mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
21634ccf58
The analyzer was not run. freeze.py read each case's source at both pins: - both pins are commits in the repository and in the right order; - the declared sink site's file is present at the vulnerable pin, and its declared functions appear in it; - the fix touches a declared site file (Budibase's sites reordered so the changed file, queries.ts, comes first). Benign controls: - 12 are reviewed automatic proposals. - 3 automatic proposals were rejected as not benign: qwed's merged a ReDoS fix, ReactPress's corrected a SQL column whitelist, and Sulu's was a branch merge that can carry the fix. - Those three, plus cct-studio and Directorist (no automatic proposal), were chosen by hand. Directorist's comes from before the vulnerable pin, because only 3 commits follow its fix. freeze.py now accepts a recorded benign control instead of reporting that none was proposed. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
476 lines
19 KiB
JSON
476 lines
19 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"population": "population-v2.toml",
|
|
"cases": [
|
|
{
|
|
"id": "pgadmin-maintenance-sqli",
|
|
"repo": "https://github.com/pgadmin-org/pgadmin4",
|
|
"vulnerable": "d112dc3b962218efc3613fa727d54f0fc5b1d527",
|
|
"fixed": "cf53953d9ad66c182a08e662c1ba29c5831b486b",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "web/pgadmin/tools/maintenance/__init__.py",
|
|
"sink_functions": [
|
|
"create_maintenance_job"
|
|
],
|
|
"sink_sha256_vulnerable": "9fa2828e8ff9d3af71b9194a8903eee6301e61f8af33c942f1a447ebbf829ec9",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "e841eedc2e859240c87899b5de1e5a077e36b6eaa4251c82435a425812bf6be6",
|
|
"fix_changed_files": 4,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "e7eaef0dc002c254e4dd15705df800c448e8eb4c",
|
|
"tip": "a50a553b0a7e529e5d87f52bdc6d3a5ee3e8b9e8",
|
|
"subject": "chore: feature tests use sys.executable; sync yarn.lock to package.json",
|
|
"files": [
|
|
"web/regression/feature_utils/app_starter.py",
|
|
"web/yarn.lock"
|
|
],
|
|
"lines": 48
|
|
}
|
|
},
|
|
{
|
|
"id": "qwed-sympy-eval",
|
|
"repo": "https://github.com/QWED-AI/qwed-verification",
|
|
"vulnerable": "06801f68cbf9c9b5e54cc17f2a61cb2792da7a26",
|
|
"fixed": "6066b68c0c4f4cc2c3771824822aaa864d082ef8",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "src/qwed_new/api/main.py",
|
|
"sink_functions": [
|
|
"verify_math"
|
|
],
|
|
"sink_sha256_vulnerable": "bff26eca2c749dbd6bbc20cfd912ef077bd2ab3c62d87b9caea5f6f989a463df",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "7632a218b3ce20eb50ebf76e3f9d0110a9152f9a38bad9f47b752294fe7a505d",
|
|
"fix_changed_files": 8,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "62e74ad0a1760abbb9986292fef3e2e6125b1187",
|
|
"tip": "89498ca5eb621a66316b2cf2de1e1e8fdaf6d79d",
|
|
"subject": "Merge pull request #211 from QWED-AI/fix/codeql-redos-data-uri",
|
|
"files": [
|
|
".coverage",
|
|
"src/qwed_new/core/output_sanitizer.py",
|
|
"tests/test_output_sanitizer.py"
|
|
],
|
|
"lines": 70
|
|
}
|
|
},
|
|
{
|
|
"id": "contextforge-prompt-ssti",
|
|
"repo": "https://github.com/IBM/mcp-context-forge",
|
|
"vulnerable": "0f8e0ad679f1fff685f486e17f642ac863c8ca9e",
|
|
"fixed": "4d31004661858a2e99055b3c0c9f14218b8f7120",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "mcpgateway/services/prompt_service.py",
|
|
"sink_functions": [
|
|
"_render_template",
|
|
"_compile_jinja_template"
|
|
],
|
|
"sink_sha256_vulnerable": "0a9752890c5324a7ff01bd15890b376b35226cc81d8853525e41f8b31fb66cb6",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "dd91186b8ee3eed6373761554ad5873e3436b7213305d1d1104f209c6be213af",
|
|
"fix_changed_files": 27,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "1f8fd58980f4565d4788ffc3587d6e3bd16b3342",
|
|
"tip": "9938c58f7819c526932c4ae4ad646a9c028cb19e",
|
|
"subject": "fix: add rust coverage reports (#4458)",
|
|
"files": [
|
|
"Makefile",
|
|
"crates/mcp_runtime/DEVELOPING.md",
|
|
"tests/unit/test_makefile_rust_targets.py"
|
|
],
|
|
"lines": 81
|
|
}
|
|
},
|
|
{
|
|
"id": "lmdeploy-media-url-ssrf",
|
|
"repo": "https://github.com/InternLM/lmdeploy",
|
|
"vulnerable": "71648d239c978452720a6d6692fe914efc8a7b94",
|
|
"fixed": "03c313006d17cc3feae86b633c44206a997c44db",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "lmdeploy/vl/media/connection.py",
|
|
"sink_functions": [
|
|
"_load_http_url"
|
|
],
|
|
"sink_sha256_vulnerable": "697f169c03cf175c338fee2dddaa81a7649913ed2908e1602bd845806fd19646",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "ec8efc50b1749326454731e395d92ab5430e6dac3cf1f334c067ab25a2eb566b",
|
|
"fix_changed_files": 12,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "b6a29db4d2d218838048975977f125dc9b1ac75d",
|
|
"tip": "3d9d23087b59fa44afe83deb03ee7cce04df3b4d",
|
|
"subject": "fix(benchmark): seed NumPy RNG so --seed controls random-mode lengths (#4785)",
|
|
"files": [
|
|
"benchmark/benchmark_guided.py",
|
|
"benchmark/profile_pipeline_api.py",
|
|
"benchmark/profile_throughput.py"
|
|
],
|
|
"lines": 3
|
|
}
|
|
},
|
|
{
|
|
"id": "winml-cli-serve-cors",
|
|
"repo": "https://github.com/microsoft/winml-cli",
|
|
"vulnerable": "02179d185f0e3ac23518236b5ca1f61fd37ef680",
|
|
"fixed": "f4073e0ef4700a25b623487e7e45c421ca0b9993",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "src/winml/modelkit/serve/cli_api.py",
|
|
"sink_functions": [],
|
|
"sink_sha256_vulnerable": "efab45cd65ef1cd0a64070fe104dfdcfc2f298c98def37973c0f22cd0140949f",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "c616799bdaace01883b9e392a3c118eb54295f827eae7f8d7cafcfd40674c012",
|
|
"fix_changed_files": 12,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "8d631f6f1e5db26a04e8c13045280408c6f984dc",
|
|
"tip": "be3e59dd412d4918c5a852aa4d8f0207c34aaf6f",
|
|
"subject": "Remove preload ORT DLL (undo PR 689) (#1380)",
|
|
"files": [
|
|
"src/winml/modelkit/__init__.py",
|
|
"tests/unit/test_modelkit_init.py"
|
|
],
|
|
"lines": 158
|
|
}
|
|
},
|
|
{
|
|
"id": "reactpress-findall-column-sqli",
|
|
"repo": "https://github.com/fecommunity/reactpress",
|
|
"vulnerable": "c3dd10681b3d2b5e224f7ac647b3769557603975",
|
|
"fixed": "78ecb70af1c021455c05fdcbe137212c70e310d6",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "server/src/modules/article/article.service.ts",
|
|
"sink_functions": [
|
|
"findAll"
|
|
],
|
|
"sink_sha256_vulnerable": "33fb3c644ab4ee3ea469cb190a58eacdc2f34f8f2379c04437f3df4d7ede7901",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "8fe3e41ec60351a004455c49d5110fb969acdf2a883b9f22505e66d56c84a3b5",
|
|
"fix_changed_files": 9,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "78ecb70af1c021455c05fdcbe137212c70e310d6",
|
|
"tip": "70c7dc39e1a885a1ac7d051c57a409432905fe6c",
|
|
"subject": "fix(server): correct column whitelist to match entity definitions",
|
|
"files": [
|
|
"server/src/utils/query-whitelist.util.ts"
|
|
],
|
|
"lines": 23
|
|
}
|
|
},
|
|
{
|
|
"id": "fuxa-tdengine-escape-sqli",
|
|
"repo": "https://github.com/frangoteam/FUXA",
|
|
"vulnerable": "193a888f8e3f805325072829b1644a2c768c948b",
|
|
"fixed": "b78f6159d02a56ce5ff48207feb936afb3534fc8",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "server/runtime/storage/tdengine/index.js",
|
|
"sink_functions": [
|
|
"getDaqValue"
|
|
],
|
|
"sink_sha256_vulnerable": "e129a1520f736ef53de1c813ca4295b2b9de09f8041477a4e96bcf242b375d0e",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "7f89162c781081034a2b6e525c0a2e29f976ee984651b2345b2b5fefdd9ac456",
|
|
"fix_changed_files": 2,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "e787e4140b5e71c5b02e23c295fa08b8df0edc53",
|
|
"tip": "bf998eeee3158e338724c71979b7cdafcfa74b32",
|
|
"subject": "Button control with configurable icon (#2349)",
|
|
"files": [
|
|
"client/src/app/_models/hmi.ts",
|
|
"client/src/app/framework/icon-selector/icon-selector.component.scss",
|
|
"client/src/app/gauges/controls/html-button/html-button.component.ts",
|
|
"client/src/app/gauges/gauge-property/gauge-property.component.html",
|
|
"client/src/app/gauges/gauge-property/gauge-property.component.scss",
|
|
"client/src/app/gauges/gauge-property/gauge-property.component.ts",
|
|
"client/src/assets/i18n/en.json"
|
|
],
|
|
"lines": 92
|
|
}
|
|
},
|
|
{
|
|
"id": "budibase-mongo-template-nosqli",
|
|
"repo": "https://github.com/Budibase/budibase",
|
|
"vulnerable": "b7e63df737eede85d951aa9665b0c0778ece7ccb",
|
|
"fixed": "dd8c0654b35cd89ce3645f2355f4bf2ff9a5dd80",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "packages/server/src/sdk/workspace/queries/queries.ts",
|
|
"sink_functions": [
|
|
"enrichContext"
|
|
],
|
|
"sink_sha256_vulnerable": "27233a212e8227bb0dc5f0045aa64b8afa0ced563b174ddd17f8ff5013a516cb",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "e127d41a1e33b89173b69e802395d753f3cfc0cda06bffa3ae6952e910102ce8",
|
|
"fix_changed_files": 4,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "a4423fc5bf237e6101c2e8348ef5372fff6484cd",
|
|
"tip": "272c6a61a2a386688792f9e26c2665f2f431a5c2",
|
|
"subject": "Merge pull request #18865 from Budibase/feature/18784-ai-credit",
|
|
"files": [
|
|
"packages/builder/src/components/usage/Usage.svelte",
|
|
"packages/builder/src/settings/pages/usage.svelte",
|
|
"packages/shared-core/src/helpers/tests/url.spec.ts",
|
|
"packages/shared-core/src/helpers/url.ts"
|
|
],
|
|
"lines": 92
|
|
}
|
|
},
|
|
{
|
|
"id": "unleash-addon-webhook-ssrf",
|
|
"repo": "https://github.com/Unleash/unleash",
|
|
"vulnerable": "b9f3217d327f24094b4352130baa30387f85cffe",
|
|
"fixed": "2100db76af3473f13e6fb40096cf17a9c2b741a1",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "src/lib/addons/addon.ts",
|
|
"sink_functions": [
|
|
"fetchRetry"
|
|
],
|
|
"sink_sha256_vulnerable": "a52627ff0742bd8c296a9f63753174b334f74aba50e013cc8bc18d60e6929aa1",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "7b405bfdf4a981787e70c21f4559e8df94d55f6a56cfc0ab130c7ff8a18549de",
|
|
"fix_changed_files": 21,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "d4efb3a31616483c438606edbecce13b868fc587",
|
|
"tip": "cb4e6250743fac364bae50b985b2b8348def7a2b",
|
|
"subject": "Merge commit '232b5d575c7d455ce7ac767183e61fd389dd8aac' into automation/sync-oss-upstream",
|
|
"files": [
|
|
"frontend/src/component/providers/UnleashFlagProvider/UnleashFlagProvider.tsx"
|
|
],
|
|
"lines": 13
|
|
}
|
|
},
|
|
{
|
|
"id": "medplum-external-auth-open-redirect",
|
|
"repo": "https://github.com/medplum/medplum",
|
|
"vulnerable": "5d4a8654b02aa67c444f96ae1eb5663c09854006",
|
|
"fixed": "7ae10035ddadde4dba7b18d3156553940465b3a1",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "packages/server/src/auth/external.ts",
|
|
"sink_functions": [
|
|
"externalCallbackHandler"
|
|
],
|
|
"sink_sha256_vulnerable": "3ab597c5f268210f56232b07094d80771dce0bc3b78996e9246bb31a0930bd53",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "74cc58f9a399550945d7a2266c8bd4dac48a852378e4eea56fb5f2a1deb72084",
|
|
"fix_changed_files": 7,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "0dd335e8520b859563626d9bf50d602a5f3ad79a",
|
|
"tip": "20790b17d76f335e60dd703f65d4eb13bbb4754d",
|
|
"subject": "tweak(cdk): make `minHealthyPercent` 100 (#8836)",
|
|
"files": [
|
|
"packages/cdk/src/backend.ts"
|
|
],
|
|
"lines": 4
|
|
}
|
|
},
|
|
{
|
|
"id": "cct-studio-server-cmdi",
|
|
"repo": "https://github.com/davila7/claude-code-templates",
|
|
"vulnerable": "acdb5893412a81eaec9862ee24a4613bf296ab45",
|
|
"fixed": "bc4618b07232633c1c0aac12a43e436268d31783",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "cli-tool/src/sandbox-server.js",
|
|
"sink_functions": [
|
|
"executeLocalTask",
|
|
"checkAndInstallAgent"
|
|
],
|
|
"sink_sha256_vulnerable": "e2c24dcf02b90e5056c2b7065ce46027ef02139991117ee70f589a3a971e974d",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "2414d562c0714689978808349499af8cadf7cf39a28a534194f2ff40954aa25e",
|
|
"fix_changed_files": 4,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": null
|
|
},
|
|
{
|
|
"id": "wp-gopay-log-filter-sqli",
|
|
"repo": "https://github.com/gopaycommunity/gopay-woocommerce-integration",
|
|
"vulnerable": "626bc8b5f8d33de6eefd921e3a05ed52ac320bcd",
|
|
"fixed": "7190c985370f9758f226c2f2addd79532a2f93d5",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "admin/views/log.php",
|
|
"sink_functions": [],
|
|
"sink_sha256_vulnerable": "541b921b7810a7b563a4ffefd2ac296e5b37f81d970c5fd9dd787f107c0593b6",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "bdc6178b33d87bcc149019555239668bd71a9bd0f9c30c3ec396ee32974810f4",
|
|
"fix_changed_files": 1,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "2b5fe58d6dadbfecb01ed34611aed8502d11e612",
|
|
"tip": "88b10bda704a37e88121e22dc22f4e5019097272",
|
|
"subject": "GPY025-136: fix i18n and remove translation calls on non-literal text",
|
|
"files": [
|
|
"includes/class-gopay-gateway-options.php",
|
|
"includes/class-gopay-wc-blocks-support.php"
|
|
],
|
|
"lines": 11
|
|
}
|
|
},
|
|
{
|
|
"id": "wp-user-registration-login-redirect",
|
|
"repo": "https://github.com/themegrill/user-registration",
|
|
"vulnerable": "e52cf151cb229852e6209fb3a627aa51485139c1",
|
|
"fixed": "75c940dab15fd54d5a3fbb9f2213767b89467b08",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "includes/functions-ur-core.php",
|
|
"sink_functions": [
|
|
"ur_process_login"
|
|
],
|
|
"sink_sha256_vulnerable": "7ec30d26e49ed039448d4e2616000987db57d2067533e0b2015fe9621e38e57f",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "867fccbaa0df3344523aff6516102cdb22e1e7cd8b2eb7b482cdf9e9e3184b06",
|
|
"fix_changed_files": 8,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "064dd7ab1585082b9b5cf078f2d22c0234f25e48",
|
|
"tip": "3b6acc4695e93d9d48969ed894c21419bd09b33a",
|
|
"subject": "Fix - Deactivate Licence button did nothing when the pro-activation transient was set (#1418)",
|
|
"files": [
|
|
"includes/class-ur-plugin-updater.php"
|
|
],
|
|
"lines": 4
|
|
}
|
|
},
|
|
{
|
|
"id": "wp-directorist-avatar-ssrf",
|
|
"repo": "https://github.com/sovware/directorist",
|
|
"vulnerable": "77cfc9bc8b453f97ab7e720330706fa4ef056867",
|
|
"fixed": "1a67825d5cf6e7c768c3a692da1d18bae732bea9",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "includes/rest-api/functions.php",
|
|
"sink_functions": [
|
|
"directorist_rest_upload_image_from_url"
|
|
],
|
|
"sink_sha256_vulnerable": "fb9e13afbf7f1b856d59a75acca4fc8ebbadb06908af5e409d2b2e7eb470e4b4",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "c451a4853a2ec8a3038741af558f4024cf34edc919a07dd3b16c8f665f834d0f",
|
|
"fix_changed_files": 7,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": null
|
|
},
|
|
{
|
|
"id": "wp-groundhogg-confirm-redirect",
|
|
"repo": "https://github.com/groundhoggwp/groundhogg",
|
|
"vulnerable": "9472a1dd79d4556c40eece501a61930793f170d3",
|
|
"fixed": "028247d4b8ec9ba051d3eb48f1466a759bc16bfd",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "templates/preferences.php",
|
|
"sink_functions": [],
|
|
"sink_sha256_vulnerable": "7887dbbac602984f3c8f754c526dc0656e547c2e66f00e0eb417d56c1af85554",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "081f9b70f08905b7c2c909306747aaacb4a885d7563f455b54638a3a70c611d8",
|
|
"fix_changed_files": 1,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "61c8a03f11b6030c630be6ae0b0c2ad641eb733a",
|
|
"tip": "e3a69f1c2814c6bebed940505894008748566b93",
|
|
"subject": "output a square image regardless of image dimensions",
|
|
"files": [
|
|
"includes/utils/html.php"
|
|
],
|
|
"lines": 13
|
|
}
|
|
},
|
|
{
|
|
"id": "froxlor-admin-ip-second-order-sqli",
|
|
"repo": "https://github.com/froxlor/froxlor",
|
|
"vulnerable": "9bf03de643a2edee4642bfc6c94db1f05253da02",
|
|
"fixed": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "lib/Froxlor/Api/Commands/IpsAndPorts.php",
|
|
"sink_functions": [
|
|
"listing",
|
|
"listingCount"
|
|
],
|
|
"sink_sha256_vulnerable": "d1494998117a922d6370c9acbc68c9f547207dfae435c9e23a1d4af1786b0854",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "c4db47c2b4b7d62f6494989c30bd682bd1a39136b6b545d79dad8d33fbff6863",
|
|
"fix_changed_files": 3,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "b595f061fbb68874423809fec9f2a42bf6b34175",
|
|
"tip": "9d274828bdc4eefec0058a5a3a25bf4eb69d0f70",
|
|
"subject": "avoid warnings regarding php8.5 in config/database.php; adjust phpunit for froxlor/framework testing",
|
|
"files": [
|
|
"composer.json",
|
|
"config/database.php",
|
|
"phpunit.xml",
|
|
"tests/Feature/ExampleTest.php",
|
|
"tests/Unit/ExampleTest.php"
|
|
],
|
|
"lines": 62
|
|
}
|
|
},
|
|
{
|
|
"id": "sulu-smart-content-sql2-injection",
|
|
"repo": "https://github.com/sulu/sulu",
|
|
"vulnerable": "d061094f5b7bb1d5e974544fce30bede9c7adf8e",
|
|
"fixed": "d19c01487af8c3de2fb3aa145856707a6367392c",
|
|
"problems": [],
|
|
"vulnerable_is_ancestor_of_fixed": true,
|
|
"sink_file": "src/Sulu/Component/Content/SmartContent/QueryBuilder.php",
|
|
"sink_functions": [
|
|
"buildCategoriesWhere",
|
|
"buildWhere"
|
|
],
|
|
"sink_sha256_vulnerable": "421e860f75a4953bef494c24b64e951dc0e3748c7d7f592d73ee419af46c73cc",
|
|
"sink_functions_missing": [],
|
|
"sink_sha256_fixed": "764798a416b14f85c24c9ff7f6342e78fde837dbf1d74207c4284bb162318b99",
|
|
"fix_changed_files": 2,
|
|
"fix_touches_sink_file": true,
|
|
"fix_touches_fix_site": false,
|
|
"benign_proposal": {
|
|
"base": "2c4ee09545cf1c9a400006fcaca3b8499cc9a161",
|
|
"tip": "87d30d8f061102ce114556d72d628224e64529e5",
|
|
"subject": "Merge branch '2.6' of https://github.com/sulu/sulu into 3.0",
|
|
"files": [
|
|
"config/packages/security.yaml",
|
|
"src/Sulu/Bundle/SecurityBundle/Security/AuthenticationHandler.php",
|
|
"src/Sulu/Bundle/SecurityBundle/Tests/Application/config/config.yml",
|
|
"src/Sulu/Bundle/SecurityBundle/Tests/Functional/Controller/LoginControllerTest.php",
|
|
"src/Sulu/Bundle/SecurityBundle/Tests/Functional/Security/AuthenticationHandlerTest.php",
|
|
"src/Sulu/Component/Content/Tests/Unit/Types/LinkTest.php",
|
|
"src/Sulu/Component/Content/Types/Link.php"
|
|
],
|
|
"lines": 183
|
|
}
|
|
}
|
|
]
|
|
}
|