mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius CiepluchandClaude Opus 5
c2d9c4ad01
Eight of the ten vendored access-control rows had no named handler at all, so every one of them would have scored `missing_context` forever rather than as a detector miss. After the re-harvest nine are named and the tenth states its reason. The handler-context mode now carries the class its framework registers, multi-line decorators, and commented-out guards -- `#@token_required` above a ThreatByte handler is the entire bug. Where the registration lives in another document (connexion's `operationId`, an express router), a recipe names `context = [...]`, the harvester writes that stanza per side, and the pair materializes both files at their repository-relative paths so the entry-point mapper sees the layout the project has. `harvest_recipe` fetches every blob before the first write and the driver takes `--report`, so a failed fetch leaves a reviewed excerpt exactly as it was. Two defects the re-harvest exposed: `.mjs` was not a known suffix, so the one pair vendored as an ES module had no file target at all; and `_python_route_access` matched auth words inside decorator prose, reading `@ns.doc(description='... without proper authorization checks')` as a guard. Recorded in the hygiene artifact: nine of the ten duplicate groups sit on both sides of the split, which the repository-level split cannot see. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
428 lines
13 KiB
JSON
428 lines
13 KiB
JSON
{
|
|
"command": "python -c 'from openultrasast.pairs import ...; duplicate_groups / split_by_repository over the vendored catalog'",
|
|
"cross_split_duplicates": [
|
|
[
|
|
"curl-cve-2023-38545",
|
|
"curl-cve-2023-38545-do_socks5"
|
|
],
|
|
[
|
|
"etude-lexical-markdown-editorconfig-c61a8b",
|
|
"popmark-editorconfig-e5ac40"
|
|
],
|
|
[
|
|
"openniw-jobs-0fc947",
|
|
"openniw-jobs-b74de3"
|
|
],
|
|
[
|
|
"openssl-cve-2020-1967",
|
|
"openssl-cve-2020-1967-tls1_check_sig_alg"
|
|
],
|
|
[
|
|
"openssl-cve-2020-1971",
|
|
"openssl-cve-2020-1971-general_name_cmp"
|
|
],
|
|
[
|
|
"openssl-cve-2021-3712",
|
|
"openssl-cve-2021-3712-append_ia5"
|
|
],
|
|
[
|
|
"openssl-cve-2022-3602",
|
|
"openssl-cve-2022-3602-ossl_punycode_decode"
|
|
],
|
|
[
|
|
"openssl-cve-2022-3786",
|
|
"openssl-cve-2022-3786-ossl_punycode_decode"
|
|
],
|
|
[
|
|
"openssl-cve-2023-0286",
|
|
"openssl-cve-2023-0286-general_name_cmp"
|
|
]
|
|
],
|
|
"duplicate_groups": [
|
|
[
|
|
"anastasios-pw-session-14ec1a",
|
|
"astroclaw-pw-session-1553a8"
|
|
],
|
|
[
|
|
"curl-cve-2023-38545",
|
|
"curl-cve-2023-38545-do_socks5"
|
|
],
|
|
[
|
|
"etude-lexical-markdown-editorconfig-c61a8b",
|
|
"popmark-editorconfig-e5ac40"
|
|
],
|
|
[
|
|
"openniw-jobs-0fc947",
|
|
"openniw-jobs-b74de3"
|
|
],
|
|
[
|
|
"openssl-cve-2020-1967",
|
|
"openssl-cve-2020-1967-tls1_check_sig_alg"
|
|
],
|
|
[
|
|
"openssl-cve-2020-1971",
|
|
"openssl-cve-2020-1971-general_name_cmp"
|
|
],
|
|
[
|
|
"openssl-cve-2021-3712",
|
|
"openssl-cve-2021-3712-append_ia5"
|
|
],
|
|
[
|
|
"openssl-cve-2022-3602",
|
|
"openssl-cve-2022-3602-ossl_punycode_decode"
|
|
],
|
|
[
|
|
"openssl-cve-2022-3786",
|
|
"openssl-cve-2022-3786-ossl_punycode_decode"
|
|
],
|
|
[
|
|
"openssl-cve-2023-0286",
|
|
"openssl-cve-2023-0286-general_name_cmp"
|
|
]
|
|
],
|
|
"generated": "2026-09-06",
|
|
"identical_twins": [
|
|
"dsvw-dsvw-do-get",
|
|
"python-insecure-app-main-try-hack-me",
|
|
"pythonssti-main-read-root",
|
|
"vampi-books-get-by-title",
|
|
"vulnpy-deserialization-do-pickle-load"
|
|
],
|
|
"known_limit": [
|
|
"owasp-java-hash"
|
|
],
|
|
"note": "Repositories in `straddling` have pairs on both sides of the train/holdout split, so a learning path can be taught by one file of a repository and evaluated on another. Pairs in `duplicate_groups` share a vulnerable excerpt byte for byte after the provenance header is stripped. Both cap what any detector number can mean. Groups in `cross_split_duplicates` sit on both sides of the split while being the same code, so the train row teaches the holdout row exactly; forks of one project defeat the repository-level split.",
|
|
"straddling": [
|
|
[
|
|
"Contrast-Security-OSS/DjanGoat",
|
|
[
|
|
"djangoat-analytics-hits-by-ip",
|
|
"djangoat-views-reset-password",
|
|
"djangoat-views-user-view"
|
|
]
|
|
],
|
|
[
|
|
"Contrast-Security-OSS/vulnpy",
|
|
[
|
|
"vulnpy-cmdi-do-os-system",
|
|
"vulnpy-cmdi-do-subprocess-popen",
|
|
"vulnpy-deserialization-do-pickle-load"
|
|
]
|
|
],
|
|
[
|
|
"LinuxUser255/Vulnerable_Python_Apps",
|
|
[
|
|
"vulnerable-python-apps-bad-mvc-do-get",
|
|
"vulnerable-python-apps-dir-traversal-do-get"
|
|
]
|
|
],
|
|
[
|
|
"OWASP-Benchmark/BenchmarkJava",
|
|
[
|
|
"owasp-java-cmdi",
|
|
"owasp-java-hash",
|
|
"owasp-java-sqli"
|
|
]
|
|
],
|
|
[
|
|
"OWASP-Benchmark/BenchmarkPython",
|
|
[
|
|
"owasp-python-cmdi",
|
|
"owasp-python-codeinj",
|
|
"owasp-python-deser",
|
|
"owasp-python-hash",
|
|
"owasp-python-sqli"
|
|
]
|
|
],
|
|
[
|
|
"anotherik/ThreatByte",
|
|
[
|
|
"threatbyte-api-v1-delete",
|
|
"threatbyte-api-v1-get",
|
|
"threatbyte-routes-dashboard"
|
|
]
|
|
],
|
|
[
|
|
"anxolerd/dvpwa",
|
|
[
|
|
"dvpwa-app-init",
|
|
"dvpwa-middlewares-session-middleware",
|
|
"dvpwa-student-create"
|
|
]
|
|
],
|
|
[
|
|
"arichardson/juliet-test-suite-c",
|
|
[
|
|
"juliet-c-cwe121-strcpy",
|
|
"juliet-c-cwe134-printf"
|
|
]
|
|
],
|
|
[
|
|
"bigfivefoods/supplieradvisor-mvp",
|
|
[
|
|
"supplieradvisor-mvp-route-387bcf",
|
|
"supplieradvisor-mvp-route-a69e8f"
|
|
]
|
|
],
|
|
[
|
|
"chromium/chromium",
|
|
[
|
|
"chromium-cve-2019-5786",
|
|
"chromium-cve-2022-2162"
|
|
]
|
|
],
|
|
[
|
|
"curl/curl",
|
|
[
|
|
"curl-cve-2020-8177",
|
|
"curl-cve-2020-8231-curl_multi_add_handle",
|
|
"curl-cve-2020-8231-curl_open",
|
|
"curl-cve-2020-8284",
|
|
"curl-cve-2020-8284-config_init",
|
|
"curl-cve-2020-8286",
|
|
"curl-cve-2021-22876",
|
|
"curl-cve-2021-22890",
|
|
"curl-cve-2021-22898",
|
|
"curl-cve-2021-22901-ossl_connect_step1",
|
|
"curl-cve-2021-22924",
|
|
"curl-cve-2021-22924-nss_do_connect",
|
|
"curl-cve-2021-22924-servercert",
|
|
"curl-cve-2021-22925",
|
|
"curl-cve-2021-22945",
|
|
"curl-cve-2021-22946",
|
|
"curl-cve-2021-22946-imap_state_capability_re",
|
|
"curl-cve-2021-22946-pop3_state_capa_resp",
|
|
"curl-cve-2021-22947",
|
|
"curl-cve-2021-22947-imap_state_starttls_resp",
|
|
"curl-cve-2021-22947-pop3_state_starttls_resp",
|
|
"curl-cve-2021-22947-smtp_state_starttls_resp",
|
|
"curl-cve-2022-22576-conn_free",
|
|
"curl-cve-2022-27774",
|
|
"curl-cve-2022-27775",
|
|
"curl-cve-2022-27776",
|
|
"curl-cve-2022-27778",
|
|
"curl-cve-2022-27780",
|
|
"curl-cve-2022-27782-curl_free_primary_ssl_co",
|
|
"curl-cve-2022-27782-curl_init_userdefined",
|
|
"curl-cve-2022-27782-gtls_shutdown",
|
|
"curl-cve-2022-27782-nss_setup_connect",
|
|
"curl-cve-2022-27782-ossl_connect_step1",
|
|
"curl-cve-2022-30115",
|
|
"curl-cve-2022-32206",
|
|
"curl-cve-2022-32207",
|
|
"curl-cve-2022-32208",
|
|
"curl-cve-2023-38545",
|
|
"curl-cve-2023-38545-do_socks5",
|
|
"curl-cve-2026-9080"
|
|
]
|
|
],
|
|
[
|
|
"dayflower/etude-lexical-markdown",
|
|
[
|
|
"etude-lexical-markdown-editorconfig-c61a8b",
|
|
"etude-lexical-markdown-editorconfig-db4f54"
|
|
]
|
|
],
|
|
[
|
|
"dolevf/Damn-Vulnerable-GraphQL-Application",
|
|
[
|
|
"damn-vulnerable-graphql-application-views-mutate",
|
|
"damn-vulnerable-graphql-application-views-resolve-pastes",
|
|
"damn-vulnerable-graphql-application-views-resolve-system-dia"
|
|
]
|
|
],
|
|
[
|
|
"erev0s/VAmPI",
|
|
[
|
|
"vampi-books-get-by-title",
|
|
"vampi-user-model-get-user",
|
|
"vampi-users-update-password"
|
|
]
|
|
],
|
|
[
|
|
"fportantier/vulpy",
|
|
[
|
|
"vulpy-libuser-create",
|
|
"vulpy-libuser-login",
|
|
"vulpy-libuser-password-change"
|
|
]
|
|
],
|
|
[
|
|
"manuelz120/extremely-vulnerable-flask-app",
|
|
[
|
|
"extremely-vulnerable-flask-app-account-before-request",
|
|
"extremely-vulnerable-flask-app-account-search",
|
|
"extremely-vulnerable-flask-app-signup-validate-token"
|
|
]
|
|
],
|
|
[
|
|
"naryal2580/vfapi",
|
|
[
|
|
"vfapi-main-delete-user",
|
|
"vfapi-main-put-user",
|
|
"vfapi-main-sql-return-users-from-username"
|
|
]
|
|
],
|
|
[
|
|
"openssl/openssl",
|
|
[
|
|
"openssl-cve-2014-0160",
|
|
"openssl-cve-2020-1967",
|
|
"openssl-cve-2020-1967-tls1_check_sig_alg",
|
|
"openssl-cve-2020-1971",
|
|
"openssl-cve-2020-1971-general_name_cmp",
|
|
"openssl-cve-2020-25659",
|
|
"openssl-cve-2021-23840",
|
|
"openssl-cve-2021-23840-evp_encryptdecryptupdate",
|
|
"openssl-cve-2021-23841",
|
|
"openssl-cve-2021-3449",
|
|
"openssl-cve-2021-3449-def_generate_session_id",
|
|
"openssl-cve-2021-3449-init_sig_algs",
|
|
"openssl-cve-2021-3449-init_sig_algs_cert",
|
|
"openssl-cve-2021-3449-ssl_ctx_set_alpn_protos",
|
|
"openssl-cve-2021-3449-ssl_generate_master_secr",
|
|
"openssl-cve-2021-3449-tls_construct_ctos_early",
|
|
"openssl-cve-2021-3449-tls_handle_alpn",
|
|
"openssl-cve-2021-3449-tls_parse_ctos_renegotia",
|
|
"openssl-cve-2021-3449-tls_process_certificate_",
|
|
"openssl-cve-2021-3449-tls_process_finished",
|
|
"openssl-cve-2021-3450",
|
|
"openssl-cve-2021-3711",
|
|
"openssl-cve-2021-3711-pkey_sm2_decrypt",
|
|
"openssl-cve-2021-3711-sm2_asym_decrypt",
|
|
"openssl-cve-2021-3712",
|
|
"openssl-cve-2021-3712-append_ia5",
|
|
"openssl-cve-2021-3712-general_name_print",
|
|
"openssl-cve-2021-3712-i2r_pci",
|
|
"openssl-cve-2021-3712-ia5ncasecmp",
|
|
"openssl-cve-2021-3712-netscape_spki_print",
|
|
"openssl-cve-2021-3712-ossl_cmp_hdr_push1_freet",
|
|
"openssl-cve-2021-3712-print_qualifiers",
|
|
"openssl-cve-2021-4044",
|
|
"openssl-cve-2021-4044-tls_post_process_server_",
|
|
"openssl-cve-2022-0778",
|
|
"openssl-cve-2022-1292",
|
|
"openssl-cve-2022-1343",
|
|
"openssl-cve-2022-1434",
|
|
"openssl-cve-2022-2068-hash_dir",
|
|
"openssl-cve-2022-29242",
|
|
"openssl-cve-2022-3358",
|
|
"openssl-cve-2022-3358-evp_cipher_init_internal",
|
|
"openssl-cve-2022-3602",
|
|
"openssl-cve-2022-3602-ossl_punycode_decode",
|
|
"openssl-cve-2022-37454",
|
|
"openssl-cve-2022-3786",
|
|
"openssl-cve-2022-3786-ossl_punycode_decode",
|
|
"openssl-cve-2022-3996",
|
|
"openssl-cve-2022-4304",
|
|
"openssl-cve-2022-4304-bn_blinding_invert_ex",
|
|
"openssl-cve-2022-4304-rsa_blinding_invert",
|
|
"openssl-cve-2022-4304-rsa_ossl_private_decrypt",
|
|
"openssl-cve-2023-0216",
|
|
"openssl-cve-2023-0217",
|
|
"openssl-cve-2023-0286",
|
|
"openssl-cve-2023-0286-general_name_cmp",
|
|
"openssl-cve-2023-0401",
|
|
"openssl-cve-2023-0464",
|
|
"openssl-cve-2023-0464-tree_init",
|
|
"openssl-cve-2023-0465",
|
|
"openssl-cve-2023-2650",
|
|
"openssl-cve-2023-2975",
|
|
"openssl-cve-2023-3446",
|
|
"openssl-cve-2023-3817-dh_check",
|
|
"openssl-cve-2023-5363",
|
|
"openssl-cve-2024-0727",
|
|
"openssl-cve-2024-0727-smime_write_pkcs7",
|
|
"openssl-cve-2024-12797",
|
|
"openssl-cve-2024-13176-ec_field_inverse_mod_ord",
|
|
"openssl-cve-2024-2511",
|
|
"openssl-cve-2024-2511-tls_construct_server_hel",
|
|
"openssl-cve-2024-4603",
|
|
"openssl-cve-2024-4741",
|
|
"openssl-cve-2024-4741-ssl3_release_read_buffer",
|
|
"openssl-cve-2024-4741-ssl_free_buffers",
|
|
"openssl-cve-2024-4741-tls_free_buffers",
|
|
"openssl-cve-2024-4741-tls_release_read_buffer",
|
|
"openssl-cve-2024-5535",
|
|
"openssl-cve-2024-5535-alpn_select_cb",
|
|
"openssl-cve-2024-5535-ssl_select_next_proto",
|
|
"openssl-cve-2024-5535-tls_construct_stoc_next_",
|
|
"openssl-cve-2024-5535-tls_parse_stoc_npn",
|
|
"openssl-cve-2024-6119",
|
|
"openssl-cve-2025-11187",
|
|
"openssl-cve-2025-15467",
|
|
"openssl-cve-2025-15469",
|
|
"openssl-cve-2025-66199",
|
|
"openssl-cve-2025-66199-tls13_process_compressed",
|
|
"openssl-cve-2025-68160",
|
|
"openssl-cve-2025-69418",
|
|
"openssl-cve-2025-69419",
|
|
"openssl-cve-2025-69421",
|
|
"openssl-cve-2025-9230",
|
|
"openssl-cve-2025-9232",
|
|
"openssl-cve-2026-14456-expect_quic_for_value",
|
|
"openssl-cve-2026-14456-port_default_packet_hand",
|
|
"openssl-cve-2026-14457",
|
|
"openssl-cve-2026-18798",
|
|
"openssl-cve-2026-2673",
|
|
"openssl-cve-2026-28388",
|
|
"openssl-cve-2026-28389",
|
|
"openssl-cve-2026-28389-dh_cms_set_shared_info",
|
|
"openssl-cve-2026-28389-ecdh_cms_set_shared_info",
|
|
"openssl-cve-2026-31789",
|
|
"openssl-cve-2026-31790",
|
|
"openssl-cve-2026-31790-rsasve_generate",
|
|
"openssl-cve-2026-34181",
|
|
"openssl-cve-2026-35188",
|
|
"openssl-cve-2026-42764",
|
|
"openssl-cve-2026-42765",
|
|
"openssl-cve-2026-42766",
|
|
"openssl-cve-2026-42768",
|
|
"openssl-cve-2026-42768-pkcs7_decrypt_rinfo",
|
|
"openssl-cve-2026-42769",
|
|
"openssl-cve-2026-42771",
|
|
"openssl-cve-2026-45445",
|
|
"openssl-cve-2026-45446",
|
|
"openssl-cve-2026-45446-aes_siv_set_ctx_params",
|
|
"openssl-cve-2026-45447",
|
|
"openssl-cve-2026-54874",
|
|
"openssl-cve-2026-54874-dtls1_process_record",
|
|
"openssl-cve-2026-54874-dtls_rlayer_buffer_recor",
|
|
"openssl-cve-2026-63072",
|
|
"openssl-cve-2026-63072-cms_kek_cipher",
|
|
"openssl-cve-2026-63073",
|
|
"openssl-cve-2026-63074",
|
|
"openssl-cve-2026-63075-txp_pkt_commit",
|
|
"openssl-cve-2026-7383",
|
|
"openssl-cve-2026-75803",
|
|
"openssl-cve-2026-75803-aes_gcm_siv_finish",
|
|
"openssl-cve-2026-75803-chacha20_poly1305_cipher",
|
|
"openssl-cve-2026-9076"
|
|
]
|
|
],
|
|
[
|
|
"sgabe/DSVPWA",
|
|
[
|
|
"dsvpwa-attacks-run",
|
|
"dsvpwa-dsvpwa-main",
|
|
"dsvpwa-handlers-do-bdr"
|
|
]
|
|
]
|
|
],
|
|
"undeclared_split": [
|
|
[
|
|
"local-python-vulnerable",
|
|
"holdout"
|
|
],
|
|
[
|
|
"local-javascript-vulnerable",
|
|
"holdout"
|
|
],
|
|
[
|
|
"local-cpp-buffer",
|
|
"train"
|
|
]
|
|
],
|
|
"vendored_pairs": 277
|
|
}
|