marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: require the path demo to serve ${served_root} (via arg/env/config)

Browse Source 
Path searches authored and verified many demos but all came back with no differential:
the demo never pointed the app's served directory at ${served_root}, so the observable
(which lives relative to ${served_root}) was outside the served tree and unreachable. The
agent had set an app env var to a value of its own; the guide only showed the --dir form.

ORACLE_GUIDE now states the agent MUST set the app's served/root to the ${served_root}
placeholder via whichever mechanism the app exposes (command-line argument, environment
variable, or config written to start.files), not only --dir, and that serving elsewhere
makes the observable unreachable. Verify-time-only clarification, observable names, and all
prohibitions are kept. Prompt strings only.

Tests: tests/test_search_worker.py 37 passed; ruff clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-07 10:29:40 +02:00
co-authored by Claude Opus 4.8
parent e387ca16a2
commit 00d1c26f5f
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/search/worker.py
+7 -6
View File
@@ -98,12 +98,13 @@ DEMO_GUIDE = (
"point environment values at .demo/name. Allowed: .pem .key .json .yaml .yml .txt .env .ini .toml .db .sqlite .crt."
)
ORACLE_GUIDE = (
"The verifier injects the oracle fixture/observable at VERIFY time only, never during exploration. "
"Do not seek it in the explore checkout: absence never means unreachable or justifies ending the search. "
"Confirm the mechanism with explore tools using app code and, where useful, your own sandbox test data: "
"sink reachability and access to data the app should not expose, without the verifier observable. "
"Target its known verifier-time location below in the demo; only differential verification on both revisions proves it. "
"Path observes a private nonce file named canary in the parent of ${served_root} in app output. "
"Verifier observables exist at VERIFY time only: never seek them in exploration or stop for absence. "
"Explore reachability/disclosure using app code/own sandbox data; demos target below. "
"Only differential verification across revisions proves it. "
"Path observes app output for private nonce file canary in ${served_root}'s parent. "
"MUST set the app's served/root to exactly the ${served_root} placeholder via its command-line argument "
"(e.g. --dir ${served_root}), environment variable or config in start.files. "
"It lives relative to ${served_root}; serving elsewhere makes it unreachable: the search cannot succeed. "
"SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). "
"Command observes marker creation at marker location ${marker_dir}/marker. "
"SSRF observes the nonce URL at its loopback listener ${callback_url}. "