mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5
3e71e9e88b
The catalog generator fills `fix_date` from the recipe at the precision the recipe has -- a full ISO day when one was recorded, otherwise the year. Every harvested recipe carries a year and almost none carries a day, and writing `-01-01` would turn a year into a claim about a month. A row counts as post-cutoff only when its earliest possible date is after the cutoff, so a coarse date can under-claim the clean slice but never over-claim it. Each family now reports the same numbers over the rows fixed after the cutoff, beside the whole number and never instead of it, with the undated count on its own line. Without a configured cutoff every scoreboard says so rather than inventing one: guessing a model's training cutoff and then publishing a contamination number from the guess would be worse than reporting none. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
528 lines
15 KiB
TOML
528 lines
15 KiB
TOML
# vfc-js pair slice. Reviewed isolated functions with provenance.
|
|
# Honesty dashboard — not the local 100% CI gate.
|
|
# Do not add these names to LANGUAGE_MANIFESTS.
|
|
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
|
|
|
|
[[pair]]
|
|
name = "angular-http-server-1-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "Apache-2.0"
|
|
repo = "simonh1000/angular-http-server"
|
|
cve = ""
|
|
cwe = "CWE-22"
|
|
commit = "8bafc9577161469f5dea01e0b98ea9c525d063e9"
|
|
parent = "d171a771a92e4685b24fb77cb894a7b7b8024c5c"
|
|
commit_url = "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9"
|
|
vuln = "angular-http-server-1-0-0/vuln.js"
|
|
fixed = "angular-http-server-1-0-0/fixed.js"
|
|
relpath = "angular-http-server.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "angular-http-server.js"
|
|
function = "requestListener"
|
|
mechanism = "path_join_user_input"
|
|
sink = "path"
|
|
evidence = "SecBench.js path-traversal sink angular-http-server.js:16:29 fixed upstream in 8bafc9577161"
|
|
|
|
[[pair]]
|
|
name = "apex-publish-static-files-2-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "vincentmorneau/apex-publish-static-files"
|
|
cve = "CVE-2018-16462"
|
|
cwe = "CWE-78"
|
|
commit = "2209af8f2b65c24aa55ab757e0e05b958c16f063"
|
|
parent = "8d28fe8a9a49e5ff3f61e239293b5646528e2915"
|
|
commit_url = "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063"
|
|
vuln = "apex-publish-static-files-2-0-0/vuln.js"
|
|
fixed = "apex-publish-static-files-2-0-0/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "index.js"
|
|
function = "publish"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink index.js:54:25 fixed upstream in 2209af8f2b65"
|
|
|
|
[[pair]]
|
|
name = "bestzip-2-1-6"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "nfriedly/node-bestzip"
|
|
cve = "CVE-2020-7730"
|
|
cwe = "CWE-78"
|
|
commit = "45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
|
|
parent = "fcea252e52b6078eff6caf5531bd32c53fccb59f"
|
|
commit_url = "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6"
|
|
vuln = "bestzip-2-1-6/vuln.js"
|
|
fixed = "bestzip-2-1-6/fixed.js"
|
|
relpath = "lib/bestzip.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2020"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "lib/bestzip.js"
|
|
function = "nativeZip"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink lib/bestzip.js:27:27 fixed upstream in 45d4a901478c"
|
|
|
|
[[pair]]
|
|
name = "clamscan-1-2-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "kylefarris/clamscan"
|
|
cve = "CVE-2020-7613"
|
|
cwe = "CWE-78"
|
|
commit = "5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
|
|
parent = "d474da7b89c0d3397cd681e79c7bcc592bff144b"
|
|
commit_url = "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538"
|
|
vuln = "clamscan-1-2-0/vuln.js"
|
|
fixed = "clamscan-1-2-0/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2020"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "index.js"
|
|
function = "local_scan"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink index.js:495:36 fixed upstream in 5f557c970817"
|
|
|
|
[[pair]]
|
|
name = "diskusage-ng-0-2-6"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "iximiuz/node-diskusage-ng"
|
|
cve = "CVE-2020-7631"
|
|
cwe = "CWE-78"
|
|
commit = "48e7e093486b528f0c81ec699573e0e4a431b8d3"
|
|
parent = "53c505506553c83861d1bd67823d6a382d3a5a43"
|
|
commit_url = "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3"
|
|
vuln = "diskusage-ng-0-2-6/vuln.js"
|
|
fixed = "diskusage-ng-0-2-6/fixed.js"
|
|
relpath = "lib/posix.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2020"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "lib/posix.js"
|
|
function = "diskusage"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink lib/posix.js:11:5 fixed upstream in 48e7e093486b"
|
|
|
|
[[pair]]
|
|
name = "dns-sync-0-1-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "skoranga/node-dns-sync"
|
|
cve = "CVE-2014-9682"
|
|
cwe = "CWE-78"
|
|
commit = "d9abaae384b198db1095735ad9c1c73d7b890a0d"
|
|
parent = "b748fe77a87749d95876028eda8e759109be4c73"
|
|
commit_url = "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d"
|
|
vuln = "dns-sync-0-1-0/vuln.js"
|
|
fixed = "dns-sync-0-1-0/fixed.js"
|
|
relpath = "lib/dns-sync.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2014"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "lib/dns-sync.js"
|
|
function = "resolve"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink lib/dns-sync.js:21:26 fixed upstream in d9abaae384b1"
|
|
|
|
[[pair]]
|
|
name = "glance-3-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "jarofghosts/glance"
|
|
cve = "CVE-2018-3715"
|
|
cwe = "CWE-22"
|
|
commit = "8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
|
|
parent = "7e69a5539236386e747fb240ae87ea65ed64bb2c"
|
|
commit_url = "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19"
|
|
vuln = "glance-3-0-0/vuln.js"
|
|
fixed = "glance-3-0-0/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "index.js"
|
|
function = "Glance$serveRequest"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "SecBench.js path-traversal sink index.js:81:14 fixed upstream in 8cfd88e44ebd"
|
|
|
|
[[pair]]
|
|
name = "hot-formula-parser-3-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "handsontable/formula-parser"
|
|
cve = "CVE-2020-6836"
|
|
cwe = "CWE-78"
|
|
commit = "396b089738d4bf30eb570a4fe6a188affa95cd5e"
|
|
parent = "944136096f44ff4ffd4ba0bcef30970ca4702fce"
|
|
commit_url = "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e"
|
|
vuln = "hot-formula-parser-3-0-0/vuln.js"
|
|
fixed = "hot-formula-parser-3-0-0/fixed.js"
|
|
relpath = "src/grammar-parser/grammar-parser.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2019"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "src/grammar-parser/grammar-parser.js"
|
|
function = "performAction"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "SecBench.js command-injection sink lib/grammar-parser/grammar-parser.js:258:31 fixed upstream in 396b089738d4"
|
|
|
|
[[pair]]
|
|
name = "libnmap-0-4-11"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "jas-/node-libnmap"
|
|
cve = "CVE-2018-16461"
|
|
cwe = "CWE-78"
|
|
commit = "c235b24b0342e12a5dbf502f89daabe95883b6c8"
|
|
parent = "49b72239b144ab7ffdf673b62e18bfd0760948f6"
|
|
commit_url = "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8"
|
|
vuln = "libnmap-0-4-11/vuln.js"
|
|
fixed = "libnmap-0-4-11/fixed.js"
|
|
relpath = "lib/classes/tools.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "lib/classes/tools.js"
|
|
function = "block"
|
|
mechanism = "source_reaches_sink"
|
|
evidence = "SecBench.js command-injection sink lib/classes/tools.js:114:25 fixed upstream in c235b24b0342"
|
|
|
|
[[pair]]
|
|
name = "pdf-image-1-0-5"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "roest01/node-pdf-image"
|
|
cve = "CVE-2018-3757"
|
|
cwe = "CWE-78"
|
|
commit = "54679496a89738443917608c2bbe2f6e5dd20e83"
|
|
parent = "d8c0dcadd93985dbefe80b84060f5f572bfbb6ff"
|
|
commit_url = "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83"
|
|
vuln = "pdf-image-1-0-5/vuln.js"
|
|
fixed = "pdf-image-1-0-5/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "index.js"
|
|
function = "getInfo"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink index.js:43:7 fixed upstream in 54679496a897"
|
|
|
|
[[pair]]
|
|
name = "pidusage-1-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "soyuka/pidusage"
|
|
cve = "CVE-2017-16034"
|
|
cwe = "CWE-78"
|
|
commit = "b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
|
|
parent = "e3660d8a8e5e61afad9b02af67356a1e239d6bde"
|
|
commit_url = "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d"
|
|
vuln = "pidusage-1-0-0/vuln.js"
|
|
fixed = "pidusage-1-0-0/fixed.js"
|
|
relpath = "lib/stats.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2017"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "lib/stats.js"
|
|
function = "ps"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink lib/stats.js:108:5 fixed upstream in b70eca15f7ca"
|
|
|
|
[[pair]]
|
|
name = "portprocesses-1-0-4"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "rrainn/PortProcesses"
|
|
cve = "CVE-2021-23348"
|
|
cwe = "CWE-78"
|
|
commit = "86811216c9b97b01b5722f879f8c88a7aa4214e1"
|
|
parent = "fffceb09aff7180afbd0bd172e820404b33c8299"
|
|
commit_url = "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1"
|
|
vuln = "portprocesses-1-0-4/vuln.js"
|
|
fixed = "portprocesses-1-0-4/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2021"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "index.js"
|
|
function = "listProcessesOnPort"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink exec.js:5:3 fixed upstream in 86811216c9b9"
|
|
|
|
[[pair]]
|
|
name = "serve-here-js-1-1-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "ChristoPy/serve-here.js"
|
|
cve = "CVE-2019-5444"
|
|
cwe = "CWE-22"
|
|
commit = "cefb51d03290b6a88dd13143ab2de31b8cf57c39"
|
|
parent = "ad077637bf7a9fe0dee3262f011aed19a45ce92c"
|
|
commit_url = "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39"
|
|
vuln = "serve-here-js-1-1-0/vuln.js"
|
|
fixed = "serve-here-js-1-1-0/fixed.js"
|
|
relpath = "source/response.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2019"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "source/response.js"
|
|
function = "ConfigureFilePath"
|
|
mechanism = "path_join_user_input"
|
|
evidence = "SecBench.js path-traversal sink source/server.js:27:15 fixed upstream in cefb51d03290"
|
|
|
|
[[pair]]
|
|
name = "static-eval-1-1-1"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "browserify/static-eval"
|
|
cve = ""
|
|
cwe = "CWE-94"
|
|
commit = "32f8efd072625e267aa7237d2daff35738c50d2a"
|
|
parent = "5bba7905b0e797460b8f6c2e38ff6869146faab3"
|
|
commit_url = "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a"
|
|
vuln = "static-eval-1-1-1/vuln.js"
|
|
fixed = "static-eval-1-1-1/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2019"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-94"
|
|
class = "code injection"
|
|
path = "index.js"
|
|
function = "walk"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "eval"
|
|
evidence = "SecBench.js code-injection sink index.js:118:20 fixed upstream in 32f8efd07262"
|
|
|
|
[[pair]]
|
|
name = "thenify-3-3-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "thenables/thenify"
|
|
cve = "CVE-2020-7677"
|
|
cwe = "CWE-94"
|
|
commit = "0d94a24eb933bc835d568f3009f4d269c4c4c17a"
|
|
parent = "aa21cfb64f47238c764d258d0faf7366a8487e36"
|
|
commit_url = "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a"
|
|
vuln = "thenify-3-3-0/vuln.js"
|
|
fixed = "thenify-3-3-0/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2020"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-94"
|
|
class = "code injection"
|
|
path = "index.js"
|
|
function = "thenify"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "eval"
|
|
evidence = "SecBench.js code-injection sink index.js:17:10 fixed upstream in 0d94a24eb933"
|
|
|
|
[[pair]]
|
|
name = "underscore-1-13-0-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "jashkenas/underscore"
|
|
cve = "CVE-2021-23358"
|
|
cwe = "CWE-94"
|
|
commit = "4c73526d43838ad6ab43a6134728776632adeb66"
|
|
parent = "ef646ccbbbd971e82719c83fc69f56a5585b3a01"
|
|
commit_url = "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66"
|
|
vuln = "underscore-1-13-0-0/vuln.js"
|
|
fixed = "underscore-1-13-0-0/fixed.js"
|
|
relpath = "modules/template.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
review_tier = "advisory"
|
|
fix_date = "2021"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-94"
|
|
class = "code injection"
|
|
path = "modules/template.js"
|
|
function = "template"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "eval"
|
|
evidence = "SecBench.js code-injection sink modules/template.js:71:14 fixed upstream in 4c73526d4383"
|
|
|
|
[[pair]]
|
|
name = "whereis-0-4-0"
|
|
slice = "vfc-js"
|
|
language = "javascript"
|
|
origin = "secbench.js"
|
|
license = "MIT"
|
|
repo = "vvo/node-whereis"
|
|
cve = "CVE-2018-3772"
|
|
cwe = "CWE-78"
|
|
commit = "0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
|
|
parent = "b8b642b1163baa37f15ed49b4064dcbdb6e1876c"
|
|
commit_url = "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b"
|
|
vuln = "whereis-0-4-0/vuln.js"
|
|
fixed = "whereis-0-4-0/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
review_tier = "advisory"
|
|
fix_date = "2018"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "index.js"
|
|
function = "whereis"
|
|
mechanism = "source_reaches_sink"
|
|
sink = "exec"
|
|
evidence = "SecBench.js command-injection sink index.js:4:6 fixed upstream in 0f64e3780235"
|