marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(learn): v1 withholds verify.flag_b and ms.operation (plane-profile leak audit)

Browse Source 
Maintainer decision 2026-10-02. Not pushed with the release; main is otherwise
at v2.0.0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 15:25:21 +02:00
co-authored by Claude Fable 5.1
parent 838638a692
commit a90e570f48
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/learn/schema.py
+6 -1
View File
@@ -102,7 +102,12 @@ EXCLUDED_FIELDS = frozenset(
# Entries name an instrument (all its state and values) or a single feature. v1 withholds the engine and the function
# length: both separate fixed from vulnerable pair sides by construction (a fix removes a sink, a guard lengthens the
# function), not by anything that holds on unseen code (leak audit 2026-10-01).
INPUT_PROFILES: Mapping[str, tuple[str, ...]] = {"v1": ("engine", "facts.function_lines"), "full": ()}
# The plane profile also withholds verify.flag_b and ms.operation in v1 (maintainer decision 2026-10-02 on the
# slice-2 leak audit: they separate pair sides because a fix removes the sink, which does not hold on unseen code).
INPUT_PROFILES: Mapping[str, tuple[str, ...]] = {
"v1": ("engine", "facts.function_lines", "verify.flag_b", "ms.operation"),
"full": (),
}
DEFAULT_INPUTS = "v1"
tests/test_learn_leaks.py
+10
View File
@@ -113,3 +113,13 @@ def test_v1_withholds_function_length_from_prompts_and_distance() -> None:
assert "facts.function_lines: 42" in render_signals(a["x"], a["instruments"], "static", inputs="full")
assert gower(a["x"], a["instruments"], b["x"], b["instruments"], "static") == 0.0
assert gower(a["x"], a["instruments"], b["x"], b["instruments"], "static", inputs="full") > 0.0
def test_v1_withholds_the_plane_profile_leak_signals() -> None:
"""Slice-2 leak audit (2026-10-02): verify.flag_b and ms.operation track the pair label in the plane profile;
v1 renders neither and the distance ignores both, while ``full`` keeps them."""
from openultrasast.learn.schema import withheld
hidden = withheld("v1")
assert {"verify.flag_b", "ms.operation", "engine", "facts.function_lines"} <= hidden
assert withheld("full") == frozenset()