mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5
3e71e9e88b
The catalog generator fills `fix_date` from the recipe at the precision the recipe has -- a full ISO day when one was recorded, otherwise the year. Every harvested recipe carries a year and almost none carries a day, and writing `-01-01` would turn a year into a claim about a month. A row counts as post-cutoff only when its earliest possible date is after the cutoff, so a coarse date can under-claim the clean slice but never over-claim it. Each family now reports the same numbers over the rows fixed after the cutoff, beside the whole number and never instead of it, with the undated count on its own line. Without a configured cutoff every scoreboard says so rather than inventing one: guessing a model's training cutoff and then publishing a contamination number from the guess would be worse than reporting none. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
vfc-js slice
Server-side JavaScript function pairs harvested from the upstream fix commits that
SecBench.js records in its package metadata
(fixCommit, sink). SecBench.js itself has no license file, so none of its files are vendored;
each excerpt carries the upstream package's license.
- Classes: command injection, path traversal, code injection first. Prototype pollution and ReDoS
rows may be added with their own mechanism and
known_limituntil the engine can talk about them. - Mode:
hunk(the function enclosing the first changed hunk on each side). - Provenance:
human.
Rebuild: python benchmarks/pairs/vfc-js/build_recipes.py --crawl /tmp/secbench.jsonl then
--from /tmp/secbench.jsonl, harvest.py --slice vfc-js --all --fetch, catalog_gen.py --slice vfc-js.