marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(model): phase 2 measured (weights v1) and carried reported by the evidence branch

Browse Source 
budget_at_recall by a real evidence pass over every region: pmpro 391 -> 116, wpstatistics 504 -> 223,
mwwpform 513 -> 292, vampi 16 -> 16. The gate (< 50) is not met. pmpro's CVE is inside its 121 tier-4
regions; WP Statistics's and MW WP Form's are one tier low because `carried` -- stage one of the
two-stage join -- was not reported as evidence. taint.sc now reports it where a sink exists, and the
vector reads the query's answer when given.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-11 11:47:06 +02:00
co-authored by Claude Fable 5.1
parent 9f881b433e
commit 1741b6bed6
5 changed files with 192 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/model/evidence.py
+3 -1
View File
@@ -156,7 +156,9 @@ def evidence_from_rows(
source_near=_as_bool(summary.get("sourceNear")),
entry=entry,
access_declared_public=access_declared_public,
carried=carried,
# The query's own answer when it gave one (phase 2: stage one of the two-stage join, reused);
# the caller's otherwise; None where neither knows, which is not False.
carried=_as_bool(summary["carried"]) if "carried" in summary else carried,
bound_names=tuple(bound_names),
)