Datasetpublic

wambosec/csi-sqli-rl

CSI SQLi RL — discover / patch dataset 180 real SQL-injection vulnerabilities (PyPI, npm, Packagist) with clean, commit-level fix ground truth, for RL training of code-security agents on two tasks: discover — given the vulnerable pre-patch source, name the file(s) and line range(s) the security fix changes. patch — write a unified diff that fixes the vulnerability. Both rewards are pure functions over the fields below — no Docker, no per-vuln images — so the dataset drives a… See the full description on the dataset page: https://huggingface.co/datasets/wambosec/csi-sqli-rl.

sourceHugging Facemitupdated 4mo agoView on Hugging Face

0likes33downloads

Dataset Card

CSI SQLi RL — discover / patch dataset

180 real SQL-injection vulnerabilities (PyPI, npm, Packagist) with clean, commit-level fix ground truth, for RL training of code-security agents on two tasks:

—discover — given the vulnerable pre-patch source, name the file(s) and line range(s) the security fix changes.
—patch — write a unified diff that fixes the vulnerability.

Both rewards are pure functions over the fields below — no Docker, no per-vuln images — so the dataset drives a portable verifiers/Prime RL environment (csi_env, load_environment(dataset=..., task_mode="discover"|"patch")).

Provenance

Built from the csi corpus (OSV → onboarded pre/post builds). Ground truth is extracted from the actual fixing commit (csi/fix_commit.py: OSV GIT-range fixed-sha / FIX / commit / pull references → the commit .diff, source files only), not the noisy whole-release tarball diff. 167/180 rows are commit-extracted; 13 fall back to a small (≤3-file) release diff. 84 of the 264 onboarded vulns were dropped as too noisy to label cleanly.

By ecosystem: composer 81, pypi 64, npm 35.

Columns

column	type	notes
`id`	str	OSV id (GHSA / PYSEC / …)
`ecosystem`	str	pypi \	npm \	composer
`package`, `pre_ref`, `post_ref`	str	vulnerable package + version refs
`cwe_ids`	list[str]	e.g. ["CWE-89"]
`effect_class`	str	`sql_injection`
`summary`	str	advisory summary
`fix_files`	list[str]	files the fix touches (ground truth)
`fix_hunks`	str (JSON)	`[{path, pre_start, pre_end, post_start, post_end}]`
`fix_diff`	str	the fix patch (commit diff or small release diff)
`fix_source`	str	`commit` \	`release-small`

Push

bash

hf auth login            # or: export HF_TOKEN=...
hf upload <you>/csi-sqli-rl . --repo-type dataset
# or, regenerate + push from the corpus:
#   uv run python scripts/build_rl_dataset.py --push <you>/csi-sqli-rl