marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

measure(contributor-scan): confirm 7.7 costs the small population nothing

Browse Source 
PMPro at 25 regions, which completed before this work and still does: 27 questions completed and 19
findings before and after, injection 1 and output encoding 18 in both. The batching changes what a
large population can afford and nothing about what a small one answers.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-22 13:56:00 +02:00
co-authored by Claude Opus 5
parent 7ad3decf9a
commit 8874145874
1 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/measurements/2026-09-22-sink-weighted-batching.json
+19 -1
View File
@@ -70,5 +70,23 @@
"Raw finding counts are dominated by output encoding, which is the family already measured to be imprecise on PHP because the WordPress escapers are absent from a sanitizer list that cannot separate weakness classes. More findings there is not better detection.", "Raw finding counts are dominated by output encoding, which is the family already measured to be imprecise on PHP because the WordPress escapers are absent from a sanitizer list that cannot separate weakness classes. More findings there is not better detection.",
"One subject. The saving depends on how common each family's sinks are in a codebase, which is a property of the code and the ontology together.", "One subject. The saving depends on how common each family's sinks are in a codebase, which is a property of the code and the ontology together.",
"The reserve share of a fifth is a first value, chosen because the phases after querying took roughly 220 s for 400 questions on this subject. It is not tuned." "The reserve share of a fifth is a first value, chosen because the phases after querying took roughly 220 s for 400 questions on this subject. It is not tuned."
] ],
"no_finding_lost_at_the_small_population": {
"subject": "PMPro at 25 regions, which completed before this work and still does",
"before": {
"completed": 27,
"findings": 19,
"seconds": 465.9
},
"after": {
"completed": 27,
"findings": 19,
"seconds": 460.5
},
"per_family": {
"injection": "1 before, 1 after",
"output_encoding": "18 before, 18 after"
},
"reading": "Identical. The batching changes what a large population can afford and nothing about what a small one answers."
}
} }