marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: family-to-oracle mapping, build memory, tolerant tool calls

Browse Source 
Demos declare their oracle within the family allowed set (injection: sql or
command; output_encoding: xss; untrusted_destination: ssrf; path: path);
builds and app starts use the search memory budget instead of the 256 MB tool
limit (npm died with SIGTRAP); malformed tool-call JSON is fed back once.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 21:07:58 +02:00
co-authored by Claude Fable 5.1
parent c190d34f60
commit bf243e6680
16 changed files with 334 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_search_demo.py
+36
View File
@@ -7,6 +7,7 @@ from openultrasast.search.demo import load_demo, validate_demo
def document():
return {
"oracle": "path",
"build": {"recipe": "none", "arguments": []},
"start": {"runtime": "python", "path": "app.py", "arguments": [], "mode": "cli"},
"steps": [{"type": "cli", "arguments": ["hello"]}],
@@ -75,3 +76,38 @@ def test_manifest_recipe_requires_file_path(recipe):
value["build"] = {"recipe": recipe, "arguments": ["."]}
with pytest.raises(ValueError):
validate_demo(value)
@pytest.mark.parametrize("oracle", [None, "injection", "unknown", [], 1])
def test_oracle_required_and_known(oracle):
value = document()
if oracle is None:
value.pop("oracle")
else:
value["oracle"] = oracle
with pytest.raises(ValueError):
validate_demo(value)
@pytest.mark.parametrize(
"family,allowed",
[
("injection", ("sql", "command")),
("path", ("path",)),
("output_encoding", ("xss",)),
("untrusted_destination", ("ssrf",)),
("deserialization", ()),
("access_control", ()),
("config_secrets", ()),
],
)
def test_family_oracle_contract(family, allowed):
from openultrasast.search.demo import FAMILY_ORACLES, validate_oracle
assert FAMILY_ORACLES[family] == allowed
for oracle in ("sql", "command", "path", "xss", "ssrf"):
if oracle in allowed:
validate_oracle(family, oracle)
else:
with pytest.raises(ValueError, match="not allowed"):
validate_oracle(family, oracle)