marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(learn): v1 also withholds function length (a leak by construction)

Browse Source 
The leak audit found facts.function_lines separating fixed from vulnerable pair
sides (a fix guard lengthens the function: 0.80 untrusted_destination, 0.75
config_secrets). Input profiles may now name single features; v1 withholds the
engine and the function length from prompts, retrieval and the proposer summary.
A withheld feature keeps its instrument block in the distance (state still counts).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-01 19:51:49 +02:00
co-authored by Claude Opus 5.5
parent 9e3c83cfdc
commit 68294e9db3
5 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/learn/retrieve.py
+4 -2
View File
@@ -97,13 +97,15 @@ def gower(
"""The per-instrument Gower distance of two records of ``profile`` (module docstring), in [0, 1]. The blocks of
instruments the input profile withholds (v1: the engine) are not compared, so neighbours cannot carry them."""
hidden = withheld(inputs)
total, blocks = 0.0, [(name, specs) for name, specs in _blocks(profile, priors) if name not in hidden]
# a withheld feature leaves its instrument's block in place: the state still counts, as it is still rendered
total = 0.0
blocks = [(name, [s for s in specs if s.name not in hidden]) for name, specs in _blocks(profile, priors) if name not in hidden]
for name, specs in blocks:
sa, sb = a_instruments.get(name, {}).get("state", "none"), b_instruments.get(name, {}).get("state", "none")
if sa != sb:
total += 1.0
elif sa == "ran":
total += sum(_feature_distance(s, a_x.get(s.name), b_x.get(s.name)) for s in specs) / len(specs)
total += sum(_feature_distance(s, a_x.get(s.name), b_x.get(s.name)) for s in specs) / len(specs) if specs else 0.0
return total / len(blocks) if blocks else 0.0