nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: google/go-containerregistry
Pull request #690 (2020-03-10 00:33:07)

Compare mount targets by string
Fixes https://github.com/google/go-containerregistry/issues/689

The defaulting logic is being deferred to accessors, which means
comparing the structs of a repo or registry will result in non-equal
references even if they're semantically equivalent. This converts them
to strings to fix that.


Patch:
diff --git a/pkg/v1/remote/write.go b/pkg/v1/remote/write.go
index 7b431c07..13f68733 100644
--- a/pkg/v1/remote/write.go
+++ b/pkg/v1/remote/write.go
@@ -449,7 +449,7 @@ func scopesForUploadingImage(repo name.Repository, layers []v1.Layer) []string {
 		if ml, ok := l.(*MountableLayer); ok {
 			// we will add push scope for ref.Context() after the loop.
 			// for now we ask pull scope for references of the same registry
-			if ml.Reference.Context() != repo && ml.Reference.Context().Registry == repo.Registry {
+			if ml.Reference.Context().String() != repo.String() && ml.Reference.Context().Registry.String() == repo.Registry.String() {
 				scopeSet[ml.Reference.Scope(transport.PullScope)] = struct{}{}
 			}
 		}


Test patch:
diff --git a/pkg/v1/remote/write_test.go b/pkg/v1/remote/write_test.go
index bab1708b..ce4aa7f4 100644
--- a/pkg/v1/remote/write_test.go
+++ b/pkg/v1/remote/write_test.go
@@ -915,6 +915,41 @@ func TestWriteWithErrors(t *testing.T) {
 	}
 }
 
+func TestDockerhubScopes(t *testing.T) {
+	src, err := name.ParseReference("busybox")
+	if err != nil {
+		t.Fatal(err)
+	}
+	rl, err := random.Layer(1024, types.DockerLayer)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ml := &MountableLayer{
+		Layer:     rl,
+		Reference: src,
+	}
+	want := src.Scope(transport.PullScope)
+
+	for _, s := range []string{
+		"jonjohnson/busybox",
+		"docker.io/jonjohnson/busybox",
+		"index.docker.io/jonjohnson/busybox",
+	} {
+		dst, err := name.ParseReference(s)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		scopes := scopesForUploadingImage(dst.Context(), []v1.Layer{ml})
+
+		if len(scopes) != 2 {
+			t.Errorf("Should have two scopes (src and dst), got %d", len(scopes))
+		} else if diff := cmp.Diff(want, scopes[1]); diff != "" {
+			t.Errorf("TestDockerhubScopes %q: (-want +got) = %v", s, diff)
+		}
+	}
+}
+
 func TestScopesForUploadingImage(t *testing.T) {
 	referenceToUpload, err := name.NewTag("example.com/sample/sample:latest", name.WeakValidation)
 	if err != nil {
Repository: google/go-flow-levee
Pull request #32 (2020-07-17 16:26:38)

Do not mark an Alloc as a Source if it is produced by a Sanitizer
This fixes a broken test in which a value return by a sanitizer with return type `Source` was marked as a source. 


Patch:
diff --git a/internal/pkg/source/source.go b/internal/pkg/source/source.go
index 35ea45d..6f448f0 100644
--- a/internal/pkg/source/source.go
+++ b/internal/pkg/source/source.go
@@ -198,7 +198,7 @@ func sourcesFromBlocks(fn *ssa.Function, conf classifier) []*Source {
 			switch v := instr.(type) {
 			// Looking for sources of PII allocated within the body of a function.
 			case *ssa.Alloc:
-				if conf.IsSource(utils.Dereference(v.Type())) {
+				if conf.IsSource(utils.Dereference(v.Type())) && !isProducedBySanitizer(v, conf) {
 					sources = append(sources, New(v, conf))
 				}
 
@@ -213,3 +213,20 @@ func sourcesFromBlocks(fn *ssa.Function, conf classifier) []*Source {
 	}
 	return sources
 }
+
+func isProducedBySanitizer(v *ssa.Alloc, conf classifier) bool {
+	for _, instr := range *v.Referrers() {
+		store, ok := instr.(*ssa.Store)
+		if !ok {
+			continue
+		}
+		call, ok := store.Val.(*ssa.Call)
+		if !ok {
+			continue
+		}
+		if conf.IsSanitizer(call) {
+			return true
+		}
+	}
+	return false
+}


Test patch:
diff --git a/internal/testdata/src/example.com/tests/dominance/tests.go b/internal/testdata/src/example.com/tests/dominance/tests.go
index 6e81b90..cf06d62 100644
--- a/internal/testdata/src/example.com/tests/dominance/tests.go
+++ b/internal/testdata/src/example.com/tests/dominance/tests.go
@@ -33,8 +33,7 @@ func TestSanitizedSourceDoesNotTriggerFindingWhenTypeAsserted(c *core.Source) {
 
 func TestSanitizedSourceDoesNotTriggerFindingWithTypedSanitizer(c core.Source) {
 	sanitized := core.SanitizeSource(c)
-	// TODO This should not trigger
-	core.Sinkf("Sanitized %v", sanitized) // want "a source has reached a sink,"
+	core.Sinkf("Sanitized %v", sanitized)
 }
 
 func TestNotGuaranteedSanitization(c *core.Source) {
Repository: google/go-flow-levee
Pull request #74 (2020-08-28 15:15:52)

Fix possible out of bounds string access
While running the analyzer on kubernetes, I ran into an out of bounds string access. This PR fixes the code that caused it.

- [x] Tests pass
- [x] Appropriate changes to README are included in PR


Patch:
diff --git a/configuration/example-config.json b/configuration/example-config.json
index 4a86565..26c228e 100644
--- a/configuration/example-config.json
+++ b/configuration/example-config.json
@@ -28,5 +28,5 @@
       "MethodRE": "Info|Warning|Error|Fatal|Exit"
     }
   ],
-  "Sanitizers": [],
+  "Sanitizers": []
 }
diff --git a/internal/pkg/fieldtags/analyzer.go b/internal/pkg/fieldtags/analyzer.go
index 22ff822..93bac7a 100644
--- a/internal/pkg/fieldtags/analyzer.go
+++ b/internal/pkg/fieldtags/analyzer.go
@@ -115,6 +115,9 @@ func (sp *sourcePatterns) isSource(field *ast.Field) bool {
 		}
 
 		i = j + 1 // skip colon
+		if i >= len(tag) {
+			return false
+		}
 		if tag[i] == '\\' {
 			i++
 		}


Test patch:
diff --git a/internal/pkg/fieldtags/testdata/src/tests/test.go b/internal/pkg/fieldtags/testdata/src/tests/test.go
index 3c90bd8..f635d8e 100644
--- a/internal/pkg/fieldtags/testdata/src/tests/test.go
+++ b/internal/pkg/fieldtags/testdata/src/tests/test.go
@@ -15,9 +15,10 @@
 package fieldtags
 
 type Person struct {
-	password           string      `levee:"source"`               // want "tagged field: fieldtags.Person.password"
-	secret             string      `json:"secret" levee:"source"` // want "tagged field: fieldtags.Person.secret"
-	another            interface{} "levee:\"source\""             // want "tagged field: fieldtags.Person.another"
-	name               string      `some_key:"non_secret"`
-	someNotTaggedField int
+	password             string      `levee:"source"`               // want "tagged field: fieldtags.Person.password"
+	secret               string      `json:"secret" levee:"source"` // want "tagged field: fieldtags.Person.secret"
+	another              interface{} "levee:\"source\""             // want "tagged field: fieldtags.Person.another"
+	name                 string      `some_key:"non_secret"`
+	spaceAfterFinalQuote string      `key:"value" `
+	someNotTaggedField   int
 }