mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
cbc252553a
Batch 3 of real (vulnerable function, fixed function) pointer pairs, mined at zero model cost from reviewed GHSA advisories (pip, npm, maven, composer, published since 2023, newest first). Same rules as batch 2, widened three ways: a merged PR's single commit when the advisory links no commit, commits up to 6 files / 240 lines, and two-family advisories with the family read from the diff. Every candidate's function diff was read: 412 reviewed, 255 kept, 3 one-per-repository, 2 withheld by the reserved-population guard (bisected with output discarded). Permissive licences only; no repository named elsewhere under benchmarks/; no WordPress plugin. Kept 251: injection 56, untrusted_destination 26, path 71, output_encoding 69, access_control 20, deserialization 9; python 83, typescript 48, php 46, java 37, javascript 37. Only 12 post-cutoff: batch 2 had used up the post-2026-06-01 pool. Memory 1133 -> 1635 static examples; complete pairs in the whole memory 459 -> 710. Embeddings: 15 calls, $0.0030. No chat-model call, no Docker, no Joern. Record: benchmarks/measurements/2026-10-04-decision-engine-harvest-3. Co-Authored-By: Claude Opus 5.5 <[email protected]>