marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 19:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

engine: stage presigned objects as .dat; task entry reports the failing step and HTTP status

Browse Source 
Through Cloudflare, signed requests for keys ending .tar/.gz/.zip/.bin reached
RustFS altered and failed with 403 (cf-cache-status BYPASS); the same signed
request straight to RustFS on the LAN returned 200. A Cloudflare cache-bypass
rule on files.because-security.com fixes it (all extensions 200, DYNAMIC); the
engine executors keep .dat as a safeguard, the plane keeps output.tar.
Implemented with Codex.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-04 16:18:01 +02:00
co-authored by Claude Opus 5.5
parent 035710493c
commit b715ff7d0e
9 changed files with 59 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/plane/memory.py
+4
View File
@@ -586,6 +586,10 @@ class ObjectClient(Protocol):
_VERIFIED: set[str] = set()
PROBE_KEY = "_probe/select.jsonl"
# Live finding: files.because-security.com denies presigned GETs ending in .tar, .gz,
# .zip or .bin (HTTP 403 AccessDenied). Use .dat for archive objects; bytes stay tar.
PRESIGNED_ARCHIVE_SUFFIX = ".dat" # engine executors only; the plane keeps output.tar
RUNS_PREFIX = "runs/"
RUNS_RULE_ID = "ousast-runs-expiry"
RUNS_EXPIRE_DAYS = 30