mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
fcb12e116a
Java shipped with injection, deserialization and crypto sinks only, so the path and output_encoding families had nothing routing to them by CWE and any Java pair in either was unreadable -- the gap hutool-cve-2018-17297 reported as "no path spec for java". Adds the JDK filesystem entry points, the servlet response writers, the outbound/redirect APIs, and the ESAPI / canonical-path sanitizers the OWASP suite itself uses. Documented APIs, provenance per entry. Post-closure-fix ceiling: 41.3% entailed (38/92) and 26.1% distinguished, up from 39.1% / 23.9%. path went 0/8 to 1/8 with its first distinguished pair; injection 29->31 entailed and 18->19 distinguished. Two points -- real, and the mechanism is understood, but the remaining gaps are data rather than machinery. Carrying a correction: the measurement harness routed config_secrets through TAINT rather than the constant-abstraction arm, so its 0/10 in this artifact measures the wrong arbiter and did so in both full runs. The harness is fixed; that family's real number is the earlier targeted re-measure, and this artifact's config row should not be read. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
1188 lines
34 KiB
JSON
1188 lines
34 KiB
JSON
{
|
|
"flat_ir_baseline": {
|
|
"corroborated_one_hop": 0.239,
|
|
"entailed": 0.022,
|
|
"source": "2026-09-08-model-entailment-ceiling.json"
|
|
},
|
|
"generated": "2026-09-08",
|
|
"overall": {
|
|
"any_verdict_rate": 0.4783,
|
|
"corroborated": 6,
|
|
"distinguished": 24,
|
|
"distinguished_rate": 0.2609,
|
|
"entailed": 38,
|
|
"entailed_rate": 0.413,
|
|
"none": 48,
|
|
"pairs": 92
|
|
},
|
|
"per_family": {
|
|
"access_control": {
|
|
"any_verdict_rate": 0.75,
|
|
"corroborated": 6,
|
|
"distinguished": 3,
|
|
"distinguished_rate": 0.375,
|
|
"entailed": 0,
|
|
"entailed_rate": 0.0,
|
|
"none": 2,
|
|
"pairs": 8
|
|
},
|
|
"config_secrets": {
|
|
"any_verdict_rate": 0.0,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 0,
|
|
"entailed_rate": 0.0,
|
|
"none": 10,
|
|
"pairs": 10
|
|
},
|
|
"deserialization": {
|
|
"any_verdict_rate": 0.3333,
|
|
"corroborated": 0,
|
|
"distinguished": 1,
|
|
"distinguished_rate": 0.3333,
|
|
"entailed": 1,
|
|
"entailed_rate": 0.3333,
|
|
"none": 2,
|
|
"pairs": 3
|
|
},
|
|
"injection": {
|
|
"any_verdict_rate": 0.62,
|
|
"corroborated": 0,
|
|
"distinguished": 19,
|
|
"distinguished_rate": 0.38,
|
|
"entailed": 31,
|
|
"entailed_rate": 0.62,
|
|
"none": 19,
|
|
"pairs": 50
|
|
},
|
|
"output_encoding": {
|
|
"any_verdict_rate": 0.0,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 0,
|
|
"entailed_rate": 0.0,
|
|
"none": 1,
|
|
"pairs": 1
|
|
},
|
|
"path": {
|
|
"any_verdict_rate": 0.125,
|
|
"corroborated": 0,
|
|
"distinguished": 1,
|
|
"distinguished_rate": 0.125,
|
|
"entailed": 1,
|
|
"entailed_rate": 0.125,
|
|
"none": 7,
|
|
"pairs": 8
|
|
},
|
|
"prototype": {
|
|
"any_verdict_rate": 0.1429,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 1,
|
|
"entailed_rate": 0.1429,
|
|
"none": 6,
|
|
"pairs": 7
|
|
},
|
|
"untrusted_destination": {
|
|
"any_verdict_rate": 0.8,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 4,
|
|
"entailed_rate": 0.8,
|
|
"none": 1,
|
|
"pairs": 5
|
|
}
|
|
},
|
|
"per_slice": {
|
|
"agent-vfc": {
|
|
"any_verdict_rate": 0.2857,
|
|
"corroborated": 3,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 5,
|
|
"entailed_rate": 0.1786,
|
|
"none": 20,
|
|
"pairs": 28
|
|
},
|
|
"github": {
|
|
"any_verdict_rate": 0.6667,
|
|
"corroborated": 0,
|
|
"distinguished": 2,
|
|
"distinguished_rate": 0.3333,
|
|
"entailed": 4,
|
|
"entailed_rate": 0.6667,
|
|
"none": 2,
|
|
"pairs": 6
|
|
},
|
|
"local": {
|
|
"any_verdict_rate": 1.0,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 2,
|
|
"entailed_rate": 1.0,
|
|
"none": 0,
|
|
"pairs": 2
|
|
},
|
|
"sast": {
|
|
"any_verdict_rate": 0.875,
|
|
"corroborated": 0,
|
|
"distinguished": 4,
|
|
"distinguished_rate": 0.5,
|
|
"entailed": 7,
|
|
"entailed_rate": 0.875,
|
|
"none": 1,
|
|
"pairs": 8
|
|
},
|
|
"vfc": {
|
|
"any_verdict_rate": 0.0,
|
|
"corroborated": 0,
|
|
"distinguished": 0,
|
|
"distinguished_rate": 0.0,
|
|
"entailed": 0,
|
|
"entailed_rate": 0.0,
|
|
"none": 1,
|
|
"pairs": 1
|
|
},
|
|
"vfc-js": {
|
|
"any_verdict_rate": 0.6471,
|
|
"corroborated": 0,
|
|
"distinguished": 6,
|
|
"distinguished_rate": 0.3529,
|
|
"entailed": 11,
|
|
"entailed_rate": 0.6471,
|
|
"none": 6,
|
|
"pairs": 17
|
|
},
|
|
"vibe-py": {
|
|
"any_verdict_rate": 0.4,
|
|
"corroborated": 3,
|
|
"distinguished": 12,
|
|
"distinguished_rate": 0.4,
|
|
"entailed": 9,
|
|
"entailed_rate": 0.3,
|
|
"none": 18,
|
|
"pairs": 30
|
|
}
|
|
},
|
|
"rows": [
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "python",
|
|
"pair": "local-python-vulnerable",
|
|
"seconds": 29.4,
|
|
"slice": "local",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request.args[\"expr\"] -> eval(request.args[\"expr\"]) (line 28, 1 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "local-javascript-vulnerable",
|
|
"seconds": 30.5,
|
|
"slice": "local",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "\"make \" + req.query.target -> childProcess.execSync(\"make \" + req.query.target) (line 14, 1 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "python",
|
|
"pair": "sven-cwe-078-os-system",
|
|
"seconds": 29.5,
|
|
"slice": "github",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "username -> os.system(\"useradd -G docker,wheel -p \" + encPass + \" \" + username) (line 10, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "python",
|
|
"pair": "sven-cwe-078-shell-true",
|
|
"seconds": 29.7,
|
|
"slice": "github",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "cmd -> _exec_cmd(self, cmd) (line 14, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "sven-cwe-089-execute-percent",
|
|
"seconds": 28.9,
|
|
"slice": "github",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "game -> cursor.execute(\"SELECT x,y,letter FROM moves WHERE gameID = %d;\" % game) (line 12, 3 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "sven-cwe-089-query-concat",
|
|
"seconds": 30.5,
|
|
"slice": "github",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "java",
|
|
"pair": "hutool-cve-2018-17297",
|
|
"seconds": 31.0,
|
|
"slice": "github",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "node-serialize-cve-2017-5941",
|
|
"seconds": 29.7,
|
|
"slice": "github",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "obj -> eval(\"(\" + obj + \")\") (line 4, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "python",
|
|
"pair": "owasp-python-codeinj",
|
|
"seconds": 29.4,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "urllib.parse.unquote_plus(request.cookies.get(\"BenchmarkTest00074\", \"noCookieValueSupplied\")) -> exec(bar) (line 51, 9 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "deserialization",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "owasp-python-deser",
|
|
"seconds": 28.7,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "urllib.parse.unquote_plus(request.cookies.get(\"BenchmarkTest00078\", \"noCookieValueSupplied\")) -> pickle.loads(base64.urlsafe_b64decode(bar)) (line 53, 12 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "owasp-python-cmdi",
|
|
"seconds": 28.3,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request.form.get(\"BenchmarkTest00165\") -> subprocess.run(argList, capture_output = True, encoding = \"utf-8\") (line 57, 15 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "owasp-python-sqli",
|
|
"seconds": 28.1,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request.form.get(\"BenchmarkTest00099\") -> cur.execute(sql) (line 49, 14 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "owasp-python-hash",
|
|
"seconds": 28.6,
|
|
"slice": "sast",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "java",
|
|
"pair": "owasp-java-cmdi",
|
|
"seconds": 49.6,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "getHeader(\"BenchmarkTest00007\") -> r.exec(args, argsEnv) (line 61, 10 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "java",
|
|
"pair": "owasp-java-sqli",
|
|
"seconds": 49.2,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "getHeader(\"BenchmarkTest00008\") -> connection.prepareCall(sql) (line 57, 9 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "java",
|
|
"pair": "juliet-java-cwe78-exec",
|
|
"seconds": 49.1,
|
|
"slice": "sast",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "String data -> Runtime.getRuntime().exec(osCommand + data) (line 8, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "openssl-cve-2022-1292",
|
|
"seconds": 1.1,
|
|
"slice": "vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "damn-vulnerable-graphql-application-views-mutate",
|
|
"seconds": 28.7,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "damn-vulnerable-graphql-application-views-resolve-pastes",
|
|
"seconds": 28.8,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "damn-vulnerable-graphql-application-views-resolve-system-dia",
|
|
"seconds": 28.6,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "djangoat-analytics-hits-by-ip",
|
|
"seconds": 27.3,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "deserialization",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "djangoat-views-reset-password",
|
|
"seconds": 27.7,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "djangoat-views-user-view",
|
|
"seconds": 27.5,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request -> User.objects.raw(\"SELECT * FROM %s WHERE user_id='%s' ORDER BY is_admin='0'\" % (table_name,user_id_form)) (line 22, 9 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dsvpwa-attacks-run",
|
|
"seconds": 28.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dsvpwa-dsvpwa-main",
|
|
"seconds": 28.6,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dsvpwa-handlers-do-bdr",
|
|
"seconds": 27.4,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dvpwa-app-init",
|
|
"seconds": 30.5,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dvpwa-middlewares-session-middleware",
|
|
"seconds": 37.2,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dvpwa-student-create",
|
|
"seconds": 32.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "deserialization",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "extremely-vulnerable-flask-app-account-before-request",
|
|
"seconds": 30.0,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "extremely-vulnerable-flask-app-account-search",
|
|
"seconds": 28.6,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request.args.get('search', '') -> text(f\"text like '%{search_param}%'\") (line 20, 6 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "extremely-vulnerable-flask-app-signup-validate-token",
|
|
"seconds": 28.8,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "session -> session.execute(text(f\"\"\"\n SELECT id, code FROM {RegistrationCode.__tablename__} WHERE code = '{code}'\n \"\"\")) (line 15, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "access_control",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "threatbyte-api-v1-delete",
|
|
"seconds": 28.2,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "delete line 28: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "access_control",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "threatbyte-api-v1-get",
|
|
"seconds": 28.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "get line 27: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "threatbyte-routes-dashboard",
|
|
"seconds": 28.5,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request.args.get('search', '') -> cursor.execute(s_query) (line 29, 8 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vampi-user-model-get-user",
|
|
"seconds": 27.7,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "access_control",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vampi-users-update-password",
|
|
"seconds": 28.8,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "update_password line 16: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vfapi-main-delete-user",
|
|
"seconds": 27.9,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vfapi-main-put-user",
|
|
"seconds": 28.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vfapi-main-sql-return-users-from-username",
|
|
"seconds": 27.8,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "output_encoding",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulnerable-python-apps-bad-mvc-do-get",
|
|
"seconds": 29.3,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulnerable-python-apps-dir-traversal-do-get",
|
|
"seconds": 28.6,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulnpy-cmdi-do-os-system",
|
|
"seconds": 27.7,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "command -> os.system(command) (line 14, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulnpy-cmdi-do-subprocess-popen",
|
|
"seconds": 28.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "command -> subprocess.Popen(command, stdout = subprocess.PIPE, stderr = subprocess.STDOUT, shell = True) (line 14, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulpy-libuser-create",
|
|
"seconds": 27.8,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "password -> c.execute(\"INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')\" % (username,password,0,0,'')) (line 18, 4 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulpy-libuser-login",
|
|
"seconds": 28.1,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "username -> c.execute(\"SELECT * FROM users WHERE username = '{}' and password = '{}'\".format(username, password)) (line 20, 5 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "vulpy-libuser-password-change",
|
|
"seconds": 27.7,
|
|
"slice": "vibe-py",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "password -> c.execute(\"UPDATE users SET password = '{}' WHERE username = '{}'\".format(password, username)) (line 20, 5 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "path",
|
|
"fixed_rung": "model_corroborated",
|
|
"language": "javascript",
|
|
"pair": "angular-http-server-1-0-0",
|
|
"seconds": 30.7,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "req.url.split('?')[0] -> fs.readFileSync(possibleFilename) (line 38, 10 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "apex-publish-static-files-2-0-0",
|
|
"seconds": 30.4,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> execSync(\n\t\t\t\t'\"' + opts.sqlclPath + '\"' + // Sqlcl path\n\t\t\t\t' ' + opts.connectString + // Connect string (user/pass@server:port/sid)\n\t\t\t\t' @\"' + path.resolve(__dirname, 'lib/script') + '\"' + // Sql t (line 61, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "bestzip-2-1-6",
|
|
"seconds": 31.9,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "options -> cp.exec(command, {\n stdio: \"inherit\",\n cwd: options.cwd\n }) (line 22, 13 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "clamscan-1-2-0",
|
|
"seconds": 46.4,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> execFile(self.settings[self.scanner].path, self._build_clam_args(path), (err, stdout, stderr) => {\n const {is_infected, viruses} = self._process_result(stdout, path);\n\n (line 1401, 46 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "diskusage-ng-0-2-6",
|
|
"seconds": 30.4,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> exec('df -k \"' + path + '\"', function(err, stdout) {\n if (err) {\n return cb(err);\n }\n\n try {\n cb(null, parse(stdout));\n } catch (e) {\n cb(e (line 19, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "dns-sync-0-1-0",
|
|
"seconds": 30.6,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "hostname -> shell.exec(cmd, {silent: true}) (line 22, 6 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "glance-3-0-0",
|
|
"seconds": 32.9,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "hot-formula-parser-3-0-0",
|
|
"seconds": 51.5,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "yytext -> eval(\"[\" + yytext + \"]\") (line 166, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "libnmap-0-4-11",
|
|
"seconds": 32.7,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "pdf-image-1-0-5",
|
|
"seconds": 32.9,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> exec(getInfoCommand, function (err, stdout, stderr) {\n if (err) {\n return reject({\n message: \"Failed to get PDF'S information\",\n error: err,\n stdout: s (line 34, 12 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "pidusage-1-0-0",
|
|
"seconds": 32.8,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> exec(cmd + pid, function(err, stdout, stderr) {\n if(err)\n return done(err, null)\n\n stdout = stdout.split(os.EOL)[1]\n stdout = stdout.replace(/^\\s+/, '').replace(/\\s\\s+/g, ' ').sp (line 116, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "portprocesses-1-0-4",
|
|
"seconds": 30.4,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "serve-here-js-1-1-0",
|
|
"seconds": 29.7,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "static-eval-1-1-1",
|
|
"seconds": 34.9,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": true,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "thenify-3-3-0",
|
|
"seconds": 31.7,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> eval(createWrapper($$__fn__$$.name, options)) (line 29, 4 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "underscore-1-13-0-0",
|
|
"seconds": 33.0,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "whereis-0-4-0",
|
|
"seconds": 34.0,
|
|
"slice": "vfc-js",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "cb -> cp.exec('where ' + name, function (error, stdout, stderr) { //windows\n if (error || stderr || stdout === '' || stdout.indexOf('\\\\') === -1) {\n cp.exec('for %i in (' + name + '. (line 21, 3 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "untrusted_destination",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "anastasios-pw-session-14ec1a",
|
|
"seconds": 38.9,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request: Request -> request.isNavigationRequest (line 14, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "untrusted_destination",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "astroclaw-pw-session-1553a8",
|
|
"seconds": 34.6,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "request: Request -> request.isNavigationRequest (line 14, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "capgo-app-hono-4dadd2",
|
|
"seconds": 10.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "dnf-plugin-anyrepo-config-26d19a",
|
|
"seconds": 28.6,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "edutrace-page-ee7ba2",
|
|
"seconds": 35.0,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "this -> setFormData(prevData => {\n const newData = JSON.parse(JSON.stringify(prevData));\n let current = newData;\n for (let i = 0; i < keys.length - 1; i++) {\n current = current[keys[i]]; (line 65, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "etude-lexical-markdown-editorconfig-c61a8b",
|
|
"seconds": 30.2,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "etude-lexical-markdown-editorconfig-db4f54",
|
|
"seconds": 32.9,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "untrusted_destination",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "market-cap-route-4f8ae9",
|
|
"seconds": 33.6,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "new URL(\"/login?error=confirm\", request.url) -> NextResponse.redirect(new URL(\"/login?error=confirm\", request.url)) (line 27, 2 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "melodix-playerprovider-089931",
|
|
"seconds": 12.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf",
|
|
"seconds": 11.6,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "money-track-category-icons-4d4a5b",
|
|
"seconds": 31.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "nestjs-filter-normalizer-aa0e60",
|
|
"seconds": 30.7,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "new-erp-final-app-6e9644",
|
|
"seconds": 10.4,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "untrusted_destination",
|
|
"fixed_rung": "model_entailed",
|
|
"language": "javascript",
|
|
"pair": "nimestream-route-d17f53",
|
|
"seconds": 32.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_entailed",
|
|
"witness": "new URL(request.url) -> fetch(imageUrl, {\n headers: {\n 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n 'Referer': referer,\n (line 57, 18 steps)"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "access_control",
|
|
"fixed_rung": "model_corroborated",
|
|
"language": "python",
|
|
"pair": "openniw-jobs-0fc947",
|
|
"seconds": 27.9,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "get_job line 16: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "access_control",
|
|
"fixed_rung": "model_corroborated",
|
|
"language": "python",
|
|
"pair": "openniw-jobs-b74de3",
|
|
"seconds": 31.3,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "get_job line 16: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "access_control",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "overleaf-with-claude-exportscontroller-3980b9",
|
|
"seconds": 1.4,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "popmark-editorconfig-e5ac40",
|
|
"seconds": 35.9,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "prototype",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "rag-pipeline-utils-config-handler-76e5f0",
|
|
"seconds": 44.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "registry-proxy-worker-426847",
|
|
"seconds": 17.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "access_control",
|
|
"fixed_rung": "model_corroborated",
|
|
"language": "javascript",
|
|
"pair": "supplieradvisor-mvp-route-387bcf",
|
|
"seconds": 43.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "model_corroborated",
|
|
"witness": "PATCH line 37: obligated operation with no discharging guard, and no guarded sibling"
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "access_control",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "supplieradvisor-mvp-route-a69e8f",
|
|
"seconds": 53.0,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "tools-cli-tools-a96bc0",
|
|
"seconds": 51.0,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "trackly-cli-path-diagnostics-1c1aed",
|
|
"seconds": 51.1,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "path",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "upstreamdrift-local-server-c3a078",
|
|
"seconds": 43.4,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "untrusted_destination",
|
|
"fixed_rung": "none",
|
|
"language": "python",
|
|
"pair": "waggledance-swarm-ssrf-host-guard-9a4548",
|
|
"seconds": 42.7,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "injection",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "workers-research-utils-209444",
|
|
"seconds": 48.7,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
},
|
|
{
|
|
"distinguished": false,
|
|
"family": "config_secrets",
|
|
"fixed_rung": "none",
|
|
"language": "javascript",
|
|
"pair": "zoonk-origin-bfbf67",
|
|
"seconds": 12.7,
|
|
"slice": "agent-vfc",
|
|
"vuln_rung": "none",
|
|
"witness": ""
|
|
}
|
|
],
|
|
"task": "model-grounded-detection 4.2 \u2014 entailment ceiling with the full model layer (taint + dominance)"
|
|
}
|