marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 20:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pre-push-safety-net): exclude vendor inputs and partition frontend coverage

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-13 11:53:29 +02:00
parent 51fabef9ea
commit 6ba2b06353
29 changed files with 1996 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/cpg/backend.py
+14 -1
View File
@@ -697,9 +697,12 @@ class JoernBackend:
methods = 0
files = 0
answered = 0
file_names: set[str] = set()
named_census = True
for shard in shards:
one = self.query_batch(shard, query, requests)
if one is None:
named_census = False
if self.execution_budget is not None:
self._note("shard_query_incomplete")
return None
@@ -709,11 +712,21 @@ class JoernBackend:
if census and isinstance(census[0], Mapping):
methods += int(str(census[0].get("methods", "0")) or 0)
files += int(str(census[0].get("files", "0")) or 0)
names = census[0].get("file_names")
if isinstance(names, list) and all(isinstance(name, str) for name in names):
file_names.update(names)
else:
named_census = False
else:
named_census = False
for rid, rows in one.items():
merged.setdefault(rid, []).extend(rows)
if not answered:
return None
merged["__census__"] = [{"methods": str(methods), "files": str(files), "shards": str(len(shards))}]
total: dict[str, object] = {"methods": str(methods), "files": str(files), "shards": str(len(shards))}
if named_census:
total["file_names"] = sorted(file_names)
merged["__census__"] = [total]
return merged
def _apply_overlays(self, cpg_path: Path, scratch: Path) -> bool:
src/openultrasast/cpg/queries/config.sc
+1 -1
View File
@@ -78,7 +78,7 @@
// per-file warnings -- so "no rows" and "no graph" are indistinguishable to the driver without this.
// It rides the batch rather than costing its own invocation, because JVM startup is what this whole
// batching design exists to avoid.
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString))
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString, "file_names" -> ujson.Arr.from(cpg.file.name.l)))
println(ujson.write(ujson.Obj.from(answers.toSeq :+ ("__census__" -> census))))
} else {
println(ujson.write(ujson.Arr(rowsFor(settings, function, file): _*)))
src/openultrasast/cpg/queries/dominance.sc
+1 -1
View File
@@ -190,7 +190,7 @@
// per-file warnings -- so "no rows" and "no graph" are indistinguishable to the driver without this.
// It rides the batch rather than costing its own invocation, because JVM startup is what this whole
// batching design exists to avoid.
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString))
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString, "file_names" -> ujson.Arr.from(cpg.file.name.l)))
println(ujson.write(ujson.Obj.from(answers.toSeq :+ ("__census__" -> census))))
} else {
println(ujson.write(ujson.Arr(rowsFor(operations, dischargers, function, file, operationRequires, dischargersByKind): _*)))
src/openultrasast/cpg/queries/taint.sc
+1 -1
View File
@@ -852,7 +852,7 @@
// per-file warnings -- so "no rows" and "no graph" are indistinguishable to the driver without this.
// It rides the batch rather than costing its own invocation, because JVM startup is what this whole
// batching design exists to avoid.
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString))
val census = ujson.Arr(ujson.Obj("methods" -> cpg.method.size.toString, "files" -> cpg.file.size.toString, "file_names" -> ujson.Arr.from(cpg.file.name.l)))
println(ujson.write(ujson.Obj.from(answers.toSeq :+ ("__census__" -> census))))
} else {
println(