mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
56b1717246
agree matched declared sites through benchmarks/independent/evaluate.py, which the runner image does not carry, so site matching would have been "not assessed". The generator now resolves the fix's old-side ranges (evaluate.hunks, line for line) into case.json, with the declared sites in the set and the reference's cost, and agree.matches_declared reproduces matches_v2; a parity test runs both over the recorded outputs of the 15 validation cases (200 probes, identical verdicts) and agree on those outputs returns the reference's 16 of 20 and $0.022. agree reports cost_per_candidate (plane spend) and cost_per_candidate_with_recorded_triage; Requirement 6.2 is judged on the latter (design.md). --runner-image re-pins the templates from ops/ax/up.sh's pin file; the committed manifests are regenerated at the current digest. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
20 lines
4.4 KiB
YAML
20 lines
4.4 KiB
YAML
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Workspace
|
|
metadata:
|
|
name: lmdeploy-media-url-ssrf-inputs
|
|
atespace: default
|
|
spec:
|
|
files:
|
|
- path: candidates.json
|
|
content: "{\n \"candidates\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\"\n}\n"
|
|
- path: functions.json
|
|
content: "[\n {\n \"function\": \"_load_http_url\",\n \"line\": 68,\n \"path\": \"lmdeploy/vl/media/connection.py\"\n }\n]\n"
|
|
- path: case.json
|
|
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.000768,\n \"recorded_usd\": 0.0249\n },\n \"family\": \"untrusted_destination\",\n \"id\": \"lmdeploy-media-url-ssrf\",\n \"ranges\": {\n \"docs/en/multi_modal/multimodal_inputs.md\": [\n [\n 395,\n 395\n ]\n ],\n \"docs/zh_cn/multi_modal/multimodal_inputs.md\": [\n [\n 394,\n 394\n ]\n ],\n \"lmdeploy/api.py\": [\n [\n 21,\n 21\n ],\n [\n 45,\n 45\n ],\n [\n 78,\n 78\n ]\n ],\n \"lmdeploy/cli/serve.py\": [\n [\n 77,\n 77\n ],\n [\n 325,\n 325\n ],\n [\n 358,\n 358\n ]\n ],\n \"lmdeploy/pipeline.py\": [\n [\n 42,\n 42\n ],\n [\n 53,\n 53\n ],\n [\n 84,\n 84\n\
|
|
\ ],\n [\n 89,\n 89\n ],\n [\n 115,\n 115\n ],\n [\n 165,\n 165\n ],\n [\n 204,\n 204\n ]\n ],\n \"lmdeploy/serve/core/async_engine.py\": [\n [\n 116,\n 116\n ],\n [\n 125,\n 125\n ]\n ],\n \"lmdeploy/serve/core/vl_async_engine.py\": [\n [\n 20,\n 20\n ],\n [\n 46,\n 46\n ],\n [\n 52,\n 52\n ]\n ],\n \"lmdeploy/serve/openai/api_server.py\": [\n [\n 1528,\n 1528\n ],\n [\n 1580,\n 1580\n ],\n [\n 1620,\n 1620\n ]\n ],\n \"lmdeploy/serve/processors/multimodal.py\": [\n [\n 40,\n 40\n ],\n [\n 47,\n 47\n ],\n [\n 52,\n 52\n ],\n [\n 106,\n 107\n ],\n [\n 156,\n 156\n ],\n [\n 163,\n 163\n ],\n [\n 167,\n 167\n ],\n [\n 170,\n 170\n ],\n [\n 180,\n 180\n ],\n [\n 192,\n 192\n ],\n [\n 269,\n 269\n ],\n [\n 282,\n 282\n ],\n [\n 313,\n\
|
|
\ 313\n ],\n [\n 315,\n 316\n ],\n [\n 329,\n 329\n ],\n [\n 403,\n 403\n ]\n ],\n \"lmdeploy/vl/media/connection.py\": [\n [\n 7,\n 7\n ],\n [\n 10,\n 10\n ],\n [\n 28,\n 28\n ],\n [\n 34,\n 34\n ],\n [\n 54,\n 54\n ],\n [\n 56,\n 59\n ],\n [\n 67,\n 69\n ],\n [\n 71,\n 71\n ],\n [\n 95,\n 95\n ],\n [\n 100,\n 100\n ]\n ],\n \"tests/test_lmdeploy/test_content_merge.py\": [\n [\n 12,\n 12\n ],\n [\n 245,\n 245\n ],\n [\n 307,\n 307\n ],\n [\n 335,\n 335\n ],\n [\n 340,\n 340\n ],\n [\n 385,\n 385\n ],\n [\n 407,\n 407\n ],\n [\n 415,\n 415\n ]\n ],\n \"tests/test_lmdeploy/test_vl/test_safe_url.py\": [\n [\n 43,\n 44\n ],\n [\n 47,\n 47\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case,\
|
|
\ 'old')\",\n \"sites\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ],\n \"sites_in_set\": [\n \"lmdeploy/vl/media/connection.py::_load_http_url\"\n ]\n}\n"
|
|
- path: triage.json
|
|
content: "{\n \"candidates\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"kept\": [\n [\n \"lmdeploy/vl/media/connection.py\",\n \"_load_http_url\",\n 68\n ]\n ],\n \"triage\": {\n \"lmdeploy/vl/media/connection.py::_load_http_url\": \"parameter\"\n }\n}\n"
|