marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 05:29:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cpg): the interpreter precondition probes the frontend's own parser script; 4.0.625 verified

Browse Source 
php2cpg drives PHP-Parser through `php` from a script inside its own install. A second install the
containerised interpreter had no mount for parsed 1 of 637 files and exited 0 -- caught by the build
census, and now refused by name before any build. On 4.0.625 with the closure exclusion gated off:
pmpro 637 of 637 in 100 s, WP Statistics 115 s with only the two data tables excluded. Phase-2 v5
verdict and the within-tier reading recorded in the brief.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-11 13:52:17 +02:00
co-authored by Claude Fable 5.1
parent 2de873274f
commit 3b3b96be5f
4 changed files with 70 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/contributor-scan/tasks.md
+7 -1
View File
@@ -925,7 +925,13 @@
maintainer verified our reproducer on master: no node with two AST parents, overlays apply cleanly.
So `_files_with_frontend_defect` and its exclusion are a workaround for two releases and should become
version-gated: verify on 4.0.625 (the reproducer, then pmpro and WP Statistics with NO exclusions), and
check whether #6283 (`--overlaysonly`) is also gone there.
check whether #6283 (`--overlaysonly`) is also gone there. **Done, 2026-09-11:** the reproducer builds
and loads cleanly on 4.0.625; #6283 still reproduces there (commented upstream). Through the backend,
with the exclusion version-gated off: **pmpro 637 of 637 files in 100 s, WP Statistics 115 s with only
the two data tables excluded by name.** One more instrument finding on the way: the second install was
not mounted into the containerised `php`, so php2cpg 4.0.625 parsed 1 of 637 files and exited 0 --
caught by the build census, and the interpreter precondition now probes the frontend's own parser
script as well as the repository.
- **Open, and the maintainer's call, not mine:** `includes/vendor/` is 207 of WP Statistics's 357 PHP
files and is not excluded by `preprocess.IGNORED_DIRS`, so vendored third-party code is both scanned
and in the graph. Whether a project's vendored code is in scope is policy; the size guard above is