marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 20:19:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(prover): access-control prover, delivery A: path records, Stapler and Jetty entries, Java operation rows, the prover and its scoring arm

Browse Source 
Codex delivery under spec access-control-prover. `semantic/obligations/paths.py` builds entry-to-function path
records from the cached caller index; `mapping.py` names Stapler web methods and Jetty handlers as entries;
`check_obligations` gains the opt-in premise `assume_entries_protected` with the label `unguarded_path`;
`hunt/prover.py` proves a change with no model call and states its coverage; `benchmarks/valid/prover_arm.py`
scores it with the valid-benchmark metrics. Two fixes after the first smoke run: a product file git holds empty
is read, not unread (four changes failed on `__init__.py` and empty assets), and absent-input reasons are
counted by name.

Smoke on the 23 fix changes of the training pool: 7 pushes caught (30 percent, Wilson 16 to 51), 28 of 93
locations, precision 7 of 8 flagged, no instrument failure; three changes over the 120 second bound. Twelve of
the 17 Jenkins fixes reach the fixed method but check no operation because the method is the operation;
the spec now carries handler-named operations for delivery B.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-14 16:50:04 +02:00
co-authored by Claude Fable 5.1
parent e514551cb6
commit beb272a5ec
15 changed files with 1352 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/ruleset/obligations/java.toml
+18 -1
View File
@@ -1,3 +1,13 @@
# Delivery A additionally checked actual calls in Git HEAD objects (2026-10-14):
# p4-plugin: CredentialsHelper.lookupCredentialsInItem, P4PasswordImpl and P4TicketImpl
# call ConnectionFactory.testConnection, ConnectionFactory calls connect, ReviewNotifier
# calls openConnection; zephyr-enterprise-test-management-plugin: ZephyrInstance calls
# getCredentialsFromId and UserService.verifyCredentials; azure-keyvault-plugin:
# AzureKeyVaultGlobalConfiguration.doTestConnection calls listPropertiesOfSecrets;
# rocketchatnotifier-plugin: RocketChatNotifier.doTestConnection calls publish.
# Each listed clone is under /home/mc/ousast-results/valid/train/hist/jenkinsci__*.
# No network documentation lookup was performed for this delivery. The existing
# documented checkAnyPermission row below is retained; it was not found in these HEADs.
# Closed authorization facts for Jenkins/Stapler, Spring Security and Servlet code.
# Checked Git HEAD source objects in /home/mc/ousast-results/valid/train/hist/:
# jenkinsci__analysis-core-plugin: DefaultGraphConfigurationView.checkPermission,
@@ -19,7 +29,7 @@ language = "java"
[[operation]]
id = "jenkins-credentials-read"
kind = "protected_read"
calls = ["lookupCredentials", "findCredentialById"]
calls = ["lookupCredentials", "lookupCredentialsInItem", "findCredentialById", "getCredentialsFromId"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"
@@ -46,6 +56,13 @@ calls = ["executeQuery", "execute", "prepareCall"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"
[[operation]]
id = "jenkins-outbound-connection"
kind = "privileged_action"
calls = ["testConnection", "verifyCredentials", "listPropertiesOfSecrets", "openConnection", "connect", "publish"]
requires = ["path_guard", "ownership_check"]
sensitivity = "high"
[[discharger]]
id = "jenkins-permission-guard"
kind = "path_guard"