mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5
3e71e9e88b
The catalog generator fills `fix_date` from the recipe at the precision the recipe has -- a full ISO day when one was recorded, otherwise the year. Every harvested recipe carries a year and almost none carries a day, and writing `-01-01` would turn a year into a claim about a month. A row counts as post-cutoff only when its earliest possible date is after the cutoff, so a coarse date can under-claim the clean slice but never over-claim it. Each family now reports the same numbers over the rows fixed after the cutoff, beside the whole number and never instead of it, with the undated count on its own line. Without a configured cutoff every scoreboard says so rather than inventing one: guessing a model's training cutoff and then publishing a contamination number from the guess would be worse than reporting none. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
1854 lines
53 KiB
TOML
1854 lines
53 KiB
TOML
# agent-vfc pair slice. Reviewed isolated functions with provenance.
|
|
# Honesty dashboard — not the local 100% CI gate.
|
|
# Do not add these names to LANGUAGE_MANIFESTS.
|
|
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
|
|
|
|
[[pair]]
|
|
name = "ah-05-07-main-0f68d7"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "AI-HealthCare-05/AH_05_07"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "0f68d71093ec0b64a4374f50a7e832e00a39170e"
|
|
parent = "350f67510bce9de606fa3ccca2a90bcd79789d7c"
|
|
commit_url = "https://github.com/AI-HealthCare-05/AH_05_07/commit/0f68d71093ec0b64a4374f50a7e832e00a39170e"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/main.py"
|
|
mode = "hunk"
|
|
relpath = "app/main.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "app/main.py"
|
|
function = "request_validation_error_handler"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix: allow browser updates through CORS (#115)"
|
|
|
|
[[pair]]
|
|
name = "ai-file-manager-searcher-2c8f65"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Rem763/ai-file-manager"
|
|
cve = ""
|
|
cwe = "CWE-89"
|
|
commit = "2c8f6556131405338fd63f989556ff7481e8a706"
|
|
parent = "96416d160231278e898135a1d193c2b9d26ec341"
|
|
commit_url = "https://github.com/Rem763/ai-file-manager/commit/2c8f6556131405338fd63f989556ff7481e8a706"
|
|
vendored = false
|
|
host = "github"
|
|
path = "ai-file-manager/core/searcher.py"
|
|
mode = "hunk"
|
|
relpath = "ai-file-manager/core/searcher.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "ai-file-manager/core/searcher.py"
|
|
function = "search"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: SQL injection hardening and API cleanup for searcher"
|
|
|
|
[[pair]]
|
|
name = "anastasios-pw-session-14ec1a"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "Anas329796/Anastasios"
|
|
cve = ""
|
|
cwe = "CWE-918"
|
|
commit = "14ec1ac50f9e4e255d875236d30129c6207401d4"
|
|
parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb"
|
|
commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4"
|
|
vuln = "anastasios-pw-session-14ec1a/vuln.ts"
|
|
fixed = "anastasios-pw-session-14ec1a/fixed.ts"
|
|
relpath = "extensions/browser/src/browser/pw-session.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "extensions/browser/src/browser/pw-session.ts"
|
|
function = "isTopLevelNavigationRequest"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
|
|
|
[[pair]]
|
|
name = "astroclaw-pw-session-1553a8"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "P1R4N351/astroclaw"
|
|
cve = ""
|
|
cwe = "CWE-918"
|
|
commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
|
parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4"
|
|
commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
|
|
vuln = "astroclaw-pw-session-1553a8/vuln.ts"
|
|
fixed = "astroclaw-pw-session-1553a8/fixed.ts"
|
|
relpath = "extensions/browser/src/browser/pw-session.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "extensions/browser/src/browser/pw-session.ts"
|
|
function = "isTopLevelNavigationRequest"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
|
|
|
[[pair]]
|
|
name = "audienceos-command-center-route-7b2b31"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Diiiploy/audienceos-command-center"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "7b2b31e33cd5f582bc5f06e39b139154d08c5ad6"
|
|
parent = "f79cc1bc6288709bc33af5168fbaf5970122f3e8"
|
|
commit_url = "https://github.com/Diiiploy/audienceos-command-center/commit/7b2b31e33cd5f582bc5f06e39b139154d08c5ad6"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/auth/callback/route.ts"
|
|
mode = "hunk"
|
|
relpath = "app/auth/callback/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "app/auth/callback/route.ts"
|
|
function = "GET"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "security(auth): harden OAuth callback against open redirect and error leakage"
|
|
|
|
[[pair]]
|
|
name = "backend-gym-main-37aec0"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "JhonatanAbrigo11/backend-gym"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "37aec05262214c538a7543cf92921ff478e2d621"
|
|
parent = "42a704179bb0c053de4dc8508f692fc25f828953"
|
|
commit_url = "https://github.com/JhonatanAbrigo11/backend-gym/commit/37aec05262214c538a7543cf92921ff478e2d621"
|
|
vendored = false
|
|
host = "github"
|
|
path = "backend/src/main.ts"
|
|
mode = "hunk"
|
|
relpath = "backend/src/main.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "backend/src/main.ts"
|
|
function = "bootstrap"
|
|
mechanism = "permissive_default"
|
|
sink = "path"
|
|
evidence = "fix: allow Vercel frontend origin in CORS"
|
|
|
|
[[pair]]
|
|
name = "bricks-document-viewer-client-8daa7c"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Lamisi/Bricks"
|
|
cve = ""
|
|
cwe = "CWE-862"
|
|
commit = "8daa7c83d71475f8d23c0d9c6a4ee21813281c8d"
|
|
parent = "12501c96609d8b6de2117bed9cc42829085c4f7b"
|
|
commit_url = "https://github.com/Lamisi/Bricks/commit/8daa7c83d71475f8d23c0d9c6a4ee21813281c8d"
|
|
vendored = false
|
|
host = "github"
|
|
path = "components/document-viewer-client.tsx"
|
|
mode = "hunk"
|
|
relpath = "components/document-viewer-client.tsx"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-862"
|
|
class = "missing authorization"
|
|
path = "components/document-viewer-client.tsx"
|
|
function = "openPdfExport"
|
|
mechanism = "missing_auth_guard"
|
|
evidence = "Fix GCM decryption missing authentication tag length (#98) (#102)"
|
|
|
|
[[pair]]
|
|
name = "bushiri-index-bd1c99"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Handoni/BUSHIRI"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "bd1c99277aa6808b440a9f3c9267d477a07c8d48"
|
|
parent = "5da2a544ec6328f9fe39d6c897af7d5f196471f4"
|
|
commit_url = "https://github.com/Handoni/BUSHIRI/commit/bd1c99277aa6808b440a9f3c9267d477a07c8d48"
|
|
vendored = false
|
|
host = "github"
|
|
path = "apps/worker/src/index.ts"
|
|
mode = "hunk"
|
|
relpath = "apps/worker/src/index.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "apps/worker/src/index.ts"
|
|
function = "resolveCorsOrigin"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix: Worker CORS 허용 Origin 추가"
|
|
|
|
[[pair]]
|
|
name = "capgo-app-hono-4dadd2"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "AGPL-3.0"
|
|
repo = "Cap-go/capgo.app"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "4dadd2580d02213d227a331eee0232aa59859b59"
|
|
parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899"
|
|
commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59"
|
|
vuln = "capgo-app-hono-4dadd2/vuln.ts"
|
|
fixed = "capgo-app-hono-4dadd2/fixed.ts"
|
|
relpath = "supabase/functions/_backend/utils/hono.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "supabase/functions/_backend/utils/hono.ts"
|
|
function = "createHono"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)"
|
|
|
|
[[pair]]
|
|
name = "career-copilot-matches-eaa75e"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "ahmednashatnoaman-svg/career-copilot"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "eaa75e6b04449a69fcae82461eca3bd67931f8c9"
|
|
parent = "6dacd24d8c300eab5eb69b605ffafad68a60c008"
|
|
commit_url = "https://github.com/ahmednashatnoaman-svg/career-copilot/commit/eaa75e6b04449a69fcae82461eca3bd67931f8c9"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/api/matches.py"
|
|
mode = "hunk"
|
|
relpath = "app/api/matches.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "app/api/matches.py"
|
|
function = "list_matches"
|
|
mechanism = "identity_from_request_body"
|
|
evidence = "security: fix IDOR in matches API — use request.state.user_id instead of query param"
|
|
|
|
[[pair]]
|
|
name = "chatpro-index-99dcd3"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "anggiadiputra/chatpro"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "99dcd3c09a3648cb56e2335047ffffff500959fc"
|
|
parent = "237ccac69ce0986b8d0ef7f5f295a0aaff8979cb"
|
|
commit_url = "https://github.com/anggiadiputra/chatpro/commit/99dcd3c09a3648cb56e2335047ffffff500959fc"
|
|
vendored = false
|
|
host = "github"
|
|
path = "apps/backend/src/index.ts"
|
|
mode = "hunk"
|
|
relpath = "apps/backend/src/index.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "apps/backend/src/index.ts"
|
|
function = "origin"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix(auth): allow Turnstile token in CORS preflight"
|
|
|
|
[[pair]]
|
|
name = "comp-6000-capstone2-index-388195"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "SpaceRobot-268369/COMP-6000-Capstone2"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "388195676bb0fec13a4d1163f6cb5c7155198e97"
|
|
parent = "a4c42810ee353ad87e6dc8f7f751c0dc8375a42d"
|
|
commit_url = "https://github.com/SpaceRobot-268369/COMP-6000-Capstone2/commit/388195676bb0fec13a4d1163f6cb5c7155198e97"
|
|
vendored = false
|
|
host = "github"
|
|
path = "backend/src/index.js"
|
|
mode = "hunk"
|
|
relpath = "backend/src/index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "backend/src/index.js"
|
|
function = "origin"
|
|
mechanism = "permissive_default"
|
|
evidence = "Fix backend CORS origin reflection"
|
|
|
|
[[pair]]
|
|
name = "dnf-plugin-anyrepo-config-26d19a"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "Apache-2.0"
|
|
repo = "jfut/dnf-plugin-anyrepo"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
|
parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a"
|
|
commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
|
|
vuln = "dnf-plugin-anyrepo-config-26d19a/vuln.py"
|
|
fixed = "dnf-plugin-anyrepo-config-26d19a/fixed.py"
|
|
relpath = "dnf_plugin_anyrepo/config.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "dnf_plugin_anyrepo/config.py"
|
|
function = "validate_repo_name"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "fix(config): prevent path traversal in repository names"
|
|
|
|
[[pair]]
|
|
name = "easy-q-api-a31c36"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "LucRoDZ/EASY-.Q"
|
|
cve = ""
|
|
cwe = "CWE-862"
|
|
commit = "a31c36230f3902a3c2a4aa191de2528dd5993620"
|
|
parent = "f9b8fac326e9c45522bf8008dfedf6875b2449f6"
|
|
commit_url = "https://github.com/LucRoDZ/EASY-.Q/commit/a31c36230f3902a3c2a4aa191de2528dd5993620"
|
|
vendored = false
|
|
host = "github"
|
|
path = "frontend/src/api.js"
|
|
mode = "hunk"
|
|
relpath = "frontend/src/api.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-862"
|
|
class = "missing authorization"
|
|
path = "frontend/src/api.js"
|
|
function = "listTables"
|
|
mechanism = "missing_auth_guard"
|
|
evidence = "fix(auth): add Bearer token to all missing authenticated API calls"
|
|
|
|
[[pair]]
|
|
name = "edutrace-page-ee7ba2"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "Apache-2.0"
|
|
repo = "jardimdesoftware/edutrace"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
|
parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd"
|
|
commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
|
|
vuln = "edutrace-page-ee7ba2/vuln.tsx"
|
|
fixed = "edutrace-page-ee7ba2/fixed.tsx"
|
|
relpath = "front/src/app/editar-anamnese/page.tsx"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "front/src/app/editar-anamnese/page.tsx"
|
|
function = "handleInputChange"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado"
|
|
|
|
[[pair]]
|
|
name = "ems-contract-analyzer-app-00884c"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "chgreer1070/ems-contract-analyzer"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "00884c98d1c43db4b647077e7f30d0ec84eaccb9"
|
|
parent = "440c38fd0a48dc70f183f2bd972258a1dc17c45e"
|
|
commit_url = "https://github.com/chgreer1070/ems-contract-analyzer/commit/00884c98d1c43db4b647077e7f30d0ec84eaccb9"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app.py"
|
|
mode = "hunk"
|
|
relpath = "app.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "app.py"
|
|
function = "analyze"
|
|
mechanism = "path_join_user_input"
|
|
sink = "path"
|
|
evidence = "Fix security issues: path traversal, debug mode, migrate PyPDF2 to pypdf"
|
|
|
|
[[pair]]
|
|
name = "enterprise-ai-lakehouse-platform-main-11e36d"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "KIRAN4056/enterprise-ai-lakehouse-platform"
|
|
cve = ""
|
|
cwe = "CWE-89"
|
|
commit = "11e36da584c79ee622faa0786a44a31d6fecf685"
|
|
parent = "5f6a17f4fb49752633c2b33c123609c1118ab883"
|
|
commit_url = "https://github.com/KIRAN4056/enterprise-ai-lakehouse-platform/commit/11e36da584c79ee622faa0786a44a31d6fecf685"
|
|
vendored = false
|
|
host = "github"
|
|
path = "processing/query-engine/python-engine/main.py"
|
|
mode = "hunk"
|
|
relpath = "processing/query-engine/python-engine/main.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "processing/query-engine/python-engine/main.py"
|
|
function = "execute_query"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: Address SQL injection vulnerabilities in query engine and MLflow services"
|
|
|
|
[[pair]]
|
|
name = "etude-lexical-markdown-editorconfig-c61a8b"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "dayflower/etude-lexical-markdown"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
|
parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5"
|
|
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
|
|
vuln = "etude-lexical-markdown-editorconfig-c61a8b/vuln.ts"
|
|
fixed = "etude-lexical-markdown-editorconfig-c61a8b/fixed.ts"
|
|
relpath = "src/config/editorConfig.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "src/config/editorConfig.ts"
|
|
function = "deepMergeInto"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix: guard deepMergeInto against prototype pollution"
|
|
|
|
[[pair]]
|
|
name = "etude-lexical-markdown-editorconfig-db4f54"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "dayflower/etude-lexical-markdown"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "db4f54b1ab80ad596de6425e84f90aa781c49999"
|
|
parent = "1c865815d05b072f4973388c3ac66b6696d9efde"
|
|
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999"
|
|
vuln = "etude-lexical-markdown-editorconfig-db4f54/vuln.ts"
|
|
fixed = "etude-lexical-markdown-editorconfig-db4f54/fixed.ts"
|
|
relpath = "src/config/editorConfig.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "src/config/editorConfig.ts"
|
|
function = "deepMergeInto"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix: make prototype pollution guard recognizable by CodeQL"
|
|
|
|
[[pair]]
|
|
name = "findconstructionstaffing-route-24edf4"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "boweiliu/findconstructionstaffing"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "24edf4ad9c506fcb7df7878f7c25827307863fb6"
|
|
parent = "ff1338c0f2d4bb27a2499f82a16b2908635ec66f"
|
|
commit_url = "https://github.com/boweiliu/findconstructionstaffing/commit/24edf4ad9c506fcb7df7878f7c25827307863fb6"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/auth/callback/route.ts"
|
|
mode = "hunk"
|
|
relpath = "app/auth/callback/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "app/auth/callback/route.ts"
|
|
function = "GET"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(auth): add open redirect protection and improve test types"
|
|
|
|
[[pair]]
|
|
name = "fitnesstracker-communityfoods-115204"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "JimmyMc1213/fitnesstracker"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "1152045961b896dca319f2dabc0467444a72d38c"
|
|
parent = "a9bc50f9b5fecaa3c8ddb739f327fdbd74972e52"
|
|
commit_url = "https://github.com/JimmyMc1213/fitnesstracker/commit/1152045961b896dca319f2dabc0467444a72d38c"
|
|
vendored = false
|
|
host = "github"
|
|
path = "src/fitness/communityFoods.ts"
|
|
mode = "hunk"
|
|
relpath = "src/fitness/communityFoods.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "src/fitness/communityFoods.ts"
|
|
function = "upsertCommunityFood"
|
|
mechanism = "permissive_default"
|
|
evidence = "Fix barcode scan saves to community_foods by handling upsert errors and RLS."
|
|
|
|
[[pair]]
|
|
name = "flytte24-views-8a5f7a"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "bogdantro/flytte24"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "8a5f7afbd901af696514842e6e174318802f1219"
|
|
parent = "63f71e32ec916f6a4cde737cbde262bd61185d56"
|
|
commit_url = "https://github.com/bogdantro/flytte24/commit/8a5f7afbd901af696514842e6e174318802f1219"
|
|
vendored = false
|
|
host = "github"
|
|
path = "apps/dashboard/views.py"
|
|
mode = "hunk"
|
|
relpath = "apps/dashboard/views.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "apps/dashboard/views.py"
|
|
function = "business_toggle_active"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: address final review findings (open redirect, missing confirm dialog, stylesheet path, seeded illustrations, rating validation)"
|
|
|
|
[[pair]]
|
|
name = "fusmle-index-47f075"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "am-gs/FUSMLE"
|
|
cve = ""
|
|
cwe = "CWE-798"
|
|
commit = "47f07502c588a2aaf9cf8d75aa918d51fd114bb1"
|
|
parent = "b216e440fef42b38f33dbdcd61bee98d6407aa51"
|
|
commit_url = "https://github.com/am-gs/FUSMLE/commit/47f07502c588a2aaf9cf8d75aa918d51fd114bb1"
|
|
vendored = false
|
|
host = "github"
|
|
path = "vercel/uworld-api-deploy/index.py"
|
|
mode = "hunk"
|
|
relpath = "vercel/uworld-api-deploy/index.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-798"
|
|
class = "hardcoded credentials"
|
|
path = "vercel/uworld-api-deploy/index.py"
|
|
function = "qbank_generate_test"
|
|
mechanism = "secret_in_client"
|
|
evidence = "security: fix vulnerable deps, restrict CORS, drop hardcoded secret, validate input"
|
|
|
|
[[pair]]
|
|
name = "green-mobile-offline-backend-example-482952"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "aurelien-sema/GREEN-mobile-offline"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "482952a41b9abb23bfcb726a97c6cca72c5165a1"
|
|
parent = "75af5411ff56de45f979d8abd60b69d915ed2198"
|
|
commit_url = "https://github.com/aurelien-sema/GREEN-mobile-offline/commit/482952a41b9abb23bfcb726a97c6cca72c5165a1"
|
|
vendored = false
|
|
host = "github"
|
|
path = "backend_example.py"
|
|
mode = "hunk"
|
|
relpath = "backend_example.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "backend_example.py"
|
|
function = "detect_disease"
|
|
mechanism = "path_join_user_input"
|
|
sink = "open"
|
|
evidence = "security: fix hardcoded signing password, path traversal, cleartext traffic, weak PBKDF2 & CORS"
|
|
|
|
[[pair]]
|
|
name = "iterviz-orchestrator-c59620"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Ezimakyu/IterViz"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "c59620161a32a1e3c1ab332fd5e487fa1a101e16"
|
|
parent = "62341c4b967b8361080b918a62891e0bdb6b570d"
|
|
commit_url = "https://github.com/Ezimakyu/IterViz/commit/c59620161a32a1e3c1ab332fd5e487fa1a101e16"
|
|
vendored = false
|
|
host = "github"
|
|
path = "backend/app/orchestrator.py"
|
|
mode = "hunk"
|
|
relpath = "backend/app/orchestrator.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "backend/app/orchestrator.py"
|
|
function = "create_assignments"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "fix(m5): address Devin Review issues (path traversal, idempotency, ws race)"
|
|
|
|
[[pair]]
|
|
name = "jogo-da-velha-rotas-326bac"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Moon15810/jogo-da-velha"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "326bac6435718a958d9ef41ec5339077c89ff64a"
|
|
parent = "351095cda75f65fce82218b792136bea6d863d4c"
|
|
commit_url = "https://github.com/Moon15810/jogo-da-velha/commit/326bac6435718a958d9ef41ec5339077c89ff64a"
|
|
vendored = false
|
|
host = "github"
|
|
path = "plataforma/auth/rotas.py"
|
|
mode = "hunk"
|
|
relpath = "plataforma/auth/rotas.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "plataforma/auth/rotas.py"
|
|
function = "login"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: valida o parametro next no login (evita open redirect)"
|
|
|
|
[[pair]]
|
|
name = "joidy-main-a2fa2c"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Axel-DaMage/joidy"
|
|
cve = ""
|
|
cwe = "CWE-89"
|
|
commit = "a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7"
|
|
parent = "c26b1055eae2d74ed7d51c860adc6864c75f19a6"
|
|
commit_url = "https://github.com/Axel-DaMage/joidy/commit/a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7"
|
|
vendored = false
|
|
host = "github"
|
|
path = "ai-service/main.py"
|
|
mode = "hunk"
|
|
relpath = "ai-service/main.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "ai-service/main.py"
|
|
function = "cluster_notes"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "execute"
|
|
evidence = "fix(ai-service): fix connection leak and SQL injection in /cluster endpoint (#614)"
|
|
|
|
[[pair]]
|
|
name = "learnly-page-a4c6b2"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "ParanyuLion/Learnly"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "a4c6b2259340151fbc0411ad1c778d3caa2aea76"
|
|
parent = "30b667e4dfbaac7b6f380ea3a53fafbc41a65795"
|
|
commit_url = "https://github.com/ParanyuLion/Learnly/commit/a4c6b2259340151fbc0411ad1c778d3caa2aea76"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/login/page.tsx"
|
|
mode = "hunk"
|
|
relpath = "app/login/page.tsx"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "app/login/page.tsx"
|
|
function = "submit"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: validate login redirect target to prevent open redirect (final review fix)"
|
|
|
|
[[pair]]
|
|
name = "lensops-kubernetesmanagement-fe4910"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "amitknigam84/lensops"
|
|
cve = ""
|
|
cwe = "CWE-862"
|
|
commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
|
parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748"
|
|
commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
|
|
vuln = "lensops-kubernetesmanagement-fe4910/vuln.tsx"
|
|
fixed = "lensops-kubernetesmanagement-fe4910/fixed.tsx"
|
|
relpath = "components/KubernetesManagement.tsx"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
known_limit = "client_side_caller"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-862"
|
|
class = "missing authorization"
|
|
path = "components/KubernetesManagement.tsx"
|
|
function = "loadNamespaces"
|
|
mechanism = "missing_auth_guard"
|
|
family = "access_control"
|
|
evidence = "Fix missing auth header on namespaces API call"
|
|
|
|
[[pair]]
|
|
name = "market-cap-route-4f8ae9"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "navaneethbv/market-cap"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
|
parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602"
|
|
commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
|
|
vuln = "market-cap-route-4f8ae9/vuln.ts"
|
|
fixed = "market-cap-route-4f8ae9/fixed.ts"
|
|
relpath = "app/auth/confirm/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "app/auth/confirm/route.ts"
|
|
function = "GET"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "Fix open redirects on the auth next param"
|
|
|
|
[[pair]]
|
|
name = "melodix-playerprovider-089931"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "alexshao3/melodix"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
|
parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7"
|
|
commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13"
|
|
vuln = "melodix-playerprovider-089931/vuln.tsx"
|
|
fixed = "melodix-playerprovider-089931/fixed.tsx"
|
|
relpath = "apps/miniapp/src/components/PlayerProvider.tsx"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "apps/miniapp/src/components/PlayerProvider.tsx"
|
|
function = "PlayerProvider"
|
|
mechanism = "permissive_default"
|
|
evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors"
|
|
|
|
[[pair]]
|
|
name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "handielson/Mercado-do-vale-news"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
|
parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc"
|
|
commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598"
|
|
vuln = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/vuln.ts"
|
|
fixed = "mercado-do-vale-news-catalogmetadataservice-9b5fcf/fixed.ts"
|
|
relpath = "services/catalogMetadataService.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "services/catalogMetadataService.ts"
|
|
function = "fetchMetadata"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix(catalog): avoid metadata cors preflight"
|
|
|
|
[[pair]]
|
|
name = "money-track-category-icons-4d4a5b"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "andrebubniak/money-track"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
|
parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2"
|
|
commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
|
|
vuln = "money-track-category-icons-4d4a5b/vuln.ts"
|
|
fixed = "money-track-category-icons-4d4a5b/fixed.ts"
|
|
relpath = "src/lib/category-icons.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "src/lib/category-icons.ts"
|
|
function = "isCategoryIcon"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard"
|
|
|
|
[[pair]]
|
|
name = "nestjs-filter-normalizer-aa0e60"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "DavideCarvalho/nestjs-filter"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
|
parent = "d899b40d3466f2ffbe9f01c4d49267412401f078"
|
|
commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8"
|
|
vuln = "nestjs-filter-normalizer-aa0e60/vuln.ts"
|
|
fixed = "nestjs-filter-normalizer-aa0e60/fixed.ts"
|
|
relpath = "packages/core/src/input/normalizer.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "packages/core/src/input/normalizer.ts"
|
|
function = "normalizeInput"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix(core): add prototype pollution guard to normalizeInput"
|
|
|
|
[[pair]]
|
|
name = "neutral-server-033e5f"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "El-Ninjo1965/Neutral"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd"
|
|
parent = "9eb92fb1b843f4e558c72549264a9156930bf72a"
|
|
commit_url = "https://github.com/El-Ninjo1965/Neutral/commit/033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd"
|
|
vendored = false
|
|
host = "github"
|
|
path = "server/bootstrap/server.js"
|
|
mode = "hunk"
|
|
relpath = "server/bootstrap/server.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "server/bootstrap/server.js"
|
|
function = "sendJson"
|
|
mechanism = "permissive_default"
|
|
evidence = "Fix PHP setup save and CORS bootstrap"
|
|
|
|
[[pair]]
|
|
name = "new-erp-final-app-6e9644"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "Apache-2.0"
|
|
repo = "Sachin-Salgar/NEW_ERP_FINAL"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
|
parent = "08976c5d7a07b0663669b875b4507446199f85d7"
|
|
commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59"
|
|
vuln = "new-erp-final-app-6e9644/vuln.ts"
|
|
fixed = "new-erp-final-app-6e9644/fixed.ts"
|
|
relpath = "src/presentation/http/app.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "src/presentation/http/app.ts"
|
|
function = "createApplication"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix: allow patch requests through cors"
|
|
|
|
[[pair]]
|
|
name = "nimestream-route-d17f53"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "Irnhakim/nimestream"
|
|
cve = ""
|
|
cwe = "CWE-918"
|
|
commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
|
parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0"
|
|
commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43"
|
|
vuln = "nimestream-route-d17f53/vuln.js"
|
|
fixed = "nimestream-route-d17f53/fixed.js"
|
|
relpath = "app/api/img/route.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "app/api/img/route.js"
|
|
function = "GET"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API"
|
|
|
|
[[pair]]
|
|
name = "niners-initializecollections-b90f9c"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Ja9vill/Niners"
|
|
cve = ""
|
|
cwe = "CWE-798"
|
|
commit = "b90f9c325cf63cc6fe39dd046606301c2af9d119"
|
|
parent = "3e828f4f08ea0d09181226857c71e6e6b725bdff"
|
|
commit_url = "https://github.com/Ja9vill/Niners/commit/b90f9c325cf63cc6fe39dd046606301c2af9d119"
|
|
vendored = false
|
|
host = "github"
|
|
path = "scripts/initializeCollections.js"
|
|
mode = "hunk"
|
|
relpath = "scripts/initializeCollections.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-798"
|
|
class = "hardcoded credentials"
|
|
path = "scripts/initializeCollections.js"
|
|
function = "runInitialization"
|
|
mechanism = "secret_in_client"
|
|
evidence = "fix(security): harden auth, remove hardcoded secrets, protect endpoints"
|
|
|
|
[[pair]]
|
|
name = "nuvanx-siteground-validate-page-templates-7ccb5b"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "NUVANX-Medicina-Estetica-Laser/nuvanx-siteground"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7"
|
|
parent = "0dc8e7b6cf3f3d3586b136c96bca56658872e4a8"
|
|
commit_url = "https://github.com/NUVANX-Medicina-Estetica-Laser/nuvanx-siteground/commit/7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7"
|
|
vendored = false
|
|
host = "github"
|
|
path = "scripts/validate-page-templates.mjs"
|
|
mode = "hunk"
|
|
relpath = "scripts/validate-page-templates.mjs"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "scripts/validate-page-templates.mjs"
|
|
function = "templateExists"
|
|
mechanism = "path_join_user_input"
|
|
sink = "path"
|
|
evidence = "fix(security): prevent path traversal in template validation"
|
|
|
|
[[pair]]
|
|
name = "openniw-jobs-0fc947"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "HHHHHejia/openniw"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
|
parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc"
|
|
commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
|
|
vuln = "openniw-jobs-0fc947/vuln.py"
|
|
fixed = "openniw-jobs-0fc947/fixed.py"
|
|
relpath = "backend/app/routers/jobs.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "backend/app/routers/jobs.py"
|
|
function = "get_job"
|
|
mechanism = "identity_from_request_body"
|
|
family = "access_control"
|
|
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
|
|
|
[[pair]]
|
|
name = "openniw-jobs-b74de3"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "ziyuzuo/openniw"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
|
parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e"
|
|
commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
|
|
vuln = "openniw-jobs-b74de3/vuln.py"
|
|
fixed = "openniw-jobs-b74de3/fixed.py"
|
|
relpath = "backend/app/routers/jobs.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "backend/app/routers/jobs.py"
|
|
function = "get_job"
|
|
mechanism = "identity_from_request_body"
|
|
family = "access_control"
|
|
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
|
|
|
|
[[pair]]
|
|
name = "overleaf-with-claude-exportscontroller-3980b9"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "AGPL-3.0"
|
|
repo = "ZUENS2020/overleaf-with-claude"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
|
parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed"
|
|
commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431"
|
|
vuln = "overleaf-with-claude-exportscontroller-3980b9/vuln.mjs"
|
|
fixed = "overleaf-with-claude-exportscontroller-3980b9/fixed.mjs"
|
|
relpath = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.context]]
|
|
relpath = "services/web/app/src/router.mjs"
|
|
vuln = "overleaf-with-claude-exportscontroller-3980b9/context/vuln/services/web/app/src/router.mjs"
|
|
fixed = "overleaf-with-claude-exportscontroller-3980b9/context/fixed/services/web/app/src/router.mjs"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "services/web/app/src/Features/Exports/ExportsController.mjs"
|
|
function = "exportProject"
|
|
mechanism = "identity_from_request_body"
|
|
family = "access_control"
|
|
evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)"
|
|
|
|
[[pair]]
|
|
name = "popmark-editorconfig-e5ac40"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "dayflower/popmark"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "e5ac407cef37c37178d440541ede301c838640fb"
|
|
parent = "31d1ac79b4cfa3118597348e79800a6561115149"
|
|
commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb"
|
|
vuln = "popmark-editorconfig-e5ac40/vuln.ts"
|
|
fixed = "popmark-editorconfig-e5ac40/fixed.ts"
|
|
relpath = "src/lexical-markdown/config/editorConfig.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "src/lexical-markdown/config/editorConfig.ts"
|
|
function = "deepMergeInto"
|
|
mechanism = "prototype_pollution"
|
|
evidence = "fix: guard deepMergeInto against prototype pollution"
|
|
|
|
[[pair]]
|
|
name = "rag-pipeline-utils-config-handler-76e5f0"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "DevilsDev/rag-pipeline-utils"
|
|
cve = ""
|
|
cwe = "CWE-1321"
|
|
commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
|
parent = "ba587867118f703632ff2dc63c4feb8ad6793420"
|
|
commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7"
|
|
vuln = "rag-pipeline-utils-config-handler-76e5f0/vuln.js"
|
|
fixed = "rag-pipeline-utils-config-handler-76e5f0/fixed.js"
|
|
relpath = "src/cli/handlers/config-handler.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-1321"
|
|
class = "prototype pollution"
|
|
path = "src/cli/handlers/config-handler.js"
|
|
function = "handleConfigSet"
|
|
mechanism = "prototype_pollution"
|
|
sink = "path"
|
|
evidence = "fix(security): prevent prototype pollution in config-handler"
|
|
|
|
[[pair]]
|
|
name = "registry-proxy-worker-426847"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "agents-repo/registry-proxy"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
|
parent = "6d5937972510cdb5ebca30607b538fdc2e280094"
|
|
commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
|
|
vuln = "registry-proxy-worker-426847/vuln.js"
|
|
fixed = "registry-proxy-worker-426847/fixed.js"
|
|
relpath = "src/worker.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "src/worker.js"
|
|
function = "buildUpstreamRequest"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)"
|
|
|
|
[[pair]]
|
|
name = "shift-left-or-die-database-68a00a"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Krystian-key/shift-left-or-die"
|
|
cve = ""
|
|
cwe = "CWE-89"
|
|
commit = "68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb"
|
|
parent = "353a8b384eb24faf34ae11fdcaf2d02b6f74f3bc"
|
|
commit_url = "https://github.com/Krystian-key/shift-left-or-die/commit/68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/database.py"
|
|
mode = "hunk"
|
|
relpath = "app/database.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "app/database.py"
|
|
function = "search_scans_by_query"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "execute"
|
|
evidence = "Fix SQL Injection: Replace f-string SQL with parameterized SQLAlchemy ORM query"
|
|
|
|
[[pair]]
|
|
name = "signaldigest-route-8ca292"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "bwaide/SignalDigest"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "8ca29233dd9f4603891f626216be6dfd352b0045"
|
|
parent = "8f7eb45c5c7cd8ffa71fa3d53730688ab147cf51"
|
|
commit_url = "https://github.com/bwaide/SignalDigest/commit/8ca29233dd9f4603891f626216be6dfd352b0045"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/auth/callback/route.ts"
|
|
mode = "hunk"
|
|
relpath = "app/auth/callback/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2025"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "app/auth/callback/route.ts"
|
|
function = "GET"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix: prevent open redirect vulnerability in auth callback"
|
|
|
|
[[pair]]
|
|
name = "soulclaw-pw-session-1346a0"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "clawsouls/soulclaw"
|
|
cve = ""
|
|
cwe = "CWE-918"
|
|
commit = "1346a0a62342e86cd083f5373a21cfe0678424ee"
|
|
parent = "60712ab1b2f57d180c77d3f25f41837d047309c1"
|
|
commit_url = "https://github.com/clawsouls/soulclaw/commit/1346a0a62342e86cd083f5373a21cfe0678424ee"
|
|
vendored = false
|
|
host = "github"
|
|
path = "extensions/browser/src/browser/pw-session.ts"
|
|
mode = "hunk"
|
|
relpath = "extensions/browser/src/browser/pw-session.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "extensions/browser/src/browser/pw-session.ts"
|
|
function = "isTopLevelNavigationRequest"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
|
|
|
|
[[pair]]
|
|
name = "supplieradvisor-mvp-route-387bcf"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "bigfivefoods/supplieradvisor-mvp"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
|
parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b"
|
|
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8"
|
|
vuln = "supplieradvisor-mvp-route-387bcf/vuln.ts"
|
|
fixed = "supplieradvisor-mvp-route-387bcf/fixed.ts"
|
|
relpath = "app/api/customers/claims/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "app/api/customers/claims/route.ts"
|
|
function = "PATCH"
|
|
mechanism = "identity_from_request_body"
|
|
family = "access_control"
|
|
evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)"
|
|
|
|
[[pair]]
|
|
name = "supplieradvisor-mvp-route-a69e8f"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "bigfivefoods/supplieradvisor-mvp"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
|
parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c"
|
|
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1"
|
|
vuln = "supplieradvisor-mvp-route-a69e8f/vuln.ts"
|
|
fixed = "supplieradvisor-mvp-route-a69e8f/fixed.ts"
|
|
relpath = "app/api/customers/opportunities/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "app/api/customers/opportunities/route.ts"
|
|
function = "GET"
|
|
mechanism = "identity_from_request_body"
|
|
family = "access_control"
|
|
evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)"
|
|
|
|
[[pair]]
|
|
name = "tabletap-safe-next-33ff1b"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "chitkid/tabletap"
|
|
cve = ""
|
|
cwe = "CWE-601"
|
|
commit = "33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5"
|
|
parent = "3871de5c3523283a65132250a38aa8650a865f49"
|
|
commit_url = "https://github.com/chitkid/tabletap/commit/33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5"
|
|
vendored = false
|
|
host = "github"
|
|
path = "apps/web/lib/safe-next.ts"
|
|
mode = "hunk"
|
|
relpath = "apps/web/lib/safe-next.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-601"
|
|
class = "open redirect"
|
|
path = "apps/web/lib/safe-next.ts"
|
|
function = "safeNext"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(web): close the backslash open redirect in safeNext"
|
|
|
|
[[pair]]
|
|
name = "tools-cli-tools-a96bc0"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "D-sorganization/Tools"
|
|
cve = ""
|
|
cwe = "CWE-78"
|
|
commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
|
parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864"
|
|
commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a"
|
|
vuln = "tools-cli-tools-a96bc0/vuln.py"
|
|
fixed = "tools-cli-tools-a96bc0/fixed.py"
|
|
relpath = "src/shared/python/ai/tools/cli_tools.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "src/shared/python/ai/tools/cli_tools.py"
|
|
function = "_is_command_allowed"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)"
|
|
|
|
[[pair]]
|
|
name = "tracechantier-web-route-cbdafd"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "TraceChantier/tracechantier-web"
|
|
cve = ""
|
|
cwe = "CWE-639"
|
|
commit = "cbdafd847aeea247f42482e169267558b201d434"
|
|
parent = "bd44165738fef8c37679eaf18eefe52eb05bb018"
|
|
commit_url = "https://github.com/TraceChantier/tracechantier-web/commit/cbdafd847aeea247f42482e169267558b201d434"
|
|
vendored = false
|
|
host = "github"
|
|
path = "app/api/modifier-chantier/route.ts"
|
|
mode = "hunk"
|
|
relpath = "app/api/modifier-chantier/route.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-639"
|
|
class = "insecure direct object reference"
|
|
path = "app/api/modifier-chantier/route.ts"
|
|
function = "POST"
|
|
mechanism = "identity_from_request_body"
|
|
evidence = "Update video copy + fix IDOR on zone deletion"
|
|
|
|
[[pair]]
|
|
name = "trackly-cli-path-diagnostics-1c1aed"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "trackly-app/trackly-cli"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "1c1aed89b07edb04051830c8f086e02b65e961c6"
|
|
parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60"
|
|
commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6"
|
|
vuln = "trackly-cli-path-diagnostics-1c1aed/vuln.js"
|
|
fixed = "trackly-cli-path-diagnostics-1c1aed/fixed.js"
|
|
relpath = "lib/path-diagnostics.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "lib/path-diagnostics.js"
|
|
function = "inspectExistingAncestor"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "fix(apply): report blocked path traversal"
|
|
|
|
[[pair]]
|
|
name = "unimart-backend-auth-controller-3ee79a"
|
|
slice = "agent-vfc"
|
|
language = "javascript"
|
|
origin = "github-agent-trailer"
|
|
license = "unlicensed"
|
|
repo = "Richmond-24/unimart-backend"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8"
|
|
parent = "58e26326cc1f5c01bef96461136ebcb9388fba5d"
|
|
commit_url = "https://github.com/Richmond-24/unimart-backend/commit/3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8"
|
|
vendored = false
|
|
host = "github"
|
|
path = "src/controllers/auth.controller.js"
|
|
mode = "hunk"
|
|
relpath = "src/controllers/auth.controller.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "src/controllers/auth.controller.js"
|
|
function = "register"
|
|
mechanism = "permissive_default"
|
|
evidence = "Fix signup hanging and CORS 'can't connect to server' errors"
|
|
|
|
[[pair]]
|
|
name = "upstreamdrift-local-server-c3a078"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "D-sorganization/UpstreamDrift"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "c3a0787080489b30e2ed0abfac03b51e45da184b"
|
|
parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc"
|
|
commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b"
|
|
vuln = "upstreamdrift-local-server-c3a078/vuln.py"
|
|
fixed = "upstreamdrift-local-server-c3a078/fixed.py"
|
|
relpath = "src/api/local_server.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "src/api/local_server.py"
|
|
function = "_find_logo_file"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "fix(api): harden local server path traversal (#2805) (#2839)"
|
|
|
|
[[pair]]
|
|
name = "waggledance-swarm-ssrf-host-guard-9a4548"
|
|
slice = "agent-vfc"
|
|
language = "python"
|
|
origin = "github-agent-trailer"
|
|
license = "Apache-2.0"
|
|
repo = "Ahkeratmehilaiset/waggledance-swarm"
|
|
cve = ""
|
|
cwe = "CWE-918"
|
|
commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
|
parent = "934b939f1cca5259eaf807db3319eb97b90d8d80"
|
|
commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b"
|
|
vuln = "waggledance-swarm-ssrf-host-guard-9a4548/vuln.py"
|
|
fixed = "waggledance-swarm-ssrf-host-guard-9a4548/fixed.py"
|
|
relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "waggledance/core/v3_13_0/ssrf_host_guard.py"
|
|
function = "normalize_allowed_hosts"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)"
|
|
|
|
[[pair]]
|
|
name = "workers-research-utils-209444"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "G4brym/workers-research"
|
|
cve = ""
|
|
cwe = "CWE-89"
|
|
commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
|
parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4"
|
|
commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e"
|
|
vuln = "workers-research-utils-209444/vuln.ts"
|
|
fixed = "workers-research-utils-209444/fixed.ts"
|
|
relpath = "src/utils.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "holdout"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "src/utils.ts"
|
|
function = "getGoogleProvider"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "Fix SQL injection in search by using parameterized queries (#41)"
|
|
|
|
[[pair]]
|
|
name = "zoonk-origin-bfbf67"
|
|
slice = "agent-vfc"
|
|
language = "typescript"
|
|
origin = "github-agent-trailer"
|
|
license = "MIT"
|
|
repo = "zoonk/zoonk"
|
|
cve = ""
|
|
cwe = "CWE-16"
|
|
commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
|
parent = "2604269350bff51f58572c133b45010cb0976a5a"
|
|
commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31"
|
|
vuln = "zoonk-origin-bfbf67/vuln.ts"
|
|
fixed = "zoonk-origin-bfbf67/fixed.ts"
|
|
relpath = "packages/utils/src/origin.ts"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "agent"
|
|
split = "train"
|
|
review_tier = "title"
|
|
fix_date = "2026"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-16"
|
|
class = "permissive default"
|
|
path = "packages/utils/src/origin.ts"
|
|
function = "getAllowedHosts"
|
|
mechanism = "permissive_default"
|
|
evidence = "fix(api): allow staging cors from previews (#1559)"
|