy +a new retry. The dispatcher records worker and pod identity in each pin JSON. + +Tasks contain the pin, units, prepared questions, source object key, and deadlines. +Results live at `engine-results//.json`; inputs are removed after +publication. The Docker lane retains JSON and a log, not a result tar, so the queue +also returns JSON. Queue timeout records timeout locally and removes pending; +an already claimed task finishes remotely and cleans its input. Orphaned inputs +from a failed submission can be removed under `engine-queue/inputs/` after checking +that no pending task or claim references them. + +Claims use per-worker choosing markers followed by ordered tickets. A worker waits +for choosing peers and every lower ticket before removing pending and starting. +This requires strongly consistent GET/PUT/LIST from RustFS, including paginated +LIST, and synchronized node clocks with skew below 30 seconds. Half of the 60-second lease margin is reserved for clock +skew; the remaining execution budget is checked again after claiming. +It does not require conditional writes, object tags, S3 Select, or bucket-admin +permissions. A dead worker's task is recovered from its expired claim. Execution +runs in a child process. Linux subreaping and a frozen descendant walk kill its +entire tree, including Joern's separate sessions, at the task deadline before the +lease expires. As with any unfenced lease, a node suspended beyond its lease must be +terminated before it rejoins; the protocol cannot guarantee exclusivity against +arbitrary process suspension or an inconsistent object store. + +SIGTERM stops new claims and lets the current task finish. The 900-second +termination grace matches the maximum task deadline. Keep these values aligned +if changing the deployment. `/healthz` serves both probes and becomes unready on +shutdown. Errors omit SDK exception text to avoid exposing credentials. diff --git a/ops/k8s/engine/deployment.yaml b/ops/k8s/engine/deployment.yaml new file mode 100644 index 0000000..e51806c --- /dev/null +++ b/ops/k8s/engine/deployment.yaml @@ -0,0 +1,63 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ousast-engine-worker +spec: + replicas: 2 + strategy: + type: Recreate + selector: + matchLabels: + app: ousast-engine-worker + template: + metadata: + labels: + app: ousast-engine-worker + spec: + automountServiceAccountToken: false + terminationGracePeriodSeconds: 900 + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app: ousast-engine-worker + topologyKey: kubernetes.io/hostname + containers: + - name: worker + image: engine-image + command: [python, /app/benchmarks/learn/engine_worker_service.py] + envFrom: + - secretRef: + name: ousast-engine-s3 + env: + - name: ENGINE_IMAGE + value: engine-image + resources: + requests: + memory: 3Gi + cpu: '1' + limits: + memory: 3Gi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: [ALL] + ports: + - name: health + containerPort: 8080 + readinessProbe: + httpGet: + path: /healthz + port: health + periodSeconds: 5 + livenessProbe: + httpGet: + path: /healthz + port: health + initialDelaySeconds: 15 + periodSeconds: 10 diff --git a/ops/k8s/engine/kustomization.yaml b/ops/k8s/engine/kustomization.yaml new file mode 100644 index 0000000..40b4c96 --- /dev/null +++ b/ops/k8s/engine/kustomization.yaml @@ -0,0 +1,22 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: ousast-engine +resources: + - namespace.yaml + - deployment.yaml +# Deliberately non-pullable until the coordinator supplies the workflow's digest. +images: + - name: engine-image + newName: ghcr.io/OWNER/openultrasast + digest: sha256:REPLACE_WITH_ENGINE_IMAGE_DIGEST +replacements: + - source: + kind: Deployment + name: ousast-engine-worker + fieldPath: spec.template.spec.containers.0.image + targets: + - select: + kind: Deployment + name: ousast-engine-worker + fieldPaths: + - spec.template.spec.containers.0.env.0.value diff --git a/ops/k8s/engine/namespace.yaml b/ops/k8s/engine/namespace.yaml new file mode 100644 index 0000000..922b151 --- /dev/null +++ b/ops/k8s/engine/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: ousast-engine diff --git a/ops/k8s/engine/secret.example.yaml b/ops/k8s/engine/secret.example.yaml new file mode 100644 index 0000000..2d05b93 --- /dev/null +++ b/ops/k8s/engine/secret.example.yaml @@ -0,0 +1,9 @@ +# Reference only; excluded from kustomization. Create using the README command. +apiVersion: v1 +kind: Secret +metadata: + name: ousast-engine-s3 + namespace: ousast-engine +type: Opaque +stringData: {} +# Required keys: S3_ENDPOINT, S3_BUCKET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY diff --git a/ops/k8s/profiles/kind-images.json b/ops/k8s/profiles/kind-images.json index b27d47b..b5bb4ba 100644 --- a/ops/k8s/profiles/kind-images.json +++ b/ops/k8s/profiles/kind-images.json @@ -1,3 +1,3 @@ { - "runner": "localhost:5001/ousast-runner@sha256:d2a55293999cc34581ef1f02a1ffb0c2dd8fc0cbe001ac952df81600e868f019" + "runner": "localhost:5001/ousast-runner@sha256:784bc6afc869c679c4966d04d3f9653a8d379726b899809590cc83327f4038e3" } diff --git a/ops/k8s/profiles/kind.toml b/ops/k8s/profiles/kind.toml index e383696..58b2206 100644 --- a/ops/k8s/profiles/kind.toml +++ b/ops/k8s/profiles/kind.toml @@ -1,8 +1,9 @@ -# The kind profile: the plane on this laptop's single-node kind cluster, which ops/ax/up.sh creates and which is +# The kind profile: the plane on this server VM's single-node kind cluster, which ops/ax/up.sh creates and which is # the development default (plane-on-kubernetes design section 1). Values only; a credential never goes here # (keys stay in the environment or .env). Every field is overridable by OUSAST_ in the environment, a pool # by OUSAST_POOL__. This file may name the kind cluster; the code must not (tests/test_plane_literals.py). +kind_observability = false # opt in with OUSAST_KIND_OBSERVABILITY=1 exec = "local" # the reconciler runs on this host against the cluster below kube_context = "kind-ousast" # kind's context for KIND_CLUSTER_NAME=ousast registry = "localhost:5001" # the kind-local registry up.sh creates (Substrate rewrites it for the node) diff --git a/src/openultrasast/learn/sources.toml b/src/openultrasast/learn/sources.toml index fd22069..42ca283 100644 --- a/src/openultrasast/learn/sources.toml +++ b/src/openultrasast/learn/sources.toml @@ -82,6 +82,18 @@ recorded = "2026-10-03" status = "development" exclude_tiers = ["title"] +# Batch 3: more advisory fixes whose function survives the fix, weighted toward injection and untrusted_destination. +# Same slice, cache layout and checks; screening record +# benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json. +[[source]] +id = "advisory-fixes-3" +kind = "pairs" +file = "benchmarks/pairs/advisory-fixes-3/catalog.toml" +evaluation = ["benchmarks/pairs/advisory-fixes-3/verification.json"] +recorded = "2026-10-04" +status = "development" +exclude_tiers = ["title"] + [[source]] id = "adjudications" kind = "adjudications" diff --git a/src/openultrasast/plane/profile.py b/src/openultrasast/plane/profile.py index d7a752c..db726db 100644 --- a/src/openultrasast/plane/profile.py +++ b/src/openultrasast/plane/profile.py @@ -1,6 +1,6 @@ """The plane's configuration surface: one ``PlaneProfile`` per cluster (plane-on-kubernetes design section 1). -A profile is a TOML file under ``ops/k8s/profiles/`` (``kind.toml`` for the laptop's kind cluster, ``k3s.toml`` for +A profile is a TOML file under ``ops/k8s/profiles/`` (``kind.toml`` for the server VM's kind cluster, ``k3s.toml`` for the production cluster) holding every value that differs between clusters: the execution mode, the kube context, the registry and the digest-pinned images file, the router and ax-server addresses (empty: tunnel through the Kubernetes API), the memory store, the atespace, ax's snapshot bucket, the worker pools and the image pull secret. @@ -59,6 +59,7 @@ class PlaneProfile: name: str path: Path exec: str = "local" + kind_observability: bool = False kube_context: str = "" registry: str = "" images: Path = Path("images.json") @@ -135,6 +136,10 @@ def _reject_secret(where: str, key: str, value: object, declared: bool = False) def _coerce(where: str, key: str, value: object, kind: str) -> Any: + if kind == "bool": + if not isinstance(value, bool): + raise ProfileError(f"{where}: {key} must be a boolean, got {value!r}") + return value if kind == "int": if isinstance(value, bool) or not isinstance(value, int): raise ProfileError(f"{where}: {key} must be an integer, got {value!r}") @@ -172,6 +177,10 @@ def _env_overrides(environ: Mapping[str, str], where: str, values: dict[str, Any raw = environ.get(_ENV_PREFIX + name.upper()) if raw is not None and raw != "": value: Any = raw + if kind == "bool": + if raw.lower() not in ("true", "false", "1", "0"): + raise ProfileError(f"{where}: {_ENV_PREFIX}{name.upper()} must be true/false or 1/0, got {raw!r}") + value = raw.lower() in ("true", "1") if kind == "int": try: value = int(raw) @@ -241,7 +250,8 @@ def _lookup(profile: PlaneProfile, dotted: str) -> str: return str(getattr(profile.pools[pool_name], key)) if head not in _SCALARS or rest: raise ProfileError(f"{profile.path}: no such field {dotted!r}") - return str(getattr(profile, head)) + value = getattr(profile, head) + return str(value).lower() if isinstance(value, bool) else str(value) def main(argv: list[str] | None = None) -> int: diff --git a/tests/test_advisory_fix_pairs.py b/tests/test_advisory_fix_pairs.py index f4a5219..fb8134d 100644 --- a/tests/test_advisory_fix_pairs.py +++ b/tests/test_advisory_fix_pairs.py @@ -21,8 +21,9 @@ from openultrasast.pairs import load_pair_catalog ROOT = Path(__file__).resolve().parents[1] PAIRS = ROOT / "benchmarks" / "pairs" -# batch 1 (2026-10-01) and batch 2 (2026-10-03, functions that survive the fix): one source each, same rules -BATCHES = {"advisory-fixes": PAIRS / "advisory-fixes", "advisory-fixes-2": PAIRS / "advisory-fixes-2"} +# batch 1 (2026-10-01), batches 2 (2026-10-03) and 3 (2026-10-04, functions that survive the fix): one source each, +# same rules +BATCHES = {name: PAIRS / name for name in ("advisory-fixes", "advisory-fixes-2", "advisory-fixes-3")} SHA = re.compile(r"[0-9a-f]{40}") PERMISSIVE_OR_COPYLEFT = re.compile( r"^(MIT|BSD-[23]-Clause|Apache-2\.0|ISC|Zlib|0BSD|Unlicense|MPL-[12]\.[01]" @@ -106,10 +107,18 @@ def test_no_pair_repeats_a_repository_the_benchmarks_already_name(source_id: str PERMISSIVE = {"MIT", "BSD-2-Clause", "BSD-3-Clause", "Apache-2.0", "ISC", "MPL-2.0", "Unlicense"} -def test_batch_two_is_permissive_and_dated_against_the_cutoff() -> None: - """Batch 2 publishes permissive licences only and records each advisory's publication against the 2026-06-01 +@pytest.mark.parametrize(("source_id", "batch"), [("advisory-fixes-2", "2026-10-03"), ("advisory-fixes-3", "2026-10-04")]) +def test_later_batches_are_permissive_and_dated_against_the_cutoff(source_id: str, batch: str) -> None: + """Batches 2 and 3 publish permissive licences only and record each advisory's publication against the 2026-06-01 cutoff, so memorisation can be measured on the post-cutoff pairs.""" - for item in _raw(BATCHES["advisory-fixes-2"]): + for item in _raw(BATCHES[source_id]): assert item["license"] in PERMISSIVE, item["name"] - assert item["batch"] == "2026-10-03", item["name"] + assert item["batch"] == batch, item["name"] assert item["post_cutoff"] is (item["published_at"][:10] >= "2026-06-01"), item["name"] + + +def test_no_repository_repeats_across_batches() -> None: + seen: Counter[str] = Counter() + for folder in BATCHES.values(): + seen.update({repo_name(item["repo"]) for item in _raw(folder)}) + assert [repo for repo, n in seen.items() if n > 1] == [] diff --git a/tests/test_ax_lean.py b/tests/test_ax_lean.py new file mode 100644 index 0000000..05f6c74 --- /dev/null +++ b/tests/test_ax_lean.py @@ -0,0 +1,130 @@ +"""Offline overlay contract and installer staging; no Kubernetes executable needed.""" + +from __future__ import annotations + +import runpy +from pathlib import Path + +import pytest +import yaml + +ROOT = Path(__file__).resolve().parents[1] +OVERLAY = ROOT / "ops/ax/substrate-kind-lean" +DISABLED = { + "OTEL_TRACES_EXPORTER": "none", + "OTEL_METRICS_EXPORTER": "none", + "OTEL_LOGS_EXPORTER": "none", + "OTEL_SDK_DISABLED": "true", +} + + +def test_ax_lean_overlay_removes_observability_and_replaces_export_config() -> None: + overlay = yaml.safe_load((OVERLAY / "kustomization.yaml").read_text()) + assert overlay["resources"] == ["../kind-upstream"] + deletes = [p for p in overlay["patches"] if "target" in p] + assert [p["target"] for p in deletes] == [ + {"namespace": "otel-system"}, + {"kind": "Namespace", "name": "otel-system"}, + {"kind": "ClusterRole", "name": "ate-prometheus"}, + {"kind": "RoleBinding", "name": "ate-prometheus", "namespace": "ate-system"}, + ] + assert all(yaml.safe_load(p["patch"])["$patch"] == "delete" for p in deletes) + config = yaml.safe_load((OVERLAY / overlay["patches"][-1]["path"]).read_text()) + assert config["metadata"] == {"name": "ate-otel-config", "namespace": "ate-system"} + # Whole-data replacement drops the upstream endpoint, interval and timeout, + # including any future keys that would otherwise survive a merge. + assert config["data"] == {"$patch": "replace", **DISABLED} + + +def test_ax_staging_preserves_upstream_and_installer_prerequisites(tmp_path: Path) -> None: + prepare = runpy.run_path(str(ROOT / "ops/ax/prepare-substrate.py"))["prepare"] + source = tmp_path / "source" + kind = source / "manifests/ate-install/kind" + kind.mkdir(parents=True) + original = "resources: [otel-collector.yaml, prometheus.yaml, ate-otel-config.yaml]\n" + (kind / "kustomization.yaml").write_text(original) + (kind / "ate-otel-config.yaml").write_text("upstream config") + (kind / "postgres").mkdir() + (kind / "postgres/kustomization.yaml").write_text("resources: [../../postgres]\n") + (source / "go.mod").write_text("module test\n") + (source / "hack").mkdir() + (source / "hack/install-ate-kind.sh").write_text("upstream installer") + stage = tmp_path / "stage" + prepare(source, stage) + install = stage / "manifests/ate-install" + assert (install / "kind-upstream/kustomization.yaml").read_text() == original + assert (install / "kind/postgres/kustomization.yaml").read_text() == "resources: [../../postgres]\n" + assert (kind / "kustomization.yaml").read_text() == original + assert (kind / "ate-otel-config.yaml").read_text() == "upstream config" + assert (stage / "hack/install-ate-kind.sh").read_text() == "upstream installer" + assert (stage / "go.mod").is_symlink() + config = yaml.safe_load((install / "kind/ate-otel-config.yaml").read_text()) + assert config["data"] == DISABLED # direct installer apply must not contain $patch + overlay = yaml.safe_load((install / "kind/kustomization.yaml").read_text()) + patch = yaml.safe_load((install / "kind" / overlay["patches"][-1]["path"]).read_text()) + assert patch["data"] == {"$patch": "replace", **DISABLED} + with pytest.raises(ValueError, match="must be empty"): + prepare(source, stage) + + +@pytest.mark.parametrize("enabled", [False, True]) +@pytest.mark.parametrize("existing", [False, True]) +def test_ax_reconciles_observability_on_ready_clusters(tmp_path: Path, enabled: bool, existing: bool) -> None: + """Execute the reconciliation shell with a function double, never real kubectl.""" + import json + import os + import subprocess + import sys + + script = (ROOT / "ops/ax/up.sh").read_text() + section = script.split("# Reconcile the choice", 1)[1].split('kubectl --context "$CTX" -n ate-system get pods', 1)[0] + section = "# Reconcile the choice" + section + source = tmp_path / "substrate/manifests/ate-install/kind" + source.mkdir(parents=True) + upstream_data = {"OTEL_EXPORTER_OTLP_ENDPOINT": "http://collector:4317", "OTEL_LOGS_EXPORTER": "otlp"} + (source / "ate-otel-config.yaml").write_text(yaml.safe_dump({"data": upstream_data})) + log = tmp_path / "calls" + consumer = { + "kind": "Deployment", + "metadata": {"name": "ate-controller"}, + "spec": {"template": {"spec": {"containers": [{"envFrom": [{"configMapRef": {"name": "ate-otel-config"}}]}]}}}, + } + nonconsumer = {"kind": "Deployment", "metadata": {"name": "unrelated"}, "spec": {"template": {"spec": {"containers": []}}}} + mock = """ +set -euo pipefail +kubectl() { + printf '%s\\t' "$@" >> "$CALL_LOG" + printf '\\n' >> "$CALL_LOG" + case " $* " in + *" get deployment "*) + if [ "$EXISTING" = 1 ]; then printf 'deployment.apps/%s\\n' "$7"; fi ;; + *" get deployments,daemonsets "*) printf '%s' "$WORKLOADS" ;; + esac + return 0 +} +""" + env = { + **os.environ, + "OBSERVABILITY": str(enabled).lower(), + "EXISTING": str(int(existing)), + "PY": sys.executable, + "CTX": "test-context", + "SRC": str(tmp_path), + "REPO_ROOT": str(ROOT), + "CALL_LOG": str(log), + "WORKLOADS": json.dumps({"items": [consumer, nonconsumer]}), + } + result = subprocess.run(["bash", "-c", mock + section], env=env, text=True, capture_output=True) + assert result.returncode == 0, result.stderr + calls = [line.rstrip("\t").split("\t") for line in log.read_text().splitlines()] + scales = [call for call in calls if "scale" in call] + assert len(scales) == (3 if existing and not enabled else 0) + assert all(call[-1] == "--replicas=0" for call in scales) + applies = [call for call in calls if "apply" in call] + assert len(applies) == (2 if enabled else 0) + config_patch = next(call[-1] for call in calls if "configmap" in call) + assert json.loads(config_patch) == [{"op": "replace", "path": "/data", "value": upstream_data if enabled else DISABLED}] + assert not any("deployment/unrelated" in call for call in calls) + assert any("deployment/ate-controller" in call for call in calls) + if not enabled: + assert "OUSAST_KIND_OBSERVABILITY=1" in result.stdout diff --git a/tests/test_engine_queue.py b/tests/test_engine_queue.py new file mode 100644 index 0000000..9ac55af --- /dev/null +++ b/tests/test_engine_queue.py @@ -0,0 +1,290 @@ +"""Offline queue protocol, image imports and deployment contract controls.""" + +from __future__ import annotations + +import importlib +import json +import os +import subprocess +import sys +import threading +import time +from concurrent.futures import ThreadPoolExecutor +from pathlib import Path +from types import SimpleNamespace + +import pytest +import yaml + +ROOT = Path(__file__).resolve().parents[1] +with pytest.MonkeyPatch.context() as patch: + patch.syspath_prepend(str(ROOT / "benchmarks/learn")) + service = importlib.import_module("engine_worker_service") + transport = importlib.import_module("engine_trace_queue") + + +class FakeS3: + def __init__(self): + self.objects = {} + self.lock = threading.Lock() + self.choosing = None + + def get(self, key): + with self.lock: + return (self.objects[key], None) if key in self.objects else None + + def put(self, key, data, labels): + with self.lock: + self.objects[key] = data + if self.choosing and key.startswith(service.CLAIMED) and json.loads(data)["ticket"] == 0: + self.choosing.wait(timeout=5) + + def delete(self, key): + with self.lock: + self.objects.pop(key, None) + + def keys(self, prefix): + with self.lock: + return sorted(k for k in self.objects if k.startswith(prefix)) + + +def task(): + return dict( + run="run", + id="pin", + task_id="run-pin", + input="engine-queue/inputs/run/pin/source.tar", + deadline=10, + question_deadline=2, + pin={"repo": "owner/repo", "pin": "commit", "units": []}, + ) + + +def test_engine_worker_racing_claimants_run_exactly_once(): + store = FakeS3() + item = task() + service.put(store, service.PENDING + item["task_id"], item) + store.choosing = threading.Barrier(2) + called = [] + + def execute(client, entry): + called.append(entry["task_id"]) + time.sleep(0.05) + return {**entry["pin"], "done": True, "instrument": {"bytes": 11}} + + with ThreadPoolExecutor(2) as pool: + futures = [pool.submit(service.Queue(store, identity).process_one, execute) for identity in ["worker-b", "worker-a"]] + results = [f.result(timeout=10) for f in futures] + assert sum(results) == 1 + assert called == ["run-pin"] + result = service.read(store, service.result_key(item)) + assert result["worker"] in {"worker-a", "worker-b"} + assert not store.keys(service.CLAIMED) + assert not store.keys(service.PENDING) + + +def test_engine_worker_expired_lease_recovered_without_pending(): + store = FakeS3() + item = task() + service.put(store, "engine-queue/claimed/dead/run-pin", dict(task=item, ticket=1, expires=99)) + queue = service.Queue(store, "new", now=lambda: 100) + assert queue.process_one(lambda *_: {**item["pin"], "done": True}) + assert service.read(store, service.result_key(item))["worker"] == "new" + assert not store.keys(service.CLAIMED) + + +def test_engine_worker_late_arrival_cannot_displace_running_owner(): + store = FakeS3() + item = task() + first = service.Queue(store, "z-first") + key = first.claim(item) + assert key + stop = threading.Event() + later = service.Queue(store, "a-later", stop=stop) + with ThreadPoolExecutor(1) as pool: + future = pool.submit(later.claim, item) + assert future.result(timeout=3) is None + assert service.read(store, key) is not None + service.put(store, service.result_key(item), {"done": True}) + store.delete(key) + + +def test_engine_queue_dispatch_roundtrip_and_timeout(tmp_path): + store = FakeS3() + checkout, output = tmp_path / "case", tmp_path / "out" + checkout.mkdir() + output.mkdir() + (checkout / "app.py").write_text("print(1)\n") + args = SimpleNamespace(deadline=10, question_deadline=2, queue_timeout=2, image="image@sha256:abc") + unit = {"unit": "u", "supported": True, "reason": "", "family": "injection"} + pin = {"repo": "owner/repo", "pin": "sha", "units": [unit], "questions": []} + + def execute(client, item): + unpacked = tmp_path / "unpacked" + unpacked.mkdir() + service.unpack(client.get(item["input"])[0], unpacked) + assert (unpacked / "app.py").read_bytes() == b"print(1)\n" + return { + **item["pin"], + "done": True, + "container_exit": 0, + "units": [service.unit_record(unit, "asked-nothing")], + "instrument": {"bytes": 9, "heap_mb": 2560}, + } + + queue = service.Queue(store, "pod-1") + dispatcher = transport.Dispatcher(args, store, pause=lambda _: queue.process_one(execute)) + completed, worker = dispatcher.execute(checkout, output, pin, "pin") + assert completed.returncode == 0 + assert worker == "pod-1" + result = json.loads((output / "result.json").read_text()) + assert result["executor"] == "queue" + assert result["units"][0]["status"] == "asked-nothing" + assert result["instrument"]["heap_mb"] == 2560 + assert dispatcher.status() == {"pending": 0, "claimed": 0, "done": 1} + assert not store.keys("engine-queue/inputs/") + ticks = iter([0, 3]) + dispatcher = transport.Dispatcher(args, store, clock=lambda: next(ticks)) + assert dispatcher.execute(checkout, output, pin, "other") == (None, None) + assert not store.keys(service.PENDING) + + +def test_engine_worker_imports_without_yaml(): + code = "import sys; sys.modules['yaml'] = None; import engine_worker_service; import engine_trace_worker" + done = subprocess.run( + [sys.executable, "-c", code], + capture_output=True, + text=True, + env={**os.environ, "PYTHONPATH": f"{ROOT / 'src'}:{ROOT / 'benchmarks/learn'}"}, + ) + assert done.returncode == 0, done.stderr + + +def test_engine_k8s_render_contract(): + base = ROOT / "ops/k8s/engine" + config = yaml.safe_load((base / "kustomization.yaml").read_text()) + # Render this base's resource inclusion, namespace, image and replacement transforms offline. + resources = [yaml.safe_load((base / name).read_text()) for name in config["resources"]] + deployment = next(r for r in resources if r["kind"] == "Deployment") + deployment["metadata"]["namespace"] = config["namespace"] + image = config["images"][0] + pod = deployment["spec"]["template"]["spec"] + container = pod["containers"][0] + assert container["image"] == image["name"] + container["image"] = image["newName"] + "@" + image["digest"] + replacement = config["replacements"][0] + assert replacement["source"]["fieldPath"] == "spec.template.spec.containers.0.image" + assert replacement["targets"][0]["fieldPaths"] == ["spec.template.spec.containers.0.env.0.value"] + container["env"][0]["value"] = container["image"] + assert "@sha256:" in container["image"] + assert deployment["spec"]["replicas"] == 2 + assert container["resources"] == {"requests": {"memory": "3Gi", "cpu": "1"}, "limits": {"memory": "3Gi"}} + affinity = pod["affinity"]["podAntiAffinity"]["requiredDuringSchedulingIgnoredDuringExecution"][0] + assert affinity["topologyKey"] == "kubernetes.io/hostname" + assert affinity["labelSelector"]["matchLabels"] == deployment["spec"]["template"]["metadata"]["labels"] + assert pod["terminationGracePeriodSeconds"] == 900 + assert container["envFrom"] == [{"secretRef": {"name": "ousast-engine-s3"}}] + for probe in ["readinessProbe", "livenessProbe"]: + assert container[probe]["httpGet"] == {"path": "/healthz", "port": "health"} + assert not pod["automountServiceAccountToken"] + assert pod["securityContext"]["runAsNonRoot"] + assert "hostPath" not in json.dumps(resources) + assert "privileged" not in json.dumps(resources) + assert all(r["kind"] != "Secret" for r in resources) + secret = yaml.safe_load((base / "secret.example.yaml").read_text()) + assert secret["stringData"] == {} + assert "AWS_SECRET_ACCESS_KEY" not in json.dumps(resources) + + +def test_engine_image_and_rustfs_policy(): + dockerfile = (ROOT / "Dockerfile").read_text() + assert "COPY benchmarks ./benchmarks" in dockerfile + assert ".[semantic,s3]" in dockerfile + for name in ["engine_trace_worker.py", "engine_trace_parse.py", "engine_worker_service.py"]: + assert (ROOT / "benchmarks/learn" / name).stat().st_size > 0 + doc = (ROOT / "docs/rustfs.md").read_text().split("## Scoped account for engine workers")[1] + policy = json.loads(doc.split("```json\n")[1].split("```")[0]) + listing, objects = policy["Statement"] + assert listing["Action"] == "s3:ListBucket" + assert set(listing["Condition"]["StringLike"]["s3:prefix"]) == { + "engine-queue/", + "engine-queue/*", + "engine-results/", + "engine-results/*", + } + assert set(objects["Action"]) == {"s3:GetObject", "s3:PutObject", "s3:DeleteObject"} + assert set(objects["Resource"]) == {"arn:aws:s3:::sast-memory/engine-queue/*", "arn:aws:s3:::sast-memory/engine-results/*"} + + +@pytest.mark.parametrize("hang", [False, True]) +def test_engine_worker_process_deadline_and_shipped_schema(tmp_path, monkeypatch, hang): + store = FakeS3() + item = task() + item["image"] = "image@sha256:abc" + item["deadline"] = 0.1 if hang else 5 + item["pin"]["units"] = [{"unit": "u", "supported": True, "reason": ""}] + (tmp_path / "app.py").write_text("print(1)\n") + store.put(item["input"], service.pack(tmp_path), {}) + monkeypatch.setenv("ENGINE_IMAGE", item["image"]) + + def fake_worker(pin, root, out, deadline, question_deadline): + assert (root / "app.py").read_bytes() == b"print(1)\n" + if hang: + time.sleep(10) + out.write_text(json.dumps({**pin, "done": True, "units": [service.unit_record(pin["units"][0], "asked-nothing")]})) + + monkeypatch.setattr(service, "worker", fake_worker) + result = service.execute_task(store, item) + assert result["done"] + assert result["units"][0]["status"] == ("timeout" if hang else "asked-nothing") + assert result["container_exit"] == (None if hang else 0) + assert result["seconds"] < 5 + + +def test_engine_worker_stopping_does_not_claim(): + store = FakeS3() + item = task() + service.put(store, service.PENDING + item["task_id"], item) + stop = threading.Event() + stop.set() + assert not service.Queue(store, stop=stop).process_one(lambda *_: pytest.fail("claimed after SIGTERM")) + assert store.keys(service.PENDING) + assert not store.keys(service.CLAIMED) + + +def test_engine_worker_rejects_archive_links_and_escape(tmp_path): + import io + import tarfile + + for name, kind in [("../escape", tarfile.REGTYPE), ("link", tarfile.SYMTYPE)]: + stream = io.BytesIO() + with tarfile.open(fileobj=stream, mode="w") as archive: + member = tarfile.TarInfo(name) + member.type = kind + member.linkname = "/etc/passwd" + archive.addfile(member) + with pytest.raises(ValueError, match="unsafe source archive"): + service.unpack(stream.getvalue(), tmp_path) + + +def test_engine_worker_timeout_kills_separate_session_descendant(tmp_path, monkeypatch): + store = FakeS3() + item = task() + item.update(image="image@sha256:abc", deadline=0.5) + item["pin"]["units"] = [{"unit": "u", "supported": True, "reason": ""}] + (tmp_path / "app.py").write_text("print(1)\n") + store.put(item["input"], service.pack(tmp_path), {}) + monkeypatch.setenv("ENGINE_IMAGE", item["image"]) + pid_file = tmp_path / "escaped-pid" + + def fake_worker(*_): + child = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"], start_new_session=True) + pid_file.write_text(str(child.pid)) + time.sleep(30) + + monkeypatch.setattr(service, "worker", fake_worker) + result = service.execute_task(store, item) + assert result["units"][0]["status"] == "timeout" + assert pid_file.exists(), "instrument: fake worker never launched its descendant" + pid = int(pid_file.read_text()) + assert not Path(f"/proc/{pid}").exists(), "escaped session survived the task deadline" diff --git a/tests/test_engine_trace.py b/tests/test_engine_trace.py index 27075a2..914f117 100644 --- a/tests/test_engine_trace.py +++ b/tests/test_engine_trace.py @@ -14,7 +14,6 @@ import pytest from openultrasast.cpg.backend import BEGIN, END, CpgResult, JoernBackend from openultrasast.model.specs import taint_specs from openultrasast.model.taint import request_params -from openultrasast.model.trace import parse_trace SCRIPT = Path(__file__).resolve().parents[1] / "benchmarks/learn/engine_trace.py" _spec = importlib.util.spec_from_file_location("engine_trace", SCRIPT) @@ -22,6 +21,8 @@ assert _spec and _spec.loader trace = importlib.util.module_from_spec(_spec) with pytest.MonkeyPatch.context() as patch: patch.syspath_prepend(str(SCRIPT.parent)) + from engine_trace_parse import parse_trace + _spec.loader.exec_module(trace) worker = sys.modules["engine_trace_worker"] @@ -304,6 +305,7 @@ def test_docker_command_is_serial_offline_frozen(): assert cmd[-1] == "60" assert "/frozen/benchmarks/learn/engine_trace_worker.py" in cmd assert "benchmarks/learn/engine_trace_worker.py" in trace.SNAPSHOT_FILES + assert "benchmarks/learn/engine_trace_parse.py" in trace.SNAPSHOT_FILES def test_summary_separates_unanswered_pairs(tmp_path): @@ -461,6 +463,8 @@ sys.modules['yaml'] = None sys.modules['boto3'] = None script = pathlib.Path(sys.argv[1]) size = len(script.read_bytes()) +# Direct script execution in the image puts the sibling modules on sys.path. +sys.path.insert(0, str(script.parent)) runpy.run_path(str(script), run_name='trace_import_check') print(json.dumps({'bytes': size, 'modules': sorted( name for name in sys.modules if name == 'openultrasast' or name.startswith('openultrasast.') @@ -486,7 +490,6 @@ def test_trace_container_transitive_import_boundary(): "openultrasast.cpg.session", "openultrasast.model", "openultrasast.model.contracts", - "openultrasast.model.trace", ] @@ -1397,3 +1400,55 @@ def test_k8s_check_roundtrip_and_retention(tmp_path, monkeypatch, capsys, keep): assert {"name": "CHECK", "value": "1"} in job["spec"]["template"]["spec"]["containers"][0]["env"] assert bool(data) is keep assert any("delete" in c for c in commands) is not keep + + +@pytest.mark.parametrize("outcome", ["success", "timeout", "failure"]) +def test_engine_queue_pin_persistence_resume_and_progress(tmp_path, monkeypatch, outcome): + from engine_trace_queue import Dispatcher + from engine_worker_service import Queue + from test_engine_queue import FakeS3 + + store = FakeS3() + args = k8s_args(tmp_path, executor="queue", queue_timeout=2, image="image@sha256:abc") + plan = trace.make_plan([unit()], tmp_path) + + class Inputs: + def materialize(self, pin, target): + target.mkdir() + (target / "app.py").write_text("def run(): pass") + return {"files": 1, "bytes": 15} + + def execute(client, task): + return { + **task["pin"], + "done": True, + "container_exit": 0, + "units": [worker.unit_record(u, "asked-nothing") for u in task["pin"]["units"]], + } + + queue = Queue(store, "pod-worker") + if outcome == "timeout": + ticks = iter([0, 3]) + args.dispatcher = Dispatcher(args, store, clock=lambda: next(ticks)) + else: + args.dispatcher = Dispatcher(args, store, pause=lambda _: queue.process_one(execute)) + if outcome == "failure": + + def fail(*_): + raise RuntimeError("credential-must-not-appear") + + monkeypatch.setattr(store, "put", fail) + monkeypatch.setattr(trace, "prepare_questions", lambda *_: {"a": {}}) + monkeypatch.setattr(subprocess, "run", lambda *_a, **_k: pytest.fail("queue must not launch Docker/kubectl")) + assert trace.run_plan(plan, None, {"image": args.image}, Inputs(), args) is (outcome != "success") + result = json.loads((tmp_path / trace.pin_name(plan[0])).read_text()) + assert result["executor"] == "queue" + assert result["units"][0]["status"] == {"success": "asked-nothing", "timeout": "timeout", "failure": "failed"}[outcome] + assert "credential-must-not-appear" not in json.dumps(result) + if outcome == "success": + assert result["worker"] == "pod-worker" + assert trace.make_plan([unit()], tmp_path) == [] + else: + assert trace.make_plan([unit()], tmp_path, rerun_status=("failed", "timeout")) + progress = json.loads((tmp_path / "progress.json").read_text()) + assert progress["pins_done"] == 1 and progress["pins_in_flight"] == 0 diff --git a/tests/test_joern_leak_audit.py b/tests/test_joern_leak_audit.py new file mode 100644 index 0000000..623714d --- /dev/null +++ b/tests/test_joern_leak_audit.py @@ -0,0 +1,161 @@ +"""Synthetic, offline result snapshots; no analyzer, model or corpus access.""" + +import importlib +import json +from pathlib import Path + +import pytest + + +@pytest.fixture +def audit_module(monkeypatch): + monkeypatch.syspath_prepend(str(Path(__file__).resolve().parents[1] / "benchmarks/learn")) + return importlib.import_module("joern_leak_audit") + + +def units(count=12): + return [ + {"unit": f"{pair}-{label}", "pair": str(pair), "label": label, "family": "injection", "group": "g", "fold": "f"} + for pair in range(count) + for label in (1, 0) + ] + + +def write_result(root, module, rows, name="pin", *, done=True, version=None): + path = root / f"{name}.json" + path.write_text( + json.dumps( + { + "repo": "repo", + "pin": name, + "done": done, + "materialization_version": module.materialization_version() if version is None else version, + "units": rows, + } + ) + ) + return path + + +def result(unit, status): + return { + **unit, + "source": "authored", + "status": status, + "pin_role": "vulnerable" if unit["label"] else "fixed", + "traces": [{"steps": [{"roles": ["source"]}, {"roles": ["sink"]}], "sanitized": False, "guard": {"text": "", "bounded": False}}] + if status == "path" + else [], + "witness_rows": [{"sink": "execute(x)"}] if status == "path" else [], + } + + +def run(module, root, population): + return module.audit(population, root, expected_rows=len(population), expected_pairs=len(population) // 2) + + +def test_skips_stale_unfinished_and_proves_read(audit_module, tmp_path): + population = units(2) + paths = [ + write_result(tmp_path, audit_module, [result(population[0], "path")], "valid"), + write_result(tmp_path, audit_module, [result(population[1], "path")], "stale", version=-1), + write_result(tmp_path, audit_module, [result(population[2], "path")], "unfinished", done=False), + write_result(tmp_path, audit_module, [result(population[3], "path")], "both", version=-1, done=False), + ] + report = run(audit_module, tmp_path, population) + evidence = report["inputs"] + assert (evidence["stale"], evidence["unfinished"], evidence["skipped"]) == (2, 2, 3) + assert evidence["files_read"] == 4 and evidence["accepted_files"] == evidence["result_rows_read"] == 1 + assert evidence["bytes_read"] == sum(p.stat().st_size for p in paths) + assert report["matched_rows"] == 1 + assert report["overall"]["coverage"]["missing"] == 3 + assert report["by_source"]["unknown"]["rows"] == 3 + assert report["overall"]["signals"]["has_path"]["rows"] == 1 + assert report["overall"]["both_asked_signals"]["has_path"]["pooled_auc"] is None + + +def test_asymmetry_and_honest_denominator(audit_module, tmp_path): + population = units(6) + statuses = [ + "path", + "asked-nothing", + "asked-nothing", + "path", + "path", + "path", + "asked-nothing", + "asked-nothing", + "path", + "failed", + "unsupported", + "timeout", + ] + write_result(tmp_path, audit_module, [result(u, s) for u, s in zip(population, statuses, strict=True)]) + report = run(audit_module, tmp_path, population) + overall = report["overall"] + assert overall["pair_asymmetry"] == {"vulnerable_only": 1, "fixed_only": 1, "both": 1, "neither": 1, "not_both_asked": 2} + assert overall["both_asked_pairs"] == 4 + assert overall["both_asked_signals"]["asked"]["within_pair_accuracy"] == 0.5 + assert overall["coverage"] == {"path": 5, "asked-nothing": 4, "failed": 1, "timeout": 1, "unsupported": 1, "missing": 0} + assert report["by_family"]["injection"] == overall == report["by_source"]["authored"] + + +@pytest.mark.parametrize("balanced", [False, True]) +def test_constructed_leak_and_balanced_set(audit_module, tmp_path, balanced): + population = units() + rows = [result(u, "path" if u["label"] == (int(u["pair"]) % 2 if balanced else 1) else "asked-nothing") for u in population] + write_result(tmp_path, audit_module, rows) + overall = run(audit_module, tmp_path, population)["overall"] + for denominator in ("signals", "both_asked_signals"): + signals = overall[denominator] + for name in ("has_path", "shortest_path_steps"): + assert signals[name]["flagged"] is not balanced + assert signals[name]["within_pair_accuracy"] == signals[name]["pooled_auc"] == (0.5 if balanced else 1) + assert signals["sink_kind"]["execute"]["flagged"] is not balanced + assert not signals["asked"]["flagged"] + assert not signals["sanitized"]["flagged"] + assert not signals["guard_present"]["flagged"] + + +def test_minimum_samples_reverse_and_source_proxy(audit_module, tmp_path): + population = units(2) + write_result(tmp_path, audit_module, [result(u, "path" if not u["label"] else "asked-nothing") for u in population]) + assert not run(audit_module, tmp_path, population)["overall"]["signals"]["has_path"]["flagged"] + population = units(12) + rows = [] + for u in population: + row = result(u, "path" if not u["label"] else "unsupported") + row["source"] = "positive" if u["label"] else "negative" + rows.append(row) + write_result(tmp_path, audit_module, rows) + report = run(audit_module, tmp_path, population) + assert report["overall"]["signals"]["asked"]["flagged"] + assert report["overall"]["signals"]["asked"]["pooled_auc"] == 0 + assert report["overall"]["both_asked_pairs"] == 0 + assert report["by_source"]["positive"]["signals"]["asked"]["pooled_auc"] is None + + +def test_shortest_trace_evidence_and_missing_trace(audit_module): + row = result(units(1)[0], "path") + row["traces"].insert(0, {"steps": [{}] * 5, "sanitized": False}) + row["witness_rows"].insert(0, {"sink": "longer(x)"}) + row["traces"][1].update(sanitized=True, guard={"bounded": True, "text": "off-path bound"}) + features = audit_module.features(row) + assert (features["shortest_path_steps"], features["sanitized"], features["guard_present"], features["sink_kind"]) == ( + 2, + 1, + 1, + "execute", + ) + row["traces"] = [] + assert audit_module.features(row)["shortest_path_steps"] is None + + +def test_bad_inputs_fail_loudly(audit_module, tmp_path): + population = units(1) + write_result(tmp_path, audit_module, [result(population[0], "path")] * 2) + with pytest.raises(ValueError, match="Duplicate"): + run(audit_module, tmp_path, population) + write_result(tmp_path, audit_module, [{**result(population[0], "path"), "label": 0}]) + with pytest.raises(ValueError, match="metadata mismatch"): + run(audit_module, tmp_path, population) diff --git a/tests/test_plane_profile.py b/tests/test_plane_profile.py index 67168ba..395f466 100644 --- a/tests/test_plane_profile.py +++ b/tests/test_plane_profile.py @@ -156,3 +156,27 @@ def test_profile_is_frozen_and_typed() -> None: assert isinstance(loaded, PlaneProfile) with pytest.raises(AttributeError): loaded.exec = "remote" # type: ignore[misc] + + +def test_kind_observability_defaults_off() -> None: + assert load_profile("kind", environ={}).kind_observability is False + + +@pytest.mark.parametrize(("raw", "expected"), [("1", True), ("true", True), ("0", False), ("FALSE", False)]) +def test_kind_observability_environment_override(tmp_path: Path, raw: str, expected: bool) -> None: + path = write_profile(tmp_path, MINIMAL + f"kind_observability = {str(not expected).lower()}\n") + assert load_profile(str(path), environ={"OUSAST_KIND_OBSERVABILITY": raw}).kind_observability is expected + + +def test_kind_observability_validation_and_print( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str] +) -> None: + path = write_profile(tmp_path, MINIMAL + 'kind_observability = "false"\n') + with pytest.raises(ProfileError, match="kind_observability must be a boolean"): + load_profile(str(path), environ={}) + path = write_profile(tmp_path) + with pytest.raises(ProfileError, match="OUSAST_KIND_OBSERVABILITY must be"): + load_profile(str(path), environ={"OUSAST_KIND_OBSERVABILITY": "maybe"}) + monkeypatch.setenv("OUSAST_KIND_OBSERVABILITY", "1") + assert profile_module.main(["--profile", str(path), "--print", "kind_observability"]) == 0 + assert capsys.readouterr().out == "true\n"