marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-11-13 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(detection-core): package-rooted entry packs wired into JS recognition; fact digest covers packs (8.2 part 2)

Browse Source
This commit is contained in:
Marius Ciepluch
2026-10-30 19:25:30 +01:00
parent 1d5a509424
commit 51971cda7e
6 changed files with 163 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/measurements/2026-10-30-recognition-coverage/NOTES.md
+11
View File
@@ -24,3 +24,14 @@ jaxrs, symfony, livewire, laravel, remix, tornado. **0/12 pilot repos covered.**
First fact-pack target: **express** (5 repos; covers 2 of the 3 in-family access_control
pilot cases: dbhub, matrix). Script: /tmp/opencode/recognition_table_71.py; raw:
table.json.
## Probe 2026-10-30 (engine wiring): handler extraction is the deeper gap
The probe ran with built-in tokens only (pack wiring is package-rooted since this commit); route statements are found (matrix: 10, dbhub: several),
but every one has `defines_handler=False` and a misidentified handler name (`res`,
`None`) on `this.app.get('/health', this.getHealth.bind(this))`-style registrations.
The prover consumes only entries with `defines_handler` + named handler + line, so all
are ignored -- this is why the admission records showed zero frameworks for these repos.
Raw probe: `probe-handler-extraction.txt`. Next increment: `_js_registration` /
`_js_handler_name` must resolve `.bind(this)` and arrow handlers. The express pack is
necessary (patterns) but not sufficient (handler identity).
benchmarks/measurements/2026-10-30-recognition-coverage/probe-handler-extraction.txt
+14
View File
@@ -0,0 +1,14 @@
bytebase__dbhub: raw route entries=10
src/server.ts:208 name=None defines_handler=False fw=None
src/server.ts:216 name=next defines_handler=False fw=None
src/server.ts:247 name=arrow_handler defines_handler=False fw=None
src/server.ts:254 name=res defines_handler=False fw=None
src/server.ts:265 name=None defines_handler=False fw=None
src/server.ts:268 name=listSources defines_handler=False fw=None
matrix-org__matrix-appservice-bridge: raw route entries=10
src/bridge.ts:1543 name=None defines_handler=False fw=None
src/components/media-proxy.ts:49 name=_res defines_handler=False fw=None
src/components/media-proxy.ts:53 name=None defines_handler=False fw=None
src/components/media-proxy.ts:54 name=res defines_handler=False fw=None
src/components/media-proxy.ts:57 name=None defines_handler=False fw=None
src/components/media-proxy.ts:62 name=None defines_handler=False fw=None