mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-11-13 17:58:18 +00:00
feat(detection-core): add unlike reference family conformance
This commit is contained in:
Marius Ciepluch
+130
@@ -0,0 +1,130 @@
|
||||
{
|
||||
"cases": [
|
||||
{
|
||||
"case_id": "obligation-positive",
|
||||
"completeness_reasons": [],
|
||||
"decision": "constraint_exposed",
|
||||
"ecosystem": "reference-obligation",
|
||||
"observations": [
|
||||
{
|
||||
"fields": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
],
|
||||
"role": "security_object",
|
||||
"status": "complete"
|
||||
}
|
||||
],
|
||||
"outcome": "violation",
|
||||
"path": "reference/obligation_positive.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["operation_reaches_boundary"],
|
||||
"kind": "operation_effect",
|
||||
"reasons": [],
|
||||
"role": "operation",
|
||||
"source": {"id": "request", "role": "input"},
|
||||
"status": "complete",
|
||||
"target": {"id": "publish", "role": "operation"}
|
||||
},
|
||||
{
|
||||
"conditions": ["constraint_required"],
|
||||
"kind": "constraint_effect",
|
||||
"reasons": [],
|
||||
"role": "constraint",
|
||||
"source": {"id": "publish", "role": "operation"},
|
||||
"status": "complete",
|
||||
"target": {"id": "unconstrained", "role": "constraint"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
]
|
||||
},
|
||||
{
|
||||
"case_id": "obligation-negative",
|
||||
"completeness_reasons": [],
|
||||
"decision": "constraint_enforced",
|
||||
"ecosystem": "reference-obligation",
|
||||
"observations": [
|
||||
{
|
||||
"fields": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
],
|
||||
"role": "security_object",
|
||||
"status": "complete"
|
||||
}
|
||||
],
|
||||
"outcome": "satisfied",
|
||||
"path": "reference/obligation_negative.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["operation_reaches_boundary"],
|
||||
"kind": "operation_effect",
|
||||
"reasons": [],
|
||||
"role": "operation",
|
||||
"source": {"id": "request", "role": "input"},
|
||||
"status": "complete",
|
||||
"target": {"id": "publish", "role": "operation"}
|
||||
},
|
||||
{
|
||||
"conditions": ["constraint_required", "constraint_enforced"],
|
||||
"kind": "constraint_effect",
|
||||
"reasons": [],
|
||||
"role": "constraint",
|
||||
"source": {"id": "publish", "role": "operation"},
|
||||
"status": "complete",
|
||||
"target": {"id": "guarded", "role": "constraint"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
]
|
||||
},
|
||||
{
|
||||
"case_id": "obligation-missing",
|
||||
"completeness_reasons": ["missing_constraint_relation"],
|
||||
"decision": "constraint_unknown",
|
||||
"ecosystem": "reference-obligation",
|
||||
"observations": [
|
||||
{
|
||||
"fields": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
],
|
||||
"role": "security_object",
|
||||
"status": "complete"
|
||||
}
|
||||
],
|
||||
"outcome": "indeterminate",
|
||||
"path": "reference/obligation_missing.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["operation_reaches_boundary"],
|
||||
"kind": "operation_effect",
|
||||
"reasons": [],
|
||||
"role": "operation",
|
||||
"source": {"id": "request", "role": "input"},
|
||||
"status": "complete",
|
||||
"target": {"id": "publish", "role": "operation"}
|
||||
},
|
||||
{
|
||||
"conditions": ["constraint_required"],
|
||||
"kind": "constraint_effect",
|
||||
"reasons": ["missing_constraint_relation"],
|
||||
"role": "constraint",
|
||||
"source": {"id": "publish", "role": "operation"},
|
||||
"status": "incomplete",
|
||||
"target": {"id": "unknown", "role": "constraint"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "operation", "value": "publish"},
|
||||
{"kind": "text", "name": "boundary", "value": "durable-store"}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"decisions": [
|
||||
{
|
||||
"allowed_statuses": ["complete"],
|
||||
"family_code": "constraint_exposed",
|
||||
"outcome": "violation",
|
||||
"required_roles": ["operation", "constraint", "security_object"]
|
||||
},
|
||||
{
|
||||
"allowed_statuses": ["complete"],
|
||||
"family_code": "constraint_enforced",
|
||||
"outcome": "satisfied",
|
||||
"required_roles": ["operation", "constraint", "security_object"]
|
||||
},
|
||||
{
|
||||
"allowed_statuses": ["incomplete", "unresolved"],
|
||||
"family_code": "constraint_unknown",
|
||||
"outcome": "indeterminate",
|
||||
"required_roles": ["constraint"]
|
||||
}
|
||||
],
|
||||
"ecosystems": ["reference-obligation"],
|
||||
"family_id": "operation-constraint",
|
||||
"family_version": "1.0.0",
|
||||
"indeterminate_reasons": ["missing_constraint_relation", "ambiguous_constraint_relation"],
|
||||
"residual_questions": [
|
||||
{
|
||||
"allowed_decisions": ["constraint_exposed", "constraint_enforced", "constraint_unknown"],
|
||||
"question_id": "is_operation_constrained",
|
||||
"required_roles": ["operation", "constraint"]
|
||||
}
|
||||
],
|
||||
"roles": [
|
||||
{
|
||||
"allowed_relation_kinds": ["operation_effect"],
|
||||
"fields": [],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "operation"
|
||||
},
|
||||
{
|
||||
"allowed_relation_kinds": ["constraint_effect"],
|
||||
"fields": [],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "constraint"
|
||||
},
|
||||
{
|
||||
"allowed_relation_kinds": [],
|
||||
"fields": [
|
||||
{"kind": "text", "name": "operation", "required": true},
|
||||
{"kind": "text", "name": "boundary", "required": true}
|
||||
],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "security_object"
|
||||
}
|
||||
],
|
||||
"schema_version": "openultrasast.detection-core.evidence-packet.v2",
|
||||
"security_object": {
|
||||
"fields": [
|
||||
{"kind": "text", "name": "operation", "required": true},
|
||||
{"kind": "text", "name": "boundary", "required": true}
|
||||
],
|
||||
"identity_fields": ["operation", "boundary"],
|
||||
"kind": "operation_constraint"
|
||||
}
|
||||
}
|
||||
+115
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"cases": [
|
||||
{
|
||||
"case_id": "flow-positive",
|
||||
"completeness_reasons": [],
|
||||
"decision": "flow_reaches_effect",
|
||||
"ecosystem": "reference-flow",
|
||||
"observations": [
|
||||
{"fields": [{"kind": "text", "name": "symbol", "value": "input"}], "role": "source", "status": "complete"},
|
||||
{"fields": [{"kind": "text", "name": "effect", "value": "emit"}], "role": "sink", "status": "complete"},
|
||||
{"fields": [{"kind": "boolean", "name": "applied", "value": false}], "role": "transform", "status": "complete"}
|
||||
],
|
||||
"outcome": "violation",
|
||||
"path": "reference/flow_positive.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["entry_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": [],
|
||||
"role": "flow",
|
||||
"source": {"id": "input", "role": "source"},
|
||||
"status": "complete",
|
||||
"target": {"id": "transform", "role": "value"}
|
||||
},
|
||||
{
|
||||
"conditions": ["effect_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": [],
|
||||
"role": "flow",
|
||||
"source": {"id": "transform", "role": "value"},
|
||||
"status": "complete",
|
||||
"target": {"id": "effect", "role": "sink"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "entry", "value": "input"},
|
||||
{"kind": "text", "name": "effect", "value": "emit"}
|
||||
]
|
||||
},
|
||||
{
|
||||
"case_id": "flow-negative",
|
||||
"completeness_reasons": [],
|
||||
"decision": "flow_transformed",
|
||||
"ecosystem": "reference-flow",
|
||||
"observations": [
|
||||
{"fields": [{"kind": "text", "name": "symbol", "value": "input"}], "role": "source", "status": "complete"},
|
||||
{"fields": [{"kind": "text", "name": "effect", "value": "emit"}], "role": "sink", "status": "complete"},
|
||||
{"fields": [{"kind": "boolean", "name": "applied", "value": true}], "role": "transform", "status": "complete"}
|
||||
],
|
||||
"outcome": "satisfied",
|
||||
"path": "reference/flow_negative.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["entry_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": [],
|
||||
"role": "flow",
|
||||
"source": {"id": "input", "role": "source"},
|
||||
"status": "complete",
|
||||
"target": {"id": "transform", "role": "value"}
|
||||
},
|
||||
{
|
||||
"conditions": ["transform_applied", "effect_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": [],
|
||||
"role": "flow",
|
||||
"source": {"id": "transform", "role": "value"},
|
||||
"status": "complete",
|
||||
"target": {"id": "effect", "role": "sink"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "entry", "value": "input"},
|
||||
{"kind": "text", "name": "effect", "value": "emit"}
|
||||
]
|
||||
},
|
||||
{
|
||||
"case_id": "flow-missing",
|
||||
"completeness_reasons": ["missing_flow_segment"],
|
||||
"decision": "flow_unknown",
|
||||
"ecosystem": "reference-flow",
|
||||
"observations": [
|
||||
{"fields": [{"kind": "text", "name": "symbol", "value": "input"}], "role": "source", "status": "complete"},
|
||||
{"fields": [{"kind": "text", "name": "effect", "value": "emit"}], "role": "sink", "status": "complete"},
|
||||
{"fields": [{"kind": "boolean", "name": "applied", "value": false}], "role": "transform", "status": "complete"}
|
||||
],
|
||||
"outcome": "indeterminate",
|
||||
"path": "reference/flow_missing.py",
|
||||
"relations": [
|
||||
{
|
||||
"conditions": ["entry_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": [],
|
||||
"role": "flow",
|
||||
"source": {"id": "input", "role": "source"},
|
||||
"status": "complete",
|
||||
"target": {"id": "transform", "role": "value"}
|
||||
},
|
||||
{
|
||||
"conditions": ["effect_observed"],
|
||||
"kind": "value_transformation",
|
||||
"reasons": ["missing_flow_segment"],
|
||||
"role": "flow",
|
||||
"source": {"id": "transform", "role": "value"},
|
||||
"status": "incomplete",
|
||||
"target": {"id": "effect", "role": "sink"}
|
||||
}
|
||||
],
|
||||
"security_object": [
|
||||
{"kind": "text", "name": "entry", "value": "input"},
|
||||
{"kind": "text", "name": "effect", "value": "emit"}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"decisions": [
|
||||
{
|
||||
"allowed_statuses": ["complete"],
|
||||
"family_code": "flow_reaches_effect",
|
||||
"outcome": "violation",
|
||||
"required_roles": ["source", "flow", "sink"]
|
||||
},
|
||||
{
|
||||
"allowed_statuses": ["complete"],
|
||||
"family_code": "flow_transformed",
|
||||
"outcome": "satisfied",
|
||||
"required_roles": ["source", "flow", "sink", "transform"]
|
||||
},
|
||||
{
|
||||
"allowed_statuses": ["complete", "incomplete", "unresolved"],
|
||||
"family_code": "flow_unknown",
|
||||
"outcome": "indeterminate",
|
||||
"required_roles": ["flow"]
|
||||
}
|
||||
],
|
||||
"ecosystems": ["reference-flow"],
|
||||
"family_id": "ordered-taint-flow",
|
||||
"family_version": "1.0.0",
|
||||
"indeterminate_reasons": ["missing_flow_segment", "ambiguous_flow_segment"],
|
||||
"residual_questions": [
|
||||
{
|
||||
"allowed_decisions": ["flow_reaches_effect", "flow_transformed", "flow_unknown"],
|
||||
"question_id": "does_value_reach_effect",
|
||||
"required_roles": ["source", "flow", "sink"]
|
||||
}
|
||||
],
|
||||
"roles": [
|
||||
{
|
||||
"allowed_relation_kinds": [],
|
||||
"fields": [{"kind": "text", "name": "symbol", "required": true}],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "source"
|
||||
},
|
||||
{
|
||||
"allowed_relation_kinds": ["value_transformation"],
|
||||
"fields": [],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "flow"
|
||||
},
|
||||
{
|
||||
"allowed_relation_kinds": [],
|
||||
"fields": [{"kind": "text", "name": "effect", "required": true}],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "sink"
|
||||
},
|
||||
{
|
||||
"allowed_relation_kinds": [],
|
||||
"fields": [{"kind": "boolean", "name": "applied", "required": true}],
|
||||
"origin_policy": "product_or_reviewed_fact",
|
||||
"role": "transform"
|
||||
}
|
||||
],
|
||||
"schema_version": "openultrasast.detection-core.evidence-packet.v2",
|
||||
"security_object": {
|
||||
"fields": [
|
||||
{"kind": "text", "name": "entry", "required": true},
|
||||
{"kind": "text", "name": "effect", "required": true}
|
||||
],
|
||||
"identity_fields": ["entry", "effect"],
|
||||
"kind": "ordered_flow"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user