measure: Semgrep arm on the valid pilot, our rules and facts converted

0 of 12 positives; 12.6 false alarms per 100 ordinary pushes (2.1 on changed lines only). The misses come from what the rules and facts express (access control lives in obligations, which do not convert; sources cover request objects only), not from the engine. Comparison arm only: a Semgrep miss is never evidence against a hunter finding. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-23 06:59:28 +00:00 · 2026-10-13 13:10:19 +02:00
parent d08dea19b8
commit c5bf52f47d
12 changed files with 4465 additions and 0 deletions
@@ -0,0 +1,21 @@
+rules:
+- id: ousast.groovy.regex.groovy-xss-unescaped
+  languages:
+  - generic
+  severity: WARNING
+  message: Groovy template unescaped output needs review
+  metadata:
+    family: output_encoding
+    cwe: CWE-79
+    origin: groovy-xss-unescaped
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - injection
+    status: enabled
+    version: '1'
+  pattern-regex: (yieldUnescaped)\s+[A-Za-z_]
+  paths:
+    include:
+    - '*.groovy'
+    - '*.tpl'