marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 03:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(model): v4 measured; a parameter-fed field becomes strong carried only when the exact flow confirms it

Browse Source 
v4 (provenance split): pmpro 69 and wpstatistics 172 unchanged -- their tier-4 members are source-fed
through same-file helpers that read the request; mwwpform 68 -> 248, because its CVE's region is fed by
a constructor parameter, the shape the split demotes and the exact flow had put at 30. v5 asks the flow
for exactly the parameter-fed fields a sink-bearing region reads, memoised per (family, file, field),
and reports carriedBy for diagnosis.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-11 13:27:49 +02:00
co-authored by Claude Fable 5.1
parent 20d53f1c4d
commit 983eda5886
3 changed files with 3502 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/flow-aware-ranking/brief.md
+10 -1
View File
@@ -179,7 +179,16 @@ A phase that cannot show that is not an improvement, it is a story.
The proxy is too loose: folding "assigned from a parameter" in with "assigned from a source" put 555
and 569 regions in tier 4 -- every constructor assigns a field from a parameter -- and the CVEs sit in
those tiers on score alone. v4 splits the provenance: source-fed (or fed by a same-file method that
reads a source) promotes to tier 4; parameter-fed only orders within a tier (weight +0.75). Measuring.
reads a source) promotes to tier 4; parameter-fed only orders within a tier (weight +0.75).
**v4, measured:** pmpro 69 and wpstatistics 172, both UNCHANGED with tier 4 still 555 and 569 -- their
tier-4 members are source-fed under the one-level rule (fields assigned from calls to same-file
helpers that read `$_REQUEST`, which on those plugins is a real request path, so the tier is roughly
honest and the CVE's position there is a within-tier question). mwwpform went 68 → **248**: its CVE's
region is fed by `$this->attachments = $attachments` in a constructor, exactly the parameter-fed shape
the split demotes, and exactly the shape the exact flow had put at 30. So v5 asks the exact flow for
precisely the parameter-fed fields a sink-bearing region reads -- memoised per (family, file, field)
for the batch, which the arbiter's memos were not until today -- and for nothing else.
- **Phase 3 — the LLM ranker.** Same evidence, ordered by a model. Gate: beats phase 2 leave-one-repository-out.
If it does not, phase 2 ships and phase 3 does not.