marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: the WordPress checkout scans, and does not find its CVE

Browse Source 
Reporting the result rather than the intention.

Paid Memberships Pro 2.9.7 with CVE-2023-23488 is pinned, verified in the
code, and scans cleanly: 637 files, 117k lines, 1577 regions, build 47s,
query 74s, 140s total, no degradations. **The CVE is not detected.**

Both ends are inside the budget -- the REST handler at position 290 as a
recognised entry point, the `$wpdb->get_var` sink at 472 -- and the taint
query runs for 23 seconds. So the gap is the middle: the flow crosses
`new MemberOrder( $code )` into a constructor and then
`$this->getMemberOrderByCode( $code )`, both dynamic in PHP. Whether
php2cpg resolves either into a callee edge is UNVERIFIED; two attempts to
query the call graph failed on script errors and were abandoned rather than
guessed at. Recorded as 5.7, with the answer required before anything is
concluded about the fact tables.

Three engine defects had to be fixed before the scan could produce even
this result, and each had previously reported the plugin clean for a
different reason:

  1577 regions, 0 scanned    joern-parse failed where php2cpg succeeded
  500 scanned, taint 0.05s   a 1.49MB batch over Linux's 128KB argv cap
  500 scanned, taint 21.7s   the entry point was not recognised as one

The middle one is the one to remember. Every honesty mechanism in this
codebase labels a verdict -- suspicion, regions_unjudged, regions_unasked,
stated family limits -- and there no verdict was produced to label, so a
vulnerable plugin was reported clean with every counter agreeing.

What is established: the WordPress engine path works end to end. What is
not: detection on a real plugin. One checkout that does not find its CVE is
not yet evidence either way about the facts, and 5.7 has to answer whether
the call graph can carry the flow at all.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-09 16:43:10 +02:00
co-authored by Claude Opus 5
parent 9020318a83
commit 8579c10e7c
2 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/contributor-scan/tasks.md
+17
View File
@@ -476,6 +476,23 @@
- _Requirements: 8.1, 9.1_
- _Depends: 5.1_
- [ ] 5.7 Does the PHP call graph carry a flow through an object?
- **The WordPress checkout scans and does not find its CVE.** Both ends are inside the budget --
`pmpro_rest_api_get_order` at position 290 as a recognised entry point, `getMemberOrderByCode` at 472 --
and the taint query runs for 23 seconds. So the question is the middle.
- The flow crosses `new MemberOrder( $code )` into a constructor and then
`$this->getMemberOrderByCode( $code )`. Both are dynamic in PHP, and whether php2cpg resolves either into
a CALLEE edge is unverified: two attempts to query the call graph failed on script errors and were
abandoned rather than guessed at.
- Answer that first. If the edges exist, the gap is elsewhere -- the source may be `$request->get_params()`
rather than a superglobal, which `parameter_sources` should cover but has not been checked on this shape.
If they do not, task 2.4's interprocedural region cannot bridge an object boundary and PHP needs
something else, which is a finding worth having either way.
- Observable: a recorded answer naming which edges exist, and either the CVE found or a stated reason it
cannot be.
- _Requirements: 4.4, 8.1, 9.1_
- _Depends: 5.1_
## Group 6 — Regression baselines
- [ ] 6.1 Repository baseline and delta