mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
56b1717246
agree matched declared sites through benchmarks/independent/evaluate.py, which the runner image does not carry, so site matching would have been "not assessed". The generator now resolves the fix's old-side ranges (evaluate.hunks, line for line) into case.json, with the declared sites in the set and the reference's cost, and agree.matches_declared reproduces matches_v2; a parity test runs both over the recorded outputs of the 15 validation cases (200 probes, identical verdicts) and agree on those outputs returns the reference's 16 of 20 and $0.022. agree reports cost_per_candidate (plane spend) and cost_per_candidate_with_recorded_triage; Requirement 6.2 is judged on the latter (design.md). --runner-image re-pins the templates from ops/ax/up.sh's pin file; the committed manifests are regenerated at the current digest. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
19 lines
3.3 KiB
YAML
19 lines
3.3 KiB
YAML
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Workspace
|
|
metadata:
|
|
name: reactpress-findall-column-sqli-inputs
|
|
atespace: default
|
|
spec:
|
|
files:
|
|
- path: candidates.json
|
|
content: "{\n \"candidates\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\"\n}\n"
|
|
- path: functions.json
|
|
content: "[\n {\n \"function\": \"findAll\",\n \"line\": 108,\n \"path\": \"server/src/modules/article/article.service.ts\"\n }\n]\n"
|
|
- path: case.json
|
|
content: "{\n \"cost\": {\n \"candidates_before_triage\": 1,\n \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n \"recorded_triage_usd\": 0.002177,\n \"recorded_usd\": 0.0193\n },\n \"family\": \"injection\",\n \"id\": \"reactpress-findall-column-sqli\",\n \"ranges\": {\n \"server/src/modules/article/article.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 106,\n 110\n ],\n [\n 307,\n 308\n ]\n ],\n \"server/src/modules/comment/comment.controller.ts\": [\n [\n 20,\n 20\n ]\n ],\n \"server/src/modules/comment/comment.service.ts\": [\n [\n 5,\n 5\n ],\n [\n 6,\n 6\n ],\n [\n 45,\n 45\n ],\n [\n 103,\n 107\n ]\n ],\n \"server/src/modules/file/file.service.ts\": [\n [\n 7,\n 7\n ],\n [\n 49,\n 49\n ],\n [\n 75,\n\
|
|
\ 79\n ]\n ],\n \"server/src/modules/knowledge/knowledge.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 137,\n 141\n ]\n ],\n \"server/src/modules/page/page.service.ts\": [\n [\n 6,\n 6\n ],\n [\n 49,\n 53\n ]\n ],\n \"server/src/starter.ts\": [\n [\n 22,\n 22\n ],\n [\n 34,\n 34\n ],\n [\n 39,\n 39\n ],\n [\n 43,\n 43\n ],\n [\n 49,\n 49\n ],\n [\n 51,\n 51\n ],\n [\n 54,\n 54\n ],\n [\n 71,\n 71\n ],\n [\n 76,\n 76\n ],\n [\n 80,\n 80\n ],\n [\n 82,\n 82\n ],\n [\n 85,\n 85\n ],\n [\n 90,\n 90\n ],\n [\n 103,\n 103\n ],\n [\n 0,\n 0\n ],\n [\n 0,\n 0\n ]\n ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case, 'old')\",\n \"sites\": [\n \"server/src/modules/article/article.service.ts::findAll\"\n ],\n \"sites_in_set\"\
|
|
: [\n \"server/src/modules/article/article.service.ts::findAll\"\n ]\n}\n"
|
|
- path: triage.json
|
|
content: "{\n \"candidates\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"kept\": [\n [\n \"server/src/modules/article/article.service.ts\",\n \"findAll\",\n 108\n ]\n ],\n \"triage\": {\n \"server/src/modules/article/article.service.ts::findAll\": \"parameter\"\n }\n}\n"
|