marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 20:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(contributor-scan): retain first-party JavaScript tests in graphs

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-13 11:29:48 +02:00
parent d02406e758
commit 51fabef9ea
15 changed files with 1329 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ops/frontend-retention/README.md
+36
View File
@@ -0,0 +1,36 @@
# First-party JavaScript test retention
This source adaptation implements contributor-scan task 2.18 for the pinned Linux
x86-64 Joern 4.0.625 installation. ASTGen 3.50.1 excludes test directories and
filenames; jssrc2cpg additionally excludes test suffixes. Both filters must accept
the explicit inclusion policy for a retained source file to reach the graph.
`install.py` verifies pinned upstream source and tool archives and the original
jssrc2cpg jar, rebuilds ASTGen with its frozen dependency lockfile, and compiles
the adapted Scala source against Joern's shipped compiler and libraries. The
changes affect test filtering only. Original input paths, bytes and imports are
preserved. Vendor and user exclusions still apply.
Docker and `ops/joern.py` run the same installer. A manual installation requires
Python 3.12 or later, Java 21, network access for the pinned build inputs, and a
pristine matching Joern installation:
```bash
python3 ops/frontend-retention/install.py /opt/joern-cli
```
The installer writes `ousast-frontend-retention-v1/manifest.json` under the Joern
root, including builder, dependency and output hashes. A repeated invocation
verifies the installed outputs and needs no network. If the recipe or installed
outputs change, reinstall the pristine pinned engine before rebuilding; the
installer refuses to layer an unverified adaptation onto modified jars.
The adapted frontend keeps stock behavior unless `OUSAST_INCLUDE_TESTS=1`.
`JoernBackend` explicitly enables it by default; `include_tests=False` supplies
the regression control. Direct frontend users must set the variable themselves.
Engine provenance must include the installed adaptation and effective policy:
the upstream version string alone cannot distinguish these graphs.
After building the image, run `ops/smoke_partitions.py` as described in `ops/README.md`.
Its off control uses `OUSAST_SMOKE_INCLUDE_TESTS=0` and must fail the test-retention
assertion. First-party test retention does not imply security capability admission.