From 950a4c7ac45f43ea511133351c7a101ee0cea8d6 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Tue, 8 Sep 2026 18:50:09 +0200 Subject: [PATCH] fix(corpus): the three silent config pairs were a settings gap, not corpus defects I was wrong, and the correction matters more than the fix. I reported these three pairs as corpus defects on a similarity measure -- 23%, 45%, 53% -- and said no settings table could make them split. That threshold came from the OWASP minimal-fix analysis and does not apply to this slice. The vibe-py corpus pairs a vulnerable function with a DIFFERENT, SAFE function from the same repository; low similarity is the design, not a defect. djangoat-views-user-view sits at 36% and dsvpwa-handlers-do-bdr at 34%, and both score pair_correct. Reading the actual code instead of the metric shows what the settings table was missing: aiohttp's Application(debug=True) and RedisStorage(httponly=False). Adding them, two of the three now split -- vuln model_entailed, fixed silent: dvpwa-app-init Application(debug = True, middlewares = [...]) dvpwa-middlewares RedisStorage(app['redis'], httponly = False) The third, dsvpwa-dsvpwa-main, stays silent for the reason predicted before the change: its setting is an argparse default (--ssl defaulting to 0), which is a CLI default rather than a security-setting call and is not reachable by this arbiter. One weakness this exposes and does not fix: permissive_values is a flat list of literals with no keyword association, so it holds both True and False. debug=True is dangerous while httponly=True is safe, and the model cannot currently tell them apart. It happens not to bite on these pairs; it is a real limit of the fact schema and worth naming. 734 passing, gates byte-identical. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- src/openultrasast/ruleset/obligations/python.toml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/openultrasast/ruleset/obligations/python.toml b/src/openultrasast/ruleset/obligations/python.toml index 3bf60b2..e8f32a8 100644 --- a/src/openultrasast/ruleset/obligations/python.toml +++ b/src/openultrasast/ruleset/obligations/python.toml @@ -38,6 +38,7 @@ kind = "security_setting" # apps, so three config pairs had no modelled setting in them at all. calls = ["CORS", "cross_origin", "set_cookie", "app.run", "config.update", "TrustedHostMiddleware", "add_middleware", "set_debug", "session_setup", "EncryptedCookieStorage", "SimpleCookieStorage", "cookie_storage", "setup_session", + "Application", "RedisStorage", "aiohttp_jinja2.setup", "Environment", "SECURE_SSL_REDIRECT", "SESSION_COOKIE_SECURE", "CSRF_COOKIE_SECURE", "SESSION_COOKIE_HTTPONLY", "ALLOWED_HOSTS", "DEBUG", "set_secure_cookie", "make_secure_cookie"] resource_arg = 0 @@ -66,7 +67,8 @@ calls = ["check_owner", "is_owner", "assert_owner", "ensure_owner", "owns", "can id = "safe-setting" kind = "non_permissive_value" calls = ["CORS", "cross_origin", "set_cookie", "app.run", "config.update", "add_middleware", - "session_setup", "SimpleCookieStorage", "setup_session", "set_secure_cookie"] + "session_setup", "SimpleCookieStorage", "setup_session", "set_secure_cookie", + "Application", "RedisStorage", "Environment"] permissive_values = ["'*'", "\"*\"", "True", "0.0.0.0", "None", "False", "allow_all", "disable"] [[discharger]]