mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
b1c5f36076
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.
- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
github advisory, agent-vfc title); reviewer = "pending" means title, a
named reviewer means reviewed, reviewed without a reviewer is rejected;
per_tier metrics in the payload; select_tier and GATING_TIERS for the
improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
row and training manifest row; title rows enter catalog.toml; the
catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
206 lines
5.9 KiB
TOML
206 lines
5.9 KiB
TOML
# Vuln-vs-fixed pair catalog. Isolated trees: the scanner sees only the vuln
|
|
# file or only the fixed file, never both. Do not add these names to
|
|
# LANGUAGE_MANIFESTS (stage-1 90% smoke gate stays on cheat-sheet fixtures).
|
|
|
|
[[pair]]
|
|
name = "local-python-vulnerable"
|
|
slice = "local"
|
|
language = "python"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
review_tier = "reviewed"
|
|
reviewer = "Marius Ciepluch"
|
|
vuln = "../fixtures/python-vulnerable/app.py"
|
|
fixed = "../fixtures/python-vulnerable/safe.py"
|
|
relpath = "app.py"
|
|
expected_from = "../manifests/python-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "local-javascript-vulnerable"
|
|
slice = "local"
|
|
language = "javascript"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
review_tier = "reviewed"
|
|
reviewer = "Marius Ciepluch"
|
|
vuln = "../fixtures/javascript-vulnerable/src/app.js"
|
|
fixed = "../fixtures/javascript-vulnerable/src/safe.js"
|
|
relpath = "src/app.js"
|
|
expected_from = "../manifests/javascript-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "local-cpp-buffer"
|
|
slice = "local"
|
|
language = "c_cpp"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
review_tier = "reviewed"
|
|
reviewer = "Marius Ciepluch"
|
|
vuln = "../fixtures/cpp-damn-vulnerable/src/buffer.cpp"
|
|
fixed = "../fixtures/cpp-damn-vulnerable/src/safe.cpp"
|
|
relpath = "src/buffer.cpp"
|
|
expected_from = "../manifests/cpp-damn-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-078-os-system"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "Internet-of-People/titania-os"
|
|
commit = "9b7805119938343fcac9dc929d8882f1d97cf14a"
|
|
commit_url = "https://github.com/Internet-of-People/titania-os/commit/9b7805119938343fcac9dc929d8882f1d97cf14a"
|
|
vuln = "github/sven-cwe-078-os-system/vuln.py"
|
|
fixed = "github/sven-cwe-078-os-system/fixed.py"
|
|
relpath = "vuedj/configtitania/views.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "vuedj/configtitania/views.py"
|
|
rule_id = "python-os-command"
|
|
sink = "os.system"
|
|
evidence = "os.system concatenates attacker-controlled username into a shell command"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-078-shell-true"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "Apache-2.0"
|
|
repo = "google/mobly"
|
|
commit = "3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee"
|
|
commit_url = "https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee"
|
|
vuln = "github/sven-cwe-078-shell-true/vuln.py"
|
|
fixed = "github/sven-cwe-078-shell-true/fixed.py"
|
|
relpath = "mobly/controllers/android_device_lib/adb.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "mobly/controllers/android_device_lib/adb.py"
|
|
rule_id = "python-shell-true"
|
|
sink = "subprocess"
|
|
evidence = "subprocess.Popen runs the command with shell=True"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-089-execute-percent"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "russ-lewis/ttt_-_python_cgi"
|
|
commit = "6096f43fd4b2d91211eec4614b7960c0816900da"
|
|
commit_url = "https://github.com/russ-lewis/ttt_-_python_cgi/commit/6096f43fd4b2d91211eec4614b7960c0816900da"
|
|
vuln = "github/sven-cwe-089-execute-percent/vuln.py"
|
|
fixed = "github/sven-cwe-089-execute-percent/fixed.py"
|
|
relpath = "cgi/common.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "cgi/common.py"
|
|
rule_id = "python-sql-injection"
|
|
sink = "execute"
|
|
evidence = "execute percent-formats attacker-controlled input into SQL"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-089-query-concat"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "pukkapies/urop2019"
|
|
commit = "3ca2e2c291d2d5fe262d20a8e0520bdfb622432b"
|
|
commit_url = "https://github.com/pukkapies/urop2019/commit/3ca2e2c291d2d5fe262d20a8e0520bdfb622432b"
|
|
vuln = "github/sven-cwe-089-query-concat/vuln.py"
|
|
fixed = "github/sven-cwe-089-query-concat/fixed.py"
|
|
relpath = "modules/query_lastfm.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "modules/query_lastfm.py"
|
|
sink = "SELECT"
|
|
evidence = "SQL query concatenates attacker-controlled tag_num"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "hutool-cve-2018-17297"
|
|
slice = "github"
|
|
language = "java"
|
|
origin = "cwe-bench-java"
|
|
license = "MulanPSL-2.0"
|
|
repo = "dromara/hutool"
|
|
cve = "CVE-2018-17297"
|
|
cwe = "CWE-22"
|
|
commit = "8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e"
|
|
parent = "fd77bb8718648f69a587046b735488a80123cc26"
|
|
commit_url = "https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e"
|
|
vuln = "github/hutool-cve-2018-17297/vuln/ZipUtil.java"
|
|
fixed = "github/hutool-cve-2018-17297/fixed/ZipUtil.java"
|
|
relpath = "cn/hutool/core/util/ZipUtil.java"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "cn/hutool/core/util/ZipUtil.java"
|
|
sink = "ZipEntry"
|
|
evidence = "zip entry name is joined onto the extract directory without a zip-slip check"
|
|
mechanism = "path_join_user_input"
|
|
|
|
[[pair]]
|
|
name = "node-serialize-cve-2017-5941"
|
|
slice = "github"
|
|
language = "javascript"
|
|
origin = "nvd"
|
|
license = "public-advisory-pattern"
|
|
cve = "CVE-2017-5941"
|
|
cwe = "CWE-95"
|
|
commit_url = "https://nvd.nist.gov/vuln/detail/CVE-2017-5941"
|
|
vuln = "github/node-serialize-cve-2017-5941/vuln.js"
|
|
fixed = "github/node-serialize-cve-2017-5941/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-95"
|
|
class = "code injection"
|
|
path = "index.js"
|
|
rule_id = "js-eval"
|
|
sink = "eval"
|
|
evidence = "eval executes attacker-controlled serialized input"
|
|
mechanism = "source_reaches_sink"
|