mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
822 B
822 B
VFC training catalog
Each JSONL row is one isolated snapshot: vuln (positive) or fixed (negative).
python3 benchmarks/pairs/vfc/generate_catalog.py
manifest.jsonl fields: id, pair, label (vuln|fixed), cve, year, cwe, project, file, relpath, license, commit, commit_url.
The JSONL is the training index. Pair eval (ousast pairs --slice vfc) is the honesty dashboard, not a merge gate.
Filter 2020–2026:
import json
from pathlib import Path
rows = [json.loads(line) for line in Path("benchmarks/pairs/vfc/training/manifest.jsonl").read_text().splitlines()]
recent = [row for row in rows if 2020 <= row["year"] <= 2026]
Do not treat this slice as a merge gate. Memory-safety pairs often LEAK after the fix; UAF/type-confusion often MISS inventory.