marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

merge(search-with-proof): path oracle covers prefix-check-bypass class [skip ci]

Browse Source 
Plant a sibling canary so prefix-bypass path traversals (startswith without separator)
are demonstrable; parent canary + differential unchanged; glance still demonstrates.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-07 11:24:31 +02:00
co-authored by Claude Opus 4.8
parent 4c356caa21 6c7d6bb1d9
commit 84509fbdc0
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/search/oracles.py
+4
View File
@@ -92,6 +92,10 @@ class PathOracle(OutputOracle):
(canary.root / "public").mkdir() (canary.root / "public").mkdir()
(canary.root / "canary").write_text(canary.nonce) (canary.root / "canary").write_text(canary.nonce)
(canary.root / "canary").chmod(0o600) (canary.root / "canary").chmod(0o600)
# Parent canary covers classic traversal; this sibling covers prefix checks
# using startswith without a separator.
(canary.root / "public_leak").write_text(canary.nonce)
(canary.root / "public_leak").chmod(0o600)
# A benign in-root control file, distinct from the out-of-root secret, so a # A benign in-root control file, distinct from the out-of-root secret, so a
# correctly serving app returns it on BOTH revisions without any traversal. # correctly serving app returns it on BOTH revisions without any traversal.
# Drawn from os.urandom, not secrets.token_hex, so it never perturbs callers # Drawn from os.urandom, not secrets.token_hex, so it never perturbs callers
src/openultrasast/search/worker.py
+4 -3
View File
@@ -102,9 +102,10 @@ ORACLE_GUIDE = (
"Explore reachability/disclosure using app code/own sandbox data; demos target below. " "Explore reachability/disclosure using app code/own sandbox data; demos target below. "
"Only differential verification across revisions proves it. " "Only differential verification across revisions proves it. "
"Path observes app output for private nonce file canary in ${served_root}'s parent. " "Path observes app output for private nonce file canary in ${served_root}'s parent. "
"MUST set the app's served/root to exactly the ${served_root} placeholder via its command-line argument " "Prefix-sibling nonce file public_leak beside public extends the served name: reachable with startswith WITHOUT "
"(e.g. --dir ${served_root}), environment variable or config in start.files. " "a trailing separator until the fix adds one. "
"It lives relative to ${served_root}; serving elsewhere makes it unreachable: the search cannot succeed. " "Target the code's vector: classic parent traversal or prefix-bypass. "
"MUST serve ${served_root} via CLI, environment or start.files. "
"SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). " "SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). "
"Command observes marker creation at marker location ${marker_dir}/marker. " "Command observes marker creation at marker location ${marker_dir}/marker. "
"SSRF observes the nonce URL at its loopback listener ${callback_url}. " "SSRF observes the nonce URL at its loopback listener ${callback_url}. "