lastlight-evals 0.10.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/dashboard/dist/assets/index-B4TAaIUR.css +1 -0
  2. package/dashboard/dist/assets/index-LFdFc6Z9.js +109 -0
  3. package/dashboard/dist/index.html +2 -2
  4. package/datasets/aacr-bench/README.md +146 -0
  5. package/datasets/pr-review/README.md +41 -0
  6. package/datasets/pr-review/anchors.json +3709 -0
  7. package/dist/add-case.js.map +1 -1
  8. package/dist/arm.js +14 -5
  9. package/dist/arm.js.map +1 -1
  10. package/dist/bootstrap.js +14 -0
  11. package/dist/bootstrap.js.map +1 -1
  12. package/dist/clean.js.map +1 -1
  13. package/dist/config.js +59 -20
  14. package/dist/config.js.map +1 -1
  15. package/dist/fake-github.js +72 -0
  16. package/dist/fake-github.js.map +1 -1
  17. package/dist/grade.js +308 -64
  18. package/dist/grade.js.map +1 -1
  19. package/dist/init.js.map +1 -1
  20. package/dist/judge.js +19 -0
  21. package/dist/judge.js.map +1 -1
  22. package/dist/mechanism.test.js +303 -13
  23. package/dist/mechanism.test.js.map +1 -1
  24. package/dist/metrics.js +88 -9
  25. package/dist/metrics.js.map +1 -1
  26. package/dist/paths.js +135 -1
  27. package/dist/paths.js.map +1 -1
  28. package/dist/phase-models.js +56 -0
  29. package/dist/phase-models.js.map +1 -0
  30. package/dist/pool.js +32 -0
  31. package/dist/pool.js.map +1 -0
  32. package/dist/pool.test.js +180 -0
  33. package/dist/pool.test.js.map +1 -0
  34. package/dist/pr-context.js +71 -6
  35. package/dist/pr-context.js.map +1 -1
  36. package/dist/repeats.test.js +317 -0
  37. package/dist/repeats.test.js.map +1 -0
  38. package/dist/report.js +99 -5
  39. package/dist/report.js.map +1 -1
  40. package/dist/review-metrics.js +571 -0
  41. package/dist/review-metrics.js.map +1 -0
  42. package/dist/review-metrics.test.js +634 -0
  43. package/dist/review-metrics.test.js.map +1 -0
  44. package/dist/review-pipeline-stats.js +414 -0
  45. package/dist/review-pipeline-stats.js.map +1 -0
  46. package/dist/review-pipeline-stats.test.js +413 -0
  47. package/dist/review-pipeline-stats.test.js.map +1 -0
  48. package/dist/run-instance.js +176 -45
  49. package/dist/run-instance.js.map +1 -1
  50. package/dist/run.js +637 -122
  51. package/dist/run.js.map +1 -1
  52. package/dist/schema.js +22 -1
  53. package/dist/schema.js.map +1 -1
  54. package/package.json +9 -8
  55. package/dashboard/dist/assets/index-B1jNgf2P.js +0 -313
  56. package/dashboard/dist/assets/index-Sic0jI7y.css +0 -1
@@ -0,0 +1,3709 @@
1
+ {
2
+ "version": 1,
3
+ "generatedAt": "2026-08-21T12:00:02.112Z",
4
+ "tokenizer": "v1",
5
+ "source": {
6
+ "dataset": "martian code-review-benchmark (offline)",
7
+ "cases": 50,
8
+ "goldFindings": 137,
9
+ "diff": "git diff -U0 <base>...<head> (three-dot / merge-base)"
10
+ },
11
+ "summary": {
12
+ "anchored": 99,
13
+ "total": 137,
14
+ "anchorRate": 0.7226277372262774,
15
+ "unanchored": 38,
16
+ "unanchoredNoTokens": 20,
17
+ "unanchoredPathOnly": 1,
18
+ "byLanguage": {
19
+ "Java": {
20
+ "total": 24,
21
+ "anchored": 18,
22
+ "rate": 0.75
23
+ },
24
+ "Python": {
25
+ "total": 32,
26
+ "anchored": 16,
27
+ "rate": 0.5
28
+ },
29
+ "Go": {
30
+ "total": 22,
31
+ "anchored": 19,
32
+ "rate": 0.8636363636363636
33
+ },
34
+ "Ruby": {
35
+ "total": 28,
36
+ "anchored": 20,
37
+ "rate": 0.7142857142857143
38
+ },
39
+ "TypeScript": {
40
+ "total": 31,
41
+ "anchored": 26,
42
+ "rate": 0.8387096774193549
43
+ }
44
+ },
45
+ "byBugType": {
46
+ "incorrect_value": {
47
+ "total": 34,
48
+ "anchored": 18,
49
+ "rate": 0.5294117647058824
50
+ },
51
+ "missing_validation": {
52
+ "total": 5,
53
+ "anchored": 2,
54
+ "rate": 0.4
55
+ },
56
+ "other": {
57
+ "total": 10,
58
+ "anchored": 8,
59
+ "rate": 0.8
60
+ },
61
+ "logic_error": {
62
+ "total": 17,
63
+ "anchored": 15,
64
+ "rate": 0.8823529411764706
65
+ },
66
+ "api_misuse": {
67
+ "total": 26,
68
+ "anchored": 19,
69
+ "rate": 0.7307692307692307
70
+ },
71
+ "null_reference": {
72
+ "total": 11,
73
+ "anchored": 11,
74
+ "rate": 1
75
+ },
76
+ "security": {
77
+ "total": 9,
78
+ "anchored": 4,
79
+ "rate": 0.4444444444444444
80
+ },
81
+ "dead_code": {
82
+ "total": 5,
83
+ "anchored": 5,
84
+ "rate": 1
85
+ },
86
+ "race_condition": {
87
+ "total": 13,
88
+ "anchored": 11,
89
+ "rate": 0.8461538461538461
90
+ },
91
+ "type_error": {
92
+ "total": 7,
93
+ "anchored": 6,
94
+ "rate": 0.8571428571428571
95
+ }
96
+ }
97
+ },
98
+ "audit": {
99
+ "seed": 20260821,
100
+ "sampleSize": 20,
101
+ "method": "Uniform sample (mulberry32, seeded Fisher-Yates) of the ANCHORED findings, each read by hand against its matched diff lines. `verdict` is the NAMING bar (what `anchored` claims): good = the matching anchor refers to the same code entity the comment is about; spurious = a homonym, or not a code reference at all. `localized` is a stricter LOCATION bar: precise = a matched line is the site the comment targets; diffuse = the right entity is named but the target site is never matched.",
102
+ "sampled": [
103
+ "prreview__keycloak-36882#0",
104
+ "prreview__keycloak-greptile-41249#0",
105
+ "prreview__grafana-103633#1",
106
+ "prreview__grafana-106778#0",
107
+ "prreview__grafana-107534#0",
108
+ "prreview__grafana-79265#2",
109
+ "prreview__grafana-79265#3",
110
+ "prreview__grafana-76186#1",
111
+ "prreview__discourse-graphite-10#0",
112
+ "prreview__discourse-graphite-10#3",
113
+ "prreview__discourse-graphite-6#0",
114
+ "prreview__discourse-graphite-4#2",
115
+ "prreview__discourse-graphite-4#4",
116
+ "prreview__discourse-graphite-2#0",
117
+ "prreview__discourse-graphite-2#1",
118
+ "prreview__cal-com-8330#1",
119
+ "prreview__cal-com-7232#1",
120
+ "prreview__cal-com-10600#0",
121
+ "prreview__cal-com-10600#3",
122
+ "prreview__cal-com-10967#4"
123
+ ],
124
+ "good": 20,
125
+ "spurious": 0,
126
+ "falseMatchRate": 0,
127
+ "diffuse": 2,
128
+ "diffuseRate": 0.1,
129
+ "verdicts": [
130
+ {
131
+ "key": "prreview__keycloak-36882#0",
132
+ "verdict": "good",
133
+ "localized": "precise",
134
+ "note": "`picocli.exit` matched the exact `picocli.exit(CompatibilityResult…)` calls the comment names."
135
+ },
136
+ {
137
+ "key": "prreview__keycloak-greptile-41249#0",
138
+ "verdict": "good",
139
+ "localized": "precise",
140
+ "note": "`UserModel` matched `isConditionalPasskeysEnabled(UserModel currentUser)` — the signature under discussion."
141
+ },
142
+ {
143
+ "key": "prreview__grafana-103633#1",
144
+ "verdict": "good",
145
+ "localized": "diffuse",
146
+ "note": "Weakest of the 20. `checkPermission` IS the function the comment names, but the one matched line is its production call site; the comment is about a misleading comment + `false` value in the test's cached-permission map, which the anchor never reaches."
147
+ },
148
+ {
149
+ "key": "prreview__grafana-106778#0",
150
+ "verdict": "good",
151
+ "localized": "precise",
152
+ "note": "`GrafanaRuleListItem` matched both its definition and the `<GrafanaRuleListItem` render site missing the `key` prop."
153
+ },
154
+ {
155
+ "key": "prreview__grafana-107534#0",
156
+ "verdict": "good",
157
+ "localized": "precise",
158
+ "note": "`applyTemplateVariables` matched the exact three-argument call (`…, request.scopedVars, request.filters`) the comment quotes."
159
+ },
160
+ {
161
+ "key": "prreview__grafana-79265#2",
162
+ "verdict": "good",
163
+ "localized": "precise",
164
+ "note": "`dbSession.Exec` matched `result, err := dbSession.Exec(args...)` verbatim — the line that would not compile."
165
+ },
166
+ {
167
+ "key": "prreview__grafana-79265#3",
168
+ "verdict": "good",
169
+ "localized": "precise",
170
+ "note": "`ErrDeviceLimitReached` matched its declaration and the `return ErrDeviceLimitReached` the comment calls misleading."
171
+ },
172
+ {
173
+ "key": "prreview__grafana-76186#1",
174
+ "verdict": "good",
175
+ "localized": "precise",
176
+ "note": "All three anchors matched: the removed `traceID` logging lines in `LoggerMiddleware` and the new `ContextualLoggerMiddleware` that omits them."
177
+ },
178
+ {
179
+ "key": "prreview__discourse-graphite-10#0",
180
+ "verdict": "good",
181
+ "localized": "precise",
182
+ "note": "`before_validation` matched the `before_validation do` block in embeddable_host.rb; the `EmbeddableHost` anchor added 11 further, unrelated call sites."
183
+ },
184
+ {
185
+ "key": "prreview__discourse-graphite-10#3",
186
+ "verdict": "good",
187
+ "localized": "diffuse",
188
+ "note": "Right entity, wrong places: `embeddable_hosts`/`EmbeddableHost` matched 13 lines across 9 files (JS controllers, hbs templates, locale yml) and never the raw-SQL migration the comment is actually about."
189
+ },
190
+ {
191
+ "key": "prreview__discourse-graphite-6#0",
192
+ "verdict": "good",
193
+ "localized": "precise",
194
+ "note": "`include_website_name` matched `def include_website_name` — literally the method whose missing `?` suffix is the finding."
195
+ },
196
+ {
197
+ "key": "prreview__discourse-graphite-4#2",
198
+ "verdict": "good",
199
+ "localized": "precise",
200
+ "note": "`postMessage` matched the exact `parent.postMessage(…, '<%= request.referer %>')` line. The separate `URL` anchor matched a locale string and two spec titles — acronym noise inside an otherwise correct label."
201
+ },
202
+ {
203
+ "key": "prreview__discourse-graphite-4#4",
204
+ "verdict": "good",
205
+ "localized": "precise",
206
+ "note": "`TopicEmbed` matched `TopicEmbed.import(user, url, …)`, the method the comment names; the `HTML` anchor separately matched an unrelated code comment."
207
+ },
208
+ {
209
+ "key": "prreview__discourse-graphite-2#0",
210
+ "verdict": "good",
211
+ "localized": "precise",
212
+ "note": "`TopicUser` matched `tu = TopicUser.find_by(…)` — the nil-able assignment the comment warns about."
213
+ },
214
+ {
215
+ "key": "prreview__discourse-graphite-2#1",
216
+ "verdict": "good",
217
+ "localized": "precise",
218
+ "note": "The misspelled `stopNotificiationsText` matched its definition and its template use; the correctly-spelled variant matched nothing, as it should."
219
+ },
220
+ {
221
+ "key": "prreview__cal-com-8330#1",
222
+ "verdict": "good",
223
+ "localized": "precise",
224
+ "note": "Four anchors matched the exact `dayjs(date.start).add(utcOffset,…) === dayjs(date.end)…` comparison the comment says will always be false."
225
+ },
226
+ {
227
+ "key": "prreview__cal-com-7232#1",
228
+ "verdict": "good",
229
+ "localized": "precise",
230
+ "note": "`immediateDelete` matched `if (immediateDelete) {` inside `deleteScheduledEmailReminder` — the exact branch the comment describes."
231
+ },
232
+ {
233
+ "key": "prreview__cal-com-10600#0",
234
+ "verdict": "good",
235
+ "localized": "precise",
236
+ "note": "`TwoFactor` matched `export default function TwoFactor` inside BackupCode.tsx — the naming inconsistency itself."
237
+ },
238
+ {
239
+ "key": "prreview__cal-com-10600#3",
240
+ "verdict": "good",
241
+ "localized": "precise",
242
+ "note": "`backupCodes` matched the decrypt-then-mutate lines in disable.ts that the race-condition comment is about."
243
+ },
244
+ {
245
+ "key": "prreview__cal-com-10967#4",
246
+ "verdict": "good",
247
+ "localized": "precise",
248
+ "note": "`createEvent`/`credentialId` matched both `Calendar.d.ts` declarations the comment contrasts, plus the implementation that keeps the old arity."
249
+ }
250
+ ]
251
+ },
252
+ "cases": [
253
+ {
254
+ "instanceId": "prreview__keycloak-37429",
255
+ "repo": "keycloak/keycloak",
256
+ "language": "Java",
257
+ "requiresContext": "cross_file",
258
+ "changedFiles": 47,
259
+ "changedLines": 448,
260
+ "gold": [
261
+ {
262
+ "goldIndex": 0,
263
+ "severity": "medium",
264
+ "anchors": [
265
+ "messages_lt"
266
+ ],
267
+ "anchoredLines": [],
268
+ "anchored": false,
269
+ "bugType": "incorrect_value",
270
+ "pathOnly": true
271
+ },
272
+ {
273
+ "goldIndex": 1,
274
+ "severity": "medium",
275
+ "anchors": [
276
+ "totpStep1",
277
+ "zh_CN"
278
+ ],
279
+ "anchoredLines": [
280
+ "themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties:141",
281
+ "themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties:101",
282
+ "themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties:101",
283
+ "themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties:96",
284
+ "themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties:112"
285
+ ],
286
+ "anchored": true,
287
+ "bugType": "incorrect_value",
288
+ "matchedAnchors": [
289
+ "totpStep1"
290
+ ],
291
+ "matchCount": 5,
292
+ "matchFiles": 5
293
+ },
294
+ {
295
+ "goldIndex": 2,
296
+ "severity": "low",
297
+ "anchors": [],
298
+ "anchoredLines": [],
299
+ "anchored": false,
300
+ "bugType": "missing_validation"
301
+ },
302
+ {
303
+ "goldIndex": 3,
304
+ "severity": "low",
305
+ "anchors": [
306
+ "santizeAnchors",
307
+ "sanitizeAnchors"
308
+ ],
309
+ "anchoredLines": [
310
+ "misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java:88",
311
+ "misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java:150"
312
+ ],
313
+ "anchored": true,
314
+ "bugType": "other",
315
+ "matchedAnchors": [
316
+ "santizeAnchors"
317
+ ],
318
+ "matchCount": 2,
319
+ "matchFiles": 1
320
+ }
321
+ ]
322
+ },
323
+ {
324
+ "instanceId": "prreview__keycloak-37634",
325
+ "repo": "keycloak/keycloak",
326
+ "language": "Java",
327
+ "requiresContext": "file",
328
+ "changedFiles": 28,
329
+ "changedLines": 748,
330
+ "gold": [
331
+ {
332
+ "goldIndex": 0,
333
+ "severity": "critical",
334
+ "anchors": [
335
+ "grantType",
336
+ "rawTokenId"
337
+ ],
338
+ "anchoredLines": [
339
+ "server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java:85",
340
+ "server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java:102",
341
+ "server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java:174",
342
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:33",
343
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:69",
344
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:72",
345
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:73",
346
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:76",
347
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java:89",
348
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:57",
349
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:58",
350
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:59"
351
+ ],
352
+ "anchored": true,
353
+ "bugType": "incorrect_value",
354
+ "matchedAnchors": [
355
+ "grantType",
356
+ "rawTokenId"
357
+ ],
358
+ "matchCount": 30,
359
+ "matchFiles": 5
360
+ },
361
+ {
362
+ "goldIndex": 1,
363
+ "severity": "high",
364
+ "anchors": [
365
+ "isAccessTokenId",
366
+ "UUID"
367
+ ],
368
+ "anchoredLines": [
369
+ "testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java:145",
370
+ "testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java:173",
371
+ "testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java:182",
372
+ "testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java:244",
373
+ "testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java:476"
374
+ ],
375
+ "anchored": true,
376
+ "bugType": "logic_error",
377
+ "matchedAnchors": [
378
+ "isAccessTokenId"
379
+ ],
380
+ "matchCount": 5,
381
+ "matchFiles": 1
382
+ },
383
+ {
384
+ "goldIndex": 2,
385
+ "severity": "low",
386
+ "anchors": [],
387
+ "anchoredLines": [],
388
+ "anchored": false,
389
+ "bugType": "other"
390
+ },
391
+ {
392
+ "goldIndex": 3,
393
+ "severity": "low",
394
+ "anchors": [
395
+ "RuntimeException",
396
+ "IllegalArgumentException"
397
+ ],
398
+ "anchoredLines": [
399
+ "services/src/test/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderTest.java:82",
400
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:75",
401
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:85",
402
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:89",
403
+ "services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java:93"
404
+ ],
405
+ "anchored": true,
406
+ "bugType": "api_misuse",
407
+ "matchedAnchors": [
408
+ "RuntimeException",
409
+ "IllegalArgumentException"
410
+ ],
411
+ "matchCount": 5,
412
+ "matchFiles": 2
413
+ }
414
+ ]
415
+ },
416
+ {
417
+ "instanceId": "prreview__keycloak-38446",
418
+ "repo": "keycloak/keycloak",
419
+ "language": "Java",
420
+ "requiresContext": "cross_file",
421
+ "changedFiles": 8,
422
+ "changedLines": 287,
423
+ "gold": [
424
+ {
425
+ "goldIndex": 0,
426
+ "severity": "medium",
427
+ "anchors": [
428
+ "Optional.get",
429
+ "RecoveryAuthnCodesUtils",
430
+ "getCredential",
431
+ "isPresent",
432
+ "NoSuchElementException"
433
+ ],
434
+ "anchoredLines": [
435
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java:80",
436
+ "services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java:8",
437
+ "services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java:17",
438
+ "server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java:56"
439
+ ],
440
+ "anchored": true,
441
+ "bugType": "null_reference",
442
+ "matchedAnchors": [
443
+ "RecoveryAuthnCodesUtils",
444
+ "getCredential"
445
+ ],
446
+ "matchCount": 4,
447
+ "matchFiles": 3
448
+ },
449
+ {
450
+ "goldIndex": 1,
451
+ "severity": "low",
452
+ "anchors": [
453
+ "RecoveryAuthnCodesCredentialModel",
454
+ "e.g",
455
+ "myUser.recoveryCodes.getId",
456
+ "myUser",
457
+ "recoveryCodes",
458
+ "getId",
459
+ "removeStoredCredentialById"
460
+ ],
461
+ "anchoredLines": [
462
+ "server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java:36",
463
+ "server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java:115",
464
+ "server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java:12",
465
+ "server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java:59",
466
+ "server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java:61",
467
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java:81",
468
+ "services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java:14",
469
+ "services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java:17",
470
+ "services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java:19",
471
+ "testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java:46",
472
+ "testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java:114",
473
+ "testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java:193"
474
+ ],
475
+ "anchored": true,
476
+ "bugType": "null_reference",
477
+ "matchedAnchors": [
478
+ "RecoveryAuthnCodesCredentialModel",
479
+ "myUser",
480
+ "recoveryCodes"
481
+ ],
482
+ "matchCount": 27,
483
+ "matchFiles": 5
484
+ }
485
+ ]
486
+ },
487
+ {
488
+ "instanceId": "prreview__keycloak-36882",
489
+ "repo": "keycloak/keycloak",
490
+ "language": "Java",
491
+ "requiresContext": "cross_file",
492
+ "changedFiles": 11,
493
+ "changedLines": 88,
494
+ "gold": [
495
+ {
496
+ "goldIndex": 0,
497
+ "severity": "medium",
498
+ "anchors": [
499
+ "picocli.exit",
500
+ "System.exit"
501
+ ],
502
+ "anchoredLines": [
503
+ "quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityCheck.java:48",
504
+ "quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityMetadata.java:48"
505
+ ],
506
+ "anchored": true,
507
+ "bugType": "api_misuse",
508
+ "matchedAnchors": [
509
+ "picocli.exit"
510
+ ],
511
+ "matchCount": 2,
512
+ "matchFiles": 2
513
+ }
514
+ ]
515
+ },
516
+ {
517
+ "instanceId": "prreview__keycloak-36880",
518
+ "repo": "keycloak/keycloak",
519
+ "language": "Java",
520
+ "requiresContext": "cross_file",
521
+ "changedFiles": 10,
522
+ "changedLines": 1004,
523
+ "gold": [
524
+ {
525
+ "goldIndex": 0,
526
+ "severity": "high",
527
+ "anchors": [
528
+ "AdminPermissions",
529
+ "ADMIN_FINE_GRAINED_AUTHZ",
530
+ "ADMIN_FINE_GRAINED_AUTHZ_V2"
531
+ ],
532
+ "anchoredLines": [
533
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java:77"
534
+ ],
535
+ "anchored": true,
536
+ "bugType": "logic_error",
537
+ "matchedAnchors": [
538
+ "ADMIN_FINE_GRAINED_AUTHZ"
539
+ ],
540
+ "matchCount": 1,
541
+ "matchFiles": 1
542
+ },
543
+ {
544
+ "goldIndex": 1,
545
+ "severity": "high",
546
+ "anchors": [
547
+ "hasPermission",
548
+ "ClientModel",
549
+ "findByName",
550
+ "client.getId",
551
+ "getId",
552
+ "server.getId",
553
+ "AdminPermissionsSchema",
554
+ "getOrCreateResource",
555
+ "resourceServer",
556
+ "getClientId"
557
+ ],
558
+ "anchoredLines": [
559
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:61",
560
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:68",
561
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:73",
562
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:82",
563
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:87",
564
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:92",
565
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:97",
566
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:102",
567
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:109",
568
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:121",
569
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:207",
570
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:237"
571
+ ],
572
+ "anchored": true,
573
+ "bugType": "incorrect_value",
574
+ "matchedAnchors": [
575
+ "hasPermission",
576
+ "ClientModel",
577
+ "findByName",
578
+ "client.getId",
579
+ "getId",
580
+ "server.getId",
581
+ "AdminPermissionsSchema",
582
+ "getClientId"
583
+ ],
584
+ "matchCount": 162,
585
+ "matchFiles": 8
586
+ },
587
+ {
588
+ "goldIndex": 2,
589
+ "severity": "high",
590
+ "anchors": [
591
+ "getClientsWithPermission",
592
+ "resourceStore",
593
+ "findByType",
594
+ "AdminPermissionsSchema",
595
+ "CLIENTS_RESOURCE_TYPE",
596
+ "getName",
597
+ "AvailableRoleMappingResource",
598
+ "getRoleIdsWithPermissions",
599
+ "IDs",
600
+ "getClientById"
601
+ ],
602
+ "anchoredLines": [
603
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:125",
604
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:138",
605
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:214",
606
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java:244",
607
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:43",
608
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:55",
609
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:67",
610
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:110",
611
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:119",
612
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:138",
613
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:150",
614
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java:162"
615
+ ],
616
+ "anchored": true,
617
+ "bugType": "incorrect_value",
618
+ "matchedAnchors": [
619
+ "getClientsWithPermission",
620
+ "resourceStore",
621
+ "findByType",
622
+ "AdminPermissionsSchema",
623
+ "CLIENTS_RESOURCE_TYPE",
624
+ "getName",
625
+ "getClientById"
626
+ ],
627
+ "matchCount": 75,
628
+ "matchFiles": 6
629
+ }
630
+ ]
631
+ },
632
+ {
633
+ "instanceId": "prreview__keycloak-37038",
634
+ "repo": "keycloak/keycloak",
635
+ "language": "Java",
636
+ "requiresContext": "cross_file",
637
+ "changedFiles": 19,
638
+ "changedLines": 957,
639
+ "gold": [
640
+ {
641
+ "goldIndex": 0,
642
+ "severity": "high",
643
+ "anchors": [
644
+ "canManage"
645
+ ],
646
+ "anchoredLines": [
647
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java:54",
648
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java:81",
649
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java:105",
650
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:299",
651
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:315",
652
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java:65",
653
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java:74",
654
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java:91",
655
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java:34",
656
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java:39",
657
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionsV2.java:90",
658
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionsV2.java:99"
659
+ ],
660
+ "anchored": true,
661
+ "bugType": "security",
662
+ "matchedAnchors": [
663
+ "canManage"
664
+ ],
665
+ "matchCount": 12,
666
+ "matchFiles": 5
667
+ },
668
+ {
669
+ "goldIndex": 1,
670
+ "severity": "high",
671
+ "anchors": [
672
+ "getGroupIdsWithViewPermission",
673
+ "hasPermission",
674
+ "groupResource.getId",
675
+ "groupResource",
676
+ "getId",
677
+ "GroupPermissionEvaluator",
678
+ "IDs",
679
+ "UserModel",
680
+ "GROUPS",
681
+ "getUsersCount",
682
+ "VIEW_MEMBERS/MANAGE_MEMBERS",
683
+ "VIEW_MEMBERS",
684
+ "MANAGE_MEMBERS",
685
+ "JPA"
686
+ ],
687
+ "anchoredLines": [
688
+ "rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java:147",
689
+ "services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java:398",
690
+ "services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java:425",
691
+ "services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java:430",
692
+ "services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java:448",
693
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java:147",
694
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:298",
695
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java:106",
696
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:310",
697
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:356",
698
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java:340",
699
+ "services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionsV2.java:52"
700
+ ],
701
+ "anchored": true,
702
+ "bugType": "api_misuse",
703
+ "matchedAnchors": [
704
+ "getGroupIdsWithViewPermission",
705
+ "hasPermission",
706
+ "groupResource.getId",
707
+ "groupResource",
708
+ "getId",
709
+ "IDs",
710
+ "UserModel",
711
+ "GROUPS",
712
+ "getUsersCount",
713
+ "VIEW_MEMBERS",
714
+ "MANAGE_MEMBERS"
715
+ ],
716
+ "matchCount": 93,
717
+ "matchFiles": 9
718
+ }
719
+ ]
720
+ },
721
+ {
722
+ "instanceId": "prreview__keycloak-33832",
723
+ "repo": "keycloak/keycloak",
724
+ "language": "Java",
725
+ "requiresContext": "cross_file",
726
+ "changedFiles": 12,
727
+ "changedLines": 682,
728
+ "gold": [
729
+ {
730
+ "goldIndex": 0,
731
+ "severity": "high",
732
+ "anchors": [
733
+ "BouncyCastle"
734
+ ],
735
+ "anchoredLines": [],
736
+ "anchored": false,
737
+ "bugType": "incorrect_value"
738
+ },
739
+ {
740
+ "goldIndex": 1,
741
+ "severity": "low",
742
+ "anchors": [
743
+ "ASN1Encoder"
744
+ ],
745
+ "anchoredLines": [
746
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Decoder.java:52",
747
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Decoder.java:68",
748
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:30",
749
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:38",
750
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:42",
751
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:43",
752
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:46",
753
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:51",
754
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:93",
755
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/ASN1Encoder.java:95",
756
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/AuthzClientCryptoProvider.java:114",
757
+ "authz/client/src/main/java/org/keycloak/authorization/client/util/crypto/AuthzClientCryptoProvider.java:115"
758
+ ],
759
+ "anchored": true,
760
+ "bugType": "dead_code",
761
+ "matchedAnchors": [
762
+ "ASN1Encoder"
763
+ ],
764
+ "matchCount": 15,
765
+ "matchFiles": 3
766
+ }
767
+ ]
768
+ },
769
+ {
770
+ "instanceId": "prreview__keycloak-40940",
771
+ "repo": "keycloak/keycloak",
772
+ "language": "Java",
773
+ "requiresContext": "cross_file",
774
+ "changedFiles": 4,
775
+ "changedLines": 62,
776
+ "gold": [
777
+ {
778
+ "goldIndex": 0,
779
+ "severity": "critical",
780
+ "anchors": [
781
+ "getSubGroupsCount",
782
+ "GroupModel",
783
+ "NPEs"
784
+ ],
785
+ "anchoredLines": [
786
+ "model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java:274",
787
+ "model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java:275",
788
+ "services/src/main/java/org/keycloak/utils/GroupUtils.java:102"
789
+ ],
790
+ "anchored": true,
791
+ "bugType": "null_reference",
792
+ "matchedAnchors": [
793
+ "getSubGroupsCount",
794
+ "GroupModel"
795
+ ],
796
+ "matchCount": 3,
797
+ "matchFiles": 2
798
+ },
799
+ {
800
+ "goldIndex": 1,
801
+ "severity": "medium",
802
+ "anchors": [
803
+ "deletedAll"
804
+ ],
805
+ "anchoredLines": [
806
+ "tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java:136",
807
+ "tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java:140",
808
+ "tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java:155"
809
+ ],
810
+ "anchored": true,
811
+ "bugType": "race_condition",
812
+ "matchedAnchors": [
813
+ "deletedAll"
814
+ ],
815
+ "matchCount": 3,
816
+ "matchFiles": 1
817
+ }
818
+ ]
819
+ },
820
+ {
821
+ "instanceId": "prreview__keycloak-greptile-41249",
822
+ "repo": "keycloak/keycloak",
823
+ "language": "Java",
824
+ "requiresContext": "cross_file",
825
+ "changedFiles": 10,
826
+ "changedLines": 502,
827
+ "gold": [
828
+ {
829
+ "goldIndex": 0,
830
+ "severity": "medium",
831
+ "anchors": [
832
+ "ConditionalPasskeysEnabled",
833
+ "UserModel"
834
+ ],
835
+ "anchoredLines": [
836
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:160"
837
+ ],
838
+ "anchored": true,
839
+ "bugType": "api_misuse",
840
+ "matchedAnchors": [
841
+ "UserModel"
842
+ ],
843
+ "matchCount": 1,
844
+ "matchFiles": 1
845
+ },
846
+ {
847
+ "goldIndex": 1,
848
+ "severity": "medium",
849
+ "anchors": [
850
+ "isConditionalPasskeysEnabled",
851
+ "UserModel",
852
+ "webauthnAuth",
853
+ "fillContextForm",
854
+ "getUser"
855
+ ],
856
+ "anchoredLines": [
857
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java:52",
858
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java:63",
859
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:115",
860
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:137",
861
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:160",
862
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java:53",
863
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:114",
864
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:116",
865
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:161",
866
+ "services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java:162"
867
+ ],
868
+ "anchored": true,
869
+ "bugType": "logic_error",
870
+ "matchedAnchors": [
871
+ "isConditionalPasskeysEnabled",
872
+ "UserModel",
873
+ "webauthnAuth",
874
+ "fillContextForm",
875
+ "getUser"
876
+ ],
877
+ "matchCount": 10,
878
+ "matchFiles": 2
879
+ }
880
+ ]
881
+ },
882
+ {
883
+ "instanceId": "prreview__sentry-93824",
884
+ "repo": "getsentry/sentry",
885
+ "language": "Python",
886
+ "requiresContext": "cross_file",
887
+ "changedFiles": 6,
888
+ "changedLines": 249,
889
+ "gold": [
890
+ {
891
+ "goldIndex": 0,
892
+ "severity": "medium",
893
+ "anchors": [],
894
+ "anchoredLines": [],
895
+ "anchored": false,
896
+ "bugType": "incorrect_value"
897
+ },
898
+ {
899
+ "goldIndex": 1,
900
+ "severity": "low",
901
+ "anchors": [],
902
+ "anchoredLines": [],
903
+ "anchored": false,
904
+ "bugType": "race_condition"
905
+ },
906
+ {
907
+ "goldIndex": 2,
908
+ "severity": "high",
909
+ "anchors": [
910
+ "get_context",
911
+ "SpawnProcess",
912
+ "POSIX"
913
+ ],
914
+ "anchoredLines": [
915
+ "src/sentry/spans/consumers/process/flusher.py:68"
916
+ ],
917
+ "anchored": true,
918
+ "bugType": "type_error",
919
+ "matchedAnchors": [
920
+ "SpawnProcess"
921
+ ],
922
+ "matchCount": 1,
923
+ "matchFiles": 1
924
+ },
925
+ {
926
+ "goldIndex": 3,
927
+ "severity": "medium",
928
+ "anchors": [
929
+ "test_consumer.py",
930
+ "test_consumer",
931
+ "time.sleep"
932
+ ],
933
+ "anchoredLines": [
934
+ "src/sentry/spans/consumers/process/flusher.py:264",
935
+ "src/sentry/spans/consumers/process/flusher.py:344",
936
+ "tests/sentry/spans/consumers/process/test_consumer.py:62",
937
+ "tests/sentry/spans/consumers/process/test_consumer.py:88"
938
+ ],
939
+ "anchored": true,
940
+ "bugType": "api_misuse",
941
+ "matchedAnchors": [
942
+ "time.sleep"
943
+ ],
944
+ "matchCount": 4,
945
+ "matchFiles": 2
946
+ },
947
+ {
948
+ "goldIndex": 4,
949
+ "severity": "medium",
950
+ "anchors": [],
951
+ "anchoredLines": [],
952
+ "anchored": false,
953
+ "bugType": "logic_error"
954
+ }
955
+ ]
956
+ },
957
+ {
958
+ "instanceId": "prreview__sentry-greptile-5",
959
+ "repo": "ai-code-review-evaluation/sentry-greptile",
960
+ "language": "Python",
961
+ "requiresContext": "cross_file",
962
+ "changedFiles": 106,
963
+ "changedLines": 3293,
964
+ "gold": [
965
+ {
966
+ "goldIndex": 0,
967
+ "severity": "medium",
968
+ "anchors": [],
969
+ "anchoredLines": [],
970
+ "anchored": false,
971
+ "bugType": "api_misuse"
972
+ },
973
+ {
974
+ "goldIndex": 1,
975
+ "severity": "medium",
976
+ "anchors": [],
977
+ "anchoredLines": [],
978
+ "anchored": false,
979
+ "bugType": "incorrect_value"
980
+ },
981
+ {
982
+ "goldIndex": 2,
983
+ "severity": "low",
984
+ "anchors": [
985
+ "error_ids",
986
+ "get_multi"
987
+ ],
988
+ "anchoredLines": [
989
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:84",
990
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:94",
991
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:104",
992
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:107",
993
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:118",
994
+ "tests/sentry/replays/test_project_replay_summarize_breadcrumbs.py:181",
995
+ "tests/sentry/replays/test_project_replay_summarize_breadcrumbs.py:247",
996
+ "src/sentry/replays/endpoints/project_replay_summarize_breadcrumbs.py:108"
997
+ ],
998
+ "anchored": true,
999
+ "bugType": "api_misuse",
1000
+ "matchedAnchors": [
1001
+ "error_ids",
1002
+ "get_multi"
1003
+ ],
1004
+ "matchCount": 8,
1005
+ "matchFiles": 2
1006
+ }
1007
+ ]
1008
+ },
1009
+ {
1010
+ "instanceId": "prreview__sentry-greptile-1",
1011
+ "repo": "ai-code-review-evaluation/sentry-greptile",
1012
+ "language": "Python",
1013
+ "requiresContext": "cross_file",
1014
+ "changedFiles": 3,
1015
+ "changedLines": 138,
1016
+ "gold": [
1017
+ {
1018
+ "goldIndex": 0,
1019
+ "severity": "low",
1020
+ "anchors": [
1021
+ "OptimizedCursorPaginator"
1022
+ ],
1023
+ "anchoredLines": [
1024
+ "src/sentry/api/endpoints/organization_auditlogs.py:11",
1025
+ "src/sentry/api/endpoints/organization_auditlogs.py:79",
1026
+ "src/sentry/api/paginator.py:821"
1027
+ ],
1028
+ "anchored": true,
1029
+ "bugType": "api_misuse",
1030
+ "matchedAnchors": [
1031
+ "OptimizedCursorPaginator"
1032
+ ],
1033
+ "matchCount": 3,
1034
+ "matchFiles": 2
1035
+ },
1036
+ {
1037
+ "goldIndex": 1,
1038
+ "severity": "high",
1039
+ "anchors": [],
1040
+ "anchoredLines": [],
1041
+ "anchored": false,
1042
+ "bugType": "api_misuse"
1043
+ },
1044
+ {
1045
+ "goldIndex": 2,
1046
+ "severity": "high",
1047
+ "anchors": [
1048
+ "API",
1049
+ "user_id",
1050
+ "organization_context",
1051
+ "has_global_access",
1052
+ "AttributeError",
1053
+ "optimized_pagination"
1054
+ ],
1055
+ "anchoredLines": [
1056
+ "src/sentry/api/endpoints/organization_auditlogs.py:71",
1057
+ "src/sentry/api/endpoints/organization_auditlogs.py:70"
1058
+ ],
1059
+ "anchored": true,
1060
+ "bugType": "null_reference",
1061
+ "matchedAnchors": [
1062
+ "organization_context",
1063
+ "has_global_access",
1064
+ "optimized_pagination"
1065
+ ],
1066
+ "matchCount": 2,
1067
+ "matchFiles": 1
1068
+ },
1069
+ {
1070
+ "goldIndex": 3,
1071
+ "severity": "high",
1072
+ "anchors": [
1073
+ "get_item_key",
1074
+ "order_by",
1075
+ "math.floor/ceil",
1076
+ "TypeError"
1077
+ ],
1078
+ "anchoredLines": [
1079
+ "src/sentry/api/paginator.py:838",
1080
+ "src/sentry/api/paginator.py:889",
1081
+ "src/sentry/api/paginator.py:904",
1082
+ "src/sentry/api/endpoints/organization_auditlogs.py:72",
1083
+ "src/sentry/api/endpoints/organization_auditlogs.py:80",
1084
+ "src/sentry/api/endpoints/organization_auditlogs.py:89"
1085
+ ],
1086
+ "anchored": true,
1087
+ "bugType": "type_error",
1088
+ "matchedAnchors": [
1089
+ "get_item_key",
1090
+ "order_by"
1091
+ ],
1092
+ "matchCount": 6,
1093
+ "matchFiles": 2
1094
+ }
1095
+ ]
1096
+ },
1097
+ {
1098
+ "instanceId": "prreview__grafana-97529",
1099
+ "repo": "grafana/grafana",
1100
+ "language": "Go",
1101
+ "requiresContext": "cross_file",
1102
+ "changedFiles": 5,
1103
+ "changedLines": 82,
1104
+ "gold": [
1105
+ {
1106
+ "goldIndex": 0,
1107
+ "severity": "high",
1108
+ "anchors": [
1109
+ "BuildIndex",
1110
+ "cacheMu"
1111
+ ],
1112
+ "anchoredLines": [
1113
+ "pkg/storage/unified/search/bleve.go:88",
1114
+ "pkg/storage/unified/search/bleve.go:89",
1115
+ "pkg/storage/unified/search/bleve.go:137",
1116
+ "pkg/storage/unified/search/bleve.go:139"
1117
+ ],
1118
+ "anchored": true,
1119
+ "bugType": "race_condition",
1120
+ "matchedAnchors": [
1121
+ "cacheMu"
1122
+ ],
1123
+ "matchCount": 4,
1124
+ "matchFiles": 1
1125
+ },
1126
+ {
1127
+ "goldIndex": 1,
1128
+ "severity": "high",
1129
+ "anchors": [
1130
+ "TotalDocs",
1131
+ "b.cache",
1132
+ "BuildIndex",
1133
+ "read/write"
1134
+ ],
1135
+ "anchoredLines": [
1136
+ "pkg/storage/unified/resource/search.go:216"
1137
+ ],
1138
+ "anchored": true,
1139
+ "bugType": "race_condition",
1140
+ "matchedAnchors": [
1141
+ "TotalDocs"
1142
+ ],
1143
+ "matchCount": 1,
1144
+ "matchFiles": 1
1145
+ }
1146
+ ]
1147
+ },
1148
+ {
1149
+ "instanceId": "prreview__sentry-80168",
1150
+ "repo": "getsentry/sentry",
1151
+ "language": "Python",
1152
+ "requiresContext": "cross_file",
1153
+ "changedFiles": 4,
1154
+ "changedLines": 400,
1155
+ "gold": [
1156
+ {
1157
+ "goldIndex": 0,
1158
+ "severity": "high",
1159
+ "anchors": [
1160
+ "MetricAlertDetectorHandler",
1161
+ "StatefulDetectorHandler",
1162
+ "counter_names",
1163
+ "get_dedupe_value",
1164
+ "get_group_key_values",
1165
+ "build_occurrence_and_event_data",
1166
+ "TypeError"
1167
+ ],
1168
+ "anchoredLines": [
1169
+ "src/sentry/incidents/grouptype.py:12",
1170
+ "src/sentry/incidents/grouptype.py:11",
1171
+ "src/sentry/incidents/grouptype.py:7",
1172
+ "tests/sentry/workflow_engine/processors/test_detector.py:27",
1173
+ "tests/sentry/workflow_engine/processors/test_detector.py:155",
1174
+ "tests/sentry/workflow_engine/processors/test_detector.py:245",
1175
+ "tests/sentry/workflow_engine/processors/test_detector.py:28",
1176
+ "tests/sentry/workflow_engine/processors/test_detector.py:156",
1177
+ "tests/sentry/workflow_engine/processors/test_detector.py:30",
1178
+ "tests/sentry/workflow_engine/processors/test_detector.py:158",
1179
+ "tests/sentry/workflow_engine/processors/test_detector.py:33",
1180
+ "tests/sentry/workflow_engine/processors/test_detector.py:161"
1181
+ ],
1182
+ "anchored": true,
1183
+ "bugType": "api_misuse",
1184
+ "matchedAnchors": [
1185
+ "MetricAlertDetectorHandler",
1186
+ "StatefulDetectorHandler",
1187
+ "counter_names",
1188
+ "get_dedupe_value",
1189
+ "get_group_key_values",
1190
+ "build_occurrence_and_event_data"
1191
+ ],
1192
+ "matchCount": 15,
1193
+ "matchFiles": 3
1194
+ },
1195
+ {
1196
+ "goldIndex": 1,
1197
+ "severity": "low",
1198
+ "anchors": [
1199
+ "DetectorEvaluationResult",
1200
+ "DetectorGroupKey"
1201
+ ],
1202
+ "anchoredLines": [
1203
+ "src/sentry/incidents/grouptype.py:8",
1204
+ "src/sentry/incidents/grouptype.py:15",
1205
+ "src/sentry/workflow_engine/processors/detector.py:48",
1206
+ "src/sentry/workflow_engine/processors/detector.py:49",
1207
+ "src/sentry/workflow_engine/processors/detector.py:139",
1208
+ "src/sentry/workflow_engine/processors/detector.py:128",
1209
+ "src/sentry/workflow_engine/processors/detector.py:231",
1210
+ "src/sentry/workflow_engine/processors/detector.py:228",
1211
+ "tests/sentry/workflow_engine/processors/test_detector.py:32",
1212
+ "tests/sentry/workflow_engine/processors/test_detector.py:33",
1213
+ "tests/sentry/workflow_engine/processors/test_detector.py:61",
1214
+ "tests/sentry/workflow_engine/processors/test_detector.py:62"
1215
+ ],
1216
+ "anchored": true,
1217
+ "bugType": "other",
1218
+ "matchedAnchors": [
1219
+ "DetectorEvaluationResult",
1220
+ "DetectorGroupKey"
1221
+ ],
1222
+ "matchCount": 31,
1223
+ "matchFiles": 3
1224
+ }
1225
+ ]
1226
+ },
1227
+ {
1228
+ "instanceId": "prreview__sentry-80528",
1229
+ "repo": "getsentry/sentry",
1230
+ "language": "Python",
1231
+ "requiresContext": "file",
1232
+ "changedFiles": 4,
1233
+ "changedLines": 553,
1234
+ "gold": [
1235
+ {
1236
+ "goldIndex": 0,
1237
+ "severity": "high",
1238
+ "anchors": [],
1239
+ "anchoredLines": [],
1240
+ "anchored": false,
1241
+ "bugType": "incorrect_value"
1242
+ },
1243
+ {
1244
+ "goldIndex": 1,
1245
+ "severity": "low",
1246
+ "anchors": [
1247
+ "MonitorCheckIn",
1248
+ "previous_checkins"
1249
+ ],
1250
+ "anchoredLines": [
1251
+ "src/sentry/monitors/logic/incident_occurrence.py:16",
1252
+ "src/sentry/monitors/logic/incident_occurrence.py:30",
1253
+ "src/sentry/monitors/logic/incidents.py:8",
1254
+ "src/sentry/monitors/logic/incidents.py:15",
1255
+ "src/sentry/monitors/logic/incidents.py:40",
1256
+ "src/sentry/monitors/logic/incidents.py:93",
1257
+ "src/sentry/monitors/logic/mark_failed.py:17",
1258
+ "src/sentry/monitors/logic/mark_failed.py:9",
1259
+ "src/sentry/monitors/logic/mark_failed.py:104",
1260
+ "src/sentry/monitors/logic/mark_failed.py:129",
1261
+ "src/sentry/monitors/logic/mark_failed.py:182",
1262
+ "src/sentry/monitors/logic/mark_failed.py:198"
1263
+ ],
1264
+ "anchored": true,
1265
+ "bugType": "other",
1266
+ "matchedAnchors": [
1267
+ "MonitorCheckIn",
1268
+ "previous_checkins"
1269
+ ],
1270
+ "matchCount": 26,
1271
+ "matchFiles": 3
1272
+ }
1273
+ ]
1274
+ },
1275
+ {
1276
+ "instanceId": "prreview__sentry-77754",
1277
+ "repo": "getsentry/sentry",
1278
+ "language": "Python",
1279
+ "requiresContext": "file",
1280
+ "changedFiles": 7,
1281
+ "changedLines": 227,
1282
+ "gold": [
1283
+ {
1284
+ "goldIndex": 0,
1285
+ "severity": "medium",
1286
+ "anchors": [],
1287
+ "anchoredLines": [],
1288
+ "anchored": false,
1289
+ "bugType": "api_misuse"
1290
+ },
1291
+ {
1292
+ "goldIndex": 1,
1293
+ "severity": "low",
1294
+ "anchors": [
1295
+ "test_from_dict_inalid_data",
1296
+ "test_from_dict_invalid_data"
1297
+ ],
1298
+ "anchoredLines": [
1299
+ "tests/sentry/integrations/services/test_assignment_source.py:13"
1300
+ ],
1301
+ "anchored": true,
1302
+ "bugType": "other",
1303
+ "matchedAnchors": [
1304
+ "test_from_dict_inalid_data"
1305
+ ],
1306
+ "matchCount": 1,
1307
+ "matchFiles": 1
1308
+ },
1309
+ {
1310
+ "goldIndex": 2,
1311
+ "severity": "low",
1312
+ "anchors": [
1313
+ "empty_array",
1314
+ "test_from_dict_empty_dict"
1315
+ ],
1316
+ "anchoredLines": [],
1317
+ "anchored": false,
1318
+ "bugType": "other"
1319
+ },
1320
+ {
1321
+ "goldIndex": 3,
1322
+ "severity": "medium",
1323
+ "anchors": [
1324
+ "to_dict",
1325
+ "e.g",
1326
+ "apply_async",
1327
+ "JSON"
1328
+ ],
1329
+ "anchoredLines": [
1330
+ "src/sentry/integrations/services/assignment_source.py:27",
1331
+ "src/sentry/integrations/utils/sync.py:141",
1332
+ "tests/sentry/integrations/services/test_assignment_source.py:35"
1333
+ ],
1334
+ "anchored": true,
1335
+ "bugType": "type_error",
1336
+ "matchedAnchors": [
1337
+ "to_dict"
1338
+ ],
1339
+ "matchCount": 3,
1340
+ "matchFiles": 3
1341
+ }
1342
+ ]
1343
+ },
1344
+ {
1345
+ "instanceId": "prreview__sentry-95633",
1346
+ "repo": "getsentry/sentry",
1347
+ "language": "Python",
1348
+ "requiresContext": "file",
1349
+ "changedFiles": 5,
1350
+ "changedLines": 1282,
1351
+ "gold": [
1352
+ {
1353
+ "goldIndex": 0,
1354
+ "severity": "high",
1355
+ "anchors": [
1356
+ "AttributeError",
1357
+ "API"
1358
+ ],
1359
+ "anchoredLines": [],
1360
+ "anchored": false,
1361
+ "bugType": "api_misuse"
1362
+ },
1363
+ {
1364
+ "goldIndex": 1,
1365
+ "severity": "low",
1366
+ "anchors": [
1367
+ "max_wait"
1368
+ ],
1369
+ "anchoredLines": [
1370
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1718",
1371
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1719",
1372
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1765",
1373
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1766",
1374
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1812",
1375
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1813",
1376
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1860",
1377
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1861",
1378
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1912",
1379
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1913",
1380
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1961",
1381
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1962"
1382
+ ],
1383
+ "anchored": true,
1384
+ "bugType": "other",
1385
+ "matchedAnchors": [
1386
+ "max_wait"
1387
+ ],
1388
+ "matchCount": 12,
1389
+ "matchFiles": 1
1390
+ },
1391
+ {
1392
+ "goldIndex": 2,
1393
+ "severity": "low",
1394
+ "anchors": [
1395
+ "test_thread_queue_parallel_error_handling"
1396
+ ],
1397
+ "anchoredLines": [
1398
+ "tests/sentry/uptime/consumers/test_results_consumer.py:1874"
1399
+ ],
1400
+ "anchored": true,
1401
+ "bugType": "other",
1402
+ "matchedAnchors": [
1403
+ "test_thread_queue_parallel_error_handling"
1404
+ ],
1405
+ "matchCount": 1,
1406
+ "matchFiles": 1
1407
+ }
1408
+ ]
1409
+ },
1410
+ {
1411
+ "instanceId": "prreview__sentry-greptile-92393",
1412
+ "repo": "getsentry/sentry",
1413
+ "language": "Python",
1414
+ "requiresContext": "cross_file",
1415
+ "changedFiles": 6,
1416
+ "changedLines": 74,
1417
+ "gold": [
1418
+ {
1419
+ "goldIndex": 0,
1420
+ "severity": "critical",
1421
+ "anchors": [
1422
+ "OptimizedCursorPaginator",
1423
+ "QuerySet"
1424
+ ],
1425
+ "anchoredLines": [],
1426
+ "anchored": false,
1427
+ "bugType": "incorrect_value"
1428
+ },
1429
+ {
1430
+ "goldIndex": 1,
1431
+ "severity": "high",
1432
+ "anchors": [
1433
+ "BasePaginator",
1434
+ "QuerySet"
1435
+ ],
1436
+ "anchoredLines": [],
1437
+ "anchored": false,
1438
+ "bugType": "incorrect_value"
1439
+ },
1440
+ {
1441
+ "goldIndex": 2,
1442
+ "severity": "high",
1443
+ "anchors": [
1444
+ "OptimizedCursorPaginator",
1445
+ "get_item_key",
1446
+ "floor/ceil",
1447
+ "order_by",
1448
+ "TypeError"
1449
+ ],
1450
+ "anchoredLines": [],
1451
+ "anchored": false,
1452
+ "bugType": "type_error"
1453
+ }
1454
+ ]
1455
+ },
1456
+ {
1457
+ "instanceId": "prreview__sentry-greptile-94376",
1458
+ "repo": "getsentry/sentry",
1459
+ "language": "Python",
1460
+ "requiresContext": "cross_file",
1461
+ "changedFiles": 7,
1462
+ "changedLines": 431,
1463
+ "gold": [
1464
+ {
1465
+ "goldIndex": 0,
1466
+ "severity": "low",
1467
+ "anchors": [
1468
+ "sample_rate",
1469
+ "0.0"
1470
+ ],
1471
+ "anchoredLines": [
1472
+ "src/sentry/testutils/factories.py:345",
1473
+ "src/sentry/testutils/factories.py:355"
1474
+ ],
1475
+ "anchored": true,
1476
+ "bugType": "logic_error",
1477
+ "matchedAnchors": [
1478
+ "sample_rate"
1479
+ ],
1480
+ "matchCount": 2,
1481
+ "matchFiles": 1
1482
+ },
1483
+ {
1484
+ "goldIndex": 1,
1485
+ "severity": "low",
1486
+ "anchors": [
1487
+ "invalidate_upsampling_cache",
1488
+ "project_ids"
1489
+ ],
1490
+ "anchoredLines": [
1491
+ "src/sentry/api/helpers/error_upsampling.py:22",
1492
+ "src/sentry/api/helpers/error_upsampling.py:29",
1493
+ "src/sentry/api/helpers/error_upsampling.py:35",
1494
+ "src/sentry/api/helpers/error_upsampling.py:43",
1495
+ "tests/sentry/api/helpers/test_error_upsampling.py:27",
1496
+ "tests/sentry/api/helpers/test_error_upsampling.py:40",
1497
+ "tests/sentry/api/helpers/test_error_upsampling.py:41",
1498
+ "tests/sentry/api/helpers/test_error_upsampling.py:44",
1499
+ "tests/sentry/api/helpers/test_error_upsampling.py:45",
1500
+ "tests/sentry/api/helpers/test_error_upsampling.py:49"
1501
+ ],
1502
+ "anchored": true,
1503
+ "bugType": "api_misuse",
1504
+ "matchedAnchors": [
1505
+ "project_ids"
1506
+ ],
1507
+ "matchCount": 10,
1508
+ "matchFiles": 2
1509
+ },
1510
+ {
1511
+ "goldIndex": 2,
1512
+ "severity": "medium",
1513
+ "anchors": [
1514
+ "scoped_dataset",
1515
+ "e.g"
1516
+ ],
1517
+ "anchoredLines": [],
1518
+ "anchored": false,
1519
+ "bugType": "incorrect_value"
1520
+ }
1521
+ ]
1522
+ },
1523
+ {
1524
+ "instanceId": "prreview__grafana-103633",
1525
+ "repo": "grafana/grafana",
1526
+ "language": "Go",
1527
+ "requiresContext": "cross_file",
1528
+ "changedFiles": 4,
1529
+ "changedLines": 273,
1530
+ "gold": [
1531
+ {
1532
+ "goldIndex": 0,
1533
+ "severity": "high",
1534
+ "anchors": [],
1535
+ "anchoredLines": [],
1536
+ "anchored": false,
1537
+ "bugType": "security"
1538
+ },
1539
+ {
1540
+ "goldIndex": 1,
1541
+ "severity": "low",
1542
+ "anchors": [
1543
+ "checkPermission"
1544
+ ],
1545
+ "anchoredLines": [
1546
+ "pkg/services/authz/rbac/service.go:125"
1547
+ ],
1548
+ "anchored": true,
1549
+ "bugType": "incorrect_value",
1550
+ "matchedAnchors": [
1551
+ "checkPermission"
1552
+ ],
1553
+ "matchCount": 1,
1554
+ "matchFiles": 1
1555
+ }
1556
+ ]
1557
+ },
1558
+ {
1559
+ "instanceId": "prreview__sentry-67876",
1560
+ "repo": "getsentry/sentry",
1561
+ "language": "Python",
1562
+ "requiresContext": "cross_file",
1563
+ "changedFiles": 3,
1564
+ "changedLines": 297,
1565
+ "gold": [
1566
+ {
1567
+ "goldIndex": 0,
1568
+ "severity": "medium",
1569
+ "anchors": [
1570
+ "github_authenticated_user"
1571
+ ],
1572
+ "anchoredLines": [
1573
+ "src/sentry/integrations/github/integration.py:438",
1574
+ "src/sentry/integrations/github/integration.py:502"
1575
+ ],
1576
+ "anchored": true,
1577
+ "bugType": "null_reference",
1578
+ "matchedAnchors": [
1579
+ "github_authenticated_user"
1580
+ ],
1581
+ "matchCount": 2,
1582
+ "matchFiles": 1
1583
+ },
1584
+ {
1585
+ "goldIndex": 1,
1586
+ "severity": "medium",
1587
+ "anchors": [
1588
+ "OAuth"
1589
+ ],
1590
+ "anchoredLines": [],
1591
+ "anchored": false,
1592
+ "bugType": "security"
1593
+ },
1594
+ {
1595
+ "goldIndex": 2,
1596
+ "severity": "high",
1597
+ "anchors": [
1598
+ "KeyError"
1599
+ ],
1600
+ "anchoredLines": [],
1601
+ "anchored": false,
1602
+ "bugType": "missing_validation"
1603
+ }
1604
+ ]
1605
+ },
1606
+ {
1607
+ "instanceId": "prreview__keycloak-32918",
1608
+ "repo": "keycloak/keycloak",
1609
+ "language": "Java",
1610
+ "requiresContext": "file",
1611
+ "changedFiles": 4,
1612
+ "changedLines": 271,
1613
+ "gold": [
1614
+ {
1615
+ "goldIndex": 0,
1616
+ "severity": "critical",
1617
+ "anchors": [],
1618
+ "anchoredLines": [],
1619
+ "anchored": false,
1620
+ "bugType": "api_misuse"
1621
+ },
1622
+ {
1623
+ "goldIndex": 1,
1624
+ "severity": "medium",
1625
+ "anchors": [],
1626
+ "anchoredLines": [],
1627
+ "anchored": false,
1628
+ "bugType": "incorrect_value"
1629
+ }
1630
+ ]
1631
+ },
1632
+ {
1633
+ "instanceId": "prreview__grafana-94942",
1634
+ "repo": "grafana/grafana",
1635
+ "language": "Go",
1636
+ "requiresContext": "file",
1637
+ "changedFiles": 7,
1638
+ "changedLines": 81,
1639
+ "gold": [
1640
+ {
1641
+ "goldIndex": 0,
1642
+ "severity": "critical",
1643
+ "anchors": [
1644
+ "enableSqlExpressions",
1645
+ "SQL"
1646
+ ],
1647
+ "anchoredLines": [
1648
+ "pkg/expr/reader.go:129",
1649
+ "pkg/expr/reader.go:194"
1650
+ ],
1651
+ "anchored": true,
1652
+ "bugType": "logic_error",
1653
+ "matchedAnchors": [
1654
+ "enableSqlExpressions"
1655
+ ],
1656
+ "matchCount": 2,
1657
+ "matchFiles": 1
1658
+ },
1659
+ {
1660
+ "goldIndex": 1,
1661
+ "severity": "high",
1662
+ "anchors": [
1663
+ "NewInMemoryDB",
1664
+ "RunCommands",
1665
+ "QueryFramesInto"
1666
+ ],
1667
+ "anchoredLines": [
1668
+ "pkg/expr/sql/db.go:24",
1669
+ "pkg/expr/sql/parser.go:24",
1670
+ "pkg/expr/sql/parser.go:23",
1671
+ "pkg/expr/sql_command.go:97",
1672
+ "pkg/expr/sql_command.go:96",
1673
+ "pkg/expr/sql/db.go:16",
1674
+ "pkg/expr/sql/db.go:20",
1675
+ "pkg/expr/sql_command.go:101",
1676
+ "pkg/expr/sql_command.go:100"
1677
+ ],
1678
+ "anchored": true,
1679
+ "bugType": "dead_code",
1680
+ "matchedAnchors": [
1681
+ "NewInMemoryDB",
1682
+ "RunCommands",
1683
+ "QueryFramesInto"
1684
+ ],
1685
+ "matchCount": 9,
1686
+ "matchFiles": 3
1687
+ }
1688
+ ]
1689
+ },
1690
+ {
1691
+ "instanceId": "prreview__grafana-90939",
1692
+ "repo": "grafana/grafana",
1693
+ "language": "Go",
1694
+ "requiresContext": "file",
1695
+ "changedFiles": 1,
1696
+ "changedLines": 16,
1697
+ "gold": [
1698
+ {
1699
+ "goldIndex": 0,
1700
+ "severity": "medium",
1701
+ "anchors": [
1702
+ "GetWebAssets",
1703
+ "RLock"
1704
+ ],
1705
+ "anchoredLines": [
1706
+ "pkg/api/webassets/webassets.go:41"
1707
+ ],
1708
+ "anchored": true,
1709
+ "bugType": "race_condition",
1710
+ "matchedAnchors": [
1711
+ "RLock"
1712
+ ],
1713
+ "matchCount": 1,
1714
+ "matchFiles": 1
1715
+ },
1716
+ {
1717
+ "goldIndex": 1,
1718
+ "severity": "high",
1719
+ "anchors": [
1720
+ "entryPointAssetsCache"
1721
+ ],
1722
+ "anchoredLines": [
1723
+ "pkg/api/webassets/webassets.go:34",
1724
+ "pkg/api/webassets/webassets.go:36",
1725
+ "pkg/api/webassets/webassets.go:37",
1726
+ "pkg/api/webassets/webassets.go:38",
1727
+ "pkg/api/webassets/webassets.go:42"
1728
+ ],
1729
+ "anchored": true,
1730
+ "bugType": "null_reference",
1731
+ "matchedAnchors": [
1732
+ "entryPointAssetsCache"
1733
+ ],
1734
+ "matchCount": 5,
1735
+ "matchFiles": 1
1736
+ }
1737
+ ]
1738
+ },
1739
+ {
1740
+ "instanceId": "prreview__grafana-80329",
1741
+ "repo": "grafana/grafana",
1742
+ "language": "Go",
1743
+ "requiresContext": "local",
1744
+ "changedFiles": 3,
1745
+ "changedLines": 261,
1746
+ "gold": [
1747
+ {
1748
+ "goldIndex": 0,
1749
+ "severity": "low",
1750
+ "anchors": [],
1751
+ "anchoredLines": [],
1752
+ "anchored": false,
1753
+ "bugType": "incorrect_value"
1754
+ }
1755
+ ]
1756
+ },
1757
+ {
1758
+ "instanceId": "prreview__grafana-90045",
1759
+ "repo": "grafana/grafana",
1760
+ "language": "Go",
1761
+ "requiresContext": "file",
1762
+ "changedFiles": 5,
1763
+ "changedLines": 655,
1764
+ "gold": [
1765
+ {
1766
+ "goldIndex": 0,
1767
+ "severity": "medium",
1768
+ "anchors": [
1769
+ "d.Log"
1770
+ ],
1771
+ "anchoredLines": [
1772
+ "pkg/apiserver/rest/dualwriter_mode3.go:38",
1773
+ "pkg/apiserver/rest/dualwriter_mode3.go:65",
1774
+ "pkg/apiserver/rest/dualwriter_mode3.go:54",
1775
+ "pkg/apiserver/rest/dualwriter_mode3.go:81",
1776
+ "pkg/apiserver/rest/dualwriter_mode3.go:96",
1777
+ "pkg/apiserver/rest/dualwriter_mode3.go:97",
1778
+ "pkg/apiserver/rest/dualwriter_mode3.go:77",
1779
+ "pkg/apiserver/rest/dualwriter_mode3.go:122",
1780
+ "pkg/apiserver/rest/dualwriter_mode3.go:113",
1781
+ "pkg/apiserver/rest/dualwriter_mode3.go:149"
1782
+ ],
1783
+ "anchored": true,
1784
+ "bugType": "incorrect_value",
1785
+ "matchedAnchors": [
1786
+ "d.Log"
1787
+ ],
1788
+ "matchCount": 10,
1789
+ "matchFiles": 1
1790
+ },
1791
+ {
1792
+ "goldIndex": 1,
1793
+ "severity": "high",
1794
+ "anchors": [
1795
+ "recordLegacyDuration",
1796
+ "recordStorageDuration"
1797
+ ],
1798
+ "anchoredLines": [
1799
+ "pkg/apiserver/rest/dualwriter_mode3.go:45",
1800
+ "pkg/apiserver/rest/dualwriter_mode3.go:56",
1801
+ "pkg/apiserver/rest/dualwriter_mode3.go:113",
1802
+ "pkg/apiserver/rest/dualwriter_mode3.go:129",
1803
+ "pkg/apiserver/rest/dualwriter_mode3.go:140",
1804
+ "pkg/apiserver/rest/dualwriter_mode3.go:48",
1805
+ "pkg/apiserver/rest/dualwriter_mode3.go:73",
1806
+ "pkg/apiserver/rest/dualwriter_mode3.go:89",
1807
+ "pkg/apiserver/rest/dualwriter_mode3.go:103",
1808
+ "pkg/apiserver/rest/dualwriter_mode3.go:106",
1809
+ "pkg/apiserver/rest/dualwriter_mode3.go:132",
1810
+ "pkg/apiserver/rest/dualwriter_mode3.go:156"
1811
+ ],
1812
+ "anchored": true,
1813
+ "bugType": "incorrect_value",
1814
+ "matchedAnchors": [
1815
+ "recordLegacyDuration",
1816
+ "recordStorageDuration"
1817
+ ],
1818
+ "matchCount": 14,
1819
+ "matchFiles": 1
1820
+ },
1821
+ {
1822
+ "goldIndex": 2,
1823
+ "severity": "medium",
1824
+ "anchors": [
1825
+ "options.Kind"
1826
+ ],
1827
+ "anchoredLines": [
1828
+ "pkg/apiserver/rest/dualwriter_mode3.go:38",
1829
+ "pkg/apiserver/rest/dualwriter_mode3.go:45",
1830
+ "pkg/apiserver/rest/dualwriter_mode3.go:48",
1831
+ "pkg/apiserver/rest/dualwriter_mode3.go:56",
1832
+ "pkg/apiserver/rest/dualwriter_mode3.go:65",
1833
+ "pkg/apiserver/rest/dualwriter_mode3.go:73",
1834
+ "pkg/apiserver/rest/dualwriter_mode3.go:81",
1835
+ "pkg/apiserver/rest/dualwriter_mode3.go:89",
1836
+ "pkg/apiserver/rest/dualwriter_mode3.go:96",
1837
+ "pkg/apiserver/rest/dualwriter_mode3.go:103",
1838
+ "pkg/apiserver/rest/dualwriter_mode3.go:113",
1839
+ "pkg/apiserver/rest/dualwriter_mode3.go:122"
1840
+ ],
1841
+ "anchored": true,
1842
+ "bugType": "incorrect_value",
1843
+ "matchedAnchors": [
1844
+ "options.Kind"
1845
+ ],
1846
+ "matchCount": 19,
1847
+ "matchFiles": 1
1848
+ }
1849
+ ]
1850
+ },
1851
+ {
1852
+ "instanceId": "prreview__grafana-106778",
1853
+ "repo": "grafana/grafana",
1854
+ "language": "Go",
1855
+ "requiresContext": "cross_file",
1856
+ "changedFiles": 14,
1857
+ "changedLines": 952,
1858
+ "gold": [
1859
+ {
1860
+ "goldIndex": 0,
1861
+ "severity": "medium",
1862
+ "anchors": [
1863
+ "GrafanaRuleListItem"
1864
+ ],
1865
+ "anchoredLines": [
1866
+ "public/app/features/alerting/unified/rule-list/FilterView.tsx:15",
1867
+ "public/app/features/alerting/unified/rule-list/FilterView.tsx:157",
1868
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.tsx:14",
1869
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.tsx:8",
1870
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.tsx:94",
1871
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleListItem.tsx:26",
1872
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleLoader.tsx:80",
1873
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleLoader.tsx:98"
1874
+ ],
1875
+ "anchored": true,
1876
+ "bugType": "api_misuse",
1877
+ "matchedAnchors": [
1878
+ "GrafanaRuleListItem"
1879
+ ],
1880
+ "matchCount": 8,
1881
+ "matchFiles": 4
1882
+ },
1883
+ {
1884
+ "goldIndex": 1,
1885
+ "severity": "high",
1886
+ "anchors": [
1887
+ "RuleActionsButtons",
1888
+ "promRule",
1889
+ "SilenceGrafanaRuleDrawer",
1890
+ "showSilenceDrawer"
1891
+ ],
1892
+ "anchoredLines": [
1893
+ "public/app/features/alerting/unified/components/rules/RulesTable.test.tsx:24",
1894
+ "public/app/features/alerting/unified/components/rules/RulesTable.test.tsx:62",
1895
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleListItem.tsx:15",
1896
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleListItem.tsx:47",
1897
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleLoader.tsx:21",
1898
+ "public/app/features/alerting/unified/rule-list/GrafanaRuleLoader.tsx:126",
1899
+ "public/app/features/alerting/unified/components/rule-viewer/AlertRuleMenu.tsx:41",
1900
+ "public/app/features/alerting/unified/components/rule-viewer/AlertRuleMenu.tsx:66",
1901
+ "public/app/features/alerting/unified/components/rule-viewer/AlertRuleMenu.tsx:73",
1902
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.test.tsx:91",
1903
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.test.tsx:93",
1904
+ "public/app/features/alerting/unified/rule-list/GrafanaGroupLoader.test.tsx:96"
1905
+ ],
1906
+ "anchored": true,
1907
+ "bugType": "logic_error",
1908
+ "matchedAnchors": [
1909
+ "RuleActionsButtons",
1910
+ "promRule"
1911
+ ],
1912
+ "matchCount": 37,
1913
+ "matchFiles": 8
1914
+ }
1915
+ ]
1916
+ },
1917
+ {
1918
+ "instanceId": "prreview__grafana-107534",
1919
+ "repo": "grafana/grafana",
1920
+ "language": "Go",
1921
+ "requiresContext": "cross_file",
1922
+ "changedFiles": 4,
1923
+ "changedLines": 63,
1924
+ "gold": [
1925
+ {
1926
+ "goldIndex": 0,
1927
+ "severity": "low",
1928
+ "anchors": [
1929
+ "applyTemplateVariables"
1930
+ ],
1931
+ "anchoredLines": [
1932
+ "public/app/plugins/datasource/loki/querySplitting.ts:299",
1933
+ "public/app/plugins/datasource/loki/shardQuerySplitting.test.ts:56",
1934
+ "public/app/plugins/datasource/loki/shardQuerySplitting.test.ts:112",
1935
+ "public/app/plugins/datasource/loki/shardQuerySplitting.test.ts:173",
1936
+ "public/app/plugins/datasource/loki/shardQuerySplitting.ts:52"
1937
+ ],
1938
+ "anchored": true,
1939
+ "bugType": "other",
1940
+ "matchedAnchors": [
1941
+ "applyTemplateVariables"
1942
+ ],
1943
+ "matchCount": 5,
1944
+ "matchFiles": 3
1945
+ }
1946
+ ]
1947
+ },
1948
+ {
1949
+ "instanceId": "prreview__grafana-79265",
1950
+ "repo": "grafana/grafana",
1951
+ "language": "Go",
1952
+ "requiresContext": "cross_file",
1953
+ "changedFiles": 11,
1954
+ "changedLines": 142,
1955
+ "gold": [
1956
+ {
1957
+ "goldIndex": 0,
1958
+ "severity": "high",
1959
+ "anchors": [],
1960
+ "anchoredLines": [],
1961
+ "anchored": false,
1962
+ "bugType": "race_condition"
1963
+ },
1964
+ {
1965
+ "goldIndex": 1,
1966
+ "severity": "medium",
1967
+ "anchors": [
1968
+ "anonDeviceService",
1969
+ "TagDevice",
1970
+ "ErrDeviceLimitReached"
1971
+ ],
1972
+ "anchoredLines": [
1973
+ "pkg/services/anonymous/anonimpl/client.go:54",
1974
+ "pkg/services/anonymous/anonimpl/client.go:44",
1975
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:18",
1976
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:96",
1977
+ "pkg/services/anonymous/anonimpl/anonstore/database_test.go:69",
1978
+ "pkg/services/anonymous/anonimpl/client.go:45"
1979
+ ],
1980
+ "anchored": true,
1981
+ "bugType": "logic_error",
1982
+ "matchedAnchors": [
1983
+ "anonDeviceService",
1984
+ "TagDevice",
1985
+ "ErrDeviceLimitReached"
1986
+ ],
1987
+ "matchCount": 6,
1988
+ "matchFiles": 3
1989
+ },
1990
+ {
1991
+ "goldIndex": 2,
1992
+ "severity": "medium",
1993
+ "anchors": [
1994
+ "dbSession.Exec",
1995
+ "dbSession"
1996
+ ],
1997
+ "anchoredLines": [
1998
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:85",
1999
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:83"
2000
+ ],
2001
+ "anchored": true,
2002
+ "bugType": "type_error",
2003
+ "matchedAnchors": [
2004
+ "dbSession.Exec",
2005
+ "dbSession"
2006
+ ],
2007
+ "matchCount": 2,
2008
+ "matchFiles": 1
2009
+ },
2010
+ {
2011
+ "goldIndex": 3,
2012
+ "severity": "low",
2013
+ "anchors": [
2014
+ "ErrDeviceLimitReached"
2015
+ ],
2016
+ "anchoredLines": [
2017
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:18",
2018
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:96",
2019
+ "pkg/services/anonymous/anonimpl/anonstore/database_test.go:69",
2020
+ "pkg/services/anonymous/anonimpl/client.go:45"
2021
+ ],
2022
+ "anchored": true,
2023
+ "bugType": "incorrect_value",
2024
+ "matchedAnchors": [
2025
+ "ErrDeviceLimitReached"
2026
+ ],
2027
+ "matchCount": 4,
2028
+ "matchFiles": 3
2029
+ },
2030
+ {
2031
+ "goldIndex": 4,
2032
+ "severity": "low",
2033
+ "anchors": [
2034
+ "device.UpdatedAt.UTC",
2035
+ "UpdatedAt",
2036
+ "UTC",
2037
+ "anonymousDeviceExpiration",
2038
+ "time.Now"
2039
+ ],
2040
+ "anchoredLines": [
2041
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:80",
2042
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:81",
2043
+ "pkg/services/anonymous/anonimpl/anonstore/database_test.go:59",
2044
+ "pkg/services/anonymous/anonimpl/anonstore/database_test.go:66",
2045
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:110",
2046
+ "pkg/services/anonymous/anonimpl/anonstore/database.go:16",
2047
+ "pkg/services/anonymous/anonimpl/api/api.go:18",
2048
+ "pkg/services/anonymous/anonimpl/api/api.go:71",
2049
+ "pkg/services/anonymous/anonimpl/api/api.go:73"
2050
+ ],
2051
+ "anchored": true,
2052
+ "bugType": "logic_error",
2053
+ "matchedAnchors": [
2054
+ "device.UpdatedAt.UTC",
2055
+ "UpdatedAt",
2056
+ "UTC",
2057
+ "anonymousDeviceExpiration",
2058
+ "time.Now"
2059
+ ],
2060
+ "matchCount": 9,
2061
+ "matchFiles": 3
2062
+ }
2063
+ ]
2064
+ },
2065
+ {
2066
+ "instanceId": "prreview__discourse-graphite-9",
2067
+ "repo": "discourse/discourse",
2068
+ "language": "Ruby",
2069
+ "requiresContext": "file",
2070
+ "changedFiles": 7,
2071
+ "changedLines": 46,
2072
+ "gold": [
2073
+ {
2074
+ "goldIndex": 0,
2075
+ "severity": "low",
2076
+ "anchors": [
2077
+ "loaded_locales"
2078
+ ],
2079
+ "anchoredLines": [
2080
+ "lib/freedom_patches/translate_accelerator.rb:63",
2081
+ "lib/freedom_patches/translate_accelerator.rb:64"
2082
+ ],
2083
+ "anchored": true,
2084
+ "bugType": "race_condition",
2085
+ "matchedAnchors": [
2086
+ "loaded_locales"
2087
+ ],
2088
+ "matchCount": 2,
2089
+ "matchFiles": 1
2090
+ },
2091
+ {
2092
+ "goldIndex": 1,
2093
+ "severity": "low",
2094
+ "anchors": [
2095
+ "e.g",
2096
+ "checking/loading"
2097
+ ],
2098
+ "anchoredLines": [
2099
+ "config/initializers/i18n.rb:16"
2100
+ ],
2101
+ "anchored": true,
2102
+ "bugType": "missing_validation",
2103
+ "matchedAnchors": [
2104
+ "e.g"
2105
+ ],
2106
+ "matchCount": 1,
2107
+ "matchFiles": 1
2108
+ }
2109
+ ]
2110
+ },
2111
+ {
2112
+ "instanceId": "prreview__grafana-76186",
2113
+ "repo": "grafana/grafana",
2114
+ "language": "Go",
2115
+ "requiresContext": "cross_file",
2116
+ "changedFiles": 8,
2117
+ "changedLines": 215,
2118
+ "gold": [
2119
+ {
2120
+ "goldIndex": 0,
2121
+ "severity": "high",
2122
+ "anchors": [
2123
+ "ContextualLoggerMiddleware",
2124
+ "QueryData",
2125
+ "CallResource",
2126
+ "CheckHealth",
2127
+ "CollectMetrics",
2128
+ "PluginContext",
2129
+ "instrumentContext"
2130
+ ],
2131
+ "anchoredLines": [
2132
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:16",
2133
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:22",
2134
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:39",
2135
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:44",
2136
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:49",
2137
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:54",
2138
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:59",
2139
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:63",
2140
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:67",
2141
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:41",
2142
+ "pkg/services/pluginsintegration/clientmiddleware/instrumentation_middleware.go:161",
2143
+ "pkg/services/pluginsintegration/clientmiddleware/metrics_middleware.go:144"
2144
+ ],
2145
+ "anchored": true,
2146
+ "bugType": "null_reference",
2147
+ "matchedAnchors": [
2148
+ "ContextualLoggerMiddleware",
2149
+ "QueryData",
2150
+ "CallResource",
2151
+ "CheckHealth",
2152
+ "CollectMetrics",
2153
+ "PluginContext",
2154
+ "instrumentContext"
2155
+ ],
2156
+ "matchCount": 39,
2157
+ "matchFiles": 4
2158
+ },
2159
+ {
2160
+ "goldIndex": 1,
2161
+ "severity": "low",
2162
+ "anchors": [
2163
+ "traceID",
2164
+ "LoggerMiddleware",
2165
+ "ContextualLoggerMiddleware"
2166
+ ],
2167
+ "anchoredLines": [
2168
+ "pkg/services/pluginsintegration/clientmiddleware/logger_middleware.go:61",
2169
+ "pkg/services/pluginsintegration/clientmiddleware/logger_middleware.go:62",
2170
+ "pkg/services/pluginsintegration/clientmiddleware/logger_middleware.go:63",
2171
+ "pkg/services/pluginsintegration/clientmiddleware/logger_middleware.go:36",
2172
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:16",
2173
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:22",
2174
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:39",
2175
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:44",
2176
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:49",
2177
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:54",
2178
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:59",
2179
+ "pkg/services/pluginsintegration/clientmiddleware/contextual_logger_middleware.go:63"
2180
+ ],
2181
+ "anchored": true,
2182
+ "bugType": "incorrect_value",
2183
+ "matchedAnchors": [
2184
+ "traceID",
2185
+ "LoggerMiddleware",
2186
+ "ContextualLoggerMiddleware"
2187
+ ],
2188
+ "matchCount": 13,
2189
+ "matchFiles": 2
2190
+ }
2191
+ ]
2192
+ },
2193
+ {
2194
+ "instanceId": "prreview__discourse-graphite-10",
2195
+ "repo": "discourse/discourse",
2196
+ "language": "Ruby",
2197
+ "requiresContext": "cross_file",
2198
+ "changedFiles": 36,
2199
+ "changedLines": 576,
2200
+ "gold": [
2201
+ {
2202
+ "goldIndex": 0,
2203
+ "severity": "critical",
2204
+ "anchors": [
2205
+ "NoMethodError",
2206
+ "before_validation",
2207
+ "EmbeddableHost"
2208
+ ],
2209
+ "anchoredLines": [
2210
+ "app/models/embeddable_host.rb:5",
2211
+ "app/controllers/admin/embeddable_hosts_controller.rb:6",
2212
+ "app/controllers/admin/embeddable_hosts_controller.rb:10",
2213
+ "app/controllers/admin/embeddable_hosts_controller.rb:15",
2214
+ "app/controllers/admin/embedding_controller.rb:18",
2215
+ "app/controllers/embed_controller.rb:61",
2216
+ "app/models/embeddable_host.rb:1",
2217
+ "app/models/topic_embed.rb:36",
2218
+ "lib/topic_retriever.rb:16",
2219
+ "spec/models/embeddable_host_spec.rb:3",
2220
+ "spec/models/embeddable_host_spec.rb:6",
2221
+ "spec/models/embeddable_host_spec.rb:12"
2222
+ ],
2223
+ "anchored": true,
2224
+ "bugType": "null_reference",
2225
+ "matchedAnchors": [
2226
+ "before_validation",
2227
+ "EmbeddableHost"
2228
+ ],
2229
+ "matchCount": 18,
2230
+ "matchFiles": 7
2231
+ },
2232
+ {
2233
+ "goldIndex": 1,
2234
+ "severity": "medium",
2235
+ "anchors": [
2236
+ "EmbeddableHostsController",
2237
+ "EmbeddableHost",
2238
+ "EmbeddableHost.where",
2239
+ "i.e",
2240
+ "e.g",
2241
+ "save_host",
2242
+ "NoMethodError"
2243
+ ],
2244
+ "anchoredLines": [
2245
+ "app/controllers/admin/embeddable_hosts_controller.rb:1",
2246
+ "spec/controllers/admin/embeddable_hosts_controller_spec.rb:3",
2247
+ "spec/controllers/admin/embeddable_hosts_controller_spec.rb:6",
2248
+ "app/controllers/admin/embeddable_hosts_controller.rb:6",
2249
+ "app/controllers/admin/embeddable_hosts_controller.rb:10",
2250
+ "app/controllers/admin/embeddable_hosts_controller.rb:15",
2251
+ "app/controllers/admin/embedding_controller.rb:18",
2252
+ "app/controllers/embed_controller.rb:61",
2253
+ "app/models/embeddable_host.rb:1",
2254
+ "app/models/topic_embed.rb:36",
2255
+ "lib/topic_retriever.rb:16",
2256
+ "spec/models/embeddable_host_spec.rb:3"
2257
+ ],
2258
+ "anchored": true,
2259
+ "bugType": "null_reference",
2260
+ "matchedAnchors": [
2261
+ "EmbeddableHostsController",
2262
+ "EmbeddableHost",
2263
+ "EmbeddableHost.where",
2264
+ "save_host"
2265
+ ],
2266
+ "matchCount": 22,
2267
+ "matchFiles": 8
2268
+ },
2269
+ {
2270
+ "goldIndex": 2,
2271
+ "severity": "medium",
2272
+ "anchors": [
2273
+ "record_for_host"
2274
+ ],
2275
+ "anchoredLines": [
2276
+ "app/models/embeddable_host.rb:10",
2277
+ "app/models/embeddable_host.rb:21",
2278
+ "app/models/topic_embed.rb:36"
2279
+ ],
2280
+ "anchored": true,
2281
+ "bugType": "incorrect_value",
2282
+ "matchedAnchors": [
2283
+ "record_for_host"
2284
+ ],
2285
+ "matchCount": 3,
2286
+ "matchFiles": 2
2287
+ },
2288
+ {
2289
+ "goldIndex": 3,
2290
+ "severity": "high",
2291
+ "anchors": [
2292
+ "embeddable_hosts",
2293
+ "SQL",
2294
+ "EmbeddableHost"
2295
+ ],
2296
+ "anchoredLines": [
2297
+ "app/assets/javascripts/admin/controllers/admin-embedding.js.es6:11",
2298
+ "app/assets/javascripts/admin/controllers/admin-embedding.js.es6:15",
2299
+ "app/assets/javascripts/admin/templates/embedding.hbs:1",
2300
+ "app/assets/javascripts/admin/templates/embedding.hbs:8",
2301
+ "app/controllers/admin/embedding_controller.rb:18",
2302
+ "app/controllers/embed_controller.rb:61",
2303
+ "app/models/site_setting.rb:72",
2304
+ "app/models/site_setting.rb:79",
2305
+ "app/models/site_setting.rb:81",
2306
+ "app/models/topic.rb:869",
2307
+ "app/serializers/embedding_serializer.rb:3",
2308
+ "config/locales/server.en.yml:1167"
2309
+ ],
2310
+ "anchored": true,
2311
+ "bugType": "incorrect_value",
2312
+ "matchedAnchors": [
2313
+ "embeddable_hosts",
2314
+ "EmbeddableHost"
2315
+ ],
2316
+ "matchCount": 45,
2317
+ "matchFiles": 19
2318
+ }
2319
+ ]
2320
+ },
2321
+ {
2322
+ "instanceId": "prreview__discourse-graphite-7",
2323
+ "repo": "discourse/discourse",
2324
+ "language": "Ruby",
2325
+ "requiresContext": "cross_file",
2326
+ "changedFiles": 32,
2327
+ "changedLines": 230,
2328
+ "gold": [
2329
+ {
2330
+ "goldIndex": 0,
2331
+ "severity": "low",
2332
+ "anchors": [],
2333
+ "anchoredLines": [],
2334
+ "anchored": false,
2335
+ "bugType": "incorrect_value"
2336
+ },
2337
+ {
2338
+ "goldIndex": 1,
2339
+ "severity": "low",
2340
+ "anchors": [
2341
+ "desktop/user.css"
2342
+ ],
2343
+ "anchoredLines": [],
2344
+ "anchored": false,
2345
+ "bugType": "incorrect_value"
2346
+ },
2347
+ {
2348
+ "goldIndex": 2,
2349
+ "severity": "low",
2350
+ "anchors": [
2351
+ "topic-post.css"
2352
+ ],
2353
+ "anchoredLines": [],
2354
+ "anchored": false,
2355
+ "bugType": "incorrect_value"
2356
+ }
2357
+ ]
2358
+ },
2359
+ {
2360
+ "instanceId": "prreview__discourse-graphite-8",
2361
+ "repo": "discourse/discourse",
2362
+ "language": "Ruby",
2363
+ "requiresContext": "cross_file",
2364
+ "changedFiles": 16,
2365
+ "changedLines": 672,
2366
+ "gold": [
2367
+ {
2368
+ "goldIndex": 0,
2369
+ "severity": "high",
2370
+ "anchors": [
2371
+ "findMembers"
2372
+ ],
2373
+ "anchoredLines": [
2374
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:37",
2375
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:48",
2376
+ "app/assets/javascripts/admin/routes/admin_group_route.js:13",
2377
+ "app/assets/javascripts/discourse/models/group.js:47",
2378
+ "app/assets/javascripts/discourse/models/group.js:58",
2379
+ "app/assets/javascripts/discourse/routes/group-members.js.es6:10",
2380
+ "app/assets/javascripts/discourse/routes/group-members.js.es6:11"
2381
+ ],
2382
+ "anchored": true,
2383
+ "bugType": "race_condition",
2384
+ "matchedAnchors": [
2385
+ "findMembers"
2386
+ ],
2387
+ "matchCount": 7,
2388
+ "matchFiles": 4
2389
+ },
2390
+ {
2391
+ "goldIndex": 1,
2392
+ "severity": "medium",
2393
+ "anchors": [
2394
+ "user_count",
2395
+ "e.g",
2396
+ "2/2"
2397
+ ],
2398
+ "anchoredLines": [
2399
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:7",
2400
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:9",
2401
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:12",
2402
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:13",
2403
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:14",
2404
+ "app/assets/javascripts/admin/controllers/admin-group.js.es6:33",
2405
+ "app/assets/javascripts/admin/templates/group.hbs:14",
2406
+ "app/assets/javascripts/discourse/models/group.js:12",
2407
+ "app/assets/javascripts/discourse/models/group.js:23",
2408
+ "app/assets/javascripts/discourse/models/group.js:32",
2409
+ "spec/controllers/admin/groups_controller_spec.rb:23",
2410
+ "spec/controllers/admin/groups_controller_spec.rb:25"
2411
+ ],
2412
+ "anchored": true,
2413
+ "bugType": "logic_error",
2414
+ "matchedAnchors": [
2415
+ "user_count"
2416
+ ],
2417
+ "matchCount": 12,
2418
+ "matchFiles": 4
2419
+ },
2420
+ {
2421
+ "goldIndex": 2,
2422
+ "severity": "medium",
2423
+ "anchors": [
2424
+ "HTTP",
2425
+ "remove_member",
2426
+ "DELETE"
2427
+ ],
2428
+ "anchoredLines": [
2429
+ "app/controllers/admin/groups_controller.rb:84",
2430
+ "config/routes.rb:49",
2431
+ "spec/controllers/admin/groups_controller_spec.rb:112",
2432
+ "spec/controllers/admin/groups_controller_spec.rb:115",
2433
+ "spec/controllers/admin/groups_controller_spec.rb:125",
2434
+ "app/assets/javascripts/discourse/models/group.js:29",
2435
+ "app/assets/javascripts/discourse/models/group.js:43",
2436
+ "app/assets/javascripts/discourse/models/group.js:83"
2437
+ ],
2438
+ "anchored": true,
2439
+ "bugType": "api_misuse",
2440
+ "matchedAnchors": [
2441
+ "remove_member",
2442
+ "DELETE"
2443
+ ],
2444
+ "matchCount": 8,
2445
+ "matchFiles": 4
2446
+ }
2447
+ ]
2448
+ },
2449
+ {
2450
+ "instanceId": "prreview__discourse-graphite-3",
2451
+ "repo": "discourse/discourse",
2452
+ "language": "Ruby",
2453
+ "requiresContext": "file",
2454
+ "changedFiles": 10,
2455
+ "changedLines": 178,
2456
+ "gold": [
2457
+ {
2458
+ "goldIndex": 0,
2459
+ "severity": "medium",
2460
+ "anchors": [
2461
+ "BlockedEmail",
2462
+ "should_block_email"
2463
+ ],
2464
+ "anchoredLines": [
2465
+ "app/models/blocked_email.rb:1",
2466
+ "app/models/blocked_email.rb:12",
2467
+ "app/models/blocked_email.rb:22",
2468
+ "lib/validators/email_validator.rb:13",
2469
+ "spec/components/validators/email_validator_spec.rb:11",
2470
+ "spec/components/validators/email_validator_spec.rb:17",
2471
+ "spec/fabricators/blocked_email_fabricator.rb:3",
2472
+ "spec/models/blocked_email_spec.rb:3",
2473
+ "spec/models/blocked_email_spec.rb:9",
2474
+ "spec/models/blocked_email_spec.rb:15",
2475
+ "spec/models/blocked_email_spec.rb:20",
2476
+ "spec/models/blocked_email_spec.rb:26"
2477
+ ],
2478
+ "anchored": true,
2479
+ "bugType": "race_condition",
2480
+ "matchedAnchors": [
2481
+ "BlockedEmail"
2482
+ ],
2483
+ "matchCount": 16,
2484
+ "matchFiles": 5
2485
+ },
2486
+ {
2487
+ "goldIndex": 1,
2488
+ "severity": "medium",
2489
+ "anchors": [
2490
+ "evil.example.com",
2491
+ "example.com"
2492
+ ],
2493
+ "anchoredLines": [],
2494
+ "anchored": false,
2495
+ "bugType": "security"
2496
+ }
2497
+ ]
2498
+ },
2499
+ {
2500
+ "instanceId": "prreview__discourse-graphite-5",
2501
+ "repo": "discourse/discourse",
2502
+ "language": "Ruby",
2503
+ "requiresContext": "cross_file",
2504
+ "changedFiles": 5,
2505
+ "changedLines": 67,
2506
+ "gold": [
2507
+ {
2508
+ "goldIndex": 0,
2509
+ "severity": "low",
2510
+ "anchors": [
2511
+ "non-Ember/noscript"
2512
+ ],
2513
+ "anchoredLines": [],
2514
+ "anchored": false,
2515
+ "bugType": "api_misuse"
2516
+ },
2517
+ {
2518
+ "goldIndex": 1,
2519
+ "severity": "low",
2520
+ "anchors": [
2521
+ "IE/Edge"
2522
+ ],
2523
+ "anchoredLines": [],
2524
+ "anchored": false,
2525
+ "bugType": "incorrect_value"
2526
+ }
2527
+ ]
2528
+ },
2529
+ {
2530
+ "instanceId": "prreview__discourse-graphite-6",
2531
+ "repo": "discourse/discourse",
2532
+ "language": "Ruby",
2533
+ "requiresContext": "file",
2534
+ "changedFiles": 5,
2535
+ "changedLines": 56,
2536
+ "gold": [
2537
+ {
2538
+ "goldIndex": 0,
2539
+ "severity": "medium",
2540
+ "anchors": [
2541
+ "include_website_name",
2542
+ "include_",
2543
+ "website_name",
2544
+ "website_host"
2545
+ ],
2546
+ "anchoredLines": [
2547
+ "app/serializers/user_serializer.rb:153",
2548
+ "app/assets/javascripts/discourse/templates/user/user.hbs:66",
2549
+ "app/assets/javascripts/discourse/templates/user/user.hbs:69",
2550
+ "app/assets/javascripts/discourse/templates/user/user.hbs:71",
2551
+ "app/serializers/user_serializer.rb:43",
2552
+ "app/serializers/user_serializer.rb:137",
2553
+ "spec/serializers/user_serializer_spec.rb:79",
2554
+ "spec/serializers/user_serializer_spec.rb:84",
2555
+ "spec/serializers/user_serializer_spec.rb:89",
2556
+ "app/serializers/user_serializer.rb:138",
2557
+ "app/serializers/user_serializer.rb:140",
2558
+ "app/serializers/user_serializer.rb:141"
2559
+ ],
2560
+ "anchored": true,
2561
+ "bugType": "api_misuse",
2562
+ "matchedAnchors": [
2563
+ "include_website_name",
2564
+ "website_name",
2565
+ "website_host"
2566
+ ],
2567
+ "matchCount": 16,
2568
+ "matchFiles": 3
2569
+ }
2570
+ ]
2571
+ },
2572
+ {
2573
+ "instanceId": "prreview__discourse-graphite-4",
2574
+ "repo": "discourse/discourse",
2575
+ "language": "Ruby",
2576
+ "requiresContext": "cross_file",
2577
+ "changedFiles": 28,
2578
+ "changedLines": 666,
2579
+ "gold": [
2580
+ {
2581
+ "goldIndex": 0,
2582
+ "severity": "critical",
2583
+ "anchors": [
2584
+ "SSRF"
2585
+ ],
2586
+ "anchoredLines": [],
2587
+ "anchored": false,
2588
+ "bugType": "security"
2589
+ },
2590
+ {
2591
+ "goldIndex": 1,
2592
+ "severity": "medium",
2593
+ "anchors": [
2594
+ "indexOf",
2595
+ "evil-discourseUrl.com",
2596
+ "discourseUrl"
2597
+ ],
2598
+ "anchoredLines": [
2599
+ "app/assets/javascripts/embed.js:17",
2600
+ "app/assets/javascripts/embed.js:1",
2601
+ "app/assets/javascripts/embed.js:7"
2602
+ ],
2603
+ "anchored": true,
2604
+ "bugType": "security",
2605
+ "matchedAnchors": [
2606
+ "indexOf",
2607
+ "discourseUrl"
2608
+ ],
2609
+ "matchCount": 3,
2610
+ "matchFiles": 1
2611
+ },
2612
+ {
2613
+ "goldIndex": 2,
2614
+ "severity": "medium",
2615
+ "anchors": [
2616
+ "postMessage",
2617
+ "targetOrigin",
2618
+ "URL"
2619
+ ],
2620
+ "anchoredLines": [
2621
+ "app/views/layouts/embed.html.erb:11",
2622
+ "config/locales/server.en.yml:770",
2623
+ "spec/components/topic_retriever_spec.rb:15",
2624
+ "spec/models/topic_embed_spec.rb:18",
2625
+ "spec/models/topic_embed_spec.rb:26"
2626
+ ],
2627
+ "anchored": true,
2628
+ "bugType": "api_misuse",
2629
+ "matchedAnchors": [
2630
+ "postMessage",
2631
+ "URL"
2632
+ ],
2633
+ "matchCount": 5,
2634
+ "matchFiles": 4
2635
+ },
2636
+ {
2637
+ "goldIndex": 3,
2638
+ "severity": "medium",
2639
+ "anchors": [
2640
+ "ALLOWALL"
2641
+ ],
2642
+ "anchoredLines": [
2643
+ "app/controllers/embed_controller.rb:28",
2644
+ "spec/controllers/embed_controller_spec.rb:37"
2645
+ ],
2646
+ "anchored": true,
2647
+ "bugType": "security",
2648
+ "matchedAnchors": [
2649
+ "ALLOWALL"
2650
+ ],
2651
+ "matchCount": 2,
2652
+ "matchFiles": 2,
2653
+ "acronymOnly": true
2654
+ },
2655
+ {
2656
+ "goldIndex": 4,
2657
+ "severity": "medium",
2658
+ "anchors": [
2659
+ "TopicEmbed",
2660
+ "NoMethodError",
2661
+ "XSS",
2662
+ "HTML"
2663
+ ],
2664
+ "anchoredLines": [
2665
+ "app/controllers/embed_controller.rb:10",
2666
+ "app/jobs/scheduled/poll_feed.rb:36",
2667
+ "app/models/topic_embed.rb:3",
2668
+ "app/models/topic_embed.rb:15",
2669
+ "app/models/topic_embed.rb:25",
2670
+ "app/models/topic_embed.rb:52",
2671
+ "app/models/topic_embed.rb:79",
2672
+ "lib/tasks/disqus.thor:148",
2673
+ "lib/topic_retriever.rb:37",
2674
+ "lib/topic_retriever.rb:42",
2675
+ "lib/topic_retriever.rb:52",
2676
+ "spec/controllers/embed_controller_spec.rb:41"
2677
+ ],
2678
+ "anchored": true,
2679
+ "bugType": "security",
2680
+ "matchedAnchors": [
2681
+ "TopicEmbed",
2682
+ "HTML"
2683
+ ],
2684
+ "matchCount": 21,
2685
+ "matchFiles": 8
2686
+ },
2687
+ {
2688
+ "goldIndex": 5,
2689
+ "severity": "medium",
2690
+ "anchors": [
2691
+ "ERB",
2692
+ "Ruby/ERB"
2693
+ ],
2694
+ "anchoredLines": [],
2695
+ "anchored": false,
2696
+ "bugType": "logic_error"
2697
+ }
2698
+ ]
2699
+ },
2700
+ {
2701
+ "instanceId": "prreview__discourse-graphite-1",
2702
+ "repo": "discourse/discourse",
2703
+ "language": "Ruby",
2704
+ "requiresContext": "cross_file",
2705
+ "changedFiles": 3,
2706
+ "changedLines": 32,
2707
+ "gold": [
2708
+ {
2709
+ "goldIndex": 0,
2710
+ "severity": "medium",
2711
+ "anchors": [
2712
+ "max_width",
2713
+ "max_height"
2714
+ ],
2715
+ "anchoredLines": [
2716
+ "app/models/optimized_image.rb:146"
2717
+ ],
2718
+ "anchored": true,
2719
+ "bugType": "dead_code",
2720
+ "matchedAnchors": [
2721
+ "max_width",
2722
+ "max_height"
2723
+ ],
2724
+ "matchCount": 1,
2725
+ "matchFiles": 1
2726
+ },
2727
+ {
2728
+ "goldIndex": 1,
2729
+ "severity": "low",
2730
+ "anchors": [
2731
+ "maxSizeKB",
2732
+ "SiteSettings",
2733
+ "max_",
2734
+ "_size_kb"
2735
+ ],
2736
+ "anchoredLines": [
2737
+ "app/assets/javascripts/discourse/lib/utilities.js:182",
2738
+ "app/assets/javascripts/discourse/lib/utilities.js:246"
2739
+ ],
2740
+ "anchored": true,
2741
+ "bugType": "incorrect_value",
2742
+ "matchedAnchors": [
2743
+ "maxSizeKB",
2744
+ "SiteSettings",
2745
+ "max_",
2746
+ "_size_kb"
2747
+ ],
2748
+ "matchCount": 2,
2749
+ "matchFiles": 1
2750
+ },
2751
+ {
2752
+ "goldIndex": 2,
2753
+ "severity": "medium",
2754
+ "anchors": [
2755
+ "GIFs",
2756
+ "allow_animated_thumbnails",
2757
+ "WxH"
2758
+ ],
2759
+ "anchoredLines": [
2760
+ "app/controllers/uploads_controller.rb:67"
2761
+ ],
2762
+ "anchored": true,
2763
+ "bugType": "api_misuse",
2764
+ "matchedAnchors": [
2765
+ "allow_animated_thumbnails"
2766
+ ],
2767
+ "matchCount": 1,
2768
+ "matchFiles": 1
2769
+ }
2770
+ ]
2771
+ },
2772
+ {
2773
+ "instanceId": "prreview__discourse-graphite-2",
2774
+ "repo": "discourse/discourse",
2775
+ "language": "Ruby",
2776
+ "requiresContext": "file",
2777
+ "changedFiles": 18,
2778
+ "changedLines": 225,
2779
+ "gold": [
2780
+ {
2781
+ "goldIndex": 0,
2782
+ "severity": "high",
2783
+ "anchors": [
2784
+ "TopicUser"
2785
+ ],
2786
+ "anchoredLines": [
2787
+ "app/controllers/topics_controller.rb:105",
2788
+ "app/controllers/topics_controller.rb:107",
2789
+ "app/controllers/topics_controller.rb:108",
2790
+ "app/controllers/topics_controller.rb:110",
2791
+ "app/models/topic_user.rb:11",
2792
+ "app/models/topic_user.rb:12",
2793
+ "app/models/topic_user.rb:130",
2794
+ "app/models/topic_user.rb:125"
2795
+ ],
2796
+ "anchored": true,
2797
+ "bugType": "null_reference",
2798
+ "matchedAnchors": [
2799
+ "TopicUser"
2800
+ ],
2801
+ "matchCount": 8,
2802
+ "matchFiles": 2
2803
+ },
2804
+ {
2805
+ "goldIndex": 1,
2806
+ "severity": "low",
2807
+ "anchors": [
2808
+ "stopNotificiationsText",
2809
+ "stopNotificationsText"
2810
+ ],
2811
+ "anchoredLines": [
2812
+ "app/assets/javascripts/discourse/controllers/topic-unsubscribe.js.es6:5",
2813
+ "app/assets/javascripts/discourse/templates/topic/unsubscribe.hbs:3"
2814
+ ],
2815
+ "anchored": true,
2816
+ "bugType": "incorrect_value",
2817
+ "matchedAnchors": [
2818
+ "stopNotificiationsText"
2819
+ ],
2820
+ "matchCount": 2,
2821
+ "matchFiles": 2
2822
+ }
2823
+ ]
2824
+ },
2825
+ {
2826
+ "instanceId": "prreview__cal-com-22532",
2827
+ "repo": "calcom/cal.com",
2828
+ "language": "TypeScript",
2829
+ "requiresContext": "cross_file",
2830
+ "changedFiles": 17,
2831
+ "changedLines": 410,
2832
+ "gold": [
2833
+ {
2834
+ "goldIndex": 0,
2835
+ "severity": "medium",
2836
+ "anchors": [
2837
+ "updateManyByCredentialId",
2838
+ "updatedAt"
2839
+ ],
2840
+ "anchoredLines": [
2841
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:1024",
2842
+ "packages/lib/server/repository/selectedCalendar.ts:400",
2843
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:1023",
2844
+ "packages/features/calendar-cache/calendar-cache.repository.interface.ts:32",
2845
+ "packages/features/calendar-cache/calendar-cache.repository.ts:180",
2846
+ "packages/features/calendar-cache/calendar-cache.repository.ts:186",
2847
+ "packages/lib/getConnectedDestinationCalendars.ts:23",
2848
+ "packages/lib/getConnectedDestinationCalendars.ts:27",
2849
+ "packages/lib/server/repository/user.ts:899",
2850
+ "packages/prisma/migrations/20250715160635_add_calendar_cache_updated_at/migration.sql:4",
2851
+ "packages/prisma/migrations/20250715160635_add_calendar_cache_updated_at/migration.sql:9",
2852
+ "packages/prisma/schema.prisma:1719"
2853
+ ],
2854
+ "anchored": true,
2855
+ "bugType": "api_misuse",
2856
+ "matchedAnchors": [
2857
+ "updateManyByCredentialId",
2858
+ "updatedAt"
2859
+ ],
2860
+ "matchCount": 13,
2861
+ "matchFiles": 9
2862
+ },
2863
+ {
2864
+ "goldIndex": 1,
2865
+ "severity": "low",
2866
+ "anchors": [
2867
+ "macOS"
2868
+ ],
2869
+ "anchoredLines": [],
2870
+ "anchored": false,
2871
+ "bugType": "api_misuse"
2872
+ }
2873
+ ]
2874
+ },
2875
+ {
2876
+ "instanceId": "prreview__cal-com-8330",
2877
+ "repo": "calcom/cal.com",
2878
+ "language": "TypeScript",
2879
+ "requiresContext": "file",
2880
+ "changedFiles": 4,
2881
+ "changedLines": 121,
2882
+ "gold": [
2883
+ {
2884
+ "goldIndex": 0,
2885
+ "severity": "medium",
2886
+ "anchors": [
2887
+ "slotStartTime",
2888
+ "slotEndTime"
2889
+ ],
2890
+ "anchoredLines": [
2891
+ "packages/trpc/server/routers/viewer/slots.ts:111",
2892
+ "packages/trpc/server/routers/viewer/slots.ts:123",
2893
+ "packages/trpc/server/routers/viewer/slots.ts:140",
2894
+ "packages/trpc/server/routers/viewer/slots.ts:141",
2895
+ "packages/trpc/server/routers/viewer/slots.ts:142",
2896
+ "packages/trpc/server/routers/viewer/slots.ts:118",
2897
+ "packages/trpc/server/routers/viewer/slots.ts:119"
2898
+ ],
2899
+ "anchored": true,
2900
+ "bugType": "incorrect_value",
2901
+ "matchedAnchors": [
2902
+ "slotStartTime",
2903
+ "slotEndTime"
2904
+ ],
2905
+ "matchCount": 7,
2906
+ "matchFiles": 1
2907
+ },
2908
+ {
2909
+ "goldIndex": 1,
2910
+ "severity": "medium",
2911
+ "anchors": [
2912
+ "isSame",
2913
+ "date.start",
2914
+ "utcOffset",
2915
+ "date.end"
2916
+ ],
2917
+ "anchoredLines": [
2918
+ "packages/trpc/server/routers/viewer/slots.ts:119",
2919
+ "packages/trpc/server/routers/viewer/slots.ts:107",
2920
+ "packages/trpc/server/routers/viewer/slots.ts:110",
2921
+ "packages/trpc/server/routers/viewer/slots.ts:114",
2922
+ "packages/trpc/server/routers/viewer/slots.ts:118",
2923
+ "packages/lib/slots.ts:212",
2924
+ "packages/lib/slots.ts:213",
2925
+ "packages/trpc/server/routers/viewer/slots.ts:123"
2926
+ ],
2927
+ "anchored": true,
2928
+ "bugType": "api_misuse",
2929
+ "matchedAnchors": [
2930
+ "isSame",
2931
+ "date.start",
2932
+ "utcOffset",
2933
+ "date.end"
2934
+ ],
2935
+ "matchCount": 8,
2936
+ "matchFiles": 2
2937
+ }
2938
+ ]
2939
+ },
2940
+ {
2941
+ "instanceId": "prreview__cal-com-14943",
2942
+ "repo": "calcom/cal.com",
2943
+ "language": "TypeScript",
2944
+ "requiresContext": "file",
2945
+ "changedFiles": 3,
2946
+ "changedLines": 44,
2947
+ "gold": [
2948
+ {
2949
+ "goldIndex": 0,
2950
+ "severity": "high",
2951
+ "anchors": [
2952
+ "retryCount"
2953
+ ],
2954
+ "anchoredLines": [
2955
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:39",
2956
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:58",
2957
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:60",
2958
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:184",
2959
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:195",
2960
+ "packages/prisma/migrations/20240508134359_add_retry_count_to_workflow_reminder/migration.sql:2",
2961
+ "packages/prisma/schema.prisma:1000"
2962
+ ],
2963
+ "anchored": true,
2964
+ "bugType": "race_condition",
2965
+ "matchedAnchors": [
2966
+ "retryCount"
2967
+ ],
2968
+ "matchCount": 7,
2969
+ "matchFiles": 3
2970
+ },
2971
+ {
2972
+ "goldIndex": 1,
2973
+ "severity": "high",
2974
+ "anchors": [
2975
+ "scheduleSMSReminders.ts",
2976
+ "scheduleSMSReminders",
2977
+ "SMS",
2978
+ "e.g",
2979
+ "WhatsApp",
2980
+ "retryCount",
2981
+ "WorkflowMethods.SMS",
2982
+ "WorkflowMethods"
2983
+ ],
2984
+ "anchoredLines": [
2985
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:31",
2986
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:33",
2987
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:39",
2988
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:58",
2989
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:60",
2990
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:184",
2991
+ "packages/features/ee/workflows/api/scheduleSMSReminders.ts:195",
2992
+ "packages/prisma/migrations/20240508134359_add_retry_count_to_workflow_reminder/migration.sql:2",
2993
+ "packages/prisma/schema.prisma:1000"
2994
+ ],
2995
+ "anchored": true,
2996
+ "bugType": "logic_error",
2997
+ "matchedAnchors": [
2998
+ "SMS",
2999
+ "retryCount",
3000
+ "WorkflowMethods.SMS",
3001
+ "WorkflowMethods"
3002
+ ],
3003
+ "matchCount": 9,
3004
+ "matchFiles": 3
3005
+ }
3006
+ ]
3007
+ },
3008
+ {
3009
+ "instanceId": "prreview__cal-com-22345",
3010
+ "repo": "calcom/cal.com",
3011
+ "language": "TypeScript",
3012
+ "requiresContext": "file",
3013
+ "changedFiles": 2,
3014
+ "changedLines": 345,
3015
+ "gold": [
3016
+ {
3017
+ "goldIndex": 0,
3018
+ "severity": "low",
3019
+ "anchors": [
3020
+ "getBaseConditions",
3021
+ "filterConditions",
3022
+ "getAuthorizationConditions",
3023
+ "Prisma.Sql",
3024
+ "authConditions",
3025
+ "if/else"
3026
+ ],
3027
+ "anchoredLines": [
3028
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:437",
3029
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:480",
3030
+ "packages/lib/server/service/insightsBooking.ts:68",
3031
+ "packages/lib/server/service/insightsBooking.ts:71",
3032
+ "packages/lib/server/service/insightsBooking.ts:72",
3033
+ "packages/lib/server/service/insightsBooking.ts:73",
3034
+ "packages/lib/server/service/insightsBooking.ts:76",
3035
+ "packages/lib/server/service/insightsBooking.ts:77",
3036
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:496",
3037
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:507",
3038
+ "packages/lib/server/service/insightsBooking.ts:78",
3039
+ "packages/lib/server/service/insightsBooking.ts:83"
3040
+ ],
3041
+ "anchored": true,
3042
+ "bugType": "dead_code",
3043
+ "matchedAnchors": [
3044
+ "getBaseConditions",
3045
+ "filterConditions",
3046
+ "getAuthorizationConditions",
3047
+ "Prisma.Sql",
3048
+ "authConditions"
3049
+ ],
3050
+ "matchCount": 24,
3051
+ "matchFiles": 2
3052
+ },
3053
+ {
3054
+ "goldIndex": 1,
3055
+ "severity": "medium",
3056
+ "anchors": [
3057
+ "userIdsFromOrg",
3058
+ "teamsFromOrg",
3059
+ "teamIds",
3060
+ "orgId"
3061
+ ],
3062
+ "anchoredLines": [
3063
+ "packages/lib/server/service/insightsBooking.ts:170",
3064
+ "packages/lib/server/service/insightsBooking.ts:174",
3065
+ "packages/lib/server/service/insightsBooking.ts:166",
3066
+ "packages/lib/server/service/insightsBooking.ts:167",
3067
+ "packages/lib/server/service/insightsBooking.ts:164",
3068
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:491",
3069
+ "packages/lib/server/service/__tests__/insightsBooking.integration-test.ts:522",
3070
+ "packages/lib/server/service/insightsBooking.ts:32"
3071
+ ],
3072
+ "anchored": true,
3073
+ "bugType": "logic_error",
3074
+ "matchedAnchors": [
3075
+ "userIdsFromOrg",
3076
+ "teamIds",
3077
+ "orgId"
3078
+ ],
3079
+ "matchCount": 8,
3080
+ "matchFiles": 2
3081
+ }
3082
+ ]
3083
+ },
3084
+ {
3085
+ "instanceId": "prreview__cal-com-11059",
3086
+ "repo": "calcom/cal.com",
3087
+ "language": "TypeScript",
3088
+ "requiresContext": "cross_file",
3089
+ "changedFiles": 40,
3090
+ "changedLines": 494,
3091
+ "gold": [
3092
+ {
3093
+ "goldIndex": 0,
3094
+ "severity": "high",
3095
+ "anchors": [
3096
+ "parseRefreshTokenResponse",
3097
+ "refresh_token",
3098
+ "OAuth"
3099
+ ],
3100
+ "anchoredLines": [
3101
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:13",
3102
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:32",
3103
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:21",
3104
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:97",
3105
+ "packages/app-store/office365calendar/lib/CalendarService.ts:20",
3106
+ "packages/app-store/office365calendar/lib/CalendarService.ts:263",
3107
+ "packages/app-store/salesforce/lib/CalendarService.ts:20",
3108
+ "packages/app-store/salesforce/lib/CalendarService.ts:90",
3109
+ "packages/app-store/zoomvideo/lib/VideoApiAdapter.ts:12",
3110
+ "packages/app-store/zoomvideo/lib/VideoApiAdapter.ts:104",
3111
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:25",
3112
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:26"
3113
+ ],
3114
+ "anchored": true,
3115
+ "bugType": "incorrect_value",
3116
+ "matchedAnchors": [
3117
+ "parseRefreshTokenResponse",
3118
+ "refresh_token"
3119
+ ],
3120
+ "matchCount": 38,
3121
+ "matchFiles": 9
3122
+ },
3123
+ {
3124
+ "goldIndex": 1,
3125
+ "severity": "high",
3126
+ "anchors": [
3127
+ "toString"
3128
+ ],
3129
+ "anchoredLines": [
3130
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:8",
3131
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:10",
3132
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:11"
3133
+ ],
3134
+ "anchored": true,
3135
+ "bugType": "api_misuse",
3136
+ "matchedAnchors": [
3137
+ "toString"
3138
+ ],
3139
+ "matchCount": 3,
3140
+ "matchFiles": 2
3141
+ },
3142
+ {
3143
+ "goldIndex": 2,
3144
+ "severity": "high",
3145
+ "anchors": [
3146
+ "parseRefreshTokenResponse",
3147
+ "safeParse"
3148
+ ],
3149
+ "anchoredLines": [
3150
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:13",
3151
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:32",
3152
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:21",
3153
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:97",
3154
+ "packages/app-store/office365calendar/lib/CalendarService.ts:20",
3155
+ "packages/app-store/office365calendar/lib/CalendarService.ts:263",
3156
+ "packages/app-store/salesforce/lib/CalendarService.ts:20",
3157
+ "packages/app-store/salesforce/lib/CalendarService.ts:90",
3158
+ "packages/app-store/zoomvideo/lib/VideoApiAdapter.ts:12",
3159
+ "packages/app-store/zoomvideo/lib/VideoApiAdapter.ts:104",
3160
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:16",
3161
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:18"
3162
+ ],
3163
+ "anchored": true,
3164
+ "bugType": "api_misuse",
3165
+ "matchedAnchors": [
3166
+ "parseRefreshTokenResponse",
3167
+ "safeParse"
3168
+ ],
3169
+ "matchCount": 14,
3170
+ "matchFiles": 5
3171
+ },
3172
+ {
3173
+ "goldIndex": 3,
3174
+ "severity": "high",
3175
+ "anchors": [
3176
+ "APP_CREDENTIAL_SHARING_ENABLED",
3177
+ "CALCOM_CREDENTIAL_SYNC_ENDPOINT",
3178
+ "refreshFunction",
3179
+ "GoogleCalendarService",
3180
+ "refreshAccessToken",
3181
+ "res.data",
3182
+ "HubspotCalendarService",
3183
+ "HubspotToken"
3184
+ ],
3185
+ "anchoredLines": [
3186
+ "apps/web/pages/api/webhook/app-credential.ts:5",
3187
+ "apps/web/pages/api/webhook/app-credential.ts:19",
3188
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:3",
3189
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:15",
3190
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:1",
3191
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:5",
3192
+ "packages/lib/constants.ts:103",
3193
+ ".env.example:240",
3194
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:8",
3195
+ "turbo.json:201",
3196
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:3",
3197
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:17"
3198
+ ],
3199
+ "anchored": true,
3200
+ "bugType": "type_error",
3201
+ "matchedAnchors": [
3202
+ "APP_CREDENTIAL_SHARING_ENABLED",
3203
+ "CALCOM_CREDENTIAL_SYNC_ENDPOINT",
3204
+ "refreshFunction",
3205
+ "HubspotToken"
3206
+ ],
3207
+ "matchCount": 14,
3208
+ "matchFiles": 7
3209
+ },
3210
+ {
3211
+ "goldIndex": 4,
3212
+ "severity": "high",
3213
+ "anchors": [
3214
+ "access_token",
3215
+ "refreshOAuthTokens"
3216
+ ],
3217
+ "anchoredLines": [
3218
+ "packages/app-store/_utils/oauth/parseRefreshTokenResponse.ts:6",
3219
+ "packages/app-store/salesforce/lib/CalendarService.ts:44",
3220
+ "packages/app-store/webex/lib/VideoApiAdapter.ts:61",
3221
+ "packages/app-store/webex/lib/VideoApiAdapter.ts:64",
3222
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:3",
3223
+ "packages/app-store/_utils/oauth/refreshOAuthTokens.ts:22",
3224
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:22",
3225
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:86",
3226
+ "packages/app-store/hubspot/lib/CalendarService.ts:26",
3227
+ "packages/app-store/hubspot/lib/CalendarService.ts:177",
3228
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:14",
3229
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:67"
3230
+ ],
3231
+ "anchored": true,
3232
+ "bugType": "type_error",
3233
+ "matchedAnchors": [
3234
+ "access_token",
3235
+ "refreshOAuthTokens"
3236
+ ],
3237
+ "matchCount": 24,
3238
+ "matchFiles": 12
3239
+ }
3240
+ ]
3241
+ },
3242
+ {
3243
+ "instanceId": "prreview__cal-com-7232",
3244
+ "repo": "calcom/cal.com",
3245
+ "language": "TypeScript",
3246
+ "requiresContext": "cross_file",
3247
+ "changedFiles": 10,
3248
+ "changedLines": 444,
3249
+ "gold": [
3250
+ {
3251
+ "goldIndex": 0,
3252
+ "severity": "medium",
3253
+ "anchors": [
3254
+ "deleteScheduledEmailReminder",
3255
+ "deleteScheduledSMSReminder",
3256
+ "forEach",
3257
+ "rescheduling/cancellation",
3258
+ "workflow/workflow",
3259
+ "deletion/updates"
3260
+ ],
3261
+ "anchoredLines": [
3262
+ "packages/features/bookings/lib/handleCancelBooking.ts:492",
3263
+ "packages/features/bookings/lib/handleCancelBooking.ts:488",
3264
+ "packages/features/bookings/lib/handleNewBooking.ts:39",
3265
+ "packages/features/bookings/lib/handleNewBooking.ts:968",
3266
+ "packages/features/ee/workflows/lib/reminders/emailReminderManager.ts:197",
3267
+ "packages/trpc/server/routers/viewer/bookings.tsx:494",
3268
+ "packages/trpc/server/routers/viewer/bookings.tsx:490",
3269
+ "packages/trpc/server/routers/viewer/workflows.tsx:214",
3270
+ "packages/trpc/server/routers/viewer/workflows.tsx:381",
3271
+ "packages/trpc/server/routers/viewer/workflows.tsx:378",
3272
+ "packages/trpc/server/routers/viewer/workflows.tsx:537",
3273
+ "packages/trpc/server/routers/viewer/workflows.tsx:521"
3274
+ ],
3275
+ "anchored": true,
3276
+ "bugType": "race_condition",
3277
+ "matchedAnchors": [
3278
+ "deleteScheduledEmailReminder",
3279
+ "deleteScheduledSMSReminder",
3280
+ "forEach"
3281
+ ],
3282
+ "matchCount": 29,
3283
+ "matchFiles": 6
3284
+ },
3285
+ {
3286
+ "goldIndex": 1,
3287
+ "severity": "high",
3288
+ "anchors": [
3289
+ "immediateDelete",
3290
+ "deleteScheduledEmailReminder",
3291
+ "SendGrid",
3292
+ "WorkflowReminder",
3293
+ "DELETE",
3294
+ "API"
3295
+ ],
3296
+ "anchoredLines": [
3297
+ "packages/features/ee/workflows/lib/reminders/emailReminderManager.ts:200",
3298
+ "packages/features/ee/workflows/lib/reminders/emailReminderManager.ts:213",
3299
+ "packages/features/bookings/lib/handleCancelBooking.ts:492",
3300
+ "packages/features/bookings/lib/handleCancelBooking.ts:488",
3301
+ "packages/features/bookings/lib/handleNewBooking.ts:39",
3302
+ "packages/features/bookings/lib/handleNewBooking.ts:968",
3303
+ "packages/features/ee/workflows/lib/reminders/emailReminderManager.ts:197",
3304
+ "packages/trpc/server/routers/viewer/bookings.tsx:494",
3305
+ "packages/trpc/server/routers/viewer/bookings.tsx:490",
3306
+ "packages/trpc/server/routers/viewer/workflows.tsx:214",
3307
+ "packages/trpc/server/routers/viewer/workflows.tsx:381",
3308
+ "packages/trpc/server/routers/viewer/workflows.tsx:378"
3309
+ ],
3310
+ "anchored": true,
3311
+ "bugType": "logic_error",
3312
+ "matchedAnchors": [
3313
+ "immediateDelete",
3314
+ "deleteScheduledEmailReminder",
3315
+ "WorkflowReminder",
3316
+ "DELETE"
3317
+ ],
3318
+ "matchCount": 20,
3319
+ "matchFiles": 7
3320
+ }
3321
+ ]
3322
+ },
3323
+ {
3324
+ "instanceId": "prreview__cal-com-14740",
3325
+ "repo": "calcom/cal.com",
3326
+ "language": "TypeScript",
3327
+ "requiresContext": "cross_file",
3328
+ "changedFiles": 15,
3329
+ "changedLines": 555,
3330
+ "gold": [
3331
+ {
3332
+ "goldIndex": 0,
3333
+ "severity": "high",
3334
+ "anchors": [],
3335
+ "anchoredLines": [],
3336
+ "anchored": false,
3337
+ "bugType": "security"
3338
+ },
3339
+ {
3340
+ "goldIndex": 1,
3341
+ "severity": "critical",
3342
+ "anchors": [
3343
+ "admin/owner",
3344
+ "isTeamAdmin",
3345
+ "isTeamOwner"
3346
+ ],
3347
+ "anchoredLines": [
3348
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:7",
3349
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:47",
3350
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:48"
3351
+ ],
3352
+ "anchored": true,
3353
+ "bugType": "logic_error",
3354
+ "matchedAnchors": [
3355
+ "isTeamAdmin",
3356
+ "isTeamOwner"
3357
+ ],
3358
+ "matchCount": 3,
3359
+ "matchFiles": 1
3360
+ },
3361
+ {
3362
+ "goldIndex": 2,
3363
+ "severity": "medium",
3364
+ "anchors": [],
3365
+ "anchoredLines": [],
3366
+ "anchored": false,
3367
+ "bugType": "incorrect_value"
3368
+ },
3369
+ {
3370
+ "goldIndex": 3,
3371
+ "severity": "medium",
3372
+ "anchors": [
3373
+ "uniqueGuests",
3374
+ "createMany"
3375
+ ],
3376
+ "anchoredLines": [
3377
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:74",
3378
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:80",
3379
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:83",
3380
+ "packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts:101"
3381
+ ],
3382
+ "anchored": true,
3383
+ "bugType": "missing_validation",
3384
+ "matchedAnchors": [
3385
+ "uniqueGuests",
3386
+ "createMany"
3387
+ ],
3388
+ "matchCount": 4,
3389
+ "matchFiles": 1
3390
+ },
3391
+ {
3392
+ "goldIndex": 4,
3393
+ "severity": "low",
3394
+ "anchors": [
3395
+ "MultiEmail"
3396
+ ],
3397
+ "anchoredLines": [
3398
+ "apps/web/components/dialog/AddGuestsDialog.tsx:13",
3399
+ "apps/web/components/dialog/AddGuestsDialog.tsx:69",
3400
+ "packages/ui/form/MultiEmail.tsx:12",
3401
+ "packages/ui/form/MultiEmail.tsx:96",
3402
+ "packages/ui/form/MultiEmailLazy.tsx:4",
3403
+ "packages/ui/form/MultiEmailLazy.tsx:6",
3404
+ "packages/ui/index.tsx:153"
3405
+ ],
3406
+ "anchored": true,
3407
+ "bugType": "incorrect_value",
3408
+ "matchedAnchors": [
3409
+ "MultiEmail"
3410
+ ],
3411
+ "matchCount": 7,
3412
+ "matchFiles": 4
3413
+ }
3414
+ ]
3415
+ },
3416
+ {
3417
+ "instanceId": "prreview__cal-com-10600",
3418
+ "repo": "calcom/cal.com",
3419
+ "language": "TypeScript",
3420
+ "requiresContext": "cross_file",
3421
+ "changedFiles": 16,
3422
+ "changedLines": 316,
3423
+ "gold": [
3424
+ {
3425
+ "goldIndex": 0,
3426
+ "severity": "low",
3427
+ "anchors": [
3428
+ "TwoFactor",
3429
+ "BackupCode.tsx",
3430
+ "BackupCode"
3431
+ ],
3432
+ "anchoredLines": [
3433
+ "apps/web/components/auth/BackupCode.tsx:7",
3434
+ "apps/web/components/auth/TwoFactor.tsx:8",
3435
+ "apps/web/components/settings/DisableTwoFactorModal.tsx:88",
3436
+ "apps/web/components/settings/DisableTwoFactorModal.tsx:106",
3437
+ "apps/web/pages/auth/login.tsx:197",
3438
+ "apps/web/pages/auth/login.tsx:221",
3439
+ "apps/web/components/settings/DisableTwoFactorModal.tsx:8",
3440
+ "apps/web/components/settings/DisableTwoFactorModal.tsx:104",
3441
+ "apps/web/pages/auth/login.tsx:32"
3442
+ ],
3443
+ "anchored": true,
3444
+ "bugType": "other",
3445
+ "matchedAnchors": [
3446
+ "TwoFactor",
3447
+ "BackupCode"
3448
+ ],
3449
+ "matchCount": 9,
3450
+ "matchFiles": 4
3451
+ },
3452
+ {
3453
+ "goldIndex": 1,
3454
+ "severity": "low",
3455
+ "anchors": [],
3456
+ "anchoredLines": [],
3457
+ "anchored": false,
3458
+ "bugType": "incorrect_value"
3459
+ },
3460
+ {
3461
+ "goldIndex": 2,
3462
+ "severity": "medium",
3463
+ "anchors": [
3464
+ "indexOf"
3465
+ ],
3466
+ "anchoredLines": [
3467
+ "apps/web/pages/api/auth/two-factor/totp/disable.ts:61",
3468
+ "packages/features/auth/lib/next-auth-options.ts:144"
3469
+ ],
3470
+ "anchored": true,
3471
+ "bugType": "incorrect_value",
3472
+ "matchedAnchors": [
3473
+ "indexOf"
3474
+ ],
3475
+ "matchCount": 2,
3476
+ "matchFiles": 2
3477
+ },
3478
+ {
3479
+ "goldIndex": 3,
3480
+ "severity": "high",
3481
+ "anchors": [
3482
+ "backupCodes",
3483
+ "backupCode"
3484
+ ],
3485
+ "anchoredLines": [
3486
+ "apps/web/components/settings/EnableTwoFactorModal.tsx:64",
3487
+ "apps/web/components/settings/EnableTwoFactorModal.tsx:92",
3488
+ "apps/web/components/settings/EnableTwoFactorModal.tsx:95",
3489
+ "apps/web/components/settings/EnableTwoFactorModal.tsx:203",
3490
+ "apps/web/components/settings/EnableTwoFactorModal.tsx:278",
3491
+ "apps/web/pages/api/auth/two-factor/totp/disable.ts:54",
3492
+ "apps/web/pages/api/auth/two-factor/totp/disable.ts:58",
3493
+ "apps/web/pages/api/auth/two-factor/totp/disable.ts:61",
3494
+ "apps/web/pages/api/auth/two-factor/totp/disable.ts:107",
3495
+ "apps/web/pages/api/auth/two-factor/totp/setup.ts:61",
3496
+ "apps/web/pages/api/auth/two-factor/totp/setup.ts:68",
3497
+ "apps/web/pages/api/auth/two-factor/totp/setup.ts:78"
3498
+ ],
3499
+ "anchored": true,
3500
+ "bugType": "race_condition",
3501
+ "matchedAnchors": [
3502
+ "backupCodes",
3503
+ "backupCode"
3504
+ ],
3505
+ "matchCount": 34,
3506
+ "matchFiles": 11
3507
+ }
3508
+ ]
3509
+ },
3510
+ {
3511
+ "instanceId": "prreview__cal-com-10967",
3512
+ "repo": "calcom/cal.com",
3513
+ "language": "TypeScript",
3514
+ "requiresContext": "cross_file",
3515
+ "changedFiles": 22,
3516
+ "changedLines": 584,
3517
+ "gold": [
3518
+ {
3519
+ "goldIndex": 0,
3520
+ "severity": "high",
3521
+ "anchors": [
3522
+ "mainHostDestinationCalendar",
3523
+ "destinationCalendar"
3524
+ ],
3525
+ "anchoredLines": [
3526
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:100",
3527
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:122",
3528
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:123",
3529
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:198",
3530
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:228",
3531
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:229",
3532
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:128",
3533
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:129",
3534
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:164",
3535
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:165",
3536
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:192",
3537
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:193"
3538
+ ],
3539
+ "anchored": true,
3540
+ "bugType": "null_reference",
3541
+ "matchedAnchors": [
3542
+ "mainHostDestinationCalendar",
3543
+ "destinationCalendar"
3544
+ ],
3545
+ "matchCount": 113,
3546
+ "matchFiles": 18
3547
+ },
3548
+ {
3549
+ "goldIndex": 1,
3550
+ "severity": "low",
3551
+ "anchors": [
3552
+ "mainHostDestinationCalendar"
3553
+ ],
3554
+ "anchoredLines": [
3555
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:100",
3556
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:122",
3557
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:123",
3558
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:198",
3559
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:228",
3560
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:229",
3561
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:128",
3562
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:129",
3563
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:164",
3564
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:165",
3565
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:192",
3566
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:193"
3567
+ ],
3568
+ "anchored": true,
3569
+ "bugType": "dead_code",
3570
+ "matchedAnchors": [
3571
+ "mainHostDestinationCalendar"
3572
+ ],
3573
+ "matchCount": 28,
3574
+ "matchFiles": 6
3575
+ },
3576
+ {
3577
+ "goldIndex": 2,
3578
+ "severity": "high",
3579
+ "anchors": [
3580
+ "externalCalendarId",
3581
+ "externalId",
3582
+ "credentialId"
3583
+ ],
3584
+ "anchoredLines": [
3585
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:256",
3586
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:306",
3587
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:315",
3588
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:316",
3589
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:317",
3590
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:190",
3591
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:193",
3592
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:234",
3593
+ "packages/app-store/larkcalendar/lib/CalendarService.ts:238",
3594
+ "packages/core/EventManager.ts:167",
3595
+ "packages/core/EventManager.ts:169",
3596
+ "packages/core/EventManager.ts:206"
3597
+ ],
3598
+ "anchored": true,
3599
+ "bugType": "logic_error",
3600
+ "matchedAnchors": [
3601
+ "externalCalendarId",
3602
+ "externalId",
3603
+ "credentialId"
3604
+ ],
3605
+ "matchCount": 84,
3606
+ "matchFiles": 9
3607
+ },
3608
+ {
3609
+ "goldIndex": 3,
3610
+ "severity": "medium",
3611
+ "anchors": [
3612
+ "IS_TEAM_BILLING_ENABLED",
3613
+ "requestedSlug"
3614
+ ],
3615
+ "anchoredLines": [
3616
+ "packages/trpc/server/routers/viewer/organizations/create.handler.ts:151",
3617
+ "packages/trpc/server/routers/viewer/organizations/create.handler.ts:153"
3618
+ ],
3619
+ "anchored": true,
3620
+ "bugType": "logic_error",
3621
+ "matchedAnchors": [
3622
+ "IS_TEAM_BILLING_ENABLED",
3623
+ "requestedSlug"
3624
+ ],
3625
+ "matchCount": 2,
3626
+ "matchFiles": 1
3627
+ },
3628
+ {
3629
+ "goldIndex": 4,
3630
+ "severity": "low",
3631
+ "anchors": [
3632
+ "createEvent",
3633
+ "credentialId",
3634
+ "e.g",
3635
+ "Lark/Office365"
3636
+ ],
3637
+ "anchoredLines": [
3638
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:87",
3639
+ "packages/core/CalendarManager.ts:234",
3640
+ "packages/core/CalendarManager.ts:236",
3641
+ "packages/core/CalendarManager.ts:249",
3642
+ "packages/core/CalendarManager.ts:246",
3643
+ "packages/core/EventManager.ts:346",
3644
+ "packages/core/EventManager.ts:370",
3645
+ "packages/core/EventManager.ts:380",
3646
+ "packages/core/EventManager.ts:356",
3647
+ "packages/types/Calendar.d.ts:219",
3648
+ "packages/types/Calendar.d.ts:221",
3649
+ "packages/app-store/googlecalendar/lib/CalendarService.ts:145"
3650
+ ],
3651
+ "anchored": true,
3652
+ "bugType": "api_misuse",
3653
+ "matchedAnchors": [
3654
+ "createEvent",
3655
+ "credentialId"
3656
+ ],
3657
+ "matchCount": 39,
3658
+ "matchFiles": 5
3659
+ }
3660
+ ]
3661
+ },
3662
+ {
3663
+ "instanceId": "prreview__cal-com-8087",
3664
+ "repo": "calcom/cal.com",
3665
+ "language": "TypeScript",
3666
+ "requiresContext": "cross_file",
3667
+ "changedFiles": 12,
3668
+ "changedLines": 189,
3669
+ "gold": [
3670
+ {
3671
+ "goldIndex": 0,
3672
+ "severity": "low",
3673
+ "anchors": [],
3674
+ "anchoredLines": [],
3675
+ "anchored": false,
3676
+ "bugType": "missing_validation"
3677
+ },
3678
+ {
3679
+ "goldIndex": 1,
3680
+ "severity": "critical",
3681
+ "anchors": [
3682
+ "forEach",
3683
+ "e.g",
3684
+ "calendar/video",
3685
+ "for...of",
3686
+ "Promise.all"
3687
+ ],
3688
+ "anchoredLines": [
3689
+ "packages/app-store/vital/lib/reschedule.ts:125",
3690
+ "packages/app-store/wipemycalother/lib/reschedule.ts:125",
3691
+ "packages/features/bookings/lib/handleCancelBooking.ts:479",
3692
+ "packages/trpc/server/routers/viewer/bookings.tsx:553",
3693
+ "packages/core/CalendarManager.ts:142",
3694
+ "packages/core/videoClient.ts:35",
3695
+ "packages/core/videoClient.ts:39"
3696
+ ],
3697
+ "anchored": true,
3698
+ "bugType": "race_condition",
3699
+ "matchedAnchors": [
3700
+ "forEach",
3701
+ "Promise.all"
3702
+ ],
3703
+ "matchCount": 7,
3704
+ "matchFiles": 6
3705
+ }
3706
+ ]
3707
+ }
3708
+ ]
3709
+ }