marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 05:29:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(ruleset): Phase 2 (task 3) — rules as governed data, severity from policy

Browse Source 
Externalize detection rules to versioned TOML and remove rule-local severity, so
rules detect and the central CWE policy decides severity — fixing "rules too
influential / not centrally managed". Zero-dependency; detection is byte-identical
(benchmark recall 44/47 = 93.6%, FP 0% unchanged) and the 90/10 gate holds.

- RulesetStore (ruleset/store.py + ruleset/<lang>/rules.toml): PatternRule as data
  (rule_id, title, languages, cwe, tags, pattern, status, min_evidence_level,
  precision_estimate, version) with NO severity; load_ruleset (sorted, with
  optional rule_policy.json ledger overlay) and a stdlib TOML write_ruleset. The
  32 rules were generated from the prior PATTERN_RULES with a verified exact
  round-trip (pattern/cwe/languages/tags/title).
- findings.py: drop the hardcoded PatternRule class + PATTERN_RULES tuple; load the
  default ruleset from TOML; quick_scan_findings(root, targets, rankings, ruleset,
  policy) resolves each finding's severity from policy via resolve_severity
  (SEVERITY_LABEL maps 0-5 -> string) and tags findings with their rule status.
- Three-status volume control: StaticFinding gains status (default "enabled");
  disabled rules never fire; shadow findings are partitioned out of the report and
  score in the CLI (written to shadow_findings.json) — no shadow rules by default.
- Emission floors (RulesetConfig.min_emit_priority / min_emit_precision, default
  0.0 = emit all) replace "every match is a finding".
- CLI loads the ruleset as a stage and uses it for the fail-loud policy check,
  detection, hunter pool, and the score CWE map. Wheel ships the ruleset TOML.

85 tests pass; ruff + mypy clean. Spec tasks 3.1-3.4 checked off.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-06-22 15:27:16 +02:00
co-authored by Claude Opus 4.8
parent fb7594a3ed
commit 444d8c9490
15 changed files with 645 additions and 347 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/findings.py
+32 -330
View File
@@ -5,8 +5,10 @@ import re
from dataclasses import asdict, dataclass
from pathlib import Path
from .policy import CwePolicy, load_policy, resolve_severity
from .preprocess import FileTarget
from .rank import RankingScore
from .ruleset import DEFAULT_RULESET_DIR, PatternRule, load_ruleset
@dataclass(frozen=True)
@@ -25,348 +27,45 @@ class StaticFinding:
reachability_conditions: list[str]
tags: list[str]
ranking_priority: float
status: str = "enabled"
@dataclass(frozen=True)
class PatternRule:
rule_id: str
title: str
severity: str
tags: tuple[str, ...]
pattern: re.Pattern[str]
cwe: str
languages: tuple[str, ...]
SEVERITY_LABEL = {5: "critical", 4: "high", 3: "medium", 2: "low", 1: "low", 0: "info"}
# Default ruleset loaded from versioned TOML data (rules-as-data).
PATTERN_RULES = load_ruleset(DEFAULT_RULESET_DIR)
C_LANGUAGES = ("c", "cpp")
PYTHON_LANGUAGES = ("python",)
JS_LANGUAGES = ("javascript", "typescript")
JAVA_LANGUAGES = ("java",)
GROOVY_LANGUAGES = ("groovy",)
PATTERN_RULES = (
# --- C / C++ -----------------------------------------------------------------
PatternRule(
rule_id="c-unsafe-copy",
title="Unsafe C string copy needs review",
severity="high",
tags=("memory_unsafe",),
pattern=re.compile(r"\b(gets|strcpy|strcat|sprintf)\s*\("),
cwe="CWE-121",
languages=C_LANGUAGES,
),
PatternRule(
rule_id="c-unsafe-memory-copy",
title="Unsafe C memory copy needs review",
severity="high",
tags=("memory_unsafe",),
pattern=re.compile(r"\b(memcpy|memmove|bcopy)\s*\("),
cwe="CWE-121",
languages=C_LANGUAGES,
),
PatternRule(
rule_id="c-unsafe-format",
title="Unsafe C format string needs review",
severity="high",
tags=("memory_unsafe",),
# Flag format functions that receive a variable format string.
# Calls with string literals, such as printf("..."), are ignored.
pattern=re.compile(r"\b(printf|vprintf|vsprintf|vsnprintf|vfprintf|syslog)\s*\(\s*[A-Za-z_]"),
cwe="CWE-134",
languages=C_LANGUAGES,
),
PatternRule(
rule_id="c-unsafe-scanf",
title="Unbounded C scanf needs review",
severity="high",
tags=("memory_unsafe",),
pattern=re.compile(r"\b(scanf|fscanf|sscanf)\s*\([^\n]*%s"),
cwe="CWE-121",
languages=C_LANGUAGES,
),
PatternRule(
rule_id="c-shell-exec",
title="C shell execution needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(system|popen)\s*\("),
cwe="CWE-78",
languages=C_LANGUAGES,
),
PatternRule(
rule_id="c-exec-family",
title="C exec command execution needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(execl|execlp|execle|execv|execvp|execvpe)\s*\("),
cwe="CWE-78",
languages=C_LANGUAGES,
),
# --- Python ------------------------------------------------------------------
PatternRule(
rule_id="python-unsafe-eval",
title="Dynamic Python execution needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(eval|exec)\s*\("),
cwe="CWE-95",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-os-command",
title="Python OS command execution needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(os\.system|os\.popen|os\.execl|os\.execlp|os\.execv|os\.execvp)\s*\("),
cwe="CWE-78",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-shell-true",
title="Subprocess shell execution needs review",
severity="medium",
tags=("syscall_entry",),
pattern=re.compile(r"subprocess\.[a-zA-Z_]+\s*\([^\n]*shell\s*=\s*True"),
cwe="CWE-78",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-unsafe-deserialization",
title="Unsafe Python deserialization needs review",
severity="high",
tags=("deserialization",),
pattern=re.compile(r"\b(pickle\.loads|pickle\.load|cPickle\.loads|yaml\.load|marshal\.loads)\s*\("),
cwe="CWE-502",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-sql-injection",
title="Python SQL string composition needs review",
severity="high",
tags=("injection",),
# Flag .execute(...) calls built with %-formatting, .format(), string
# concatenation, or an f-string. Parameterised %s placeholders pass.
pattern=re.compile(r"(\.execute)\s*\(\s*[^\n]*(?:[\"']\s*%\s*[(A-Za-z_]|\.format\s*\(|[\"']\s*\+|\bf[\"'])"),
cwe="CWE-89",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-path-traversal",
title="Python file open with external input needs review",
severity="medium",
tags=("filesystem_entry",),
pattern=re.compile(r"\b(open)\s*\(\s*[^\n]*(?:request\.|req\.|argv|input\s*\(|params\[|GET\[|POST\[)"),
cwe="CWE-22",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-ssrf",
title="Python outbound request with external input needs review",
severity="medium",
tags=("network_entry",),
pattern=re.compile(
r"\b(requests\.(?:get|post|put|delete|head|patch)|urllib\.request\.urlopen|urlopen)\s*\(\s*[^\n]*(?:request\.|req\.|argv|input\s*\()"
),
cwe="CWE-918",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-weak-hash",
title="Python weak hash needs review",
severity="low",
tags=("crypto",),
pattern=re.compile(r"\bhashlib\.(md5|sha1)\s*\("),
cwe="CWE-327",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-ssti",
title="Python server-side template injection needs review",
severity="high",
tags=("injection",),
pattern=re.compile(r"\b(render_template_string)\s*\("),
cwe="CWE-94",
languages=PYTHON_LANGUAGES,
),
PatternRule(
rule_id="python-flask-debug",
title="Flask debug mode enabled needs review",
severity="low",
tags=("insecure_default",),
pattern=re.compile(r"\.run\s*\([^\n]*(debug)\s*=\s*True"),
cwe="CWE-489",
languages=PYTHON_LANGUAGES,
),
# --- JavaScript / TypeScript -------------------------------------------------
PatternRule(
rule_id="js-command-exec",
title="Node child_process command execution needs review",
severity="high",
tags=("syscall_entry",),
# exec and execSync invoke a shell. execFile and spawn with an argv array
# do not, so this rule leaves them alone.
pattern=re.compile(r"\b(exec|execSync)\s*\("),
cwe="CWE-78",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-spawn-shell",
title="Node spawn with shell needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(spawn|spawnSync)\s*\([^\n]*shell\s*:\s*true"),
cwe="CWE-78",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-eval",
title="Dynamic JavaScript evaluation needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(eval)\s*\("),
cwe="CWE-95",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-function-constructor",
title="JavaScript Function constructor needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"new\s+(Function)\s*\("),
cwe="CWE-95",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-xss-response",
title="Unsanitized HTTP response reflection needs review",
severity="high",
tags=("injection",),
pattern=re.compile(r"\.(send|write|end)\s*\(\s*[^\n]*\b(?:req|request)\.(?:query|params|body)"),
cwe="CWE-79",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-dom-xss",
title="DOM sink with untrusted input needs review",
severity="high",
tags=("injection",),
pattern=re.compile(r"\.(innerHTML|outerHTML)\s*=\s*[^\n]*\b(?:req|request|location|document\.location)"),
cwe="CWE-79",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-sql-injection",
title="JavaScript SQL string composition needs review",
severity="high",
tags=("injection",),
pattern=re.compile(r"\.(query|execute)\s*\(\s*[^\n]*(?:\$\{|\+\s*[A-Za-z_$])"),
cwe="CWE-89",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-path-traversal",
title="Node filesystem access with external input needs review",
severity="medium",
tags=("filesystem_entry",),
pattern=re.compile(
r"\bfs\.(readFile|readFileSync|writeFile|writeFileSync|createReadStream|unlink|unlinkSync)\s*\(\s*[^\n]*\b(?:req|request)\."
),
cwe="CWE-22",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-ssrf",
title="JavaScript outbound request with external input needs review",
severity="medium",
tags=("network_entry",),
pattern=re.compile(r"\b(axios|fetch|got)\s*[.(][^\n]*\b(?:req|request)\."),
cwe="CWE-918",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-weak-hash",
title="JavaScript weak hash needs review",
severity="low",
tags=("crypto",),
pattern=re.compile(r"createHash\s*\(\s*[\"'](md5|sha1)[\"']"),
cwe="CWE-327",
languages=JS_LANGUAGES,
),
PatternRule(
rule_id="js-deserialize",
title="JavaScript unsafe deserialization needs review",
severity="high",
tags=("deserialization",),
pattern=re.compile(r"\b(unserialize)\s*\("),
cwe="CWE-502",
languages=JS_LANGUAGES,
),
# --- Java --------------------------------------------------------------------
PatternRule(
rule_id="java-command-exec",
title="Java runtime command execution needs review",
severity="high",
tags=("syscall_entry",),
pattern=re.compile(r"\b(exec)\s*\("),
cwe="CWE-78",
languages=JAVA_LANGUAGES,
),
PatternRule(
rule_id="java-sql-injection",
title="Java SQL string composition needs review",
severity="high",
tags=("injection",),
# Flag SQL strings that start with a statement keyword and then concatenate
# more data. Parameterised queries with placeholders are ignored.
pattern=re.compile(r"(?i)\"\s*(select|insert|update|delete)\b[^\"]*\"\s*\+"),
cwe="CWE-89",
languages=JAVA_LANGUAGES,
),
PatternRule(
rule_id="java-weak-hash",
title="Java weak hash needs review",
severity="low",
tags=("crypto",),
pattern=re.compile(r"MessageDigest\.getInstance\s*\(\s*\"(MD5|SHA-1)\""),
cwe="CWE-327",
languages=JAVA_LANGUAGES,
),
PatternRule(
rule_id="java-deserialization",
title="Java unsafe deserialization needs review",
severity="high",
tags=("deserialization",),
pattern=re.compile(r"\.(readObject)\s*\("),
cwe="CWE-502",
languages=JAVA_LANGUAGES,
),
# --- Groovy server-side templates -------------------------------------------
PatternRule(
rule_id="groovy-xss-unescaped",
title="Groovy template unescaped output needs review",
severity="high",
tags=("injection",),
# Flag unescaped bound variables. String literals are ignored.
pattern=re.compile(r"(yieldUnescaped)\s+[A-Za-z_]"),
cwe="CWE-79",
languages=GROOVY_LANGUAGES,
),
)
def quick_scan_findings(root: Path, targets: list[FileTarget], rankings: list[RankingScore]) -> list[StaticFinding]:
def quick_scan_findings(
root: Path,
targets: list[FileTarget],
rankings: list[RankingScore],
ruleset: tuple[PatternRule, ...] | None = None,
policy: dict[str, CwePolicy] | None = None,
*,
min_emit_priority: float = 0.0,
min_emit_precision: float = 0.0,
) -> list[StaticFinding]:
ruleset = PATTERN_RULES if ruleset is None else ruleset
policy = load_policy() if policy is None else policy
ranking_by_path = {ranking.path: ranking for ranking in rankings}
# Compile once; disabled rules and rules below the precision floor never fire.
compiled = [
(rule, re.compile(rule.pattern)) for rule in ruleset if rule.status != "disabled" and rule.precision_estimate >= min_emit_precision
]
findings: list[StaticFinding] = []
for target in targets:
text = _read_text(root / target.path)
for rule in PATTERN_RULES:
for rule, pattern in compiled:
if rule.languages and target.language not in rule.languages:
continue
ranking = ranking_by_path.get(target.path)
for match in rule.pattern.finditer(text):
for match in pattern.finditer(text):
if _match_is_in_comment(text, match.start(), target.language):
continue
findings.append(_finding_from_match(target, rule, text, match, ranking))
finding = _finding_from_match(target, rule, text, match, ranking, policy)
if finding.ranking_priority >= min_emit_priority:
findings.append(finding)
return sorted(findings, key=lambda item: (_severity_sort(item.severity), -item.ranking_priority, item.path))
@@ -393,17 +92,19 @@ def _finding_from_match(
text: str,
match: re.Match[str],
ranking: RankingScore | None,
policy: dict[str, CwePolicy],
) -> StaticFinding:
offset = match.start()
line = text.count("\n", 0, offset) + 1
reachability_status, function_name, reachability_evidence = _reachability_for_line(target, line)
priority = ranking.priority if ranking is not None else 1.0
matched_token = match.group(1) if match.groups() else match.group(0).split("(", 1)[0].strip()
severity = SEVERITY_LABEL.get(resolve_severity(policy, rule.cwe), "info")
return StaticFinding(
finding_id=f"{rule.rule_id}:{target.path}:{line}",
path=target.path,
title=rule.title,
severity=rule.severity,
severity=severity,
confidence="medium",
evidence_level="static_corroboration",
rationale=(
@@ -416,6 +117,7 @@ def _finding_from_match(
reachability_conditions=_reachability_conditions(reachability_evidence),
tags=sorted(set(target.tags) | set(rule.tags)),
ranking_priority=_finding_priority(priority, reachability_status),
status=rule.status,
)