marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 19:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(learn): v1 also withholds function length (a leak by construction)

Browse Source 
The leak audit found facts.function_lines separating fixed from vulnerable pair
sides (a fix guard lengthens the function: 0.80 untrusted_destination, 0.75
config_secrets). Input profiles may now name single features; v1 withholds the
engine and the function length from prompts, retrieval and the proposer summary.
A withheld feature keeps its instrument block in the distance (state still counts).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-01 19:51:49 +02:00
co-authored by Claude Opus 5.5
parent 9e3c83cfdc
commit 68294e9db3
5 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/learn/program.py
+1 -1
View File
@@ -118,7 +118,7 @@ def render_signals(x: Mapping[str, Any], instruments: Mapping[str, Mapping[str,
lines.append(f"{name}: {STATE_WORDS[state]}")
continue
for spec in features_for(profile):
if spec.instrument == name:
if spec.instrument == name and spec.name not in hidden:
value = x[spec.name]
lines.append(f"{spec.name}: {'null' if value is None else json.dumps(value)}")
return "\n".join(lines)