| """Loads SecVulEval (HF: arag0rn/SecVulEval) and normalizes to the unified |
| corpus schema (spec §3.2). |
| |
| SecVulEval ships statement-level `changed_statements` (line, code) pairs, |
| but **its line numbers are relative to the original source FILE, not the |
| extracted function body** (verified by inspection: a sample with an 80-line |
| func_body had a changed_statements line number of 877). Silently trusting |
| them would map every patch line to nothing inside func_vuln. We therefore |
| recompute `patch_lines_vuln` ourselves via the same diff-based approach as |
| PrimeVul (`src/data/diff_utils.py`), using `changed_statements` only to |
| sanity-check CWE/pairing — not for line numbers. See DECISIONS.md |
| "SecVulEval patch-line numbers were file-absolute, not function-relative". |
| |
| Pairing is via `fixed_func_idx`, which points from a vulnerable row's `idx` |
| to its patched counterpart's `idx` in the same table. |
| |
| `commit_date` is not provided by this dataset directly; recovering it would |
| require one GitHub API call per of its 6,050 distinct commits, which the |
| unauthenticated API's 60 req/hour limit makes impractical in one session |
| (~100+ hours). Left as None here, consistent with PrimeVul rows that didn't |
| match Big-Vul; see DECISIONS.md. Revisit with a GitHub token if the |
| chronological split's date coverage needs improving. |
| """ |
| from __future__ import annotations |
|
|
| import hashlib |
| from pathlib import Path |
|
|
| import pandas as pd |
|
|
| from src.data.diff_utils import diff_and_patch_lines |
|
|
| PARQUET_PATH = Path("data/raw/SecVulEval/secvuleval.parquet") |
|
|
|
|
| def _func_hash(text: str) -> str: |
| return hashlib.sha256(text.encode("utf-8", errors="replace")).hexdigest()[:16] |
|
|
|
|
| def _first_or_none(arr) -> str | None: |
| try: |
| return arr[0] if arr is not None and len(arr) > 0 else None |
| except TypeError: |
| return None |
|
|
|
|
| def normalize_secvuleval(path: Path = PARQUET_PATH) -> tuple[list[dict], dict]: |
| df = pd.read_parquet(path) |
| by_idx = {int(row.idx): row for row in df.itertuples()} |
|
|
| rows: list[dict] = [] |
| n_pairs = 0 |
| seen_pairs: set[frozenset[int]] = set() |
|
|
| for row in df.itertuples(): |
| if not row.is_vulnerable: |
| continue |
| fixed_idx = row.fixed_func_idx |
| if fixed_idx is None or pd.isna(fixed_idx): |
| continue |
| fixed_idx = int(fixed_idx) |
| if fixed_idx not in by_idx: |
| continue |
| patch_row = by_idx[fixed_idx] |
|
|
| pair_key = frozenset((int(row.idx), fixed_idx)) |
| if pair_key in seen_pairs: |
| continue |
| seen_pairs.add(pair_key) |
| n_pairs += 1 |
|
|
| cve = _first_or_none(row.cve_list) |
| cwe = _first_or_none(row.cwe_list) |
| pair_id = f"secvuleval:{row.commit_id}:{row.idx}" |
|
|
| diff_text, patch_lines_vuln = diff_and_patch_lines(row.func_body, patch_row.func_body) |
|
|
| |
| |
| |
| for target, func_text in ((1, row.func_body), (0, patch_row.func_body)): |
| sample_id = f"secvuleval:{cve or 'NOCVE'}:{row.commit_id}:{row.idx}:{_func_hash(func_text)}" |
| rows.append({ |
| "sample_id": sample_id, |
| "source": "secvuleval", |
| "project": row.project, |
| "cve": cve, |
| "cwe": cwe, |
| "commit_id": row.commit_id, |
| "func_vuln": row.func_body, |
| "func_patch": patch_row.func_body, |
| "diff": diff_text, |
| "patch_lines_vuln": patch_lines_vuln if target == 1 else [], |
| "commit_date": None, |
| "target": target, |
| "pair_id": pair_id, |
| }) |
|
|
| stats = { |
| "n_pairs": n_pairs, |
| "n_rows": len(rows), |
| "n_with_date": 0, |
| "date_coverage": 0.0, |
| } |
| return rows, stats |
|
|
