Marius CiepluchandClaude Opus 5 950a4c7ac4 fix(corpus): the three silent config pairs were a settings gap, not corpus defects ...

I was wrong, and the correction matters more than the fix.

I reported these three pairs as corpus defects on a similarity measure -- 23%,
45%, 53% -- and said no settings table could make them split. That threshold
came from the OWASP minimal-fix analysis and does not apply to this slice. The
vibe-py corpus pairs a vulnerable function with a DIFFERENT, SAFE function from
the same repository; low similarity is the design, not a defect.
djangoat-views-user-view sits at 36% and dsvpwa-handlers-do-bdr at 34%, and
both score pair_correct.

Reading the actual code instead of the metric shows what the settings table was
missing: aiohttp's Application(debug=True) and RedisStorage(httponly=False).
Adding them, two of the three now split -- vuln model_entailed, fixed silent:

  dvpwa-app-init         Application(debug = True, middlewares = [...])
  dvpwa-middlewares      RedisStorage(app['redis'], httponly = False)

The third, dsvpwa-dsvpwa-main, stays silent for the reason predicted before the
change: its setting is an argparse default (--ssl defaulting to 0), which is a
CLI default rather than a security-setting call and is not reachable by this
arbiter.

One weakness this exposes and does not fix: permissive_values is a flat list of
literals with no keyword association, so it holds both True and False. debug=True
is dangerous while httponly=True is safe, and the model cannot currently tell
them apart. It happens not to bite on these pairs; it is a real limit of the
fact schema and worth naming.

734 passing, gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

2026-09-08 18:50:09 +02:00

..

openultrasast

fix(corpus): the three silent config pairs were a settings gap, not corpus defects

2026-09-08 18:50:09 +02:00