marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 20:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(prover): access-control prover, delivery A: path records, Stapler and Jetty entries, Java operation rows, the prover and its scoring arm

Browse Source 
Codex delivery under spec access-control-prover. `semantic/obligations/paths.py` builds entry-to-function path
records from the cached caller index; `mapping.py` names Stapler web methods and Jetty handlers as entries;
`check_obligations` gains the opt-in premise `assume_entries_protected` with the label `unguarded_path`;
`hunt/prover.py` proves a change with no model call and states its coverage; `benchmarks/valid/prover_arm.py`
scores it with the valid-benchmark metrics. Two fixes after the first smoke run: a product file git holds empty
is read, not unread (four changes failed on `__init__.py` and empty assets), and absent-input reasons are
counted by name.

Smoke on the 23 fix changes of the training pool: 7 pushes caught (30 percent, Wilson 16 to 51), 28 of 93
locations, precision 7 of 8 flagged, no instrument failure; three changes over the 120 second bound. Twelve of
the 17 Jenkins fixes reach the fixed method but check no operation because the method is the operation;
the spec now carries handler-named operations for delivery B.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-14 16:50:04 +02:00
co-authored by Claude Fable 5.1
parent e514551cb6
commit beb272a5ec
15 changed files with 1352 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_obligation_facts.py
+24
View File
@@ -91,3 +91,27 @@ def test_java_php_facts_resolve_operations_and_dischargers(language, text, opera
assert ir.parse_ok
assert operation in {op.fact_id for op in find_operations(ir, facts, text=text)}
assert discharger in {d.fact_id for d in find_discharges(ir, facts, load_facts().for_language(language), text=text)}
def test_delivery_a_java_operations_and_dischargers_resolve():
from openultrasast.semantic.obligations.facts import load_obligation_facts
facts = load_obligation_facts().for_language("java")
operations = {call: fact for fact in facts.operations for call in fact.calls}
dischargers = {call: fact for fact in facts.dischargers for call in fact.calls}
for call in (
"lookupCredentials",
"lookupCredentialsInItem",
"getCredentialsFromId",
"testConnection",
"verifyCredentials",
"listPropertiesOfSecrets",
"openConnection",
"connect",
"publish",
"getItemByFullName",
"updateByXml",
):
assert "path_guard" in operations[call].requires
assert dischargers["checkPermission"].kind == dischargers["checkAnyPermission"].kind == "path_guard"
assert dischargers["hasPermission"].kind == "ownership_check"