[17:21:02] Harness 4.2.3 -> /data/pruva/runs/8c31a926-4b9c-4aab-8abc-40b4cecba295/bundle/logs/vuln_variant/harness_4.2.3.log [17:21:02] Harness 4.2.4 -> /data/pruva/runs/8c31a926-4b9c-4aab-8abc-40b4cecba295/bundle/logs/vuln_variant/harness_4.2.4.log [17:21:02] Harness 4.2.5 -> /data/pruva/runs/8c31a926-4b9c-4aab-8abc-40b4cecba295/bundle/logs/vuln_variant/harness_4.2.5.log ---- CLASSIFICATION ---- vulnerable 4.2.3: eval_reached_for_contributor = True fixed 4.2.4: eval_reached_for_contributor = False latest 4.2.5: eval_reached_for_contributor = False 4.2.3: G1=False G2_brace_blocked=False G4_freeform_stripper_present=True probe=false (eval_reached_caught_throwable (no G1 on vuln)) variant A_original_cve: reached_eval_on_vuln (no G1) (safe_eval=true) variant B_stripslashes_diff: reached_eval_on_vuln (no G1) (safe_eval=true) variant D_brace_var_call: reached_eval_on_vuln (no G1) (safe_eval=true) variant E_concat_callable: rejected_or_error_on_vuln (safe_eval=false) G4 freeform: logic_removed=True changed=True 4.2.4: G1=True G2_brace_blocked=True G4_freeform_stripper_present=True probe=true (gate_blocked_G1 (eval never reached for contributor)) variant A_original_cve: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant B_stripslashes_diff: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant D_brace_var_call: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant E_concat_callable: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) G4 freeform: logic_removed=True changed=True 4.2.5: G1=True G2_brace_blocked=True G4_freeform_stripper_present=True probe=true (gate_blocked_G1 (eval never reached for contributor)) variant A_original_cve: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant B_stripslashes_diff: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant D_brace_var_call: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) variant E_concat_callable: BLOCKED_at_trust_gate_G1 (contributor never reaches eval) (safe_eval=true) G4 freeform: logic_removed=True changed=True [17:21:02] Verdict flag: NO_BYPASS [17:21:02] NO BYPASS: all candidate variants are blocked on 4.2.4/4.2.5 (negative result). [17:21:02] Variants A/B/D reach eval only on vulnerable 4.2.3 (alternate triggers, not a fix bypass); [17:21:02] the closed-default trust gate (G1) is the primary blocker on fixed, with G2 (token '}' block) [17:21:02] and G4 (freeform stripper) as defense in depth.