mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
a35397c0ec
Model deepseek-flash (declared provider extension, endpoint prices in parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned Task templates repo-facts / verify / agree, and a generator (plane/generate.py, `ousast plane workspaces --validation-set ...`) that emits per case the vulnerable-pin Workspace, a files-only inputs Workspace (recorded candidates after the recorded triage, declared sites, triage), per-case Tasks and one Run validation-46: facts -> verify a, verify b -> agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded per-pass share. A Run entry cannot add a binding or env, and Run.inputs names only task artifacts, so the case is fixed by per-case Tasks. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
32 lines
17 KiB
YAML
32 lines
17 KiB
YAML
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Workspace
|
|
metadata:
|
|
name: pgadmin-maintenance-sqli-inputs
|
|
atespace: default
|
|
spec:
|
|
files:
|
|
- path: candidates.json
|
|
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n\
|
|
\ ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\
|
|
,\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\",\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"\
|
|
create_maintenance_job\",\n 222\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\"\n}\n"
|
|
- path: functions.json
|
|
content: "[\n {\n \"function\": \"login\",\n \"line\": 169,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"search_ldap_user\",\n \"line\": 288,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"create_restore_point\",\n \"line\": 1881,\n \"path\": \"web/pgadmin/browser/server_groups/servers/__init__.py\"\n },\n {\n \"function\": \"_check_rename_db_or_change_table_space\",\n \"line\": 808,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"_fetch_db_details\",\n \"line\": 831,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 761,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 1061,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"get_sql\"\
|
|
,\n \"line\": 1107,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"update\",\n \"line\": 936,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 546,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\"\n },\n {\n \"function\": \"_fetch_properties\",\n \"line\": 362,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 412,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"enable_disable\",\n \"line\": 662,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"get_job_args_value\",\n \"line\": 779,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
\n },\n {\n \"function\": \"run_job\",\n \"line\": 746,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 365,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 454,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"sql\",\n \"line\": 492,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 623,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 290,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\"\
|
|
: \"delete\",\n \"line\": 394,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\": \"get_extension_details\",\n \"line\": 30,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 601,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 464,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\"\n },\n {\n \"function\": \"create_maintenance_job\",\n \"line\": 222,\n \"path\": \"web/pgadmin/tools/maintenance/__init__.py\"\n }\n]\n"
|
|
- path: case.json
|
|
content: "{\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"sites\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
|
|
- path: triage.json
|
|
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_ctypes\",\n 651\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_encodings\",\n\
|
|
\ 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
|
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"kept\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\
|
|
,\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
|
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"triage\": {\n \"web/pgadmin/authenticate/ldap.py::login\": \"request\",\n \"web/pgadmin/authenticate/ldap.py::search_ldap_user\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/__init__.py::create_restore_point\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_check_rename_db_or_change_table_space\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_fetch_db_details\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_ctypes\"\
|
|
: \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_encodings\": \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_sql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::update\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::_fetch_properties\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::enable_disable\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::get_job_args_value\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::run_job\"\
|
|
: \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::sql\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py::get_extension_details\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py::create\"\
|
|
: \"request\",\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\": \"request\"\n }\n}\n"
|