mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
c0b9e41000
Tasks 1.2, 2.1-2.5 and 6.2 (pair-side filters). - pairs.py: coverage with a source counts as detection and as leak; function-scoped matching by line-range containment from the vulnerable side's parse (unresolvable labels are counted loss, never silent misses); exact or alias sink matching; weak CWE-only labels never match; side-by-side inventory/overlay/hunter scorers; per_profile, per_mechanism, achievable, known_limit and loss payload; loader rejects unknown mechanism/provenance/split and reserved or missing function labels on harvested slices; candidate rulesets thread through for the improve loop. - overlay.py: OverlayRecord.function (additive) filled from the shared naming helper in one parse; benchmark.py: ExpectedFinding.mechanism. - cli pairs: --slice over every slice, --profile, --split, --hunter, --hunter-model. - catalogs migrated to the new schema (provenance, split, function, mechanism, known_limit for owasp-java-hash); baseline recorded in the spec notes. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
200 lines
5.8 KiB
TOML
200 lines
5.8 KiB
TOML
# Vuln-vs-fixed pair catalog. Isolated trees: the scanner sees only the vuln
|
|
# file or only the fixed file, never both. Do not add these names to
|
|
# LANGUAGE_MANIFESTS (stage-1 90% smoke gate stays on cheat-sheet fixtures).
|
|
|
|
[[pair]]
|
|
name = "local-python-vulnerable"
|
|
slice = "local"
|
|
language = "python"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
vuln = "../fixtures/python-vulnerable/app.py"
|
|
fixed = "../fixtures/python-vulnerable/safe.py"
|
|
relpath = "app.py"
|
|
expected_from = "../manifests/python-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "local-javascript-vulnerable"
|
|
slice = "local"
|
|
language = "javascript"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
vuln = "../fixtures/javascript-vulnerable/src/app.js"
|
|
fixed = "../fixtures/javascript-vulnerable/src/safe.js"
|
|
relpath = "src/app.js"
|
|
expected_from = "../manifests/javascript-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "local-cpp-buffer"
|
|
slice = "local"
|
|
language = "c_cpp"
|
|
origin = "in-tree-fixture"
|
|
license = "in-tree"
|
|
vuln = "../fixtures/cpp-damn-vulnerable/src/buffer.cpp"
|
|
fixed = "../fixtures/cpp-damn-vulnerable/src/safe.cpp"
|
|
relpath = "src/buffer.cpp"
|
|
expected_from = "../manifests/cpp-damn-vulnerable.toml"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-078-os-system"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "Internet-of-People/titania-os"
|
|
commit = "9b7805119938343fcac9dc929d8882f1d97cf14a"
|
|
commit_url = "https://github.com/Internet-of-People/titania-os/commit/9b7805119938343fcac9dc929d8882f1d97cf14a"
|
|
vuln = "github/sven-cwe-078-os-system/vuln.py"
|
|
fixed = "github/sven-cwe-078-os-system/fixed.py"
|
|
relpath = "vuedj/configtitania/views.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "vuedj/configtitania/views.py"
|
|
rule_id = "python-os-command"
|
|
sink = "os.system"
|
|
evidence = "os.system concatenates attacker-controlled username into a shell command"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-078-shell-true"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "Apache-2.0"
|
|
repo = "google/mobly"
|
|
commit = "3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee"
|
|
commit_url = "https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee"
|
|
vuln = "github/sven-cwe-078-shell-true/vuln.py"
|
|
fixed = "github/sven-cwe-078-shell-true/fixed.py"
|
|
relpath = "mobly/controllers/android_device_lib/adb.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "mobly/controllers/android_device_lib/adb.py"
|
|
rule_id = "python-shell-true"
|
|
sink = "subprocess"
|
|
evidence = "subprocess.Popen runs the command with shell=True"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-089-execute-percent"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "russ-lewis/ttt_-_python_cgi"
|
|
commit = "6096f43fd4b2d91211eec4614b7960c0816900da"
|
|
commit_url = "https://github.com/russ-lewis/ttt_-_python_cgi/commit/6096f43fd4b2d91211eec4614b7960c0816900da"
|
|
vuln = "github/sven-cwe-089-execute-percent/vuln.py"
|
|
fixed = "github/sven-cwe-089-execute-percent/fixed.py"
|
|
relpath = "cgi/common.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "cgi/common.py"
|
|
rule_id = "python-sql-injection"
|
|
sink = "execute"
|
|
evidence = "execute percent-formats attacker-controlled input into SQL"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "sven-cwe-089-query-concat"
|
|
slice = "github"
|
|
language = "python"
|
|
origin = "sven"
|
|
license = "original-project"
|
|
repo = "pukkapies/urop2019"
|
|
commit = "3ca2e2c291d2d5fe262d20a8e0520bdfb622432b"
|
|
commit_url = "https://github.com/pukkapies/urop2019/commit/3ca2e2c291d2d5fe262d20a8e0520bdfb622432b"
|
|
vuln = "github/sven-cwe-089-query-concat/vuln.py"
|
|
fixed = "github/sven-cwe-089-query-concat/fixed.py"
|
|
relpath = "modules/query_lastfm.py"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "modules/query_lastfm.py"
|
|
sink = "SELECT"
|
|
evidence = "SQL query concatenates attacker-controlled tag_num"
|
|
mechanism = "source_reaches_sink"
|
|
|
|
[[pair]]
|
|
name = "hutool-cve-2018-17297"
|
|
slice = "github"
|
|
language = "java"
|
|
origin = "cwe-bench-java"
|
|
license = "MulanPSL-2.0"
|
|
repo = "dromara/hutool"
|
|
cve = "CVE-2018-17297"
|
|
cwe = "CWE-22"
|
|
commit = "8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e"
|
|
parent = "fd77bb8718648f69a587046b735488a80123cc26"
|
|
commit_url = "https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e"
|
|
vuln = "github/hutool-cve-2018-17297/vuln/ZipUtil.java"
|
|
fixed = "github/hutool-cve-2018-17297/fixed/ZipUtil.java"
|
|
relpath = "cn/hutool/core/util/ZipUtil.java"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "train"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "cn/hutool/core/util/ZipUtil.java"
|
|
sink = "ZipEntry"
|
|
evidence = "zip entry name is joined onto the extract directory without a zip-slip check"
|
|
mechanism = "path_join_user_input"
|
|
|
|
[[pair]]
|
|
name = "node-serialize-cve-2017-5941"
|
|
slice = "github"
|
|
language = "javascript"
|
|
origin = "nvd"
|
|
license = "public-advisory-pattern"
|
|
cve = "CVE-2017-5941"
|
|
cwe = "CWE-95"
|
|
commit_url = "https://nvd.nist.gov/vuln/detail/CVE-2017-5941"
|
|
vuln = "github/node-serialize-cve-2017-5941/vuln.js"
|
|
fixed = "github/node-serialize-cve-2017-5941/fixed.js"
|
|
relpath = "index.js"
|
|
min_recall = 1.0
|
|
fix_policy = "silent"
|
|
provenance = "human"
|
|
split = "holdout"
|
|
|
|
[[pair.expected]]
|
|
cwe = "CWE-95"
|
|
class = "code injection"
|
|
path = "index.js"
|
|
rule_id = "js-eval"
|
|
sink = "eval"
|
|
evidence = "eval executes attacker-controlled serialized input"
|
|
mechanism = "source_reaches_sink"
|