mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from openultrasast.findings import build_quick_hunter_prompt, quick_scan_findings, write_findings
|
||
|
|
from openultrasast.preprocess import preprocess_repository
|
||
|
|
from openultrasast.rank import rank_targets
|
||
|
|
from openultrasast.reports import write_markdown_report
|
||
|
|
|
||
|
|
|
||
|
|
def test_quick_scan_findings_emit_static_corroboration(tmp_path: Path) -> None:
|
||
|
|
repo = tmp_path / "repo"
|
||
|
|
repo.mkdir()
|
||
|
|
(repo / "parser.c").write_text("void parse(char *src) { char dst[8]; strcpy(dst, src); }\n")
|
||
|
|
_, targets = preprocess_repository(repo)
|
||
|
|
rankings = rank_targets(targets)
|
||
|
|
|
||
|
|
findings = quick_scan_findings(repo, targets, rankings)
|
||
|
|
|
||
|
|
assert len(findings) == 1
|
||
|
|
assert findings[0].evidence_level == "static_corroboration"
|
||
|
|
assert findings[0].path == "parser.c"
|
||
|
|
assert findings[0].line == 1
|
||
|
|
|
||
|
|
|
||
|
|
def test_findings_and_report_artifacts(tmp_path: Path) -> None:
|
||
|
|
repo = tmp_path / "repo"
|
||
|
|
repo.mkdir()
|
||
|
|
(repo / "runner.py").write_text("import subprocess\nsubprocess.run(cmd, shell=True)\n")
|
||
|
|
_, targets = preprocess_repository(repo)
|
||
|
|
findings = quick_scan_findings(repo, targets, rank_targets(targets))
|
||
|
|
findings_path = tmp_path / "findings.json"
|
||
|
|
report_path = tmp_path / "report.md"
|
||
|
|
|
||
|
|
write_findings(findings, findings_path)
|
||
|
|
write_markdown_report(findings, report_path)
|
||
|
|
|
||
|
|
assert json.loads(findings_path.read_text())["findings"][0]["severity"] == "medium"
|
||
|
|
assert "Subprocess shell execution" in report_path.read_text()
|
||
|
|
|
||
|
|
|
||
|
|
def test_quick_hunter_prompt_is_bounded() -> None:
|
||
|
|
repo = Path("/repo/example.py")
|
||
|
|
target = next(iter(preprocess_repository(repo.parent)[1]), None) if repo.parent.exists() else None
|
||
|
|
assert target is None
|
||
|
|
class Target:
|
||
|
|
path = "example.py"
|
||
|
|
language = "python"
|
||
|
|
tags = ["auth_boundary"]
|
||
|
|
|
||
|
|
prompt = build_quick_hunter_prompt(Target(), "x" * 5000) # type: ignore[arg-type]
|
||
|
|
|
||
|
|
assert "example.py" in prompt
|
||
|
|
assert len(prompt) < 4300
|