mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
b1c5f36076
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.
- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
github advisory, agent-vfc title); reviewer = "pending" means title, a
named reviewer means reviewed, reviewed without a reviewer is rejected;
per_tier metrics in the payload; select_tier and GATING_TIERS for the
improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
row and training manifest row; title rows enter catalog.toml; the
catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
10 KiB
10 KiB
agent-vfc candidate review sheet
Set reviewer = "<name>" in recipes.toml for each row you confirm (and fix mechanism/cwe if the title-based guess is wrong), then run python benchmarks/pairs/catalog_gen.py --slice agent-vfc. Rows with reviewer = "pending" load at review_tier = "title": they are scored and reported by pairs --slice agent-vfc, and never gate the improve loop (Req 9.3/9.4); a named reviewer promotes a row to reviewed.
| # | name | mechanism (guess) | cwe | language | commit | title |
|---|---|---|---|---|---|---|
| 1 | academic-based-qoder-app-a79ddb |
permissive_default | CWE-16 | python | a79ddb90 | fix(hub): allow DSH token validation CORS |
| 2 | anastasios-pw-session-14ec1a |
source_reaches_sink | CWE-918 | typescript | 14ec1ac5 | fix(browser): harden SSRF redirect guard against non-navigation document hops [A |
| 3 | arsnova-eu-httpcors-9bcba4 |
permissive_default | CWE-16 | typescript | 9bcba4f4 | fix(security): Produktions-CORS auf Same-Origin begrenzen (#143) |
| 4 | astroclaw-pw-session-1553a8 |
source_reaches_sink | CWE-918 | typescript | 1553a8ad | fix(browser): harden SSRF redirect guard against non-navigation document hops [A |
| 5 | capgo-app-apptabs-7d73fd |
permissive_default | CWE-16 | typescript | 7d73fd21 | fix(notifications): harden API CORS and mark console tab as beta (#2623) |
| 6 | capgo-app-hono-4dadd2 |
permissive_default | CWE-16 | typescript | 4dadd258 | fix(api): CORS for Capacitor localhost WebView (#3105) |
| 7 | dailyforge-server-ed1470 |
permissive_default | CWE-16 | javascript | ed147081 | Fix: add localhost fallback for CORS origin (#172) |
| 8 | dnf-plugin-anyrepo-config-26d19a |
path_join_user_input | CWE-22 | python | 26d19aeb | fix(config): prevent path traversal in repository names |
| 9 | edutrace-page-ee7ba2 |
prototype_pollution | CWE-1321 | typescript | ee7ba25f | fix(front): impedir prototype pollution nos handlers de formulário aninhado |
| 10 | etoj-index-605274 |
permissive_default | CWE-16 | typescript | 6052743d | Fix CORS: Add PATCH method to allowed methods |
| 11 | etude-lexical-markdown-editorconfig-c61a8b |
prototype_pollution | CWE-1321 | typescript | c61a8bf7 | fix: guard deepMergeInto against prototype pollution |
| 12 | etude-lexical-markdown-editorconfig-db4f54 |
prototype_pollution | CWE-1321 | typescript | db4f54b1 | fix: make prototype pollution guard recognizable by CodeQL |
| 13 | gitim-git-cors-proxy-e4c3a4 |
permissive_default | CWE-16 | typescript | e4c3a479 | fix(frontend): use gitim cors proxy by default |
| 14 | lensops-kubernetesmanagement-fe4910 |
missing_auth_guard | CWE-862 | typescript | fe49109a | Fix missing auth header on namespaces API call |
| 15 | market-cap-route-4f8ae9 |
source_reaches_sink | CWE-601 | typescript | 4f8ae9be | Fix open redirects on the auth next param |
| 16 | melodix-playerprovider-089931 |
permissive_default | CWE-16 | typescript | 089931ef | Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors |
| 17 | mercado-do-vale-news-catalogmetadataservice-9b5fcf |
permissive_default | CWE-16 | typescript | 9b5fcf2d | fix(catalog): avoid metadata cors preflight |
| 18 | money-track-category-icons-4d4a5b |
prototype_pollution | CWE-1321 | typescript | 4d4a5b06 | fix(category-icons): use Object.hasOwn to prevent prototype pollution in type gu |
| 19 | nestjs-filter-normalizer-aa0e60 |
prototype_pollution | CWE-1321 | typescript | aa0e600d | fix(core): add prototype pollution guard to normalizeInput |
| 20 | new-erp-final-app-6e9644 |
permissive_default | CWE-16 | typescript | 6e9644c8 | fix: allow patch requests through cors |
| 21 | nimestream-route-d17f53 |
source_reaches_sink | CWE-918 | javascript | d17f535b | fix: resolve command injection and SSRF/Open Redirect security issues in multiSc |
| 22 | onlook-helper-57ce1c |
missing_auth_guard | CWE-862 | typescript | 57ce1ccf | Fix CVE-2025-63783: Add authorization checks to project mutation APIs (#3062) |
| 23 | openniw-jobs-0fc947 |
identity_from_request_body | CWE-639 | python | 0fc94733 | Fix IDOR on job endpoint: case-bound jobs require case ownership |
| 24 | openniw-jobs-b74de3 |
identity_from_request_body | CWE-639 | python | b74de31b | Fix IDOR on job endpoint: case-bound jobs require case ownership |
| 25 | overleaf-with-claude-exportscontroller-3980b9 |
identity_from_request_body | CWE-639 | javascript | 3980b9e5 | Fix IDOR in exports by adding token verification (Issue #31637) (#32883) |
| 26 | popmark-editorconfig-e5ac40 |
prototype_pollution | CWE-1321 | typescript | e5ac407c | fix: guard deepMergeInto against prototype pollution |
| 27 | rag-pipeline-utils-config-handler-76e5f0 |
prototype_pollution | CWE-1321 | javascript | 76e5f0a9 | fix(security): prevent prototype pollution in config-handler |
| 28 | registry-proxy-worker-426847 |
permissive_default | CWE-16 | javascript | 42684789 | fix: handle CORS OPTIONS preflight for catalog fetches (#10) |
| 29 | rls-alembic-rls-d2b6af |
permissive_default | CWE-16 | python | d2b6af47 | Guard against ENABLE ROW LEVEL SECURITY on tables with no policies (#143) |
| 30 | supplieradvisor-mvp-route-387bcf |
identity_from_request_body | CWE-639 | typescript | 387bcf40 | Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156) |
| 31 | supplieradvisor-mvp-route-a69e8f |
identity_from_request_body | CWE-639 | typescript | a69e8f27 | Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership |
| 32 | tools-cli-tools-a96bc0 |
source_reaches_sink | CWE-78 | python | a96bc050 | 🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307) |
| 33 | tools-wsgi-e18686 |
path_join_user_input | CWE-22 | python | e18686aa | fix(security): validate mesh filenames against path traversal in _download_meshe |
| 34 | trackly-cli-path-diagnostics-1c1aed |
path_join_user_input | CWE-22 | javascript | 1c1aed89 | fix(apply): report blocked path traversal |
| 35 | upstreamdrift-local-server-c3a078 |
path_join_user_input | CWE-22 | python | c3a07870 | fix(api): harden local server path traversal (#2805) (#2839) |
| 36 | vantalk-firebase-16c3b0 |
secret_in_client | CWE-798 | typescript | 16c3b028 | fix(security): load Firebase API key from env, remove hardcoded secret |
| 37 | waggledance-swarm-ssrf-host-guard-9a4548 |
source_reaches_sink | CWE-918 | python | 9a454843 | fix(ssrf): reject bare-string allowed hosts (#1460) |
| 38 | workers-research-utils-209444 |
source_reaches_sink | CWE-89 | typescript | 209444eb | Fix SQL injection in search by using parameterized queries (#41) |
| 39 | zoonk-origin-bfbf67 |
permissive_default | CWE-16 | typescript | bfbf670c | fix(api): allow staging cors from previews (#1559) |