marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

engine: stage presigned objects as .dat; task entry reports the failing step and HTTP status

Browse Source 
Through Cloudflare, signed requests for keys ending .tar/.gz/.zip/.bin reached
RustFS altered and failed with 403 (cf-cache-status BYPASS); the same signed
request straight to RustFS on the LAN returned 200. A Cloudflare cache-bypass
rule on files.because-security.com fixes it (all extensions 200, DYNAMIC); the
engine executors keep .dat as a safeguard, the plane keeps output.tar.
Implemented with Codex.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-04 16:18:01 +02:00
co-authored by Claude Opus 5.5
parent 035710493c
commit b715ff7d0e
9 changed files with 59 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_engine_trace.py
+4 -2
View File
@@ -1265,6 +1265,8 @@ def test_kubernetes_host_pin_success_failure_and_cleanup(tmp_path, monkeypatch,
manifest = json.loads(kwargs["input"])
if manifest["kind"] == "Secret":
assert manifest["metadata"]["ownerReferences"][0]["uid"] == "job-uid"
for variable, filename in [("SOURCE_URL", "source.dat"), ("ANALYZER_URL", "analyzer.dat"), ("RESULT_URL", "result.dat")]:
assert manifest["stringData"][variable].split("?")[0].endswith("/" + filename)
if manifest["kind"] == "Job":
stdout = json.dumps({"metadata": {"uid": "job-uid"}})
env = manifest["spec"]["template"]["spec"]["containers"][0]["env"]
@@ -1276,10 +1278,10 @@ def test_kubernetes_host_pin_success_failure_and_cleanup(tmp_path, monkeypatch,
entry = tarfile.TarInfo("result.json")
entry.size = len(result_bytes)
archive.addfile(entry, io.BytesIO(result_bytes))
source_key = next(key for key in objects if key.endswith("source.tar"))
source_key = next(key for key in objects if key.endswith("source.dat"))
with tarfile.open(fileobj=io.BytesIO(objects[source_key])) as archive:
assert archive.extractfile("app.py").read() == b"def run(): pass"
objects[source_key.replace("source.tar", "result.tar")] = stream.getvalue()
objects[source_key.replace("source.dat", "result.dat")] = stream.getvalue()
if action[:2] == ["get", "job"]:
stdout = json.dumps(
{"status": {"conditions": [{"type": "Failed", "status": "True", "reason": "DeadlineExceeded"}]}}