mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
56b1717246
agree matched declared sites through benchmarks/independent/evaluate.py, which the runner image does not carry, so site matching would have been "not assessed". The generator now resolves the fix's old-side ranges (evaluate.hunks, line for line) into case.json, with the declared sites in the set and the reference's cost, and agree.matches_declared reproduces matches_v2; a parity test runs both over the recorded outputs of the 15 validation cases (200 probes, identical verdicts) and agree on those outputs returns the reference's 16 of 20 and $0.022. agree reports cost_per_candidate (plane spend) and cost_per_candidate_with_recorded_triage; Requirement 6.2 is judged on the latter (design.md). --runner-image re-pins the templates from ops/ax/up.sh's pin file; the committed manifests are regenerated at the current digest. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
33 lines
18 KiB
YAML
33 lines
18 KiB
YAML
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Workspace
|
|
metadata:
|
|
name: pgadmin-maintenance-sqli-inputs
|
|
atespace: default
|
|
spec:
|
|
files:
|
|
- path: candidates.json
|
|
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n\
|
|
\ ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\
|
|
,\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\",\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"\
|
|
create_maintenance_job\",\n 222\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\"\n}\n"
|
|
- path: functions.json
|
|
content: "[\n {\n \"function\": \"login\",\n \"line\": 169,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"search_ldap_user\",\n \"line\": 288,\n \"path\": \"web/pgadmin/authenticate/ldap.py\"\n },\n {\n \"function\": \"create_restore_point\",\n \"line\": 1881,\n \"path\": \"web/pgadmin/browser/server_groups/servers/__init__.py\"\n },\n {\n \"function\": \"_check_rename_db_or_change_table_space\",\n \"line\": 808,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"_fetch_db_details\",\n \"line\": 831,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 761,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 1061,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"get_sql\"\
|
|
,\n \"line\": 1107,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"update\",\n \"line\": 936,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 546,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\"\n },\n {\n \"function\": \"_fetch_properties\",\n \"line\": 362,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 412,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"enable_disable\",\n \"line\": 662,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"get_job_args_value\",\n \"line\": 779,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
\n },\n {\n \"function\": \"run_job\",\n \"line\": 746,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 365,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 454,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"sql\",\n \"line\": 492,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n \"function\": \"msql\",\n \"line\": 623,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 290,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\"\
|
|
: \"delete\",\n \"line\": 394,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n \"function\": \"get_extension_details\",\n \"line\": 30,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\"\n },\n {\n \"function\": \"delete\",\n \"line\": 601,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\n },\n {\n \"function\": \"create\",\n \"line\": 464,\n \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\"\n },\n {\n \"function\": \"create_maintenance_job\",\n \"line\": 222,\n \"path\": \"web/pgadmin/tools/maintenance/__init__.py\"\n }\n]\n"
|
|
- path: case.json
|
|
content: "{\n \"cost\": {\n \"candidates_before_triage\": 27,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.048665,\n \"recorded_usd\": 0.3949\n },\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"ranges\": {\n \"web/pgadmin/tools/maintenance/__init__.py\": [\n [\n 12,\n 12\n ],\n [\n 150,\n 150\n ],\n [\n 171,\n 171\n ]\n ],\n \"web/pgadmin/tools/maintenance/templates/maintenance/sql/command.sql\": [\n [\n 16,\n 16\n ]\n ],\n \"web/pgadmin/tools/maintenance/tests/test_maintenance_create_job_unit_test.py\": [\n [\n 562,\n 562\n ],\n [\n 647,\n 647\n ],\n [\n 714,\n 714\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case,\
|
|
\ 'old')\",\n \"sites\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ],\n \"sites_in_set\": [\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
|
|
- path: triage.json
|
|
content: "{\n \"candidates\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_ctypes\",\n 651\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_encodings\",\n\
|
|
\ 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
|
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"kept\": [\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"login\",\n 169\n ],\n [\n \"web/pgadmin/authenticate/ldap.py\",\n \"search_ldap_user\",\n 288\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n \"create_restore_point\",\n 1881\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_check_rename_db_or_change_table_space\",\n 808\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"_fetch_db_details\",\n 831\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"create\",\n 761\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\"\
|
|
,\n \"delete\",\n 1061\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"get_sql\",\n 1107\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n \"update\",\n 936\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n \"delete\",\n 546\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"_fetch_properties\",\n 362\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"create\",\n 412\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"enable_disable\",\n 662\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n \"get_job_args_value\",\n 779\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\
|
|
,\n \"run_job\",\n 746\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"create\",\n 365\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"msql\",\n 454\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\",\n \"sql\",\n 492\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\",\n \"msql\",\n 623\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"create\",\n 290\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\",\n \"delete\",\n 394\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\",\n \"get_extension_details\",\n 30\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\
|
|
,\n \"delete\",\n 601\n ],\n [\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\",\n \"create\",\n 464\n ],\n [\n \"web/pgadmin/tools/maintenance/__init__.py\",\n \"create_maintenance_job\",\n 222\n ]\n ],\n \"triage\": {\n \"web/pgadmin/authenticate/ldap.py::login\": \"request\",\n \"web/pgadmin/authenticate/ldap.py::search_ldap_user\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/__init__.py::create_restore_point\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_check_rename_db_or_change_table_space\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::_fetch_db_details\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_ctypes\"\
|
|
: \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_encodings\": \"internal\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::get_sql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/__init__.py::update\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::_fetch_properties\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::enable_disable\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::get_job_args_value\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py::run_job\"\
|
|
: \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py::sql\": \"stored\",\n \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py::msql\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::create\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py::get_extension_details\": \"parameter\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py::delete\": \"request\",\n \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py::create\"\
|
|
: \"request\",\n \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\": \"request\"\n }\n}\n"
|