mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 12:09:27 +00:00
bench(harnessx-removal): deterministic baseline without the extra (task 1)
Equality script (design section 3) records suite outcomes, `ousast pairs --json`, the python-vulnerable quick benchmark, one standard scan and `improve --dry-run` from a frozen export with the harnessx extra absent and no model reachable. Two independent records are byte-identical (determinism.json). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
2ed6d9a036
commit
ca5caf735f
@@ -0,0 +1 @@
|
||||
Excluded from comparison: JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp; JSON keys ending in: _seconds, _ms; run directory names / run ids (<timestamp>-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> <RUN_ID>; trace/events.jsonl as a whole (timings); never copied; the export's absolute root path -> <ROOT>; the children's TMPDIR -> <TMP>; suite: only the outcome per test id is kept (junit durations dropped); env.json is a provenance record (commit, freeze hash, instrument checks), not compared
|
||||
+181
@@ -0,0 +1,181 @@
|
||||
{
|
||||
"baseline_deltas": [],
|
||||
"benchmark_name": "python-vulnerable",
|
||||
"benchmark_run_id": "<RUN_ID>",
|
||||
"calibration_records": [
|
||||
{
|
||||
"cwe": "CWE-89",
|
||||
"evidence": "execute runs a SQL query string built from request input on a prior line",
|
||||
"failed_stage": "benchmark_ground_truth_matching",
|
||||
"next_improvement_candidate": "language_hunter",
|
||||
"path": "app.py",
|
||||
"reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability",
|
||||
"rule_id": null,
|
||||
"vulnerability_class": "sql injection"
|
||||
}
|
||||
],
|
||||
"false_positives": [],
|
||||
"language": "python_web",
|
||||
"metrics": {
|
||||
"actual_findings_total": 12,
|
||||
"artifact_links": {
|
||||
"findings": "<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>/findings.json",
|
||||
"manifest": "<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>/manifest.json",
|
||||
"report": "<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>/report.md",
|
||||
"sarif": "<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>/report.sarif"
|
||||
},
|
||||
"expected_findings_total": 13,
|
||||
"false_positive_findings_total": 0,
|
||||
"matched_findings_total": 12,
|
||||
"missed_findings_total": 1,
|
||||
"model_usage": {},
|
||||
"per_rule": {
|
||||
"python-flask-debug": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-os-command": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-path-traversal": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-shell-true": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-sql-injection": {
|
||||
"false_positives": 0,
|
||||
"matched": 2,
|
||||
"missed": 0
|
||||
},
|
||||
"python-ssrf": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-ssti": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-unsafe-deserialization": {
|
||||
"false_positives": 0,
|
||||
"matched": 2,
|
||||
"missed": 0
|
||||
},
|
||||
"python-unsafe-eval": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
},
|
||||
"python-weak-hash": {
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0
|
||||
}
|
||||
},
|
||||
"precision": 1.0,
|
||||
"recall": 0.9230769230769231
|
||||
},
|
||||
"misses": [
|
||||
{
|
||||
"cwe": "CWE-89",
|
||||
"evidence": "execute runs a SQL query string built from request input on a prior line",
|
||||
"path": "app.py",
|
||||
"reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability",
|
||||
"rule_id": null,
|
||||
"vulnerability_class": "sql injection"
|
||||
}
|
||||
],
|
||||
"mode": "quick",
|
||||
"rule_recommendations": [
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-flask-debug"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-os-command"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-path-traversal"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-shell-true"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 2,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-sql-injection"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-ssrf"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-ssti"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 2,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-unsafe-deserialization"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-unsafe-eval"
|
||||
},
|
||||
{
|
||||
"action": "keep",
|
||||
"false_positives": 0,
|
||||
"matched": 1,
|
||||
"missed": 0,
|
||||
"rationale": "rule matched expected findings with no false positives",
|
||||
"rule_id": "python-weak-hash"
|
||||
}
|
||||
],
|
||||
"scan_run_dir": "<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>"
|
||||
}
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
[
|
||||
{
|
||||
"cwe": "CWE-89",
|
||||
"evidence": "execute runs a SQL query string built from request input on a prior line",
|
||||
"failed_stage": "benchmark_ground_truth_matching",
|
||||
"next_improvement_candidate": "language_hunter",
|
||||
"path": "app.py",
|
||||
"reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability",
|
||||
"rule_id": null,
|
||||
"vulnerability_class": "sql injection"
|
||||
}
|
||||
]
|
||||
+1
@@ -0,0 +1 @@
|
||||
[]
|
||||
@@ -0,0 +1,11 @@
|
||||
scan_id=<RUN_ID>
|
||||
run_dir=<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>
|
||||
file_targets=2
|
||||
ranked_targets=2
|
||||
findings=12
|
||||
calibrations_applied=0
|
||||
benchmark_run_id=<RUN_ID>
|
||||
benchmark_run_dir=<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/benchmarks/<RUN_ID>
|
||||
benchmark_expected=13
|
||||
benchmark_matched=12
|
||||
benchmark_missed=1
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"baseline": "this directory (record run A)",
|
||||
"candidate": "record run B: second independent record from a fresh export of the same tree, same venv; not committed",
|
||||
"differences": [],
|
||||
"equal": true,
|
||||
"exclusions": [
|
||||
"JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp",
|
||||
"JSON keys ending in: _seconds, _ms",
|
||||
"run directory names / run ids (<timestamp>-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> <RUN_ID>",
|
||||
"trace/events.jsonl as a whole (timings); never copied",
|
||||
"the export's absolute root path -> <ROOT>; the children's TMPDIR -> <TMP>",
|
||||
"suite: only the outcome per test id is kept (junit durations dropped)",
|
||||
"env.json is a provenance record (commit, freeze hash, instrument checks), not compared"
|
||||
],
|
||||
"raw_bytes_identical": "all 15 files incl. env.json (diff -r empty)"
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
{
|
||||
"child_env": {
|
||||
"OPENULTRASAST_SKIP_DOTENV": "1",
|
||||
"PYTHONHASHSEED": "0",
|
||||
"api_keys": "every *_API_KEY unset",
|
||||
"config": "empty"
|
||||
},
|
||||
"exclusions": [
|
||||
"JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp",
|
||||
"JSON keys ending in: _seconds, _ms",
|
||||
"run directory names / run ids (<timestamp>-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> <RUN_ID>",
|
||||
"trace/events.jsonl as a whole (timings); never copied",
|
||||
"the export's absolute root path -> <ROOT>; the children's TMPDIR -> <TMP>",
|
||||
"suite: only the outcome per test id is kept (junit durations dropped)",
|
||||
"env.json is a provenance record (commit, freeze hash, instrument checks), not compared"
|
||||
],
|
||||
"freeze_sha256": "0e5ad41948a751e1c60f72738c48f5ac482b24b67e51c77369ab3be51fa418eb",
|
||||
"harnessx_importable": false,
|
||||
"inputs": {
|
||||
"benchmarks/manifests/java-spring-boot-vulnerable.toml": 1032,
|
||||
"benchmarks/manifests/python-vulnerable.toml": 2771,
|
||||
"benchmarks/pairs/catalog.toml": 6052
|
||||
},
|
||||
"instrument_checks": {
|
||||
"benchmark": {
|
||||
"expected": 13,
|
||||
"findings": 12,
|
||||
"matched": 12,
|
||||
"missed": 1
|
||||
},
|
||||
"benchmark_files": {
|
||||
"benchmark_result.json": 5891,
|
||||
"calibration_records.json": 406,
|
||||
"external_baseline_deltas.json": 3
|
||||
},
|
||||
"improve": {
|
||||
"journal_bytes": null,
|
||||
"rounds": 1
|
||||
},
|
||||
"openultrasast_module": "<ROOT>/src/openultrasast/__init__.py",
|
||||
"pairs": {
|
||||
"detected_vuln": 57,
|
||||
"labeled_expected": 342,
|
||||
"labeled_matched": 82,
|
||||
"outcomes": 317,
|
||||
"pair_correct": 32,
|
||||
"pairs": 317
|
||||
},
|
||||
"scan": {
|
||||
"file_targets": 2,
|
||||
"findings": 17
|
||||
},
|
||||
"scan_files": {
|
||||
"findings.json": 20469,
|
||||
"fusion.json": 6284,
|
||||
"harness.json": 189,
|
||||
"manifest.json": 13265,
|
||||
"report.sarif": 40310,
|
||||
"verification.json": 10573
|
||||
},
|
||||
"suite": {
|
||||
"error": 0,
|
||||
"failure": 0,
|
||||
"passed": 1688,
|
||||
"skipped": 36
|
||||
}
|
||||
},
|
||||
"python": "3.11.13",
|
||||
"tree_ish": "ca420bfb99d649f01030b8a28ff3ffa4b32d1b22",
|
||||
"tree_sitter": true
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
manifest=benchmarks/manifests/java-spring-boot-vulnerable.toml
|
||||
target=<ROOT>/benchmarks/fixtures/java-spring-boot-vulnerable
|
||||
round 1: no_proposals | recall 100.00%->100.00% fp 0.00%->0.00% score 73->73 | edits: -
|
||||
rounds=1 accepted=0
|
||||
dry_run=true (no ledger or mechanism store written)
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,630 @@
|
||||
{
|
||||
"findings": [
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-flask-debug:app.py:81",
|
||||
"function_name": null,
|
||||
"line": 81,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 1.5,
|
||||
"rationale": "Static pattern python-flask-debug (CWE-489) matched debug on line 81; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"insecure_default",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Flask debug mode enabled needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"function_name": "ping",
|
||||
"line": 17,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-os-command (CWE-78) matched os.system on line 17; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/ping')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 17,
|
||||
"function_name": "ping",
|
||||
"kind": "route",
|
||||
"line": 15,
|
||||
"name": "ping",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python OS command execution needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-path-traversal:app.py:55",
|
||||
"function_name": "read",
|
||||
"line": 55,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-path-traversal (CWE-22) matched open on line 55; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/read')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 55,
|
||||
"function_name": "read",
|
||||
"kind": "route",
|
||||
"line": 54,
|
||||
"name": "read",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python file open with external input needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"function_name": "run",
|
||||
"line": 23,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-shell-true (CWE-78) matched subprocess.check_output on line 23; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/run')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 23,
|
||||
"function_name": "run",
|
||||
"kind": "route",
|
||||
"line": 21,
|
||||
"name": "run",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Subprocess shell execution needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"function_name": "user",
|
||||
"line": 44,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 44; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/user')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 44,
|
||||
"function_name": "user",
|
||||
"kind": "route",
|
||||
"line": 42,
|
||||
"name": "user",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"injection",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python SQL string composition needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"function_name": "report",
|
||||
"line": 50,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 50; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/report')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 50,
|
||||
"function_name": "report",
|
||||
"kind": "route",
|
||||
"line": 48,
|
||||
"name": "report",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"injection",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python SQL string composition needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssrf:app.py:60",
|
||||
"function_name": "fetch",
|
||||
"line": 60,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-ssrf (CWE-918) matched requests.get on line 60; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/fetch')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 60,
|
||||
"function_name": "fetch",
|
||||
"kind": "route",
|
||||
"line": 59,
|
||||
"name": "fetch",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"network_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python outbound request with external input needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssti:app.py:70",
|
||||
"function_name": "render",
|
||||
"line": 70,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-ssti (CWE-94) matched render_template_string on line 70; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/render')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 70,
|
||||
"function_name": "render",
|
||||
"kind": "route",
|
||||
"line": 69,
|
||||
"name": "render",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"injection",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python server-side template injection needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:33",
|
||||
"function_name": "load",
|
||||
"line": 33,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-unsafe-deserialization (CWE-502) matched pickle.loads on line 33; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/load')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 33,
|
||||
"function_name": "load",
|
||||
"kind": "route",
|
||||
"line": 32,
|
||||
"name": "load",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Unsafe Python deserialization needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:38",
|
||||
"function_name": "config",
|
||||
"line": 38,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-unsafe-deserialization (CWE-502) matched yaml.load on line 38; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/config')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 38,
|
||||
"function_name": "config",
|
||||
"kind": "route",
|
||||
"line": 37,
|
||||
"name": "config",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Unsafe Python deserialization needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"function_name": "calc",
|
||||
"line": 28,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-unsafe-eval (CWE-95) matched eval on line 28; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/calc')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 28,
|
||||
"function_name": "calc",
|
||||
"kind": "route",
|
||||
"line": 27,
|
||||
"name": "calc",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Dynamic Python execution needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-weak-hash:app.py:65",
|
||||
"function_name": "token",
|
||||
"line": 65,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 3.8,
|
||||
"rationale": "Static pattern python-weak-hash (CWE-327) matched md5 on line 65; manual verification still required.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [
|
||||
{
|
||||
"access_declared": false,
|
||||
"access_evidence": [
|
||||
"app.get('/token')"
|
||||
],
|
||||
"access_level": "public",
|
||||
"conditions": [],
|
||||
"defines_handler": true,
|
||||
"end_line": 65,
|
||||
"function_name": "token",
|
||||
"kind": "route",
|
||||
"line": 64,
|
||||
"name": "token",
|
||||
"path": "app.py",
|
||||
"provenance": "entrypoint:route:public",
|
||||
"rationale": "route surface classified as public at http_request",
|
||||
"registered_by": "",
|
||||
"trust_boundary": "http_request"
|
||||
}
|
||||
],
|
||||
"reachability_status": "reachable",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"crypto",
|
||||
"deserialization",
|
||||
"filesystem_entry",
|
||||
"syscall_entry"
|
||||
],
|
||||
"title": "Python weak hash needs review"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "overlay-coverage:app.py:77:execute",
|
||||
"function_name": null,
|
||||
"line": 77,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 0.0,
|
||||
"rationale": "uninventoried sink execute reached from request",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"overlay-originated"
|
||||
],
|
||||
"title": "Overlay coverage: execute"
|
||||
},
|
||||
{
|
||||
"confidence": "medium",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "overlay-coverage:safe.py:11:os.system",
|
||||
"function_name": null,
|
||||
"line": 11,
|
||||
"path": "safe.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 0.0,
|
||||
"rationale": "uninventoried sink os.system reached from parameter",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"overlay-originated"
|
||||
],
|
||||
"title": "Overlay coverage: os.system"
|
||||
},
|
||||
{
|
||||
"confidence": "low",
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:44:identity_constraint",
|
||||
"function_name": "user",
|
||||
"line": 44,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 0.3,
|
||||
"rationale": "protected_read on users in user is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"obligation:protected_read",
|
||||
"discharger:identity_constraint",
|
||||
"obligation_evidence:function_local",
|
||||
"resource:users"
|
||||
],
|
||||
"title": "Obligation not discharged: protected_read on users without identity_constraint"
|
||||
},
|
||||
{
|
||||
"confidence": "low",
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:50:identity_constraint",
|
||||
"function_name": "report",
|
||||
"line": 50,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 0.3,
|
||||
"rationale": "protected_read on reports in report is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"obligation:protected_read",
|
||||
"discharger:identity_constraint",
|
||||
"obligation_evidence:function_local",
|
||||
"resource:reports"
|
||||
],
|
||||
"title": "Obligation not discharged: protected_read on reports without identity_constraint"
|
||||
},
|
||||
{
|
||||
"confidence": "low",
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:77:identity_constraint",
|
||||
"function_name": "search",
|
||||
"line": 77,
|
||||
"path": "app.py",
|
||||
"proposed_snippet": null,
|
||||
"ranking_priority": 0.3,
|
||||
"rationale": "protected_read on a resource in search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
||||
"reachability_conditions": [],
|
||||
"reachability_evidence": [],
|
||||
"reachability_status": "unknown",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"status": "enabled",
|
||||
"tags": [
|
||||
"obligation:protected_read",
|
||||
"discharger:identity_constraint",
|
||||
"obligation_evidence:function_local"
|
||||
],
|
||||
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
[
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"degradations": [],
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"model_ids": [],
|
||||
"panels": [
|
||||
{
|
||||
"confidence": 0.75,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.",
|
||||
"leaning": "vulnerability",
|
||||
"model_id": null,
|
||||
"rationale": "reachability=reachable, severity=critical, verified=True",
|
||||
"role": "panel_a",
|
||||
"vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached."
|
||||
},
|
||||
{
|
||||
"confidence": 0.6,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"leaning": "false_positive",
|
||||
"model_id": null,
|
||||
"rationale": "reachable=True, rejected=False, verified=True",
|
||||
"role": "panel_b",
|
||||
"vulnerability_case": "A tainted sink shape exists in the source."
|
||||
}
|
||||
],
|
||||
"triggered": true,
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
],
|
||||
"votes": {
|
||||
"accepted": 2
|
||||
},
|
||||
"warnings": []
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"degradations": [],
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"model_ids": [],
|
||||
"panels": [
|
||||
{
|
||||
"confidence": 0.75,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.",
|
||||
"leaning": "vulnerability",
|
||||
"model_id": null,
|
||||
"rationale": "reachability=reachable, severity=critical, verified=True",
|
||||
"role": "panel_a",
|
||||
"vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached."
|
||||
},
|
||||
{
|
||||
"confidence": 0.6,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"leaning": "false_positive",
|
||||
"model_id": null,
|
||||
"rationale": "reachable=True, rejected=False, verified=True",
|
||||
"role": "panel_b",
|
||||
"vulnerability_case": "A tainted sink shape exists in the source."
|
||||
}
|
||||
],
|
||||
"triggered": true,
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
],
|
||||
"votes": {
|
||||
"accepted": 2
|
||||
},
|
||||
"warnings": []
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"degradations": [],
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"model_ids": [],
|
||||
"panels": [
|
||||
{
|
||||
"confidence": 0.75,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.",
|
||||
"leaning": "vulnerability",
|
||||
"model_id": null,
|
||||
"rationale": "reachability=reachable, severity=high, verified=True",
|
||||
"role": "panel_a",
|
||||
"vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached."
|
||||
},
|
||||
{
|
||||
"confidence": 0.6,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"leaning": "false_positive",
|
||||
"model_id": null,
|
||||
"rationale": "reachable=True, rejected=False, verified=True",
|
||||
"role": "panel_b",
|
||||
"vulnerability_case": "A tainted sink shape exists in the source."
|
||||
}
|
||||
],
|
||||
"triggered": true,
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:high"
|
||||
],
|
||||
"votes": {
|
||||
"accepted": 2
|
||||
},
|
||||
"warnings": []
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"degradations": [],
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"model_ids": [],
|
||||
"panels": [
|
||||
{
|
||||
"confidence": 0.75,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.",
|
||||
"leaning": "vulnerability",
|
||||
"model_id": null,
|
||||
"rationale": "reachability=reachable, severity=high, verified=True",
|
||||
"role": "panel_a",
|
||||
"vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached."
|
||||
},
|
||||
{
|
||||
"confidence": 0.6,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"leaning": "false_positive",
|
||||
"model_id": null,
|
||||
"rationale": "reachable=True, rejected=False, verified=True",
|
||||
"role": "panel_b",
|
||||
"vulnerability_case": "A tainted sink shape exists in the source."
|
||||
}
|
||||
],
|
||||
"triggered": true,
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:high"
|
||||
],
|
||||
"votes": {
|
||||
"accepted": 2
|
||||
},
|
||||
"warnings": []
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"degradations": [],
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"model_ids": [],
|
||||
"panels": [
|
||||
{
|
||||
"confidence": 0.75,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.",
|
||||
"leaning": "vulnerability",
|
||||
"model_id": null,
|
||||
"rationale": "reachability=reachable, severity=critical, verified=True",
|
||||
"role": "panel_a",
|
||||
"vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached."
|
||||
},
|
||||
{
|
||||
"confidence": 0.6,
|
||||
"disposition": "accepted",
|
||||
"false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"leaning": "false_positive",
|
||||
"model_id": null,
|
||||
"rationale": "reachable=True, rejected=False, verified=True",
|
||||
"role": "panel_b",
|
||||
"vulnerability_case": "A tainted sink shape exists in the source."
|
||||
}
|
||||
],
|
||||
"triggered": true,
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
],
|
||||
"votes": {
|
||||
"accepted": 2
|
||||
},
|
||||
"warnings": []
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,11 @@
|
||||
{
|
||||
"contract_mode": "strict",
|
||||
"model_roles": {
|
||||
"hunter": null,
|
||||
"patcher": null,
|
||||
"ranker": null,
|
||||
"verifier": null
|
||||
},
|
||||
"processor_versions": {},
|
||||
"prompt_hashes": {}
|
||||
}
|
||||
@@ -0,0 +1,461 @@
|
||||
{
|
||||
"artifacts": {
|
||||
"complexity_map": "complexity_map.json",
|
||||
"findings": "findings.json",
|
||||
"fusion": "fusion.json",
|
||||
"markdown": "report.md",
|
||||
"overlay": "overlay.json",
|
||||
"sarif": "report.sarif",
|
||||
"score": "score.json",
|
||||
"trajectories": "traces/hunter_trajectories.jsonl",
|
||||
"verification": "verification.json"
|
||||
},
|
||||
"complexity": {
|
||||
"heuristic_only": true,
|
||||
"hotspot_count": 14
|
||||
},
|
||||
"degradations": [
|
||||
{
|
||||
"detail": "no path records; obligations evaluated within entry-point handlers only",
|
||||
"files": [
|
||||
"app.py",
|
||||
"safe.py"
|
||||
],
|
||||
"language": "python",
|
||||
"reason": "obligations_function_local",
|
||||
"stage": "obligations"
|
||||
},
|
||||
{
|
||||
"detail": "no hunter client or model",
|
||||
"reason": "intent_adjudication_unavailable",
|
||||
"stage": "obligations"
|
||||
},
|
||||
{
|
||||
"reason": "cpg_unavailable",
|
||||
"stage": "model"
|
||||
},
|
||||
{
|
||||
"reason": "hunter_model_unavailable",
|
||||
"stage": "map"
|
||||
}
|
||||
],
|
||||
"findings": [
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-flask-debug:app.py:81",
|
||||
"line": 81,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "rejected"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"line": 17,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-path-traversal:app.py:55",
|
||||
"line": 55,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"line": 23,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"line": 44,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"line": 50,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssrf:app.py:60",
|
||||
"line": 60,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssti:app.py:70",
|
||||
"line": 70,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:33",
|
||||
"line": 33,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:38",
|
||||
"line": 38,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"line": 28,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-weak-hash:app.py:65",
|
||||
"line": 65,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "medium",
|
||||
"verification_status": "accepted"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "overlay-coverage:app.py:77:execute",
|
||||
"line": 77,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "not_run"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "overlay-coverage:safe.py:11:os.system",
|
||||
"line": 11,
|
||||
"path": "safe.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "critical",
|
||||
"verification_status": "not_run"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:44:identity_constraint",
|
||||
"line": 44,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "not_run"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:50:identity_constraint",
|
||||
"line": 50,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "not_run"
|
||||
},
|
||||
{
|
||||
"artifact_refs": {
|
||||
"findings_json": "findings.json",
|
||||
"markdown": "report.md",
|
||||
"sarif": "report.sarif",
|
||||
"trajectories_jsonl": "traces/hunter_trajectories.jsonl",
|
||||
"verification_json": "verification.json"
|
||||
},
|
||||
"evidence_level": "suspicion",
|
||||
"finding_id": "obligation:protected_read:app.py:77:identity_constraint",
|
||||
"line": 77,
|
||||
"path": "app.py",
|
||||
"rung": "suspicion",
|
||||
"severity": "high",
|
||||
"verification_status": "not_run"
|
||||
}
|
||||
],
|
||||
"fusion": [
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
]
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
]
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:high"
|
||||
]
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:high"
|
||||
]
|
||||
},
|
||||
{
|
||||
"decision_source": "deterministic-reconciler",
|
||||
"disposition": "accepted",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"triggers": [
|
||||
"gates_risky_fix",
|
||||
"severity:critical"
|
||||
]
|
||||
}
|
||||
],
|
||||
"model": {
|
||||
"by_rung": {},
|
||||
"cost_usd": 0.0,
|
||||
"coverage": [],
|
||||
"family_coverage": [],
|
||||
"model_calls": 0,
|
||||
"partitions": [],
|
||||
"query_seconds_by_kind": {},
|
||||
"question_outcomes": [],
|
||||
"regions_scanned": 0,
|
||||
"regions_unasked": 0,
|
||||
"regions_unjudged": 0,
|
||||
"scope": null,
|
||||
"seconds": 0.0,
|
||||
"skipped": "cpg_unavailable",
|
||||
"unjudged_sample": []
|
||||
},
|
||||
"obligations": {
|
||||
"degradations": [
|
||||
{
|
||||
"detail": "no path records; obligations evaluated within entry-point handlers only",
|
||||
"files": [
|
||||
"app.py",
|
||||
"safe.py"
|
||||
],
|
||||
"language": "python",
|
||||
"reason": "obligations_function_local",
|
||||
"stage": "obligations"
|
||||
},
|
||||
{
|
||||
"detail": "no hunter client or model",
|
||||
"reason": "intent_adjudication_unavailable",
|
||||
"stage": "obligations"
|
||||
}
|
||||
],
|
||||
"findings_by_label": {
|
||||
"function_local": 3
|
||||
},
|
||||
"operations": 4,
|
||||
"policy_version": null,
|
||||
"sets": [
|
||||
{
|
||||
"handlers": 1,
|
||||
"module": "app",
|
||||
"resource": "reports"
|
||||
},
|
||||
{
|
||||
"handlers": 1,
|
||||
"module": "app",
|
||||
"resource": "users"
|
||||
}
|
||||
],
|
||||
"sibling_sets": 2,
|
||||
"under_populated": 2
|
||||
},
|
||||
"provenance": {
|
||||
"agent_commits": 0,
|
||||
"sampled_commits": 0,
|
||||
"signals": [
|
||||
"git:unavailable"
|
||||
],
|
||||
"value": "human"
|
||||
},
|
||||
"score": {
|
||||
"by_category": {
|
||||
"Code Injection": 2,
|
||||
"Code Quality": 1,
|
||||
"Command or Argument Injection": 2,
|
||||
"Cryptographic Issues": 1,
|
||||
"Directory Traversal": 1,
|
||||
"Encapsulation": 2,
|
||||
"Information Leakage": 1,
|
||||
"SQL Injection": 2
|
||||
},
|
||||
"gate": {
|
||||
"block_severity_reachable": 5,
|
||||
"blocking": false,
|
||||
"min_score": 80,
|
||||
"passed": false
|
||||
},
|
||||
"max_severity": 5,
|
||||
"out_of_scope_dynamic_only": 0,
|
||||
"penalty_total": 105.6,
|
||||
"project_score": 17,
|
||||
"unmapped_cwe": []
|
||||
},
|
||||
"stages": {
|
||||
"completed": [
|
||||
"static",
|
||||
"map"
|
||||
],
|
||||
"requested": [
|
||||
"static",
|
||||
"map"
|
||||
],
|
||||
"skipped": []
|
||||
},
|
||||
"target": "<ROOT>/benchmarks/fixtures/python-vulnerable"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,6 @@
|
||||
scan_id=<RUN_ID>
|
||||
run_dir=<ROOT>/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/<RUN_ID>
|
||||
file_targets=2
|
||||
ranked_targets=2
|
||||
findings=17
|
||||
calibrations_applied=1
|
||||
@@ -0,0 +1,280 @@
|
||||
{
|
||||
"verifications": [
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "No function-level attacker-reachable entry point currently reaches this line.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-flask-debug:app.py:81",
|
||||
"pro_case": "A static pattern matched the source line.",
|
||||
"required_next_step": "Add reachability evidence before prioritizing a fix.",
|
||||
"status": "rejected",
|
||||
"tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.",
|
||||
"verified": false
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-path-traversal:app.py:55",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssrf:app.py:60",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssti:app.py:70",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:33",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:38",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-weak-hash:app.py:65",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user