mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
feat(plane): tie-break pass on disputed candidates; 2-of-3 agreement
The design revisit after plane-increment-1.json (14/20 agreed, 19/20 in either
pass): a third verify pass on the candidates passes a and b dispute, and agree
decides 2-of-3 where pass c asked (the a/b rule elsewhere; c alone never decides).
- verify: optional OUSAST_INPUT_ONLY restricts the hunt to the named candidates
(agree's disputed.json); an empty list is done with 0 units and no model client.
- agree: optional OUSAST_INPUT_PASS_C; metrics keep every key and add tiebreak
{asked, flipped_to_agreed, flipped_to_rejected, rule}; usd_total, hunts and
declared-site metrics are on the final decision.
- generate: per case <case>-vc and <case>-final appended to validation-46; the
first 60 entries stay byte-identical, so a rerun keeps their done state.
- Offline replay over the recorded outputs with an empty pass c reproduces the
recorded agree summaries exactly (14/20 agreed, 23 agreed, 10 disputed).
- Spec: Requirement 6.4, design Measurement, task 8.1.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
c5e6ed3221
commit
6e6bcfc40c
@@ -1,5 +1,5 @@
|
||||
# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
|
||||
# 15 cases, 46 candidates (43 kept by the recorded triage); usd ceiling 2.02.
|
||||
# 15 cases, 46 candidates (43 kept by the recorded triage); usd ceiling 3.03.
|
||||
apiVersion: openultrasast.io/v1alpha1
|
||||
kind: Run
|
||||
metadata:
|
||||
@@ -561,3 +561,378 @@ spec:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget: *id015
|
||||
- name: budibase-mongo-template-nosqli-vc
|
||||
task: verify-c-budibase-mongo-template-nosqli
|
||||
dependsOn:
|
||||
- budibase-mongo-template-nosqli-agree
|
||||
inputs:
|
||||
facts: budibase-mongo-template-nosqli-facts/facts.json
|
||||
only: budibase-mongo-template-nosqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.06
|
||||
calls: 16
|
||||
- name: budibase-mongo-template-nosqli-final
|
||||
task: agree-budibase-mongo-template-nosqli
|
||||
inputs:
|
||||
pass_a: budibase-mongo-template-nosqli-va/units.jsonl
|
||||
pass_b: budibase-mongo-template-nosqli-vb/units.jsonl
|
||||
pass_c: budibase-mongo-template-nosqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: cct-studio-server-cmdi-vc
|
||||
task: verify-c-cct-studio-server-cmdi
|
||||
dependsOn:
|
||||
- cct-studio-server-cmdi-agree
|
||||
inputs:
|
||||
facts: cct-studio-server-cmdi-facts/facts.json
|
||||
only: cct-studio-server-cmdi-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: cct-studio-server-cmdi-final
|
||||
task: agree-cct-studio-server-cmdi
|
||||
inputs:
|
||||
pass_a: cct-studio-server-cmdi-va/units.jsonl
|
||||
pass_b: cct-studio-server-cmdi-vb/units.jsonl
|
||||
pass_c: cct-studio-server-cmdi-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: contextforge-prompt-ssti-vc
|
||||
task: verify-c-contextforge-prompt-ssti
|
||||
dependsOn:
|
||||
- contextforge-prompt-ssti-agree
|
||||
inputs:
|
||||
facts: contextforge-prompt-ssti-facts/facts.json
|
||||
only: contextforge-prompt-ssti-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.04
|
||||
calls: 8
|
||||
- name: contextforge-prompt-ssti-final
|
||||
task: agree-contextforge-prompt-ssti
|
||||
inputs:
|
||||
pass_a: contextforge-prompt-ssti-va/units.jsonl
|
||||
pass_b: contextforge-prompt-ssti-vb/units.jsonl
|
||||
pass_c: contextforge-prompt-ssti-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: froxlor-admin-ip-second-order-sqli-vc
|
||||
task: verify-c-froxlor-admin-ip-second-order-sqli
|
||||
dependsOn:
|
||||
- froxlor-admin-ip-second-order-sqli-agree
|
||||
inputs:
|
||||
facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
|
||||
only: froxlor-admin-ip-second-order-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.07
|
||||
calls: 16
|
||||
- name: froxlor-admin-ip-second-order-sqli-final
|
||||
task: agree-froxlor-admin-ip-second-order-sqli
|
||||
inputs:
|
||||
pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
|
||||
pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
|
||||
pass_c: froxlor-admin-ip-second-order-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: fuxa-tdengine-escape-sqli-vc
|
||||
task: verify-c-fuxa-tdengine-escape-sqli
|
||||
dependsOn:
|
||||
- fuxa-tdengine-escape-sqli-agree
|
||||
inputs:
|
||||
facts: fuxa-tdengine-escape-sqli-facts/facts.json
|
||||
only: fuxa-tdengine-escape-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.12
|
||||
calls: 8
|
||||
- name: fuxa-tdengine-escape-sqli-final
|
||||
task: agree-fuxa-tdengine-escape-sqli
|
||||
inputs:
|
||||
pass_a: fuxa-tdengine-escape-sqli-va/units.jsonl
|
||||
pass_b: fuxa-tdengine-escape-sqli-vb/units.jsonl
|
||||
pass_c: fuxa-tdengine-escape-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: lmdeploy-media-url-ssrf-vc
|
||||
task: verify-c-lmdeploy-media-url-ssrf
|
||||
dependsOn:
|
||||
- lmdeploy-media-url-ssrf-agree
|
||||
inputs:
|
||||
facts: lmdeploy-media-url-ssrf-facts/facts.json
|
||||
only: lmdeploy-media-url-ssrf-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: lmdeploy-media-url-ssrf-final
|
||||
task: agree-lmdeploy-media-url-ssrf
|
||||
inputs:
|
||||
pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
|
||||
pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
|
||||
pass_c: lmdeploy-media-url-ssrf-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: medplum-external-auth-open-redirect-vc
|
||||
task: verify-c-medplum-external-auth-open-redirect
|
||||
dependsOn:
|
||||
- medplum-external-auth-open-redirect-agree
|
||||
inputs:
|
||||
facts: medplum-external-auth-open-redirect-facts/facts.json
|
||||
only: medplum-external-auth-open-redirect-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: medplum-external-auth-open-redirect-final
|
||||
task: agree-medplum-external-auth-open-redirect
|
||||
inputs:
|
||||
pass_a: medplum-external-auth-open-redirect-va/units.jsonl
|
||||
pass_b: medplum-external-auth-open-redirect-vb/units.jsonl
|
||||
pass_c: medplum-external-auth-open-redirect-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: pgadmin-maintenance-sqli-vc
|
||||
task: verify-c-pgadmin-maintenance-sqli
|
||||
dependsOn:
|
||||
- pgadmin-maintenance-sqli-agree
|
||||
inputs:
|
||||
facts: pgadmin-maintenance-sqli-facts/facts.json
|
||||
only: pgadmin-maintenance-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.45
|
||||
calls: 96
|
||||
- name: pgadmin-maintenance-sqli-final
|
||||
task: agree-pgadmin-maintenance-sqli
|
||||
inputs:
|
||||
pass_a: pgadmin-maintenance-sqli-va/units.jsonl
|
||||
pass_b: pgadmin-maintenance-sqli-vb/units.jsonl
|
||||
pass_c: pgadmin-maintenance-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: qwed-sympy-eval-vc
|
||||
task: verify-c-qwed-sympy-eval
|
||||
dependsOn:
|
||||
- qwed-sympy-eval-agree
|
||||
inputs:
|
||||
facts: qwed-sympy-eval-facts/facts.json
|
||||
only: qwed-sympy-eval-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: qwed-sympy-eval-final
|
||||
task: agree-qwed-sympy-eval
|
||||
inputs:
|
||||
pass_a: qwed-sympy-eval-va/units.jsonl
|
||||
pass_b: qwed-sympy-eval-vb/units.jsonl
|
||||
pass_c: qwed-sympy-eval-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: reactpress-findall-column-sqli-vc
|
||||
task: verify-c-reactpress-findall-column-sqli
|
||||
dependsOn:
|
||||
- reactpress-findall-column-sqli-agree
|
||||
inputs:
|
||||
facts: reactpress-findall-column-sqli-facts/facts.json
|
||||
only: reactpress-findall-column-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: reactpress-findall-column-sqli-final
|
||||
task: agree-reactpress-findall-column-sqli
|
||||
inputs:
|
||||
pass_a: reactpress-findall-column-sqli-va/units.jsonl
|
||||
pass_b: reactpress-findall-column-sqli-vb/units.jsonl
|
||||
pass_c: reactpress-findall-column-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: unleash-addon-webhook-ssrf-vc
|
||||
task: verify-c-unleash-addon-webhook-ssrf
|
||||
dependsOn:
|
||||
- unleash-addon-webhook-ssrf-agree
|
||||
inputs:
|
||||
facts: unleash-addon-webhook-ssrf-facts/facts.json
|
||||
only: unleash-addon-webhook-ssrf-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: unleash-addon-webhook-ssrf-final
|
||||
task: agree-unleash-addon-webhook-ssrf
|
||||
inputs:
|
||||
pass_a: unleash-addon-webhook-ssrf-va/units.jsonl
|
||||
pass_b: unleash-addon-webhook-ssrf-vb/units.jsonl
|
||||
pass_c: unleash-addon-webhook-ssrf-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: winml-cli-serve-cors-vc
|
||||
task: verify-c-winml-cli-serve-cors
|
||||
dependsOn:
|
||||
- winml-cli-serve-cors-agree
|
||||
inputs:
|
||||
facts: winml-cli-serve-cors-facts/facts.json
|
||||
only: winml-cli-serve-cors-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: winml-cli-serve-cors-final
|
||||
task: agree-winml-cli-serve-cors
|
||||
inputs:
|
||||
pass_a: winml-cli-serve-cors-va/units.jsonl
|
||||
pass_b: winml-cli-serve-cors-vb/units.jsonl
|
||||
pass_c: winml-cli-serve-cors-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: wp-directorist-avatar-ssrf-vc
|
||||
task: verify-c-wp-directorist-avatar-ssrf
|
||||
dependsOn:
|
||||
- wp-directorist-avatar-ssrf-agree
|
||||
inputs:
|
||||
facts: wp-directorist-avatar-ssrf-facts/facts.json
|
||||
only: wp-directorist-avatar-ssrf-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.03
|
||||
calls: 8
|
||||
- name: wp-directorist-avatar-ssrf-final
|
||||
task: agree-wp-directorist-avatar-ssrf
|
||||
inputs:
|
||||
pass_a: wp-directorist-avatar-ssrf-va/units.jsonl
|
||||
pass_b: wp-directorist-avatar-ssrf-vb/units.jsonl
|
||||
pass_c: wp-directorist-avatar-ssrf-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: wp-gopay-log-filter-sqli-vc
|
||||
task: verify-c-wp-gopay-log-filter-sqli
|
||||
dependsOn:
|
||||
- wp-gopay-log-filter-sqli-agree
|
||||
inputs:
|
||||
facts: wp-gopay-log-filter-sqli-facts/facts.json
|
||||
only: wp-gopay-log-filter-sqli-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.02
|
||||
calls: 8
|
||||
- name: wp-gopay-log-filter-sqli-final
|
||||
task: agree-wp-gopay-log-filter-sqli
|
||||
inputs:
|
||||
pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
|
||||
pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
|
||||
pass_c: wp-gopay-log-filter-sqli-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
- name: wp-groundhogg-confirm-redirect-vc
|
||||
task: verify-c-wp-groundhogg-confirm-redirect
|
||||
dependsOn:
|
||||
- wp-groundhogg-confirm-redirect-agree
|
||||
inputs:
|
||||
facts: wp-groundhogg-confirm-redirect-facts/facts.json
|
||||
only: wp-groundhogg-confirm-redirect-agree/disputed.json
|
||||
outputs:
|
||||
- units.jsonl
|
||||
- summary.json
|
||||
budget:
|
||||
usd: 0.05
|
||||
calls: 8
|
||||
- name: wp-groundhogg-confirm-redirect-final
|
||||
task: agree-wp-groundhogg-confirm-redirect
|
||||
inputs:
|
||||
pass_a: wp-groundhogg-confirm-redirect-va/units.jsonl
|
||||
pass_b: wp-groundhogg-confirm-redirect-vb/units.jsonl
|
||||
pass_c: wp-groundhogg-confirm-redirect-vc/units.jsonl
|
||||
outputs:
|
||||
- agreed.json
|
||||
- disputed.json
|
||||
budget:
|
||||
usd: 0
|
||||
calls: 0
|
||||
|
||||
@@ -1738,3 +1738,468 @@ spec:
|
||||
workspaces:
|
||||
- name: wp-groundhogg-confirm-redirect-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-budibase-mongo-template-nosqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: budibase-mongo-template-nosqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: budibase-mongo-template-nosqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-cct-studio-server-cmdi
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: cct-studio-server-cmdi-vulnerable
|
||||
path: /workspace/case
|
||||
- name: cct-studio-server-cmdi-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-contextforge-prompt-ssti
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: contextforge-prompt-ssti-vulnerable
|
||||
path: /workspace/case
|
||||
- name: contextforge-prompt-ssti-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-froxlor-admin-ip-second-order-sqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: froxlor-admin-ip-second-order-sqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: froxlor-admin-ip-second-order-sqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-fuxa-tdengine-escape-sqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: fuxa-tdengine-escape-sqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: fuxa-tdengine-escape-sqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-lmdeploy-media-url-ssrf
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: lmdeploy-media-url-ssrf-vulnerable
|
||||
path: /workspace/case
|
||||
- name: lmdeploy-media-url-ssrf-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-medplum-external-auth-open-redirect
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: medplum-external-auth-open-redirect-vulnerable
|
||||
path: /workspace/case
|
||||
- name: medplum-external-auth-open-redirect-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-pgadmin-maintenance-sqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: pgadmin-maintenance-sqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: pgadmin-maintenance-sqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-qwed-sympy-eval
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: qwed-sympy-eval-vulnerable
|
||||
path: /workspace/case
|
||||
- name: qwed-sympy-eval-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-reactpress-findall-column-sqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: reactpress-findall-column-sqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: reactpress-findall-column-sqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-unleash-addon-webhook-ssrf
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: unleash-addon-webhook-ssrf-vulnerable
|
||||
path: /workspace/case
|
||||
- name: unleash-addon-webhook-ssrf-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-winml-cli-serve-cors
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: winml-cli-serve-cors-vulnerable
|
||||
path: /workspace/case
|
||||
- name: winml-cli-serve-cors-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-wp-directorist-avatar-ssrf
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: wp-directorist-avatar-ssrf-vulnerable
|
||||
path: /workspace/case
|
||||
- name: wp-directorist-avatar-ssrf-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-wp-gopay-log-filter-sqli
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: wp-gopay-log-filter-sqli-vulnerable
|
||||
path: /workspace/case
|
||||
- name: wp-gopay-log-filter-sqli-inputs
|
||||
path: /workspace/inputs
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: verify-c-wp-groundhogg-confirm-redirect
|
||||
atespace: default
|
||||
annotations:
|
||||
openultrasast.io/model: deepseek-flash
|
||||
spec:
|
||||
image: localhost:5001/ousast-runner@sha256:200e335877b52d68ea0bc53b4c9ba49ef2ee19e8a5ec2c874148b969123ef7ab
|
||||
command:
|
||||
- verify
|
||||
env:
|
||||
- name: OUSAST_WORKSPACE_DIR
|
||||
value: /workspace/case/repo
|
||||
- name: OUSAST_INPUT_CANDIDATES
|
||||
value: /workspace/inputs/candidates.json
|
||||
- name: OUSAST_PASS
|
||||
value: c
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
workspaces:
|
||||
- name: wp-groundhogg-confirm-redirect-vulnerable
|
||||
path: /workspace/case
|
||||
- name: wp-groundhogg-confirm-redirect-inputs
|
||||
path: /workspace/inputs
|
||||
|
||||
Reference in New Issue
Block a user