mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
c3e841003c
Tasks 3.3 and 4.1. - vfc curl and openssl-cve-2021-3449 excerpts re-harvested through the shared library: whole functions with upstream_start headers, the vendored key redacted code-safely, no truncated bodies. - vfc/recipes.toml carries mode, fix_path and function anchors; training/manifest.jsonl regenerated. - Juliet CWE-121 strcpy pair gets its buffer declarations back so the vulnerable side is a real overflow again. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
VFC training catalog
Each JSONL row is one isolated snapshot: vuln (positive) or fixed (negative).
python3 benchmarks/pairs/vfc/generate_catalog.py
manifest.jsonl fields: id, pair, label (vuln|fixed), cve, year, cwe, project, file, relpath, license, commit, commit_url.
The JSONL is the training index. Pair eval (ousast pairs --slice vfc) is the honesty dashboard, not a merge gate.
Filter 2020–2026:
import json
from pathlib import Path
rows = [json.loads(line) for line in Path("benchmarks/pairs/vfc/training/manifest.jsonl").read_text().splitlines()]
recent = [row for row in rows if 2020 <= row["year"] <= 2026]
Do not treat this slice as a merge gate. Memory-safety pairs often LEAK after the fix; UAF/type-confusion often MISS inventory.