marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(taint): a guard validates only the value it tests

Browse Source 
p14 showed PMPro's functions.php:906 discharged by `elseif (in_array('E', $levels))`.
That checks whether a constant is in `$levels`; it says nothing about `$levels`. The
guard counted a carried variable in any argument. Only argument 1, the tested value
(`in_array`'s needle, the URL given to `url_has_allowed_host_and_scheme`), is
validated now. The allowlist test gains the haystack shape as a reported control.
The test fails when any argument counts.

The other p14 removals were right: WP Statistics export_data x2
(`if (!in_array($table, $allow_tbl)) $table = false;`) and PMPro memberorder.php:1633.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-25 18:34:15 +02:00
co-authored by Claude Opus 5.5
parent 69d4a8626f
commit 63460f8af4
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/cpg/queries/taint.sc
+4 -1
View File
@@ -710,8 +710,11 @@
def guardsIn(root: io.shiftleft.codepropertygraph.generated.nodes.AstNode, names: Set[String]): List[io.shiftleft.codepropertygraph.generated.nodes.Call] =
if (guardNames.isEmpty) Nil
else
// Only the TESTED value is validated -- the first argument: `in_array`'s needle, the URL a redirect check is
// given. PMPro's `in_array( 'E', $levels )` asks whether a constant is in `$levels`; with any argument
// counted, it discharged a flow through `$levels` itself.
root.ast.isCall.l.filter(g => guardNames.contains(g.name)).filter { g =>
g.argument.l.exists(_.ast.exists {
g.argument.l.filter(_.argumentIndex == 1).exists(_.ast.exists {
case i: io.shiftleft.codepropertygraph.generated.nodes.Identifier => names(i.name) || names(i.code.trim)
case c: io.shiftleft.codepropertygraph.generated.nodes.Call if c.name == FIELD_ACCESS => names(c.code.trim)
case _ => false