mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-22 06:29:29 +00:00
bench(harnessx-removal): deterministic baseline without the extra (task 1)
Equality script (design section 3) records suite outcomes, `ousast pairs --json`, the python-vulnerable quick benchmark, one standard scan and `improve --dry-run` from a frozen export with the harnessx extra absent and no model reachable. Two independent records are byte-identical (determinism.json). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
2ed6d9a036
commit
ca5caf735f
@@ -0,0 +1,280 @@
|
||||
{
|
||||
"verifications": [
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "No function-level attacker-reachable entry point currently reaches this line.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-flask-debug:app.py:81",
|
||||
"pro_case": "A static pattern matched the source line.",
|
||||
"required_next_step": "Add reachability evidence before prioritizing a fix.",
|
||||
"status": "rejected",
|
||||
"tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.",
|
||||
"verified": false
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-os-command:app.py:17",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-path-traversal:app.py:55",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-shell-true:app.py:23",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:44",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-sql-injection:app.py:50",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssrf:app.py:60",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-ssti:app.py:70",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:33",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-deserialization:app.py:38",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-unsafe-eval:app.py:28",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"context_sources": [
|
||||
"evidence_level",
|
||||
"finding_id",
|
||||
"function_name",
|
||||
"line",
|
||||
"path",
|
||||
"reachability_conditions",
|
||||
"reachability_evidence",
|
||||
"reachability_status",
|
||||
"severity",
|
||||
"tags",
|
||||
"title"
|
||||
],
|
||||
"counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
|
||||
"evidence_level": "static_corroboration",
|
||||
"finding_id": "python-weak-hash:app.py:65",
|
||||
"pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
|
||||
"required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
|
||||
"status": "accepted",
|
||||
"tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
|
||||
"verified": true
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user