mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
spec(pre-push-safety-net): reserve the independent population v1 (15.1), unscanned
Eleven cases chosen by the maintainer from fifteen researched by advisory and fix diff only -- nothing cloned, nothing scanned, none among the 262 repositories the benchmarks reference -- plus the earlier Ghost reservation. Four are PHP repositories that ship JavaScript (two WordPress plugins), satisfying the multi-language requirement; families are limited to the v1 scope (injection, untrusted destination, permissive config). The development subjects shaped every rule of the last week and can no longer measure whether those rules generalise; this population can, until something scans it. A guard test fails the moment a reserved repository is referenced by a recipe, catalog, manifest or measurement outside benchmarks/independent/. Freezing (pins and sinks verified by reading source, a benign change per case) is the next step. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
d5277c60d0
commit
451d4e4be7
@@ -0,0 +1,174 @@
|
||||
# Independent evaluation population v1 (pre-push-safety-net task 15.1, milestone M4).
|
||||
#
|
||||
# RESERVED, NOT SCANNED. Every case below was chosen from public advisories and fix diffs by web research alone:
|
||||
# no repository was cloned, no scanner or project tooling was run on any of them, and none appears among the
|
||||
# 262 repositories referenced anywhere in this project's benchmarks. They exist to answer the question the
|
||||
# development subjects can no longer answer honestly -- PMPro, WP Statistics, MW WP Form, NodeGoat and VAmPI all
|
||||
# shaped the rules they would be measured by.
|
||||
#
|
||||
# Rules for this file:
|
||||
# * Do not scan, trace, probe or census any of these repositories until the population is FROZEN (status
|
||||
# below) and the freeze commit is recorded. A scan before that makes the case a development subject.
|
||||
# * Freezing requires, per case: the vulnerable and fixed pins verified in the checkout, the sink confirmed at
|
||||
# the vulnerable pin by reading source, and a BENIGN change chosen from the same history without scanning.
|
||||
# * No rule, fact or query change may cite anything learned from these cases before their evaluation is
|
||||
# recorded; after it, a retune needs a new untouched population (release-milestones M4).
|
||||
#
|
||||
# Selected by the maintainer on 2026-09-24 from 15 researched candidates (menu selection); rejected alternates
|
||||
# and the research notes are in the research log referenced below.
|
||||
|
||||
schema_version = 1
|
||||
status = "reserved-unscanned"
|
||||
reserved_on = "2026-09-24"
|
||||
selected_by = "maintainer"
|
||||
research = "web research of GitHub advisories and fix diffs via the GitHub API; no clone, no scan"
|
||||
multi_language_members = ["wp-ultimate-member-sqli", "wp-learnpress-sqli", "phpmyfaq-captcha-ua-sqli", "yeswiki-bazar-form-sqli"]
|
||||
also_reserved = ["../push/ghost-reserved.toml"]
|
||||
|
||||
[[case]]
|
||||
id = "wp-ultimate-member-sqli"
|
||||
repo = "https://github.com/ultimatemember/ultimatemember"
|
||||
language = "php"
|
||||
also = ["javascript"]
|
||||
family = "injection"
|
||||
advisory = ["CVE-2024-1071", "GHSA-mh7h-gpmx-fggj"]
|
||||
vulnerable = "a49b3061ded1630e4f6860b4ebece5ccf0a493d2"
|
||||
fixed = "476de92f4c9aaa56c3e2f5527b242ce0476f4655"
|
||||
sink = "includes/core/class-member-directory-meta.php :: Member_Directory_Meta::ajax_get_members (ORDER BY built from esc_sql'd sort values)"
|
||||
privilege = "unauthenticated (only with the custom usermeta table option on)"
|
||||
license = "GPL"
|
||||
notes = "Release pair 2.8.2 (e1885a73) -> 2.8.3 (a6a7d13a) spans 94 commits; the commit pair is the clean one. c61008bd is a larger follow-up refactor of the same file."
|
||||
|
||||
[[case]]
|
||||
id = "wp-learnpress-sqli"
|
||||
repo = "https://github.com/LearnPress/learnpress"
|
||||
language = "php"
|
||||
also = ["javascript"]
|
||||
family = "injection"
|
||||
advisory = ["CVE-2024-8522", "GHSA-3w3r-r6g6-w8x5", "CVE-2024-8529", "GHSA-98wp-w76v-f75p"]
|
||||
vulnerable = "73b3cbceef8669056e9da5e2f2c78944eb139af5"
|
||||
fixed = "aaf42fe0c6bf05dcf2ff125750b7bd836e76fa3c"
|
||||
sink = "inc/Databases/class-lp-db.php :: LP_Database::execute (implode of only_fields into SELECT); source REST get_courses c_only_fields/c_fields"
|
||||
privilege = "unauthenticated (REST /wp-json/learnpress/v1/courses)"
|
||||
license = "GPL"
|
||||
notes = "The fix also touches assets/src/js/loadAJAX.js: the change itself is multi-language."
|
||||
|
||||
[[case]]
|
||||
id = "phpmyfaq-captcha-ua-sqli"
|
||||
repo = "https://github.com/thorsten/phpMyFAQ"
|
||||
language = "php"
|
||||
also = ["typescript", "javascript"]
|
||||
family = "injection"
|
||||
advisory = ["CVE-2026-46364", "GHSA-289f-fq7w-6q2w"]
|
||||
vulnerable = "11583abcf4787543d00c25d6c7926af6f509faf0"
|
||||
fixed = "545bdffb11244a4741cd29ac909a849c9a6a2e53"
|
||||
sink = "phpmyfaq/src/phpMyFAQ/Captcha/BuiltinCaptcha.php :: garbageCollector, saveCaptcha (User-Agent and client IP in sprintf SQL)"
|
||||
privilege = "unauthenticated (GET /api/captcha)"
|
||||
license = "MPL-2.0"
|
||||
notes = "The advisory's commit b9f25109 is the vulnerable master commit the reporter tested, not the fix. Release pair 4.1.1 (f791858b) -> 4.1.2 (66792f25)."
|
||||
|
||||
[[case]]
|
||||
id = "yeswiki-bazar-form-sqli"
|
||||
repo = "https://github.com/YesWiki/yeswiki"
|
||||
language = "php"
|
||||
also = ["javascript"]
|
||||
family = "injection"
|
||||
advisory = ["CVE-2026-46670", "GHSA-jwvv-qr7q-cv8j"]
|
||||
vulnerable = "6f222915df36fca628fc83325cb0feed8dc2aca0"
|
||||
fixed = "fe7244bffcbeffd42777496ebc2a6f6118cc2388"
|
||||
sink = "tools/bazar/services/FormManager.php :: FormManager::create (bn_id_nature unquoted in INSERT); source FormController::displayAll imported-form JSON"
|
||||
privilege = "unauthenticated"
|
||||
license = "AGPL-3.0"
|
||||
notes = "Four-line fix: intval plus a Guard::isAllowed check. Default branch doryphore-dev."
|
||||
|
||||
[[case]]
|
||||
id = "signalk-remote-conn-ssrf"
|
||||
repo = "https://github.com/SignalK/signalk-server"
|
||||
language = "typescript"
|
||||
family = "untrusted_destination"
|
||||
advisory = ["CVE-2026-55591", "GHSA-q59x-jc9f-gfqf"]
|
||||
vulnerable = "1c479cc0d2d26d14ed74416cff36fa7336c7bf9e"
|
||||
fixed = "2816b0dda1bdde893d85c969a9c5950e7825eee7"
|
||||
sink = "src/serverroutes.ts :: makeRemoteRequest (req.body.host/port to http(s).request)"
|
||||
privilege = "unauthenticated by default (security not configured); admin otherwise"
|
||||
license = "Apache-2.0"
|
||||
notes = "Fix adds a schema, an ssrfGuard module and requestId validation (~450 added lines, mostly guard code and tests)."
|
||||
|
||||
[[case]]
|
||||
id = "saltcorn-sync-sqli"
|
||||
repo = "https://github.com/saltcorn/saltcorn"
|
||||
language = "javascript"
|
||||
also = ["typescript"]
|
||||
family = "injection"
|
||||
advisory = ["CVE-2026-41478", "GHSA-jp74-mfrx-3qvh"]
|
||||
vulnerable = "e7e09254a3c69dc6582eda9e5b5769935db108af"
|
||||
fixed = "2b6c8a2eab88955ea6b12b1b4e5c2e613faefef5"
|
||||
sink = "packages/server/routes/sync.js :: getSyncRows, getDelRows (maxLoadedId and timestamps in SQL template literals)"
|
||||
privilege = "authenticated low-privilege user"
|
||||
license = "MIT"
|
||||
notes = "Large multi-package repository; the fix is on the main line (v1.4.6 is a separate backport), so use the commit pair."
|
||||
|
||||
[[case]]
|
||||
id = "mongo-express-bson-rce"
|
||||
repo = "https://github.com/mongo-express/mongo-express"
|
||||
language = "javascript"
|
||||
family = "injection"
|
||||
advisory = ["CVE-2019-10758", "GHSA-h47j-hc6x-h3qq"]
|
||||
vulnerable = "ea02b364d43f179f191fc91fb9962efdb0843a8d"
|
||||
fixed = "d8c9bda46a204ecba1d35558452685cd0674e6f2"
|
||||
sink = "lib/bson.js :: toBSON (vm.runInNewContext over request text); callers lib/routes/collection.js, lib/routes/document.js"
|
||||
privilege = "authenticated (HTTP basic auth, default admin:pass)"
|
||||
license = "MIT"
|
||||
notes = "Code injection, not SQL. The advisory's first reference 7d365141 is only the v0.54.0 release commit."
|
||||
|
||||
[[case]]
|
||||
id = "mockoon-admin-api-cors"
|
||||
repo = "https://github.com/mockoon/mockoon"
|
||||
language = "typescript"
|
||||
family = "config_secrets"
|
||||
advisory = ["CVE-2026-59148", "GHSA-rqx4-3f6q-3x2v"]
|
||||
vulnerable = "b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585"
|
||||
fixed = "c420b5a56918475b8663977b51e5f986e45b3299"
|
||||
sink = "packages/commons-server/src/libs/server/admin-api.ts :: admin-API middleware (Access-Control-Allow-Origin: *)"
|
||||
privilege = "unauthenticated"
|
||||
license = "MIT"
|
||||
notes = "Weaker fit: the fix commit touches 34 files; only one hunk in admin-api.ts is the CORS fix."
|
||||
|
||||
[[case]]
|
||||
id = "alerta-query-sqli"
|
||||
repo = "https://github.com/alerta/alerta"
|
||||
language = "python"
|
||||
family = "injection"
|
||||
advisory = ["CVE-2026-34400", "GHSA-8prr-286p-4w7j"]
|
||||
vulnerable = "71c098d8bb8091e76edaefeef4662eb77c753ce7"
|
||||
fixed = "fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883"
|
||||
sink = "alerta/database/backends/postgres/queryparser.py :: SearchTerm.__repr__ (f-string WHERE) used by utils.py QueryBuilder.from_params"
|
||||
privilege = "API user; possibly unauthenticated if AUTH_REQUIRED defaults to False (unverified)"
|
||||
license = "Apache-2.0"
|
||||
notes = "The advisory's aeba85a3 introduced the parser; the fix is fdd52cd1."
|
||||
|
||||
[[case]]
|
||||
id = "wger-next-open-redirect"
|
||||
repo = "https://github.com/wger-project/wger"
|
||||
language = "python"
|
||||
family = "untrusted_destination"
|
||||
advisory = ["GHSA-vqv8-j3mj-wjxj"]
|
||||
vulnerable = "d30e85b23fb1307ac6579e9e3ae393c50470cea7"
|
||||
fixed = "0ba371bbb50cd5668820f240995405e1b2483384"
|
||||
sink = "wger/core/views/user.py :: trainer_login; wger/core/views/languages.py :: use_browser_language (request.GET next redirected unchecked)"
|
||||
privilege = "use_browser_language: unauthenticated; trainer_login: authenticated trainer"
|
||||
license = "AGPL-3.0"
|
||||
notes = "No CVE. A later commit cfa27a7f fixes the same pattern in core/middleware.py; not part of this fix."
|
||||
|
||||
[[case]]
|
||||
id = "opencve-notification-ssrf"
|
||||
repo = "https://github.com/opencve/opencve"
|
||||
language = "python"
|
||||
family = "untrusted_destination"
|
||||
advisory = ["CVE-2026-62282", "GHSA-ch3g-4xvr-674q"]
|
||||
vulnerable = "928bbadbb1672051bcfc2a6289a9e6a8f029c106"
|
||||
fixed = "0af7f894debc95c67fa53e7ba5a6cdecb10c34f0"
|
||||
sink = "web/projects/notifications.py :: _http_post_json (webhook and Slack test POST to a user-supplied URL)"
|
||||
privilege = "authenticated (can configure project notifications)"
|
||||
license = "unverified (GitHub reports NOASSERTION; possibly non-OSS BSL) -- verify before publishing any result"
|
||||
notes = "Selected by the maintainer despite the licence question; results must not be redistributed until it is checked."
|
||||
Reference in New Issue
Block a user