marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 12:09:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: oracle placeholders for demos; Python apps run under the venv interpreter

Browse Source 
Demos may reference ${served_root}, ${database_path}, ${marker_dir} or
${callback_url}; the verifier substitutes them per side, so apps that take a
directory or database argument can be wired to the oracle. Python apps start
under the verifier interpreter (the one pip built the products for): the image
carries a second system Python whose ABI tag broke compiled extensions.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-06 12:43:11 +02:00
co-authored by Claude Fable 5.1
parent 0d3e6df31c
commit 7a91cc1482
6 changed files with 270 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_search_demo.py
+36
View File
@@ -225,3 +225,39 @@ def test_data_files_never_follow_links_or_overwrite(tmp_path, where):
assert not list(outside.iterdir())
if where == "existing":
assert (root / "keys/key.pem").read_text() == "original"
@pytest.mark.parametrize("field", ["arguments", "environment", "files"])
@pytest.mark.parametrize(
"oracle,name",
[("path", "served_root"), ("sql", "database_path"), ("sql", "database_url"), ("command", "marker_dir"), ("ssrf", "callback_url")],
)
def test_oracle_placeholders_scoped_to_start(field, oracle, name):
value = document()
value["oracle"] = oracle
def put(text):
value["start"][field] = [text] if field == "arguments" else {"CONFIG" if field == "environment" else "config.txt": text}
put("${" + name + "}")
assert validate_demo(value) == value
value["oracle"] = "xss"
with pytest.raises(ValueError):
validate_demo(value)
value["oracle"] = oracle
for invalid in ("${nonsense}", "/fixture/public", "SERVED_ROOT", "DATABASE", "CALLBACK_URL", "${SERVED_ROOT}", "${bad-name}"):
put(invalid)
with pytest.raises(ValueError):
validate_demo(value)
@pytest.mark.parametrize("name", ["served_root", "database_path", "database_url", "marker_dir", "callback_url"])
def test_fixture_placeholders_cannot_be_step_inputs_or_captures(name):
value = document()
value["steps"][0]["arguments"] = ["${" + name + "}"]
with pytest.raises(ValueError):
validate_demo(value)
value["steps"][0]["arguments"] = []
value["steps"][0]["capture"] = {"name": name, "source": "output"}
with pytest.raises(ValueError):
validate_demo(value)