feat(model): phase 2 measured (weights v1) and carried reported by the evidence branch

budget_at_recall by a real evidence pass over every region: pmpro 391 -> 116, wpstatistics 504 -> 223, mwwpform 513 -> 292, vampi 16 -> 16. The gate (< 50) is not met. pmpro's CVE is inside its 121 tier-4 regions; WP Statistics's and MW WP Form's are one tier low because `carried` -- stage one of the two-stage join -- was not reported as evidence. taint.sc now reports it where a sink exists, and the vector reads the query's answer when given. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-10-16 19:59:26 +00:00 · 2026-09-11 11:47:06 +02:00
parent 9f881b433e
commit 1741b6bed6
5 changed files with 192 additions and 1 deletions
@@ -0,0 +1,140 @@
+{
+  "note": "phase 2, weights v1: order by a real evidence pass over every region (position.py --evidence), Joern 4.0.623",
+  "results": [
+    {
+      "repo": "mwwpform",
+      "regions": 983,
+      "distinct_ranks": 5,
+      "largest_tier_share": 0.817,
+      "largest_tier_rank": 0.3,
+      "budget_at_recall": 292,
+      "known": [
+        {
+          "id": "CVE-2023-6559",
+          "family": "path",
+          "site": "classes/services/class.mail.php:259:_delete_files",
+          "position": 291,
+          "rank": 0.3,
+          "in_scope": true,
+          "reached_transitively": false
+        }
+      ],
+      "build_seconds": 47.6,
+      "evidence_seconds": 67.5,
+      "pairs": 4915,
+      "pairs_unanswered": 0,
+      "tier_counts": {
+        "0": 4511,
+        "1": 37,
+        "3": 357,
+        "4": 10
+      }
+    },
+    {
+      "repo": "pmpro",
+      "regions": 4463,
+      "distinct_ranks": 5,
+      "largest_tier_share": 0.838,
+      "largest_tier_rank": 0.3,
+      "budget_at_recall": 116,
+      "known": [
+        {
+          "id": "CVE-2023-23488",
+          "family": "injection",
+          "site": "classes/class.memberorder.php:936:getMemberOrderByCode",
+          "position": 115,
+          "rank": 0.3,
+          "in_scope": true,
+          "reached_transitively": false
+        }
+      ],
+      "build_seconds": 84.8,
+      "evidence_seconds": 255.1,
+      "pairs": 22315,
+      "pairs_unanswered": 0,
+      "tier_counts": {
+        "0": 21275,
+        "1": 74,
+        "2": 86,
+        "3": 759,
+        "4": 121
+      }
+    },
+    {
+      "repo": "vampi",
+      "regions": 25,
+      "distinct_ranks": 5,
+      "largest_tier_share": 0.36,
+      "largest_tier_rank": 1.0,
+      "budget_at_recall": 16,
+      "known": [
+        {
+          "id": "VAmPI-SQLI",
+          "family": "injection",
+          "site": "models/user_model.py:73:get_user",
+          "position": null,
+          "rank": null,
+          "in_scope": true,
+          "reached_transitively": true
+        },
+        {
+          "id": "VAmPI-BOLA",
+          "family": "access_control",
+          "site": "api_views/users.py:187:update_password",
+          "position": 15,
+          "rank": 0.8,
+          "in_scope": true,
+          "reached_transitively": false
+        },
+        {
+          "id": "VAmPI-BOLA-BOOKS",
+          "family": "access_control",
+          "site": "api_views/books.py:51:get_by_title",
+          "position": 10,
+          "rank": 0.8,
+          "in_scope": true,
+          "reached_transitively": false
+        }
+      ],
+      "build_seconds": 5.2,
+      "evidence_seconds": 15.8,
+      "pairs": 125,
+      "pairs_unanswered": 0,
+      "tier_counts": {
+        "0": 123,
+        "1": 1,
+        "4": 1
+      }
+    },
+    {
+      "repo": "wpstatistics",
+      "regions": 1673,
+      "distinct_ranks": 6,
+      "largest_tier_share": 0.753,
+      "largest_tier_rank": 0.3,
+      "budget_at_recall": 223,
+      "known": [
+        {
+          "id": "CVE-2022-25148",
+          "family": "injection",
+          "site": "includes/class-wp-statistics-pages.php:225:record",
+          "position": 222,
+          "rank": 0.3,
+          "in_scope": true,
+          "reached_transitively": false
+        }
+      ],
+      "build_seconds": 106.4,
+      "evidence_seconds": 156.2,
+      "pairs": 8359,
+      "pairs_unanswered": 0,
+      "tier_counts": {
+        "0": 7468,
+        "1": 77,
+        "2": 5,
+        "3": 726,
+        "4": 83
+      }
+    }
+  ]
+}