marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 03:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(config): report every permissive setting in a file, not the first one

Browse Source 
NodeGoat's server.js configures a permissive session at line 78 and disables template
auto-escaping at line 135, both inside the same function. The arbiter returned one verdict per
question, so the escaping defect that task 14.3 added was detected on every run and reported on
none: which of two real defects a contributor saw depended on where in the file it sat.

Configuration now returns one verdict per setting whose value the model could read. The pipeline
already emitted one finding per entailed answer, so this arbiter was the only place still folding
them to one.

Three boundaries are drawn rather than assumed.

- A setting whose value is COMPUTED stays one verdict per region. That band is a question for the
  judge rather than a finding, and returning every undecided setting would multiply model calls
  for claims the graph did not establish.
- A call carrying two permissive literals is one finding. cors({origin: true, credentials: true})
  is one misconfiguration, not two.
- Config verdicts now carry a path:line:function location. Without one they shared the region's
  identity and the deduplicator kept a single finding, so the plural answer collapsed straight
  back to one. That is the same gap dominance carried until its findings stopped arriving with no
  line at all.

Dominance is left answering once per region, and that is settled rather than pending: its claim is
that a region contradicts itself, so the region is the unit and a second verdict would restate the
same inconsistency. The pipeline now says so where it used to call this a known gap.

Measured: NodeGoat's config_secrets goes from one finding to two, server.js:78 for the session and
server.js:135 for the disabled escaping, with the applied marked.setOptions fix between them
staying silent. VAmPI is unchanged and no other family moved.

1,417 tests pass, seventeen skipped; thirteen Joern-gated query tests pass in the image.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-20 16:30:04 +02:00
co-authored by Claude Opus 5
parent e6bdac46e2
commit 3bd844055c
6 changed files with 167 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/model/config_value.py
+55 -14
View File
@@ -30,17 +30,29 @@ def request_params(spec: ConfigSpec, *, function: str = "", file: str = "") -> d
return {"settings": spec.settings, "function": function, "file": file}
def verdict(cpg: CpgResult, spec: ConfigSpec, *, function: str = "", file: str = "") -> Verdict | None:
"""The verdict for a security setting in ``function``, or ``None`` when nothing is established."""
def verdicts(cpg: CpgResult, spec: ConfigSpec, *, function: str = "", file: str = "") -> list[Verdict]:
"""Every configuration defect this region establishes, one per setting, strongest first.
A file configures many things, and one verdict per region reported the first of them. Measured on
NodeGoat: `server.js` disables template auto-escaping at line 135 and configures a permissive session at
line 78, both inside the same function, so the escaping defect was detected on every run and reported on
none. A contributor was shown one of two defects and told nothing about the other, and which one depended
on where in the file it sat.
Only the decided band is plural. A setting whose value the model could not READ is a question for the
judge rather than a finding, and asking it once per region is what that band has always cost; returning
every undecided setting would multiply model calls for claims none of which the graph established.
"""
rows = cpg.run("config", request_params(spec, function=function, file=file))
settings = _settings(rows, spec, function=function)
if not settings:
return None
return []
# Both abstractions read the same literal: a permissive flag ("*", True) and a weak algorithm ("md5").
permissive = {value.strip().strip("'\"").lower() for value in spec.permissive}
permissive |= {value.strip().strip("'\"").lower() for value in spec.weak_algorithms}
scoped = {setting: {value.strip().strip("'\"").lower() for value in values} for setting, values in spec.permissive_by_setting}
found: list[Verdict] = []
for row in settings:
literals = row["literals"]
if not isinstance(literals, list):
@@ -48,22 +60,51 @@ def verdict(cpg: CpgResult, spec: ConfigSpec, *, function: str = "", file: str =
allowed = _permissive_for(str(row["setting"]), scoped) or permissive
for literal in literals:
if str(literal).strip().strip("'\"").lower() in allowed:
return Verdict(
rung=Rung.ENTAILED,
family=spec.family,
witness=f"{row['setting']} (line {row['line']}): permissive literal {literal}",
found.append(
Verdict(
rung=Rung.ENTAILED,
family=spec.family,
witness=f"{row['setting']} (line {row['line']}): permissive literal {literal}",
location=_location(row, file),
)
)
break # one verdict per setting: a call with two permissive literals is one defect
if found:
return found
# A setting whose value the model could not read. Not safe, not decided.
computed = [row for row in settings if not row["literals"]] # type: ignore[truthy-iterable]
if computed:
row = computed[0]
return Verdict(
rung=Rung.CORROBORATED,
family=spec.family,
witness=f"{row['setting']} (line {row['line']}): value is computed, not a literal the model can evaluate",
)
return None
return [
Verdict(
rung=Rung.CORROBORATED,
family=spec.family,
witness=f"{row['setting']} (line {row['line']}): value is computed, not a literal the model can evaluate",
location=_location(row, file),
)
]
return []
def verdict(cpg: CpgResult, spec: ConfigSpec, *, function: str = "", file: str = "") -> Verdict | None:
"""The strongest single verdict, kept for callers that ask one question and want one answer."""
answers = verdicts(cpg, spec, function=function, file=file)
return answers[0] if answers else None
def _location(row: Mapping[str, object], file: str) -> str:
"""``path:line:function`` of the setting, when the region named a file.
Two settings in one file are two findings only if they are two SITES. Without this they shared the
region's own identity and the deduplicator kept one, which is the same defect dominance carried until its
findings stopped arriving as `api_views/users.py:?:update_password`. The config query reports no file of
its own, so the region's is used -- correct because this arbiter never leaves the file it was asked about.
"""
line = str(row.get("line") or "")
if not file or not line.lstrip("-").isdigit() or int(line) < 0:
return ""
return f"{file}:{line}:{row.get('method') or '?'}"
def _permissive_for(setting: str, scoped: Mapping[str, set[str]]) -> set[str]:
@@ -115,4 +156,4 @@ def _settings(rows: object, spec: ConfigSpec, *, function: str) -> list[dict[str
return sorted(kept, key=lambda row: (str(row["method"]), _line(row), str(row["setting"])))
__all__ = ["request_params", "verdict"]
__all__ = ["request_params", "verdict", "verdicts"]
src/openultrasast/model/pipeline.py
+9 -4
View File
@@ -30,6 +30,7 @@ from typing import Any
from ..cpg.backend import CpgResult
from ..redaction import redact_secrets
from .config_value import verdict as config_verdict
from .config_value import verdicts as config_verdicts
from .dominance import verdict as dominance_verdict
from .ladder import Rung, Verdict
from .specs import ConfigSpec, DominanceSpec, TaintSpec
@@ -83,11 +84,15 @@ def _arbitrate_all(
One verdict per region was the right answer for a pair -- one labelled function, one bug -- and the wrong
one for a region that spans a file. A PHP file with an SQL injection on line 6 and a command injection on
line 13 produced ONE injection verdict, and `system` won it on flow length, so the SQL injection went
unreported by construction. Only taint can report several sites today; dominance and config still answer
once per region, which is correct for dominance (its claim is about the region's consistency) and a
known gap for config.
unreported by construction.
Taint and configuration report every site they decide. Dominance still answers once per region, and that
is correct rather than pending: its claim is that a region CONTRADICTS ITSELF, so the region is the unit
and a second verdict would be the same statement about the same inconsistency.
"""
if isinstance(spec, (DominanceSpec, ConfigSpec)):
if isinstance(spec, ConfigSpec):
return config_verdicts(cpg, spec, function=function, file=path)
if isinstance(spec, DominanceSpec):
answer = _arbitrate(cpg, spec, path=path, function=function, parameter_sources=parameter_sources, call_depth=call_depth)
return [answer] if answer is not None else []
return taint_verdicts(cpg, spec, function=function, file=path, parameter_sources=parameter_sources, call_depth=call_depth)