# vfc-js pair slice. Reviewed isolated functions with provenance.
# Honesty dashboard — not the local 100% CI gate.
# Do not add these names to LANGUAGE_MANIFESTS.
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.

[[pair]]
name = "angular-http-server-1-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "Apache-2.0"
repo = "simonh1000/angular-http-server"
cve = ""
cwe = "CWE-22"
commit = "8bafc9577161469f5dea01e0b98ea9c525d063e9"
parent = "d171a771a92e4685b24fb77cb894a7b7b8024c5c"
commit_url = "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9"
vuln = "angular-http-server-1-0-0/vuln.js"
fixed = "angular-http-server-1-0-0/fixed.js"
relpath = "angular-http-server.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-22"
class = "path traversal"
path = "angular-http-server.js"
function = "requestListener"
mechanism = "path_join_user_input"
sink = "path"
evidence = "SecBench.js path-traversal sink angular-http-server.js:16:29 fixed upstream in 8bafc9577161"

[[pair]]
name = "apex-publish-static-files-2-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "vincentmorneau/apex-publish-static-files"
cve = "CVE-2018-16462"
cwe = "CWE-78"
commit = "2209af8f2b65c24aa55ab757e0e05b958c16f063"
parent = "8d28fe8a9a49e5ff3f61e239293b5646528e2915"
commit_url = "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063"
vuln = "apex-publish-static-files-2-0-0/vuln.js"
fixed = "apex-publish-static-files-2-0-0/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "index.js"
function = "publish"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink index.js:54:25 fixed upstream in 2209af8f2b65"

[[pair]]
name = "bestzip-2-1-6"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "nfriedly/node-bestzip"
cve = "CVE-2020-7730"
cwe = "CWE-78"
commit = "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
parent = "fcea252e52b6078eff6caf5531bd32c53fccb59f"
commit_url = "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
vuln = "bestzip-2-1-6/vuln.js"
fixed = "bestzip-2-1-6/fixed.js"
relpath = "lib/bestzip.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2020"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "lib/bestzip.js"
function = "nativeZip"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink lib/bestzip.js:27:27 fixed upstream in 45d4a901478c"

[[pair]]
name = "clamscan-1-2-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "kylefarris/clamscan"
cve = "CVE-2020-7613"
cwe = "CWE-78"
commit = "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
parent = "d474da7b89c0d3397cd681e79c7bcc592bff144b"
commit_url = "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
vuln = "clamscan-1-2-0/vuln.js"
fixed = "clamscan-1-2-0/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2020"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "index.js"
function = "local_scan"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink index.js:495:36 fixed upstream in 5f557c970817"

[[pair]]
name = "diskusage-ng-0-2-6"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "iximiuz/node-diskusage-ng"
cve = "CVE-2020-7631"
cwe = "CWE-78"
commit = "48e7e093486b528f0c81ec699573e0e4a431b8d3"
parent = "53c505506553c83861d1bd67823d6a382d3a5a43"
commit_url = "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3"
vuln = "diskusage-ng-0-2-6/vuln.js"
fixed = "diskusage-ng-0-2-6/fixed.js"
relpath = "lib/posix.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2020"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "lib/posix.js"
function = "diskusage"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink lib/posix.js:11:5 fixed upstream in 48e7e093486b"

[[pair]]
name = "dns-sync-0-1-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "skoranga/node-dns-sync"
cve = "CVE-2014-9682"
cwe = "CWE-78"
commit = "d9abaae384b198db1095735ad9c1c73d7b890a0d"
parent = "b748fe77a87749d95876028eda8e759109be4c73"
commit_url = "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d"
vuln = "dns-sync-0-1-0/vuln.js"
fixed = "dns-sync-0-1-0/fixed.js"
relpath = "lib/dns-sync.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2014"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "lib/dns-sync.js"
function = "resolve"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink lib/dns-sync.js:21:26 fixed upstream in d9abaae384b1"

[[pair]]
name = "glance-3-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "jarofghosts/glance"
cve = "CVE-2018-3715"
cwe = "CWE-22"
commit = "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
parent = "7e69a5539236386e747fb240ae87ea65ed64bb2c"
commit_url = "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
vuln = "glance-3-0-0/vuln.js"
fixed = "glance-3-0-0/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-22"
class = "path traversal"
path = "index.js"
function = "Glance$serveRequest"
mechanism = "path_join_user_input"
evidence = "SecBench.js path-traversal sink index.js:81:14 fixed upstream in 8cfd88e44ebd"

[[pair]]
name = "hot-formula-parser-3-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "handsontable/formula-parser"
cve = "CVE-2020-6836"
cwe = "CWE-78"
commit = "396b089738d4bf30eb570a4fe6a188affa95cd5e"
parent = "944136096f44ff4ffd4ba0bcef30970ca4702fce"
commit_url = "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e"
vuln = "hot-formula-parser-3-0-0/vuln.js"
fixed = "hot-formula-parser-3-0-0/fixed.js"
relpath = "src/grammar-parser/grammar-parser.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2019"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "src/grammar-parser/grammar-parser.js"
function = "performAction"
mechanism = "source_reaches_sink"
evidence = "SecBench.js command-injection sink lib/grammar-parser/grammar-parser.js:258:31 fixed upstream in 396b089738d4"

[[pair]]
name = "libnmap-0-4-11"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "jas-/node-libnmap"
cve = "CVE-2018-16461"
cwe = "CWE-78"
commit = "c235b24b0342e12a5dbf502f89daabe95883b6c8"
parent = "49b72239b144ab7ffdf673b62e18bfd0760948f6"
commit_url = "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8"
vuln = "libnmap-0-4-11/vuln.js"
fixed = "libnmap-0-4-11/fixed.js"
relpath = "lib/classes/tools.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "lib/classes/tools.js"
function = "block"
mechanism = "source_reaches_sink"
evidence = "SecBench.js command-injection sink lib/classes/tools.js:114:25 fixed upstream in c235b24b0342"

[[pair]]
name = "pdf-image-1-0-5"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "roest01/node-pdf-image"
cve = "CVE-2018-3757"
cwe = "CWE-78"
commit = "54679496a89738443917608c2bbe2f6e5dd20e83"
parent = "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff"
commit_url = "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83"
vuln = "pdf-image-1-0-5/vuln.js"
fixed = "pdf-image-1-0-5/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "index.js"
function = "getInfo"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink index.js:43:7 fixed upstream in 54679496a897"

[[pair]]
name = "pidusage-1-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "soyuka/pidusage"
cve = "CVE-2017-16034"
cwe = "CWE-78"
commit = "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
parent = "e3660d8a8e5e61afad9b02af67356a1e239d6bde"
commit_url = "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
vuln = "pidusage-1-0-0/vuln.js"
fixed = "pidusage-1-0-0/fixed.js"
relpath = "lib/stats.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2017"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "lib/stats.js"
function = "ps"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink lib/stats.js:108:5 fixed upstream in b70eca15f7ca"

[[pair]]
name = "portprocesses-1-0-4"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "rrainn/PortProcesses"
cve = "CVE-2021-23348"
cwe = "CWE-78"
commit = "86811216c9b97b01b5722f879f8c88a7aa4214e1"
parent = "fffceb09aff7180afbd0bd172e820404b33c8299"
commit_url = "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1"
vuln = "portprocesses-1-0-4/vuln.js"
fixed = "portprocesses-1-0-4/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2021"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "index.js"
function = "listProcessesOnPort"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink exec.js:5:3 fixed upstream in 86811216c9b9"

[[pair]]
name = "serve-here-js-1-1-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "ChristoPy/serve-here.js"
cve = "CVE-2019-5444"
cwe = "CWE-22"
commit = "cefb51d03290b6a88dd13143ab2de31b8cf57c39"
parent = "ad077637bf7a9fe0dee3262f011aed19a45ce92c"
commit_url = "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39"
vuln = "serve-here-js-1-1-0/vuln.js"
fixed = "serve-here-js-1-1-0/fixed.js"
relpath = "source/response.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2019"

[[pair.expected]]
cwe = "CWE-22"
class = "path traversal"
path = "source/response.js"
function = "ConfigureFilePath"
mechanism = "path_join_user_input"
evidence = "SecBench.js path-traversal sink source/server.js:27:15 fixed upstream in cefb51d03290"

[[pair]]
name = "static-eval-1-1-1"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "browserify/static-eval"
cve = ""
cwe = "CWE-94"
commit = "32f8efd072625e267aa7237d2daff35738c50d2a"
parent = "5bba7905b0e797460b8f6c2e38ff6869146faab3"
commit_url = "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a"
vuln = "static-eval-1-1-1/vuln.js"
fixed = "static-eval-1-1-1/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2019"

[[pair.expected]]
cwe = "CWE-94"
class = "code injection"
path = "index.js"
function = "walk"
mechanism = "source_reaches_sink"
sink = "eval"
evidence = "SecBench.js code-injection sink index.js:118:20 fixed upstream in 32f8efd07262"

[[pair]]
name = "thenify-3-3-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "thenables/thenify"
cve = "CVE-2020-7677"
cwe = "CWE-94"
commit = "0d94a24eb933bc835d568f3009f4d269c4c4c17a"
parent = "aa21cfb64f47238c764d258d0faf7366a8487e36"
commit_url = "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a"
vuln = "thenify-3-3-0/vuln.js"
fixed = "thenify-3-3-0/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2020"

[[pair.expected]]
cwe = "CWE-94"
class = "code injection"
path = "index.js"
function = "thenify"
mechanism = "source_reaches_sink"
sink = "eval"
evidence = "SecBench.js code-injection sink index.js:17:10 fixed upstream in 0d94a24eb933"

[[pair]]
name = "underscore-1-13-0-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "jashkenas/underscore"
cve = "CVE-2021-23358"
cwe = "CWE-94"
commit = "4c73526d43838ad6ab43a6134728776632adeb66"
parent = "ef646ccbbbd971e82719c83fc69f56a5585b3a01"
commit_url = "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66"
vuln = "underscore-1-13-0-0/vuln.js"
fixed = "underscore-1-13-0-0/fixed.js"
relpath = "modules/template.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2021"

[[pair.expected]]
cwe = "CWE-94"
class = "code injection"
path = "modules/template.js"
function = "template"
mechanism = "source_reaches_sink"
sink = "eval"
evidence = "SecBench.js code-injection sink modules/template.js:71:14 fixed upstream in 4c73526d4383"

[[pair]]
name = "whereis-0-4-0"
slice = "vfc-js"
language = "javascript"
origin = "secbench.js"
license = "MIT"
repo = "vvo/node-whereis"
cve = "CVE-2018-3772"
cwe = "CWE-78"
commit = "0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
parent = "b8b642b1163baa37f15ed49b4064dcbdb6e1876c"
commit_url = "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
vuln = "whereis-0-4-0/vuln.js"
fixed = "whereis-0-4-0/fixed.js"
relpath = "index.js"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2018"

[[pair.expected]]
cwe = "CWE-78"
class = "command injection"
path = "index.js"
function = "whereis"
mechanism = "source_reaches_sink"
sink = "exec"
evidence = "SecBench.js command-injection sink index.js:4:6 fixed upstream in 0f64e3780235"