mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00

Files

T

Marius CiepluchandClaude Fable 5.1 8ab4207618 feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3.

- mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites.
- vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only
  because the LLM-generated repositories carry no license (escalated).
- vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0),
  SecBench.js itself is not vendored (no license); sinks derived on 13/17.
- agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus
  REVIEW.md; the loaded catalog stays empty until a human reviews them.
- datasets.toml and README document every slice and its review status.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

2026-09-05 10:45:42 +02:00

846 B

Raw Blame History

vfc-js slice

Server-side JavaScript function pairs harvested from the upstream fix commits that SecBench.js records in its package metadata (fixCommit, sink). SecBench.js itself has no license file, so none of its files are vendored; each excerpt carries the upstream package's license.

Classes: command injection, path traversal, code injection first. Prototype pollution and ReDoS rows may be added with their own mechanism and known_limit until the engine can talk about them.
Mode: hunk (the function enclosing the first changed hunk on each side).
Provenance: human.

Rebuild: python benchmarks/pairs/vfc-js/build_recipes.py --crawl /tmp/secbench.jsonl then --from /tmp/secbench.jsonl, harvest.py --slice vfc-js --all --fetch, catalog_gen.py --slice vfc-js.

846 B Raw Blame History

vfc-js slice

846 B

Raw Blame History