marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
Open_Ultra_SAST/benchmarks/pairs/vfc-js/recipes.toml
T
Marius CiepluchandClaude Fable 5.1 8ab4207618 feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary 
Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3.

- mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites.
- vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only
  because the LLM-generated repositories carry no license (escalated).
- vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0),
  SecBench.js itself is not vendored (no license); sinks derived on 13/17.
- agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus
  REVIEW.md; the loaded catalog stays empty until a human reviews them.
- datasets.toml and README document every slice and its review status.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-09-05 10:45:42 +02:00

603 lines
18 KiB
TOML
Raw Permalink Blame History

# vfc-js harvest recipes derived from SecBench.js fixCommit metadata by build_recipes.py.
# Excerpts come from the upstream package repository (its license), never from SecBench.js.
[[recipe]]
name = "angular-http-server-1-0-0"
host = "github"
repo = "simonh1000/angular-http-server"
parent = "d171a771a92e4685b24fb77cb894a7b7b8024c5c"
commit = "8bafc9577161469f5dea01e0b98ea9c525d063e9"
path = "angular-http-server.js"
mode = "hunk"
language = "javascript"
relpath = "angular-http-server.js"
license = "Apache-2.0"
cve = ""
year = 2018
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "angular-http-server"
sink_location = "angular-http-server.js:16:29"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink angular-http-server.js:16:29 fixed upstream in 8bafc9577161"
commit_url = "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9"
split = "train"
[[recipe]]
name = "apex-publish-static-files-2-0-0"
host = "github"
repo = "vincentmorneau/apex-publish-static-files"
parent = "8d28fe8a9a49e5ff3f61e239293b5646528e2915"
commit = "2209af8f2b65c24aa55ab757e0e05b958c16f063"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2018-16462"
year = 2018
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "apex-publish-static-files"
sink_location = "index.js:54:25"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:54:25 fixed upstream in 2209af8f2b65"
commit_url = "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063"
split = "holdout"
[[recipe]]
name = "arpping-2-0-0"
host = "github"
repo = "haf-decent/arpping"
parent = "ce9efe8ab7f059ddf45ae4f8f7587689ac3c068c"
commit = "0db06723f8c3c73a5cc0829c667d45cba25ca44d"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = ""
year = 2021
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "arpping"
sink_location = "index.js:120:13"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:120:13 fixed upstream in 0db06723f8c3"
commit_url = "https://github.com/haf-decent/arpping/commit/0db06723f8c3c73a5cc0829c667d45cba25ca44d"
split = "train"
[[recipe]]
name = "bestzip-2-1-6"
host = "github"
repo = "nfriedly/node-bestzip"
parent = "fcea252e52b6078eff6caf5531bd32c53fccb59f"
commit = "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
path = "lib/bestzip.js"
mode = "hunk"
language = "javascript"
relpath = "lib/bestzip.js"
license = "MIT"
cve = "CVE-2020-7730"
year = 2020
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "bestzip"
sink_location = "lib/bestzip.js:27:27"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/bestzip.js:27:27 fixed upstream in 45d4a901478c"
commit_url = "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
split = "holdout"
[[recipe]]
name = "clamscan-1-2-0"
host = "github"
repo = "kylefarris/clamscan"
parent = "d474da7b89c0d3397cd681e79c7bcc592bff144b"
commit = "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2020-7613"
year = 2020
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "clamscan"
sink_location = "index.js:495:36"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:495:36 fixed upstream in 5f557c970817"
commit_url = "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
split = "train"
[[recipe]]
name = "codecov-3-6-4"
host = "github"
repo = "codecov/codecov-node"
parent = "5f6cc62d4f83bf3a75c973868259798814cd231e"
commit = "c0711c656686e902af2cd92d6aecc8074de4d83d"
path = "lib/codecov.js"
mode = "hunk"
language = "javascript"
relpath = "lib/codecov.js"
license = "MIT"
cve = "CVE-2020-15123"
year = 2020
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "codecov"
sink_location = "lib/codecov.js:419:7"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/codecov.js:419:7 fixed upstream in c0711c656686"
commit_url = "https://github.com/codecov/codecov-node/commit/c0711c656686e902af2cd92d6aecc8074de4d83d"
split = "holdout"
[[recipe]]
name = "crud-file-server-0-7-0"
host = "github"
repo = "omphalos/crud-file-server"
parent = "833e7fcc2bc8406b9c76836a51ae173f50c56bf0"
commit = "4fc3b404f718abb789f4ce4272c39c7a138c7a82"
path = "crud-file-server.js"
mode = "hunk"
language = "javascript"
relpath = "crud-file-server.js"
license = "Unlicense"
cve = "CVE-2018-3733"
year = 2018
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "crud-file-server"
sink_location = "crud-file-server.js:170:14"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink crud-file-server.js:170:14 fixed upstream in 4fc3b404f718"
commit_url = "https://github.com/omphalos/crud-file-server/commit/4fc3b404f718abb789f4ce4272c39c7a138c7a82"
split = "train"
[[recipe]]
name = "diskusage-ng-0-2-6"
host = "github"
repo = "iximiuz/node-diskusage-ng"
parent = "53c505506553c83861d1bd67823d6a382d3a5a43"
commit = "48e7e093486b528f0c81ec699573e0e4a431b8d3"
path = "lib/posix.js"
mode = "hunk"
language = "javascript"
relpath = "lib/posix.js"
license = "MIT"
cve = "CVE-2020-7631"
year = 2020
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "diskusage-ng"
sink_location = "lib/posix.js:11:5"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/posix.js:11:5 fixed upstream in 48e7e093486b"
commit_url = "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3"
split = "holdout"
[[recipe]]
name = "dns-sync-0-1-0"
host = "github"
repo = "skoranga/node-dns-sync"
parent = "b748fe77a87749d95876028eda8e759109be4c73"
commit = "d9abaae384b198db1095735ad9c1c73d7b890a0d"
path = "lib/dns-sync.js"
mode = "hunk"
language = "javascript"
relpath = "lib/dns-sync.js"
license = "MIT"
cve = "CVE-2014-9682"
year = 2014
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "dns-sync"
sink_location = "lib/dns-sync.js:21:26"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/dns-sync.js:21:26 fixed upstream in d9abaae384b1"
commit_url = "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d"
split = "train"
[[recipe]]
name = "get-npm-package-version-1-0-6"
host = "github"
repo = "hoperyy/get-npm-package-version"
parent = "52797864df09049ea28d65d14620774257a965b0"
commit = "40b1cf31a0607ea66f9e30a0c3af1383b52b2dec"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "ISC"
cve = "CVE-2020-7795"
year = 2021
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "get-npm-package-version"
sink_location = "index.js:16:48"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:16:48 fixed upstream in 40b1cf31a060"
commit_url = "https://github.com/hoperyy/get-npm-package-version/commit/40b1cf31a0607ea66f9e30a0c3af1383b52b2dec"
split = "holdout"
[[recipe]]
name = "glance-3-0-0"
host = "github"
repo = "jarofghosts/glance"
parent = "7e69a5539236386e747fb240ae87ea65ed64bb2c"
commit = "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2018-3715"
year = 2018
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "glance"
sink_location = "index.js:81:14"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink index.js:81:14 fixed upstream in 8cfd88e44ebd"
commit_url = "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
split = "train"
[[recipe]]
name = "hostr-2-0-0"
host = "github"
repo = "henrytseng/hostr"
parent = "5827ba48fd4a08c26604b97798c57d45fe1cd51e"
commit = "789a00047459fd80b6f0a9701a1378a47fb73ba8"
path = "lib/routes/statics.js"
mode = "hunk"
language = "javascript"
relpath = "lib/routes/statics.js"
license = "MIT"
cve = "CVE-2017-16029"
year = 2016
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "hostr"
sink_location = "lib/routes/static.js:56:27"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink lib/routes/static.js:56:27 fixed upstream in 789a00047459"
commit_url = "https://github.com/henrytseng/hostr/commit/789a00047459fd80b6f0a9701a1378a47fb73ba8"
split = "holdout"
[[recipe]]
name = "hot-formula-parser-3-0-0"
host = "github"
repo = "handsontable/formula-parser"
parent = "944136096f44ff4ffd4ba0bcef30970ca4702fce"
commit = "396b089738d4bf30eb570a4fe6a188affa95cd5e"
path = "src/grammar-parser/grammar-parser.js"
mode = "hunk"
language = "javascript"
relpath = "src/grammar-parser/grammar-parser.js"
license = "MIT"
cve = "CVE-2020-6836"
year = 2019
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "hot-formula-parser"
sink_location = "lib/grammar-parser/grammar-parser.js:258:31"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/grammar-parser/grammar-parser.js:258:31 fixed upstream in 396b089738d4"
commit_url = "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e"
split = "train"
[[recipe]]
name = "is-my-json-valid-2-20-0"
host = "github"
repo = "mafintosh/is-my-json-valid"
parent = "adf40bd9f22f6c9ee7d4c612c4193a7b835416bc"
commit = "3419563687df463b4ca709a2b46be8e15d6a2b3d"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = ""
year = 2020
cwe = "CWE-94"
class = "code injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "is-my-json-valid"
sink_location = "index.js:172:21"
secbench_class = "code-injection"
evidence = "SecBench.js code-injection sink index.js:172:21 fixed upstream in 3419563687df"
commit_url = "https://github.com/mafintosh/is-my-json-valid/commit/3419563687df463b4ca709a2b46be8e15d6a2b3d"
split = "holdout"
[[recipe]]
name = "libnmap-0-4-11"
host = "github"
repo = "jas-/node-libnmap"
parent = "49b72239b144ab7ffdf673b62e18bfd0760948f6"
commit = "c235b24b0342e12a5dbf502f89daabe95883b6c8"
path = "lib/classes/tools.js"
mode = "hunk"
language = "javascript"
relpath = "lib/classes/tools.js"
license = "MIT"
cve = "CVE-2018-16461"
year = 2018
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "libnmap"
sink_location = "lib/classes/tools.js:114:25"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/classes/tools.js:114:25 fixed upstream in c235b24b0342"
commit_url = "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8"
split = "train"
[[recipe]]
name = "node-simple-router-0-10-0"
host = "github"
repo = "sandy98/node-simple-router"
parent = "91da4299aee0086cc1e0cc837763578af6f82cea"
commit = "dfdd52e2e80607af433097d940b3834fd96df488"
path = "lib/router.js"
mode = "hunk"
language = "javascript"
relpath = "lib/router.js"
license = "MIT"
cve = "CVE-2017-16083"
year = 2017
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "node-simple-router"
sink_location = "lib/router.js:757:27"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink lib/router.js:757:27 fixed upstream in dfdd52e2e806"
commit_url = "https://github.com/sandy98/node-simple-router/commit/dfdd52e2e80607af433097d940b3834fd96df488"
split = "holdout"
[[recipe]]
name = "pdf-image-1-0-5"
host = "github"
repo = "roest01/node-pdf-image"
parent = "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff"
commit = "54679496a89738443917608c2bbe2f6e5dd20e83"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2018-3757"
year = 2018
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "pdf-image"
sink_location = "index.js:43:7"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:43:7 fixed upstream in 54679496a897"
commit_url = "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83"
split = "train"
[[recipe]]
name = "pidusage-1-0-0"
host = "github"
repo = "soyuka/pidusage"
parent = "e3660d8a8e5e61afad9b02af67356a1e239d6bde"
commit = "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
path = "lib/stats.js"
mode = "hunk"
language = "javascript"
relpath = "lib/stats.js"
license = "MIT"
cve = "CVE-2017-16034"
year = 2017
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "pidusage"
sink_location = "lib/stats.js:108:5"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink lib/stats.js:108:5 fixed upstream in b70eca15f7ca"
commit_url = "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
split = "holdout"
[[recipe]]
name = "portprocesses-1-0-4"
host = "github"
repo = "rrainn/PortProcesses"
parent = "fffceb09aff7180afbd0bd172e820404b33c8299"
commit = "86811216c9b97b01b5722f879f8c88a7aa4214e1"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2021-23348"
year = 2021
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "portprocesses"
sink_location = "exec.js:5:3"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink exec.js:5:3 fixed upstream in 86811216c9b9"
commit_url = "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1"
split = "train"
[[recipe]]
name = "serve-here-js-1-1-0"
host = "github"
repo = "ChristoPy/serve-here.js"
parent = "ad077637bf7a9fe0dee3262f011aed19a45ce92c"
commit = "cefb51d03290b6a88dd13143ab2de31b8cf57c39"
path = "source/response.js"
mode = "hunk"
language = "javascript"
relpath = "source/response.js"
license = "MIT"
cve = "CVE-2019-5444"
year = 2019
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "human"
origin = "secbench.js"
project = "serve-here.js"
sink_location = "source/server.js:27:15"
secbench_class = "path-traversal"
evidence = "SecBench.js path-traversal sink source/server.js:27:15 fixed upstream in cefb51d03290"
commit_url = "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39"
split = "holdout"
[[recipe]]
name = "static-eval-1-1-1"
host = "github"
repo = "browserify/static-eval"
parent = "5bba7905b0e797460b8f6c2e38ff6869146faab3"
commit = "32f8efd072625e267aa7237d2daff35738c50d2a"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = ""
year = 2019
cwe = "CWE-94"
class = "code injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "static-eval"
sink_location = "index.js:118:20"
secbench_class = "code-injection"
evidence = "SecBench.js code-injection sink index.js:118:20 fixed upstream in 32f8efd07262"
commit_url = "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a"
split = "train"
[[recipe]]
name = "thenify-3-3-0"
host = "github"
repo = "thenables/thenify"
parent = "aa21cfb64f47238c764d258d0faf7366a8487e36"
commit = "0d94a24eb933bc835d568f3009f4d269c4c4c17a"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2020-7677"
year = 2020
cwe = "CWE-94"
class = "code injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "thenify"
sink_location = "index.js:17:10"
secbench_class = "code-injection"
evidence = "SecBench.js code-injection sink index.js:17:10 fixed upstream in 0d94a24eb933"
commit_url = "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a"
split = "holdout"
[[recipe]]
name = "underscore-1-13-0-0"
host = "github"
repo = "jashkenas/underscore"
parent = "ef646ccbbbd971e82719c83fc69f56a5585b3a01"
commit = "4c73526d43838ad6ab43a6134728776632adeb66"
path = "modules/template.js"
mode = "hunk"
language = "javascript"
relpath = "modules/template.js"
license = "MIT"
cve = "CVE-2021-23358"
year = 2021
cwe = "CWE-94"
class = "code injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "underscore"
sink_location = "modules/template.js:71:14"
secbench_class = "code-injection"
evidence = "SecBench.js code-injection sink modules/template.js:71:14 fixed upstream in 4c73526d4383"
commit_url = "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66"
split = "train"
[[recipe]]
name = "whereis-0-4-0"
host = "github"
repo = "vvo/node-whereis"
parent = "b8b642b1163baa37f15ed49b4064dcbdb6e1876c"
commit = "0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
path = "index.js"
mode = "hunk"
language = "javascript"
relpath = "index.js"
license = "MIT"
cve = "CVE-2018-3772"
year = 2018
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "human"
origin = "secbench.js"
project = "whereis"
sink_location = "index.js:4:6"
secbench_class = "command-injection"
evidence = "SecBench.js command-injection sink index.js:4:6 fixed upstream in 0f64e3780235"
commit_url = "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
split = "holdout"
Reference in New Issue View Git Blame Copy Permalink