marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(corpus): the three silent config pairs were a settings gap, not corpus defects

Browse Source 
I was wrong, and the correction matters more than the fix.

I reported these three pairs as corpus defects on a similarity measure -- 23%,
45%, 53% -- and said no settings table could make them split. That threshold
came from the OWASP minimal-fix analysis and does not apply to this slice. The
vibe-py corpus pairs a vulnerable function with a DIFFERENT, SAFE function from
the same repository; low similarity is the design, not a defect.
djangoat-views-user-view sits at 36% and dsvpwa-handlers-do-bdr at 34%, and
both score pair_correct.

Reading the actual code instead of the metric shows what the settings table was
missing: aiohttp's Application(debug=True) and RedisStorage(httponly=False).
Adding them, two of the three now split -- vuln model_entailed, fixed silent:

  dvpwa-app-init         Application(debug = True, middlewares = [...])
  dvpwa-middlewares      RedisStorage(app['redis'], httponly = False)

The third, dsvpwa-dsvpwa-main, stays silent for the reason predicted before the
change: its setting is an argparse default (--ssl defaulting to 0), which is a
CLI default rather than a security-setting call and is not reachable by this
arbiter.

One weakness this exposes and does not fix: permissive_values is a flat list of
literals with no keyword association, so it holds both True and False. debug=True
is dangerous while httponly=True is safe, and the model cannot currently tell
them apart. It happens not to bite on these pairs; it is a real limit of the
fact schema and worth naming.

734 passing, gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-08 18:50:09 +02:00
co-authored by Claude Opus 5
parent db3db6056d
commit 950a4c7ac4
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/ruleset/obligations/python.toml
+3 -1
View File
@@ -38,6 +38,7 @@ kind = "security_setting"
# apps, so three config pairs had no modelled setting in them at all.
calls = ["CORS", "cross_origin", "set_cookie", "app.run", "config.update", "TrustedHostMiddleware", "add_middleware", "set_debug",
"session_setup", "EncryptedCookieStorage", "SimpleCookieStorage", "cookie_storage", "setup_session",
"Application", "RedisStorage", "aiohttp_jinja2.setup", "Environment",
"SECURE_SSL_REDIRECT", "SESSION_COOKIE_SECURE", "CSRF_COOKIE_SECURE", "SESSION_COOKIE_HTTPONLY", "ALLOWED_HOSTS", "DEBUG",
"set_secure_cookie", "make_secure_cookie"]
resource_arg = 0
@@ -66,7 +67,8 @@ calls = ["check_owner", "is_owner", "assert_owner", "ensure_owner", "owns", "can
id = "safe-setting"
kind = "non_permissive_value"
calls = ["CORS", "cross_origin", "set_cookie", "app.run", "config.update", "add_middleware",
"session_setup", "SimpleCookieStorage", "setup_session", "set_secure_cookie"]
"session_setup", "SimpleCookieStorage", "setup_session", "set_secure_cookie",
"Application", "RedisStorage", "Environment"]
permissive_values = ["'*'", "\"*\"", "True", "0.0.0.0", "None", "False", "allow_all", "disable"]
[[discharger]]