marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 12:09:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Browse Source 
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.
This commit is contained in:
Marius Ciepluch
2026-09-04 13:57:33 +02:00
parent 32aa92191a
commit 1ae41eea19
76 changed files with 6538 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/pairs/sast/juliet-java/cwe78-exec-vuln.java
+11
View File
@@ -0,0 +1,11 @@
/* Juliet CWE-78 flow variant 01 — bad sink only.
* Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
* https://github.com/UnitTestBot/juliet-java-test-suite (NIST Juliet 1.3, CC0)
*/
public class CWE78_OS_Command_Injection__console_readLine_01 {
public void bad(String data) throws Throwable {
String osCommand = "/bin/ls ";
Process process = Runtime.getRuntime().exec(osCommand + data);
process.waitFor();
}
}