marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 12:39:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(specs): the whole-repository scan completes -- 72 minutes, CVE-2023-23488 found, 250 findings

Browse Source 
pmpro, 637 files, the product's own build path after 60963f5: build 97 s with overlays, evidence 76 s,
taint 4,105 s for 348 real requests (11.8 s each), arbitrate 99 s, peak child RSS 2.4 GB. The CVE is at
class.memberorder.php:936 among 250 entailed findings across 40 files -- the number the flow-aware-ranking
spec now has to concentrate. callDepth measured on the same graph: a 1.4x time term and a 100x payload
term (3,838 rows for ten requests at depth 3 against 38 at depth 1).

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-11 09:10:14 +02:00
co-authored by Claude Fable 5.1
parent 60963f565c
commit 5be63bdfea
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/contributor-scan/tasks.md
+23
View File
@@ -896,6 +896,29 @@
the build as a data table and reported in `unparsed`; (3) the hook half's seeds are the callback's own
file. The payload diff between a raw and a saved-overlay pmpro graph was checked request by request:
identical (sink, line, source kind, sanitized) sets, fewer repeated flow paths on the saved one.
- **`callDepth`, finally measured.** Same ten pairs, both halves on, the saved-overlay pmpro graph; the
fixed cost is now ~18 s (JVM plus an 8 s reload) and is included:
| callDepth | 10 requests | per request, JVM incl. | rows |
|---|---|---|---|
| 0 | 107.5 s | 10.8 s | 3 |
| 1 | 124.9 s | 12.5 s | 38 |
| 3 | 150.5 s | 15.0 s | **3,838** |
Depth is a 1.4× time term, not the 5× the sharding-era numbers implied -- but it is a **100× payload
term**: at depth 3 the same ten pairs return 3,838 flow rows, most of them the same (sink, source kind,
sanitized) evidence repeated once per path through the reachable set. Across 339 real requests that is
on the order of 130,000 rows to ship and parse, and the reporter collapses them only after they have
been paid for. The next cost to take out is in the query's row emission, not its graph work: one row
per (sink, source kind, sanitized), with a path count, would be the same evidence at 1% of the bytes.
- **The whole-repository scan completes, 2026-09-11.** pmpro, 637 files, the product's own build path
(overlays at build, seeds scoped, size guard), no judge, `OPENULTRASAST_CPG_QUERY_TIMEOUT=7200`:
build 97 s, evidence 76 s, **taint 4,105 s for 348 real requests = 11.8 s each**, arbitrate 99 s,
**total 72 minutes**, peak child RSS 2.4 GB, `tier_counts = {0: 2152, 1: 60, 2: 20, 3: 218, 4: 50}`.
**CVE-2023-23488 found at `class.memberorder.php:936:getMemberOrderByCode`**, among 250 entailed
findings across 40 files. First completion of this scan on this repository. The 2,400 s default is
still too low for it and stays -- a per-push scan of 4,463 regions is the flow-aware-ranking spec's
problem, and 250 findings is the number that spec now has to concentrate.
- **Open, and the maintainer's call, not mine:** `includes/vendor/` is 207 of WP Statistics's 357 PHP
files and is not excluded by `preprocess.IGNORED_DIRS`, so vendored third-party code is both scanned
and in the graph. Whether a project's vendored code is in scope is policy; the size guard above is