mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
feat(plane): honest coverage in alerts; PHP alerts from the engine on the host
Quick mode has rules only for c/cpp, groovy, java, javascript/typescript and python, so every PHP case's "0 alerts" read as clean. The `alerts` task now records per language of the files read whether quick mode covers it (derived from the bundled ruleset, not a list): coverage quick | none, with file counts per pin, and `uncovered`. `remember` turns that into `coverage` memory rows (a new kind; the Run passes the alerts summary.json as input), loop-measure reports coverage per language, and improve/memory.py's M1/M2 skip a repository+pin whose coverage for the rule's language is only `none` (counted under `coverage_none` in the proposal's excluded). `ousast plane alerts-engine <Run.yaml> --source <frozen export>` (plane/engine_alerts.py) does the alerts task on the host for cases whose files include a language the engine covers but quick mode does not (PHP): exports both pins from the case cache, runs the quick scan and the openultrasast:dev engine container (finding_dump.py, --network none, --memory 3g, one at a time, per-pin deadline), writes engine findings in the alerts.jsonl row shape (rule_id engine:<family>, source engine, in_fix_range from case.json) with a summary (files read, questions, completed, seconds, degradations per pin), and marks the task done via reconciler.mark_done. No result, no files read, or questions == 0 fails loudly and leaves the run untouched. Refuses a git checkout as source. Runner image rebuilt and re-pinned (sha256:ebb40a9a...); validation-46 regenerated (digest only). Live, recorded in benchmarks/measurements/2026-09-30-php-engine-alerts/: froxlor 366 files, 130/130 questions per pin, 6 alerts per pin, 0 in the fix range; wp-gopay 19 files, 101/101 questions, 0 alerts. The loop: 32 run rows (coverage 8, php=engine), 0 proposals, gate no_proposals, $0. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
f4bd984fda
commit
45d02ecf20
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"modules": 134,
|
||||
"modules": 135,
|
||||
"counts": {
|
||||
"load_bearing": 127,
|
||||
"load_bearing": 128,
|
||||
"standalone_capability": 7
|
||||
},
|
||||
"orphaned": [],
|
||||
@@ -662,6 +662,7 @@
|
||||
"cli",
|
||||
"improve.memory",
|
||||
"plane.egress",
|
||||
"plane.engine_alerts",
|
||||
"plane.generate",
|
||||
"plane.memory",
|
||||
"plane.reconciler",
|
||||
@@ -698,6 +699,12 @@
|
||||
"plane.reconciler"
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "plane.engine_alerts",
|
||||
"classification": "load_bearing",
|
||||
"reason": "harnessx-removal Req 6.3: engine alerts where quick mode has no rules (PHP), on the host",
|
||||
"importers": []
|
||||
},
|
||||
{
|
||||
"module": "plane.generate",
|
||||
"classification": "load_bearing",
|
||||
@@ -761,6 +768,7 @@
|
||||
"reason": "ai-service-plane Req 4.1: the task entrypoint package the runner imports by name; runner integration pending (task 3)",
|
||||
"importers": [
|
||||
"cli",
|
||||
"plane.engine_alerts",
|
||||
"plane.generate",
|
||||
"plane.memory",
|
||||
"plane.tasks.agree",
|
||||
@@ -778,7 +786,9 @@
|
||||
"module": "plane.tasks.alerts",
|
||||
"classification": "load_bearing",
|
||||
"reason": "harnessx-removal Req 6.3: quick-mode alerts on a case's vulnerable and fixed pins, model-free",
|
||||
"importers": []
|
||||
"importers": [
|
||||
"plane.engine_alerts"
|
||||
]
|
||||
},
|
||||
{
|
||||
"module": "plane.tasks.loop",
|
||||
@@ -1139,6 +1149,7 @@
|
||||
"improve.memory",
|
||||
"improve.validator",
|
||||
"pairs",
|
||||
"plane.tasks.alerts",
|
||||
"plane.tasks.loop",
|
||||
"stage_processors"
|
||||
]
|
||||
|
||||
+96
@@ -0,0 +1,96 @@
|
||||
{
|
||||
"alerts": {
|
||||
"fixed": 6,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"alerts_engine": {
|
||||
"fixed": 6,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"calls": 0,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"coverage": "quick",
|
||||
"files": {
|
||||
"fixed": 18,
|
||||
"vulnerable": 18
|
||||
}
|
||||
},
|
||||
"php": {
|
||||
"coverage": "engine",
|
||||
"files": {
|
||||
"fixed": 348,
|
||||
"vulnerable": 348
|
||||
}
|
||||
}
|
||||
},
|
||||
"deadline": 1800.0,
|
||||
"engine": {
|
||||
"fixed": {
|
||||
"bytes": 4256572,
|
||||
"completed": 130,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 366,
|
||||
"findings": 6,
|
||||
"questions": 130,
|
||||
"seconds": 383.2
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 4256094,
|
||||
"completed": 130,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 366,
|
||||
"findings": 6,
|
||||
"questions": 130,
|
||||
"seconds": 398.2
|
||||
}
|
||||
},
|
||||
"engine_languages": [
|
||||
"php"
|
||||
],
|
||||
"family": "injection",
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"in_fix_range": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"model": null,
|
||||
"pins": {
|
||||
"fixed": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e",
|
||||
"vulnerable": "9bf03de643a2edee4642bfc6c94db1f05253da02"
|
||||
},
|
||||
"quick_languages": [
|
||||
"c",
|
||||
"cpp",
|
||||
"groovy",
|
||||
"java",
|
||||
"javascript",
|
||||
"python",
|
||||
"typescript"
|
||||
],
|
||||
"read": {
|
||||
"fixed": {
|
||||
"bytes": 4256572,
|
||||
"files": 366
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 4256094,
|
||||
"files": 366
|
||||
}
|
||||
},
|
||||
"seconds": 789.1,
|
||||
"source": "engine",
|
||||
"status": "done",
|
||||
"uncovered": [],
|
||||
"units_done": 2,
|
||||
"units_total": 2,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
}
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
{"function": "<global>", "in_fix_range": false, "line": 109, "path": "admin_configfiles.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "lockJob", "in_fix_range": false, "line": 232, "path": "lib/Froxlor/Cli/MasterCron.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "safe_exec", "in_fix_range": false, "line": 258, "path": "lib/Froxlor/FileDir.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "safe_exec", "in_fix_range": false, "line": 260, "path": "lib/Froxlor/FileDir.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "checkDatabase", "in_fix_range": false, "line": 364, "path": "lib/Froxlor/Install/Install.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "checkDatabase", "in_fix_range": false, "line": 367, "path": "lib/Froxlor/Install/Install.php", "pin": "9bf03de643a2edee4642bfc6c94db1f05253da02", "pin_role": "vulnerable", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "<global>", "in_fix_range": false, "line": 109, "path": "admin_configfiles.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "lockJob", "in_fix_range": false, "line": 232, "path": "lib/Froxlor/Cli/MasterCron.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "safe_exec", "in_fix_range": false, "line": 258, "path": "lib/Froxlor/FileDir.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "safe_exec", "in_fix_range": false, "line": 260, "path": "lib/Froxlor/FileDir.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "checkDatabase", "in_fix_range": false, "line": 364, "path": "lib/Froxlor/Install/Install.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
{"function": "checkDatabase", "in_fix_range": false, "line": 367, "path": "lib/Froxlor/Install/Install.php", "pin": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e", "pin_role": "fixed", "rule_id": "engine:injection", "rule_status": "enabled", "source": "engine"}
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"accepted": false,
|
||||
"adoption": null,
|
||||
"benchmark_edits": [],
|
||||
"manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
|
||||
"memory_edits": [],
|
||||
"outcome": {
|
||||
"accepted": false,
|
||||
"degradations": [],
|
||||
"edits": [],
|
||||
"fp_after": 0.0,
|
||||
"fp_before": 0.0,
|
||||
"matched_after": 2,
|
||||
"matched_before": 2,
|
||||
"per_profile_after": {},
|
||||
"per_profile_before": {},
|
||||
"profile_regressions": [],
|
||||
"profiles_under_minimum": [],
|
||||
"reason": "no_proposals",
|
||||
"recall_after": 1.0,
|
||||
"recall_before": 1.0,
|
||||
"round": 1,
|
||||
"score_after": 73,
|
||||
"score_before": 73
|
||||
},
|
||||
"proposals": 0,
|
||||
"reason": "no_proposals",
|
||||
"round": 1
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
{
|
||||
"inputs_bytes": {
|
||||
"froxlor_admin_ip_second_order_sqli": 15137,
|
||||
"wp_gopay_log_filter_sqli": 4027
|
||||
},
|
||||
"rows": {
|
||||
"run": 32,
|
||||
"snapshot": 191,
|
||||
"union": 211
|
||||
},
|
||||
"run": "validation-46",
|
||||
"run_metrics": {
|
||||
"agreed": 3,
|
||||
"alerts": {
|
||||
"engine:injection": {
|
||||
"fixed": 6,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 6
|
||||
}
|
||||
},
|
||||
"candidates": 4,
|
||||
"cases": 2,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"engine": 0,
|
||||
"none": 0,
|
||||
"quick": 4
|
||||
},
|
||||
"php": {
|
||||
"engine": 4,
|
||||
"none": 0,
|
||||
"quick": 0
|
||||
}
|
||||
},
|
||||
"declared_sites_agreed": 3,
|
||||
"declared_sites_matched": 4,
|
||||
"dispute_rate": {
|
||||
"injection": {
|
||||
"candidates": 4,
|
||||
"disputed": 1,
|
||||
"rate": 0.25
|
||||
}
|
||||
},
|
||||
"disputed": 1,
|
||||
"rejected": 0,
|
||||
"tiebreaks": 3,
|
||||
"usd": 0.10796,
|
||||
"usd_per_candidate": 0.02699
|
||||
},
|
||||
"store_metrics": {
|
||||
"agreed": 28,
|
||||
"alerts": {
|
||||
"c-shell-exec": {
|
||||
"fixed": 2,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 2
|
||||
},
|
||||
"c-unsafe-memory-copy": {
|
||||
"fixed": 2,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 2
|
||||
},
|
||||
"python-shell-true": {
|
||||
"fixed": 1,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 1
|
||||
},
|
||||
"python-unsafe-deserialization": {
|
||||
"fixed": 8,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 8
|
||||
},
|
||||
"python-unsafe-eval": {
|
||||
"fixed": 23,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 23
|
||||
}
|
||||
},
|
||||
"candidates": 43,
|
||||
"cases": 14,
|
||||
"coverage": {},
|
||||
"declared_sites_agreed": 16,
|
||||
"declared_sites_matched": 19,
|
||||
"dispute_rate": {
|
||||
"injection": {
|
||||
"candidates": 38,
|
||||
"disputed": 5,
|
||||
"rate": 0.1316
|
||||
},
|
||||
"untrusted_destination": {
|
||||
"candidates": 5,
|
||||
"disputed": 0,
|
||||
"rate": 0.0
|
||||
}
|
||||
},
|
||||
"disputed": 5,
|
||||
"rejected": 10,
|
||||
"tiebreaks": 10,
|
||||
"usd": 0.856679,
|
||||
"usd_per_candidate": 0.019923
|
||||
},
|
||||
"union_metrics": {
|
||||
"agreed": 28,
|
||||
"alerts": {
|
||||
"c-shell-exec": {
|
||||
"fixed": 2,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 2
|
||||
},
|
||||
"c-unsafe-memory-copy": {
|
||||
"fixed": 2,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 2
|
||||
},
|
||||
"engine:injection": {
|
||||
"fixed": 6,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"python-shell-true": {
|
||||
"fixed": 1,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 1
|
||||
},
|
||||
"python-unsafe-deserialization": {
|
||||
"fixed": 8,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 8
|
||||
},
|
||||
"python-unsafe-eval": {
|
||||
"fixed": 23,
|
||||
"fixed_in_fix_range": 0,
|
||||
"vulnerable": 23
|
||||
}
|
||||
},
|
||||
"candidates": 43,
|
||||
"cases": 14,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"engine": 0,
|
||||
"none": 0,
|
||||
"quick": 4
|
||||
},
|
||||
"php": {
|
||||
"engine": 4,
|
||||
"none": 0,
|
||||
"quick": 0
|
||||
}
|
||||
},
|
||||
"declared_sites_agreed": 16,
|
||||
"declared_sites_matched": 19,
|
||||
"dispute_rate": {
|
||||
"injection": {
|
||||
"candidates": 38,
|
||||
"disputed": 5,
|
||||
"rate": 0.1316
|
||||
},
|
||||
"untrusted_destination": {
|
||||
"candidates": 5,
|
||||
"disputed": 0,
|
||||
"rate": 0.0
|
||||
}
|
||||
},
|
||||
"disputed": 5,
|
||||
"rejected": 10,
|
||||
"tiebreaks": 10,
|
||||
"usd": 0.856679,
|
||||
"usd_per_candidate": 0.019923
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,391 @@
|
||||
{
|
||||
"engine_image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"host_resources_during_engine_runs": {
|
||||
"disk_free_mb_min": 2102,
|
||||
"engine_container_gib_peak": 2.129,
|
||||
"host_available_mb_min": 1952,
|
||||
"host_total_mb": 7877,
|
||||
"host_used_mb_peak": 5924,
|
||||
"samples": 61
|
||||
},
|
||||
"new_spend_usd": 0.0,
|
||||
"note": "Engine alerts for the two PHP loop cases of validation-46, produced on the host by `ousast plane alerts-engine` (openultrasast:dev, frozen export of f4bd984's src + finding_dump.py, --network none --memory 3g, one container at a time, deadline 1800 s per pin), then the loop's remember -> measure -> propose -> improve on the local ax with the rebuilt runner image. The quick-mode alerts these cases had before (0 per pin) were a zero on an uncovered language.",
|
||||
"runner_image": "localhost:5001/ousast-runner@sha256:ebb40a9a0985bb0665a74cbaf3db5ab0c31efda369a5f5366c51f7c12fad68c8",
|
||||
"tasks": {
|
||||
"froxlor-admin-ip-second-order-sqli-alerts": {
|
||||
"finished": "2026-09-30T11:32:02+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"reused": {
|
||||
"alerts": {
|
||||
"fixed": 6,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"seconds": 789.1,
|
||||
"source": "engine"
|
||||
},
|
||||
"started": "2026-09-30T09:50:49+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"alerts": {
|
||||
"fixed": 6,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"alerts_engine": {
|
||||
"fixed": 6,
|
||||
"vulnerable": 6
|
||||
},
|
||||
"calls": 0,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"coverage": "quick",
|
||||
"files": {
|
||||
"fixed": 18,
|
||||
"vulnerable": 18
|
||||
}
|
||||
},
|
||||
"php": {
|
||||
"coverage": "engine",
|
||||
"files": {
|
||||
"fixed": 348,
|
||||
"vulnerable": 348
|
||||
}
|
||||
}
|
||||
},
|
||||
"deadline": 1800.0,
|
||||
"engine": {
|
||||
"fixed": {
|
||||
"bytes": 4256572,
|
||||
"completed": 130,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 366,
|
||||
"findings": 6,
|
||||
"questions": 130,
|
||||
"seconds": 383.2
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 4256094,
|
||||
"completed": 130,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 366,
|
||||
"findings": 6,
|
||||
"questions": 130,
|
||||
"seconds": 398.2
|
||||
}
|
||||
},
|
||||
"engine_languages": [
|
||||
"php"
|
||||
],
|
||||
"family": "injection",
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"in_fix_range": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"model": null,
|
||||
"pins": {
|
||||
"fixed": "a1eaca5a1601c8a30e00814a4fc73ad0c185f89e",
|
||||
"vulnerable": "9bf03de643a2edee4642bfc6c94db1f05253da02"
|
||||
},
|
||||
"quick_languages": [
|
||||
"c",
|
||||
"cpp",
|
||||
"groovy",
|
||||
"java",
|
||||
"javascript",
|
||||
"python",
|
||||
"typescript"
|
||||
],
|
||||
"read": {
|
||||
"fixed": {
|
||||
"bytes": 4256572,
|
||||
"files": 366
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 4256094,
|
||||
"files": 366
|
||||
}
|
||||
},
|
||||
"seconds": 789.1,
|
||||
"source": "engine",
|
||||
"status": "done",
|
||||
"uncovered": [],
|
||||
"units_done": 2,
|
||||
"units_total": 2,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": null
|
||||
},
|
||||
"froxlor-admin-ip-second-order-sqli-remember": {
|
||||
"finished": "2026-09-30T11:38:01+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"started": "2026-09-30T11:37:32+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"calls": 0,
|
||||
"facts_row": "omitted: the facts task's summary names no image, and a reuse key must not guess it",
|
||||
"model": null,
|
||||
"rows": 25,
|
||||
"status": "done",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": 0
|
||||
},
|
||||
"loop-improve": {
|
||||
"finished": "2026-09-30T11:39:55+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"started": "2026-09-30T11:39:24+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"accepted": false,
|
||||
"calls": 0,
|
||||
"edits": 0,
|
||||
"memory_edits": 0,
|
||||
"model": null,
|
||||
"reason": "no_proposals",
|
||||
"status": "done",
|
||||
"step": "improve",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": 0
|
||||
},
|
||||
"loop-measure": {
|
||||
"finished": "2026-09-30T11:38:54+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"started": "2026-09-30T11:38:28+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"calls": 0,
|
||||
"model": null,
|
||||
"rows": {
|
||||
"run": 32,
|
||||
"snapshot": 191,
|
||||
"union": 211
|
||||
},
|
||||
"status": "done",
|
||||
"step": "measure",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": 0
|
||||
},
|
||||
"loop-propose": {
|
||||
"finished": "2026-09-30T11:39:24+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"started": "2026-09-30T11:38:54+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"calls": 0,
|
||||
"excluded": 0,
|
||||
"kept": 211,
|
||||
"model": null,
|
||||
"proposals": 0,
|
||||
"rows": 211,
|
||||
"status": "done",
|
||||
"step": "propose",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": 0
|
||||
},
|
||||
"memory-snapshot": {
|
||||
"finished": "2026-09-30T11:37:31+00:00",
|
||||
"model": null,
|
||||
"reused": {
|
||||
"index_digest": "5e9299a551eea21289224ee063b2eb8cdf3f845a69967baf8b8c02d5be9cfc74",
|
||||
"kept": 191,
|
||||
"rows": 191,
|
||||
"snapshot": "file:///tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr2/memory"
|
||||
},
|
||||
"started": null,
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"calls": 0,
|
||||
"model": null,
|
||||
"reused": {
|
||||
"excluded": {
|
||||
"gated_case": {},
|
||||
"holdout_pair": {},
|
||||
"population": {},
|
||||
"rows": 0
|
||||
},
|
||||
"guard": {
|
||||
"catalog": "benchmarks/pairs/catalog.toml",
|
||||
"manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
|
||||
"populations": []
|
||||
},
|
||||
"index_digest": "5e9299a551eea21289224ee063b2eb8cdf3f845a69967baf8b8c02d5be9cfc74",
|
||||
"index_entries": 19,
|
||||
"kept": 191,
|
||||
"rows": 191,
|
||||
"store": "file:///tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr2/memory"
|
||||
},
|
||||
"status": "done",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": null
|
||||
},
|
||||
"usd": null
|
||||
},
|
||||
"wp-gopay-log-filter-sqli-alerts": {
|
||||
"finished": "2026-09-30T11:36:07+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"reused": {
|
||||
"alerts": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"seconds": 245.2,
|
||||
"source": "engine"
|
||||
},
|
||||
"started": "2026-09-30T09:52:27+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"alerts": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"alerts_engine": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"calls": 0,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"coverage": "quick",
|
||||
"files": {
|
||||
"fixed": 4,
|
||||
"vulnerable": 4
|
||||
}
|
||||
},
|
||||
"php": {
|
||||
"coverage": "engine",
|
||||
"files": {
|
||||
"fixed": 15,
|
||||
"vulnerable": 15
|
||||
}
|
||||
}
|
||||
},
|
||||
"deadline": 1800.0,
|
||||
"engine": {
|
||||
"fixed": {
|
||||
"bytes": 150539,
|
||||
"completed": 101,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved",
|
||||
"vendor_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 19,
|
||||
"findings": 0,
|
||||
"questions": 101,
|
||||
"seconds": 122.0
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 150528,
|
||||
"completed": 101,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved",
|
||||
"vendor_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 19,
|
||||
"findings": 0,
|
||||
"questions": 101,
|
||||
"seconds": 120.2
|
||||
}
|
||||
},
|
||||
"engine_languages": [
|
||||
"php"
|
||||
],
|
||||
"family": "injection",
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"in_fix_range": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"model": null,
|
||||
"pins": {
|
||||
"fixed": "7190c985370f9758f226c2f2addd79532a2f93d5",
|
||||
"vulnerable": "626bc8b5f8d33de6eefd921e3a05ed52ac320bcd"
|
||||
},
|
||||
"quick_languages": [
|
||||
"c",
|
||||
"cpp",
|
||||
"groovy",
|
||||
"java",
|
||||
"javascript",
|
||||
"python",
|
||||
"typescript"
|
||||
],
|
||||
"read": {
|
||||
"fixed": {
|
||||
"bytes": 150539,
|
||||
"files": 19
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 150528,
|
||||
"files": 19
|
||||
}
|
||||
},
|
||||
"seconds": 245.2,
|
||||
"source": "engine",
|
||||
"status": "done",
|
||||
"uncovered": [],
|
||||
"units_done": 2,
|
||||
"units_total": 2,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": null
|
||||
},
|
||||
"wp-gopay-log-filter-sqli-remember": {
|
||||
"finished": "2026-09-30T11:38:28+00:00",
|
||||
"model": null,
|
||||
"reason": null,
|
||||
"started": "2026-09-30T11:38:01+00:00",
|
||||
"status": "done",
|
||||
"summary": {
|
||||
"calls": 0,
|
||||
"facts_row": "omitted: the facts task's summary names no image, and a reuse key must not guess it",
|
||||
"model": null,
|
||||
"rows": 7,
|
||||
"status": "done",
|
||||
"units_done": 1,
|
||||
"units_total": 1,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
},
|
||||
"usd": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,235 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set /tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/phpgap/set/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --loop --loop-commit 1ad472c68d759e4ef010bd7a2e23532b1de538a9 --loop-repo https://github.com/norandom/OpenUltraSAST.git --loop-manifest benchmarks/manifests/java-spring-boot-vulnerable.toml`; do not edit, regenerate.
|
||||
# 2 cases, 4 candidates (4 kept by the recorded triage); usd ceiling 0.27.
|
||||
apiVersion: openultrasast.io/v1alpha1
|
||||
kind: Run
|
||||
metadata:
|
||||
name: validation-46
|
||||
annotations:
|
||||
openultrasast.io/population: population-v2
|
||||
openultrasast.io/split: validation
|
||||
spec:
|
||||
tasks:
|
||||
- name: froxlor-admin-ip-second-order-sqli-facts
|
||||
task: repo-facts-froxlor-admin-ip-second-order-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id001
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: froxlor-admin-ip-second-order-sqli-va
|
||||
task: verify-a-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-vb
|
||||
task: verify-b-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-agree
|
||||
task: agree-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
|
||||
pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id001
|
||||
- name: wp-gopay-log-filter-sqli-facts
|
||||
task: repo-facts-wp-gopay-log-filter-sqli
|
||||
outputs:
|
||||
- facts.json
|
||||
budget: &id002
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: repo-facts
|
||||
- name: wp-gopay-log-filter-sqli-va
|
||||
task: verify-a-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-vb
|
||||
task: verify-b-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-agree
|
||||
task: agree-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
|
||||
pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id002
|
||||
- name: froxlor-admin-ip-second-order-sqli-vc
|
||||
task: verify-c-froxlor-admin-ip-second-order-sqli
|
||||
dependsOn:
|
||||
- froxlor-admin-ip-second-order-sqli-agree
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
only: froxlor-admin-ip-second-order-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-final
|
||||
task: agree-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
|
||||
pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
|
||||
pass_c: froxlor-admin-ip-second-order-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: wp-gopay-log-filter-sqli-vc
|
||||
task: verify-c-wp-gopay-log-filter-sqli
|
||||
dependsOn:
|
||||
- wp-gopay-log-filter-sqli-agree
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
only: wp-gopay-log-filter-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-final
|
||||
task: agree-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
|
||||
pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
|
||||
pass_c: wp-gopay-log-filter-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: froxlor-admin-ip-second-order-sqli-alerts
|
||||
task: alerts-froxlor-admin-ip-second-order-sqli
|
||||
outputs:
|
||||
- alerts.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: engine
|
||||
- name: froxlor-admin-ip-second-order-sqli-remember
|
||||
task: remember-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
facts_summary: froxlor-admin-ip-second-order-sqli-facts/summary.json
|
||||
pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
|
||||
summary_a: froxlor-admin-ip-second-order-sqli-va/summary.json
|
||||
pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
|
||||
summary_b: froxlor-admin-ip-second-order-sqli-vb/summary.json
|
||||
pass_c: froxlor-admin-ip-second-order-sqli-vc/units.jsonl
|
||||
summary_c: froxlor-admin-ip-second-order-sqli-vc/summary.json
|
||||
agreed: froxlor-admin-ip-second-order-sqli-final/agreed.json
|
||||
alerts: froxlor-admin-ip-second-order-sqli-alerts/alerts.jsonl
|
||||
alerts_summary: froxlor-admin-ip-second-order-sqli-alerts/summary.json
|
||||
outputs:
|
||||
- memory.jsonl
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: wp-gopay-log-filter-sqli-alerts
|
||||
task: alerts-wp-gopay-log-filter-sqli
|
||||
outputs:
|
||||
- alerts.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: engine
|
||||
- name: wp-gopay-log-filter-sqli-remember
|
||||
task: remember-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
facts_summary: wp-gopay-log-filter-sqli-facts/summary.json
|
||||
pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
|
||||
summary_a: wp-gopay-log-filter-sqli-va/summary.json
|
||||
pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
|
||||
summary_b: wp-gopay-log-filter-sqli-vb/summary.json
|
||||
pass_c: wp-gopay-log-filter-sqli-vc/units.jsonl
|
||||
summary_c: wp-gopay-log-filter-sqli-vc/summary.json
|
||||
agreed: wp-gopay-log-filter-sqli-final/agreed.json
|
||||
alerts: wp-gopay-log-filter-sqli-alerts/alerts.jsonl
|
||||
alerts_summary: wp-gopay-log-filter-sqli-alerts/summary.json
|
||||
outputs:
|
||||
- memory.jsonl
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: memory-snapshot
|
||||
task: memory-snapshot
|
||||
outputs:
|
||||
- rows.jsonl
|
||||
- index.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: loop-measure
|
||||
task: loop-measure
|
||||
inputs:
|
||||
remember_froxlor-admin-ip-second-order-sqli: froxlor-admin-ip-second-order-sqli-remember/memory.jsonl
|
||||
remember_wp-gopay-log-filter-sqli: wp-gopay-log-filter-sqli-remember/memory.jsonl
|
||||
snapshot: memory-snapshot/rows.jsonl
|
||||
outputs:
|
||||
- measure.json
|
||||
- rows.jsonl
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: loop-propose
|
||||
task: loop-propose
|
||||
inputs:
|
||||
measure: loop-measure/measure.json
|
||||
rows: loop-measure/rows.jsonl
|
||||
index: memory-snapshot/index.json
|
||||
outputs:
|
||||
- proposals.jsonl
|
||||
- memory_proposals.jsonl
|
||||
- signals.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: loop-improve
|
||||
task: loop-improve
|
||||
inputs:
|
||||
proposals: loop-propose/proposals.jsonl
|
||||
outputs:
|
||||
- gate.json
|
||||
- journal.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
serialize: engine
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"wp-gopay-log-filter-sqli": [
|
||||
[
|
||||
"admin/views/log.php",
|
||||
"<global>"
|
||||
]
|
||||
],
|
||||
"froxlor-admin-ip-second-order-sqli": [
|
||||
[
|
||||
"lib/Froxlor/Api/Commands/Domains.php",
|
||||
"validateIpAddresses"
|
||||
],
|
||||
[
|
||||
"lib/Froxlor/Api/Commands/IpsAndPorts.php",
|
||||
"listing"
|
||||
],
|
||||
[
|
||||
"lib/Froxlor/Api/Commands/IpsAndPorts.php",
|
||||
"listingCount"
|
||||
]
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"advisory": true,
|
||||
"disputed_families": [],
|
||||
"thresholds": {
|
||||
"min_candidates": 5,
|
||||
"min_dispute_rate": 0.3
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"excluded": {
|
||||
"gated_case": {},
|
||||
"holdout_pair": {},
|
||||
"population": {},
|
||||
"rows": 0
|
||||
},
|
||||
"guard": {
|
||||
"catalog": "benchmarks/pairs/catalog.toml",
|
||||
"manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
|
||||
"populations": []
|
||||
},
|
||||
"index_digest": "5e9299a551eea21289224ee063b2eb8cdf3f845a69967baf8b8c02d5be9cfc74",
|
||||
"index_entries": 19,
|
||||
"kept": 191,
|
||||
"rows": 191,
|
||||
"store": "file:///tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr2/memory"
|
||||
}
|
||||
+98
@@ -0,0 +1,98 @@
|
||||
{
|
||||
"alerts": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"alerts_engine": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"calls": 0,
|
||||
"coverage": {
|
||||
"javascript": {
|
||||
"coverage": "quick",
|
||||
"files": {
|
||||
"fixed": 4,
|
||||
"vulnerable": 4
|
||||
}
|
||||
},
|
||||
"php": {
|
||||
"coverage": "engine",
|
||||
"files": {
|
||||
"fixed": 15,
|
||||
"vulnerable": 15
|
||||
}
|
||||
}
|
||||
},
|
||||
"deadline": 1800.0,
|
||||
"engine": {
|
||||
"fixed": {
|
||||
"bytes": 150539,
|
||||
"completed": 101,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved",
|
||||
"vendor_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 19,
|
||||
"findings": 0,
|
||||
"questions": 101,
|
||||
"seconds": 122.0
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 150528,
|
||||
"completed": 101,
|
||||
"degradations": [
|
||||
"cross_partition_semantics_unresolved",
|
||||
"vendor_semantics_unresolved"
|
||||
],
|
||||
"exit": 0,
|
||||
"files": 19,
|
||||
"findings": 0,
|
||||
"questions": 101,
|
||||
"seconds": 120.2
|
||||
}
|
||||
},
|
||||
"engine_languages": [
|
||||
"php"
|
||||
],
|
||||
"family": "injection",
|
||||
"host": true,
|
||||
"image": "sha256:e6f8dc6cc7547f7118bd058687de676e0fcf741799d1d3839b3e8648ce190fbb",
|
||||
"in_fix_range": {
|
||||
"fixed": 0,
|
||||
"vulnerable": 0
|
||||
},
|
||||
"model": null,
|
||||
"pins": {
|
||||
"fixed": "7190c985370f9758f226c2f2addd79532a2f93d5",
|
||||
"vulnerable": "626bc8b5f8d33de6eefd921e3a05ed52ac320bcd"
|
||||
},
|
||||
"quick_languages": [
|
||||
"c",
|
||||
"cpp",
|
||||
"groovy",
|
||||
"java",
|
||||
"javascript",
|
||||
"python",
|
||||
"typescript"
|
||||
],
|
||||
"read": {
|
||||
"fixed": {
|
||||
"bytes": 150539,
|
||||
"files": 19
|
||||
},
|
||||
"vulnerable": {
|
||||
"bytes": 150528,
|
||||
"files": 19
|
||||
}
|
||||
},
|
||||
"seconds": 245.2,
|
||||
"source": "engine",
|
||||
"status": "done",
|
||||
"uncovered": [],
|
||||
"units_done": 2,
|
||||
"units_total": 2,
|
||||
"usage": {},
|
||||
"usd": 0
|
||||
}
|
||||
Reference in New Issue
Block a user