From d1f37abadd041249f77012ecdb0ce01e77bef562 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:11:00 +0200 Subject: [PATCH] feat(model): carried with provenance -- source-fed promotes a tier, parameter-fed only orders Structural carried (v3) measured: pmpro 391 -> 69, wpstatistics 504 -> 172, mwwpform 513 -> 68 -- and tier 4 swollen to 555 and 569 regions, because "assigned from a parameter" was folded in with "assigned from a source" and every constructor does the former. The query now reports carriedKind; the vector promotes on "source" and gives "parameter" a within-tier weight of 0.75. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- .kiro/specs/flow-aware-ranking/brief.md | 23 +- .../2026-09-11-evidence-rank-v3.json | 3473 +++++++++++++++++ src/openultrasast/cpg/queries/taint.sc | 103 +- src/openultrasast/model/evidence.py | 10 +- tests/test_model_evidence.py | 30 + 5 files changed, 3591 insertions(+), 48 deletions(-) create mode 100644 benchmarks/ranking/baselines/2026-09-11-evidence-rank-v3.json diff --git a/.kiro/specs/flow-aware-ranking/brief.md b/.kiro/specs/flow-aware-ranking/brief.md index b792844..23c94ed 100644 --- a/.kiro/specs/flow-aware-ranking/brief.md +++ b/.kiro/specs/flow-aware-ranking/brief.md @@ -159,8 +159,27 @@ A phase that cannot show that is not an improvement, it is a story. regions; evidence pass 68 → 84 s) -- the first repository under the gate. vampi unchanged at 16. pmpro's v2 pass hit the scan's 300 s default query ceiling (v1 took 255 s; the join facts on its 1,040 sink-bearing pairs cost more than the 45 s of headroom) and answered nothing, which the benchmark - reported as `tiers={}` and the static order; the benchmark now sets its own ceiling and pmpro is - re-measured. + reported as `tiers={}` and the static order; the benchmark now sets its own ceiling (1,800 s). WP Statistics's v2 pass went the same way (v1 156 s, + v2 past 300 s), so both are re-measured under it. + + **Then the flow form was the wall, not the ceiling:** pmpro's v2 pass did not finish in 1,800 s either + (the arbiter's `carried` is a `reachableByFlows` per candidate assignment, and 1,040 sink-bearing pairs + of them). So `carried` in evidence mode became STRUCTURE (v3): a field the region reads is assigned, in + its file, from a source expression, from a parameter of the assigning method, or from a same-file + method that reads a source; a hook applied in scope has a registered callback holding one of those. + Milliseconds again (pmpro 266 s, wpstatistics 168 s, mwwpform 69 s): + + | repository | static | v1 (no carried) | v2 (flow carried) | v3 (structural) | tier 4 under v3 | + |---|---|---|---|---|---| + | pmpro | 391 | 116 | timed out | **69** | 555 | + | wpstatistics | 504 | 223 | timed out | **172** | 569 | + | mwwpform | 513 | 292 | **30** | 68 | 84 | + | vampi | 16 | 16 | 16 | 16 | 1 | + + The proxy is too loose: folding "assigned from a parameter" in with "assigned from a source" put 555 + and 569 regions in tier 4 -- every constructor assigns a field from a parameter -- and the CVEs sit in + those tiers on score alone. v4 splits the provenance: source-fed (or fed by a same-file method that + reads a source) promotes to tier 4; parameter-fed only orders within a tier (weight +0.75). Measuring. - **Phase 3 — the LLM ranker.** Same evidence, ordered by a model. Gate: beats phase 2 leave-one-repository-out. If it does not, phase 2 ships and phase 3 does not. diff --git a/benchmarks/ranking/baselines/2026-09-11-evidence-rank-v3.json b/benchmarks/ranking/baselines/2026-09-11-evidence-rank-v3.json new file mode 100644 index 0000000..8f202e2 --- /dev/null +++ b/benchmarks/ranking/baselines/2026-09-11-evidence-rank-v3.json @@ -0,0 +1,3473 @@ +{ + "note": "phase 2, weights v1 + structural carried (source, parameter and one-level-of-call folded together), Joern 4.0.623", + "results": [ + { + "repo": "mwwpform", + "regions": 983, + "distinct_ranks": 5, + "largest_tier_share": 0.817, + "largest_tier_rank": 0.3, + "budget_at_recall": 68, + "known": [ + { + "id": "CVE-2023-6559", + "family": "path", + "site": "classes/services/class.mail.php:259:_delete_files", + "position": 67, + "rank": 0.3, + "in_scope": true, + "reached_transitively": false + } + ], + "head": [ + { + "position": 0, + "tier": 4, + "score": 9.0, + "site": "classes/controllers/class.main.php:_template_redirect", + "rank": 0.3 + }, + { + "position": 1, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.akismet_error.php:input_page", + "rank": 0.3 + }, + { + "position": 2, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.checkbox.php:confirm_page", + "rank": 0.3 + }, + { + "position": 3, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.checkbox.php:input_page", + "rank": 0.3 + }, + { + "position": 4, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.custom-mail-tag.php:input_page", + "rank": 0.3 + }, + { + "position": 5, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.datepicker.php:input_page", + "rank": 0.3 + }, + { + "position": 6, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.email.php:input_page", + "rank": 0.3 + }, + { + "position": 7, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.error.php:input_page", + "rank": 0.3 + }, + { + "position": 8, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.file.php:input_page", + "rank": 0.3 + }, + { + "position": 9, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.image.php:input_page", + "rank": 0.3 + }, + { + "position": 10, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.monthpicker.php:input_page", + "rank": 0.3 + }, + { + "position": 11, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.number.php:input_page", + "rank": 0.3 + }, + { + "position": 12, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.password.php:input_page", + "rank": 0.3 + }, + { + "position": 13, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.radio.php:confirm_page", + "rank": 0.3 + }, + { + "position": 14, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.radio.php:input_page", + "rank": 0.3 + }, + { + "position": 15, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.range.php:input_page", + "rank": 0.3 + }, + { + "position": 16, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.select.php:confirm_page", + "rank": 0.3 + }, + { + "position": 17, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.select.php:input_page", + "rank": 0.3 + }, + { + "position": 18, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.tel.php:input_page", + "rank": 0.3 + }, + { + "position": 19, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.text.php:input_page", + "rank": 0.3 + }, + { + "position": 20, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.textarea.php:input_page", + "rank": 0.3 + }, + { + "position": 21, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.url.php:input_page", + "rank": 0.3 + }, + { + "position": 22, + "tier": 4, + "score": 7.0, + "site": "classes/form-fields/class.zip.php:input_page", + "rank": 0.3 + }, + { + "position": 23, + "tier": 4, + "score": 6.0, + "site": "classes/controllers/class.contact-data-list.php:__construct", + "rank": 0.3 + }, + { + "position": 24, + "tier": 4, + "score": 6.0, + "site": "classes/controllers/class.contact-data-list.php:_add_csv_download_button", + "rank": 0.3 + }, + { + "position": 25, + "tier": 4, + "score": 6.0, + "site": "classes/controllers/class.main.php:_send", + "rank": 0.3 + }, + { + "position": 26, + "tier": 4, + "score": 6.0, + "site": "classes/models/class.csv.php:download", + "rank": 0.3 + }, + { + "position": 27, + "tier": 4, + "score": 6.0, + "site": "tests/classes/services/test-mail-parser.php:save__saved_when_null_but_attachement_files_are_not_saved", + "rank": 0.3 + }, + { + "position": 28, + "tier": 4, + "score": 5.0, + "site": "classes/controllers/class.main.php:_mwform_formkey", + "rank": 1.0 + }, + { + "position": 29, + "tier": 4, + "score": 5.0, + "site": "classes/services/class.mail.php:send_admin_mail", + "rank": 0.3 + }, + { + "position": 30, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_admin_mail_raw__hook_mwform_admin_mail", + "rank": 0.3 + }, + { + "position": 31, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_admin_mail_raw__hook_mwform_admin_mail__Data_in_callback_is_independent", + "rank": 0.3 + }, + { + "position": 32, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_admin_mail_raw__hook_mwform_admin_mail__replace", + "rank": 0.3 + }, + { + "position": 33, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:send_admin_mail__save", + "rank": 0.3 + }, + { + "position": 34, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:send_admin_mail__save__replace_by_hook_mwform_admin_mail", + "rank": 0.3 + }, + { + "position": 35, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:send_admin_mail__save__when_mail_to_is_false", + "rank": 0.3 + }, + { + "position": 36, + "tier": 4, + "score": 5.0, + "site": "tests/classes/services/test-mail.php:send_admin_mail__when_mail_to_is_false", + "rank": 0.3 + }, + { + "position": 37, + "tier": 4, + "score": 4.5, + "site": "classes/validation-rules/class.filesize.php:rule", + "rank": 0.3 + }, + { + "position": 38, + "tier": 4, + "score": 4.0, + "site": "classes/services/class.exec-shortcode.php:_mwform", + "rank": 1.0 + }, + { + "position": 39, + "tier": 4, + "score": 4.0, + "site": "classes/controllers/class.main.php:_file_upload", + "rank": 0.3 + }, + { + "position": 40, + "tier": 4, + "score": 4.0, + "site": "classes/models/class.mail.php:_put_mail_log", + "rank": 0.3 + }, + { + "position": 41, + "tier": 4, + "score": 4.0, + "site": "classes/models/class.mail.php:send", + "rank": 0.3 + }, + { + "position": 42, + "tier": 4, + "score": 4.0, + "site": "classes/services/class.exec-shortcode.php:initialize", + "rank": 0.3 + }, + { + "position": 43, + "tier": 4, + "score": 4.0, + "site": "classes/services/class.mail-parser.php:save", + "rank": 0.3 + }, + { + "position": 44, + "tier": 4, + "score": 4.0, + "site": "classes/services/class.mail.php:send_reply_mail", + "rank": 0.3 + }, + { + "position": 45, + "tier": 4, + "score": 4.0, + "site": "classes/services/class.redirected.php:redirect_js", + "rank": 0.3 + }, + { + "position": 46, + "tier": 4, + "score": 4.0, + "site": "mw-wp-form.php:_current_screen", + "rank": 0.3 + }, + { + "position": 47, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail-parser.php:get_saved_mail_id__saved", + "rank": 0.3 + }, + { + "position": 48, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail-parser.php:save", + "rank": 0.3 + }, + { + "position": 49, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail-parser.php:save__saved_when_null", + "rank": 0.3 + }, + { + "position": 50, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_auto_mail_raw__hook_mwform_auto_mail", + "rank": 0.3 + }, + { + "position": 51, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_auto_mail_raw__hook_mwform_auto_mail__Data_in_callback_is_independent", + "rank": 0.3 + }, + { + "position": 52, + "tier": 4, + "score": 4.0, + "site": "tests/classes/services/test-mail.php:hook_mwform_auto_mail_raw__hook_mwform_auto_mail__replace", + "rank": 0.3 + }, + { + "position": 53, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_admin_mail_options", + "rank": 0.3 + }, + { + "position": 54, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_complete_message", + "rank": 0.3 + }, + { + "position": 55, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_mail_options", + "rank": 0.3 + }, + { + "position": 56, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_settings", + "rank": 0.3 + }, + { + "position": 57, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_style", + "rank": 0.3 + }, + { + "position": 58, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_url", + "rank": 0.3 + }, + { + "position": 59, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.admin.php:_validation_rule", + "rank": 0.3 + }, + { + "position": 60, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.chart.php:_index", + "rank": 0.3 + }, + { + "position": 61, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.contact-data-list.php:_add_form_columns", + "rank": 0.3 + }, + { + "position": 62, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.contact-data.php:_detail", + "rank": 0.3 + }, + { + "position": 63, + "tier": 4, + "score": 3.0, + "site": "classes/controllers/class.stores-inquiry-data-form-list.php:_index", + "rank": 0.3 + }, + { + "position": 64, + "tier": 4, + "score": 3.0, + "site": "classes/models/class.contact-data-setting.php:get_posts", + "rank": 0.3 + }, + { + "position": 65, + "tier": 4, + "score": 3.0, + "site": "classes/models/class.validation.php:check", + "rank": 0.3 + }, + { + "position": 66, + "tier": 4, + "score": 3.0, + "site": "classes/models/class.validation.php:single_check", + "rank": 0.3 + }, + { + "position": 67, + "tier": 4, + "score": 3.0, + "site": "classes/services/class.mail.php:_delete_files", + "rank": 0.3 + }, + { + "position": 68, + "tier": 4, + "score": 3.0, + "site": "mw-wp-form.php:__construct", + "rank": 0.3 + }, + { + "position": 69, + "tier": 3, + "score": 5.5, + "site": "classes/abstract/class.form-field.php:confirm_page", + "rank": 0.3 + }, + { + "position": 70, + "tier": 3, + "score": 5.5, + "site": "classes/abstract/class.form-field.php:input_page", + "rank": 0.3 + }, + { + "position": 71, + "tier": 3, + "score": 5.5, + "site": "classes/abstract/class.form-field.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 72, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.akismet_error.php:confirm_page", + "rank": 0.3 + }, + { + "position": 73, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.back-button.php:confirm_page", + "rank": 0.3 + }, + { + "position": 74, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.back-button.php:input_page", + "rank": 0.3 + }, + { + "position": 75, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.back-button.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 76, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-back.php:confirm_page", + "rank": 0.3 + }, + { + "position": 77, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-back.php:input_page", + "rank": 0.3 + }, + { + "position": 78, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-back.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 79, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-button.php:confirm_page", + "rank": 0.3 + }, + { + "position": 80, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-button.php:input_page", + "rank": 0.3 + }, + { + "position": 81, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-button.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 82, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-confirm.php:confirm_page", + "rank": 0.3 + }, + { + "position": 83, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-confirm.php:input_page", + "rank": 0.3 + }, + { + "position": 84, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-confirm.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 85, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-submit.php:confirm_page", + "rank": 0.3 + }, + { + "position": 86, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-submit.php:input_page", + "rank": 0.3 + }, + { + "position": 87, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button-submit.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 88, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button.php:confirm_page", + "rank": 0.3 + }, + { + "position": 89, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button.php:input_page", + "rank": 0.3 + }, + { + "position": 90, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.button.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 91, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.checkbox.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 92, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.confirm-button.php:confirm_page", + "rank": 0.3 + }, + { + "position": 93, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.confirm-button.php:input_page", + "rank": 0.3 + }, + { + "position": 94, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.confirm-button.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 95, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.custom-mail-tag.php:confirm_page", + "rank": 0.3 + }, + { + "position": 96, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.custom-mail-tag.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 97, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.datepicker.php:confirm_page", + "rank": 0.3 + }, + { + "position": 98, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.datepicker.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 99, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.email.php:confirm_page", + "rank": 0.3 + }, + { + "position": 100, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.email.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 101, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.error.php:confirm_page", + "rank": 0.3 + }, + { + "position": 102, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.error.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 103, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.file.php:confirm_page", + "rank": 0.3 + }, + { + "position": 104, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.file.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 105, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.hidden.php:confirm_page", + "rank": 0.3 + }, + { + "position": 106, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.hidden.php:input_page", + "rank": 0.3 + }, + { + "position": 107, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.hidden.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 108, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.image.php:confirm_page", + "rank": 0.3 + }, + { + "position": 109, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.image.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 110, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.monthpicker.php:confirm_page", + "rank": 0.3 + }, + { + "position": 111, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.monthpicker.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 112, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.number.php:confirm_page", + "rank": 0.3 + }, + { + "position": 113, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.number.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 114, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.password.php:confirm_page", + "rank": 0.3 + }, + { + "position": 115, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.password.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 116, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.radio.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 117, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.range.php:confirm_page", + "rank": 0.3 + }, + { + "position": 118, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.range.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 119, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.select.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 120, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit-button.php:confirm_page", + "rank": 0.3 + }, + { + "position": 121, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit-button.php:input_page", + "rank": 0.3 + }, + { + "position": 122, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit-button.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 123, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit.php:confirm_page", + "rank": 0.3 + }, + { + "position": 124, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit.php:input_page", + "rank": 0.3 + }, + { + "position": 125, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.submit.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 126, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.tel.php:confirm_page", + "rank": 0.3 + }, + { + "position": 127, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.tel.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 128, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.text.php:confirm_page", + "rank": 0.3 + }, + { + "position": 129, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.text.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 130, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.textarea.php:confirm_page", + "rank": 0.3 + }, + { + "position": 131, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.textarea.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 132, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.url.php:confirm_page", + "rank": 0.3 + }, + { + "position": 133, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.url.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 134, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.zip.php:confirm_page", + "rank": 0.3 + }, + { + "position": 135, + "tier": 3, + "score": 5.5, + "site": "classes/form-fields/class.zip.php:mwform_tag_generator_dialog", + "rank": 0.3 + }, + { + "position": 136, + "tier": 3, + "score": 5.5, + "site": "classes/models/class.data.php:regenerate_upload_file_keys", + "rank": 0.3 + }, + { + "position": 137, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.akismet.php:admin", + "rank": 0.3 + }, + { + "position": 138, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.alpha.php:admin", + "rank": 0.3 + }, + { + "position": 139, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.alphanumeric.php:admin", + "rank": 0.3 + }, + { + "position": 140, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.between.php:admin", + "rank": 0.3 + }, + { + "position": 141, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.date.php:admin", + "rank": 0.3 + }, + { + "position": 142, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.eq.php:admin", + "rank": 0.3 + }, + { + "position": 143, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.filesize.php:admin", + "rank": 0.3 + }, + { + "position": 144, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.filetype.php:admin", + "rank": 0.3 + }, + { + "position": 145, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.hiragana.php:admin", + "rank": 0.3 + }, + { + "position": 146, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.in.php:admin", + "rank": 0.3 + }, + { + "position": 147, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.kana.php:admin", + "rank": 0.3 + }, + { + "position": 148, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.katakana.php:admin", + "rank": 0.3 + }, + { + "position": 149, + "tier": 3, + "score": 5.5, + "site": "classes/validation-rules/class.mail.php:admin", + "rank": 0.3 + } + ], + "build_seconds": 38.3, + "evidence_seconds": 69.3, + "pairs": 4915, + "pairs_unanswered": 0, + "tier_counts": { + "0": 4511, + "1": 37, + "3": 283, + "4": 84 + } + }, + { + "repo": "pmpro", + "regions": 4463, + "distinct_ranks": 5, + "largest_tier_share": 0.838, + "largest_tier_rank": 0.3, + "budget_at_recall": 69, + "known": [ + { + "id": "CVE-2023-23488", + "family": "injection", + "site": "classes/class.memberorder.php:936:getMemberOrderByCode", + "position": 68, + "rank": 0.3, + "in_scope": true, + "reached_transitively": false + } + ], + "head": [ + { + "position": 0, + "tier": 4, + "score": 11.0, + "site": "shortcodes/pmpro_member_profile_edit.php:pmpro_shortcode_member_profile_edit", + "rank": 1.0 + }, + { + "position": 1, + "tier": 4, + "score": 10.0, + "site": "includes/email.php:pmpro_email_templates_send_test", + "rank": 0.8 + }, + { + "position": 2, + "tier": 4, + "score": 10.0, + "site": "includes/services.php:pmpro_get_order_json", + "rank": 0.8 + }, + { + "position": 3, + "tier": 4, + "score": 10.0, + "site": "adminpages/functions.php:pmpro_add_email_order_modal", + "rank": 0.3 + }, + { + "position": 4, + "tier": 4, + "score": 10.0, + "site": "classes/class-pmpro-field.php:displayAtCheckout", + "rank": 0.3 + }, + { + "position": 5, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_cybersource.php:authorize", + "rank": 0.3 + }, + { + "position": 6, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_cybersource.php:charge", + "rank": 0.3 + }, + { + "position": 7, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_payflowpro.php:authorize", + "rank": 0.3 + }, + { + "position": 8, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_payflowpro.php:charge", + "rank": 0.3 + }, + { + "position": 9, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_paypal.php:authorize", + "rank": 0.3 + }, + { + "position": 10, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_paypal.php:charge", + "rank": 0.3 + }, + { + "position": 11, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:pmpro_checkout_confirmed", + "rank": 0.3 + }, + { + "position": 12, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_payment_option_fields", + "rank": 0.3 + }, + { + "position": 13, + "tier": 4, + "score": 10.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:user_profile_fields_save", + "rank": 0.3 + }, + { + "position": 14, + "tier": 4, + "score": 10.0, + "site": "includes/functions.php:pmpro_changeMembershipLevel", + "rank": 0.3 + }, + { + "position": 15, + "tier": 4, + "score": 10.0, + "site": "includes/profile.php:pmpro_member_profile_edit_form", + "rank": 0.3 + }, + { + "position": 16, + "tier": 4, + "score": 10.0, + "site": "includes/profile.php:pmpro_membership_level_profile_fields_update", + "rank": 0.3 + }, + { + "position": 17, + "tier": 4, + "score": 10.0, + "site": "includes/updates/upgrade_1_8_9_3.php:pmpro_upgrade_1_8_9_3_ajax", + "rank": 0.3 + }, + { + "position": 18, + "tier": 4, + "score": 10.0, + "site": "services/ipnhandler.php:pmpro_ipnChangeMembershipLevel", + "rank": 0.3 + }, + { + "position": 19, + "tier": 4, + "score": 10.0, + "site": "services/ipnhandler.php:pmpro_ipnFailedPayment", + "rank": 0.3 + }, + { + "position": 20, + "tier": 4, + "score": 10.0, + "site": "services/ipnhandler.php:pmpro_ipnSaveOrder", + "rank": 0.3 + }, + { + "position": 21, + "tier": 4, + "score": 10.0, + "site": "services/stripe-webhook.php:pmpro_stripe_webhook_change_membership_level", + "rank": 0.3 + }, + { + "position": 22, + "tier": 4, + "score": 10.0, + "site": "services/twocheckout-ins.php:pmpro_insChangeMembershipLevel", + "rank": 0.3 + }, + { + "position": 23, + "tier": 4, + "score": 10.0, + "site": "services/twocheckout-ins.php:pmpro_insSaveOrder", + "rank": 0.3 + }, + { + "position": 24, + "tier": 4, + "score": 9.0, + "site": "classes/class-pmpro-wisdom-tracker.php:marketing_notice", + "rank": 0.3 + }, + { + "position": 25, + "tier": 4, + "score": 9.0, + "site": "classes/class-pmpro-wisdom-tracker.php:optin_notice", + "rank": 0.3 + }, + { + "position": 26, + "tier": 4, + "score": 9.0, + "site": "classes/gateways/class.pmprogateway_braintree.php:cancel", + "rank": 0.3 + }, + { + "position": 27, + "tier": 4, + "score": 9.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:cancel", + "rank": 0.3 + }, + { + "position": 28, + "tier": 4, + "score": 9.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:cancel", + "rank": 0.3 + }, + { + "position": 29, + "tier": 4, + "score": 9.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_checkout_before_change_membership_level", + "rank": 0.3 + }, + { + "position": 30, + "tier": 4, + "score": 8.5, + "site": "includes/notifications.php:pmpro_notifications", + "rank": 0.8 + }, + { + "position": 31, + "tier": 4, + "score": 8.5, + "site": "adminpages/reports/login.php:pmpro_report_login_page", + "rank": 0.3 + }, + { + "position": 32, + "tier": 4, + "score": 8.5, + "site": "adminpages/reports/memberships.php:pmpro_report_memberships_page", + "rank": 0.3 + }, + { + "position": 33, + "tier": 4, + "score": 8.5, + "site": "adminpages/reports/sales.php:pmpro_report_sales_page", + "rank": 0.3 + }, + { + "position": 34, + "tier": 4, + "score": 8.5, + "site": "classes/class-pmpro-field.php:saveFile", + "rank": 0.3 + }, + { + "position": 35, + "tier": 4, + "score": 8.5, + "site": "classes/class-pmpro-members-list-table.php:no_items", + "rank": 0.3 + }, + { + "position": 36, + "tier": 4, + "score": 8.5, + "site": "classes/gateways/class.pmprogateway_braintree.php:pmpro_include_payment_information_fields", + "rank": 0.3 + }, + { + "position": 37, + "tier": 4, + "score": 8.5, + "site": "includes/addons.php:pmpro_admin_init_updating_plugins", + "rank": 0.3 + }, + { + "position": 38, + "tier": 4, + "score": 8.5, + "site": "includes/functions.php:pmpro_get_ip", + "rank": 0.3 + }, + { + "position": 39, + "tier": 4, + "score": 8.5, + "site": "includes/login.php:pmpro_login_forms_handler", + "rank": 0.3 + }, + { + "position": 40, + "tier": 4, + "score": 8.5, + "site": "includes/login.php:pmpro_reset_password_form", + "rank": 0.3 + }, + { + "position": 41, + "tier": 4, + "score": 8.5, + "site": "includes/scripts.php:pmpro_enqueue_scripts", + "rank": 0.3 + }, + { + "position": 42, + "tier": 4, + "score": 8.5, + "site": "services/ipnhandler.php:pmpro_ipnValidate", + "rank": 0.3 + }, + { + "position": 43, + "tier": 4, + "score": 8.0, + "site": "shortcodes/pmpro_account.php:pmpro_shortcode_account", + "rank": 1.0 + }, + { + "position": 44, + "tier": 4, + "score": 8.0, + "site": "shortcodes/pmpro_member.php:pmpro_member_shortcode", + "rank": 1.0 + }, + { + "position": 45, + "tier": 4, + "score": 8.0, + "site": "includes/cleanup.php:pmpro_delete_user", + "rank": 0.3 + }, + { + "position": 46, + "tier": 4, + "score": 8.0, + "site": "includes/compatibility/divi.php:__construct", + "rank": 0.3 + }, + { + "position": 47, + "tier": 4, + "score": 8.0, + "site": "includes/functions.php:pmpro_cancelMembershipLevel", + "rank": 0.3 + }, + { + "position": 48, + "tier": 4, + "score": 8.0, + "site": "includes/profile.php:pmpro_membership_history_email_modal", + "rank": 0.3 + }, + { + "position": 49, + "tier": 4, + "score": 8.0, + "site": "includes/upgradecheck.php:pmpro_checkForUpgrades", + "rank": 0.3 + }, + { + "position": 50, + "tier": 4, + "score": 8.0, + "site": "scheduled/crons.php:pmpro_cron_expire_memberships", + "rank": 0.3 + }, + { + "position": 51, + "tier": 4, + "score": 8.0, + "site": "services/twocheckout-ins.php:pmpro_insRecurringRestarted", + "rank": 0.3 + }, + { + "position": 52, + "tier": 4, + "score": 8.0, + "site": "services/twocheckout-ins.php:pmpro_insRecurringStopped", + "rank": 0.3 + }, + { + "position": 53, + "tier": 4, + "score": 7.5, + "site": "shortcodes/pmpro_login.php:pmpro_shortcode_login", + "rank": 1.0 + }, + { + "position": 54, + "tier": 4, + "score": 7.0, + "site": "includes/recaptcha.php:pmpro_wp_ajax_validate_recaptcha", + "rank": 1.0 + }, + { + "position": 55, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-wisdom-tracker.php:goodbye_form_callback", + "rank": 0.8 + }, + { + "position": 56, + "tier": 4, + "score": 7.0, + "site": "includes/rest-api.php:pmpro_rest_api_get_order", + "rank": 0.8 + }, + { + "position": 57, + "tier": 4, + "score": 7.0, + "site": "adminpages/dashboard.php:pmpro_dashboard_report_recent_orders_callback", + "rank": 0.3 + }, + { + "position": 58, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-admin-activity-email.php:sendAdminActivity", + "rank": 0.3 + }, + { + "position": 59, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-field.php:displayInProfile", + "rank": 0.3 + }, + { + "position": 60, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-levels.php:delete", + "rank": 0.3 + }, + { + "position": 61, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-site-health.php:debug_information", + "rank": 0.3 + }, + { + "position": 62, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-wisdom-tracker.php:__construct", + "rank": 0.3 + }, + { + "position": 63, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-wisdom-tracker.php:get_data", + "rank": 0.3 + }, + { + "position": 64, + "tier": 4, + "score": 7.0, + "site": "classes/class-pmpro-wisdom-tracker.php:goodbye_ajax", + "rank": 0.3 + }, + { + "position": 65, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:__construct", + "rank": 0.3 + }, + { + "position": 66, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:cancel", + "rank": 0.3 + }, + { + "position": 67, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:getLastMemberOrder", + "rank": 0.3 + }, + { + "position": 68, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:getMemberOrderByCode", + "rank": 0.3 + }, + { + "position": 69, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:getMemberOrderByPayPalToken", + "rank": 0.3 + }, + { + "position": 70, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:get_order", + "rank": 0.3 + }, + { + "position": 71, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:get_orders", + "rank": 0.3 + }, + { + "position": 72, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:get_original_subscription_order", + "rank": 0.3 + }, + { + "position": 73, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:saveOrder", + "rank": 0.3 + }, + { + "position": 74, + "tier": 4, + "score": 7.0, + "site": "classes/class.memberorder.php:updateTimestamp", + "rank": 0.3 + }, + { + "position": 75, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:add_from_to_headers", + "rank": 0.3 + }, + { + "position": 76, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendAdminChangeAdminEmail", + "rank": 0.3 + }, + { + "position": 77, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendAdminChangeEmail", + "rank": 0.3 + }, + { + "position": 78, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendBillableInvoiceEmail", + "rank": 0.3 + }, + { + "position": 79, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendBillingAdminEmail", + "rank": 0.3 + }, + { + "position": 80, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendBillingEmail", + "rank": 0.3 + }, + { + "position": 81, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendBillingFailureAdminEmail", + "rank": 0.3 + }, + { + "position": 82, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendBillingFailureEmail", + "rank": 0.3 + }, + { + "position": 83, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendCancelAdminEmail", + "rank": 0.3 + }, + { + "position": 84, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendCancelEmail", + "rank": 0.3 + }, + { + "position": 85, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendCheckoutAdminEmail", + "rank": 0.3 + }, + { + "position": 86, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendCheckoutEmail", + "rank": 0.3 + }, + { + "position": 87, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendCreditCardExpiringEmail", + "rank": 0.3 + }, + { + "position": 88, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendEmail", + "rank": 0.3 + }, + { + "position": 89, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendInvoiceEmail", + "rank": 0.3 + }, + { + "position": 90, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendMembershipExpiredEmail", + "rank": 0.3 + }, + { + "position": 91, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendMembershipExpiringEmail", + "rank": 0.3 + }, + { + "position": 92, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendPaymentActionRequiredAdminEmail", + "rank": 0.3 + }, + { + "position": 93, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendPaymentActionRequiredEmail", + "rank": 0.3 + }, + { + "position": 94, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendRefundedAdminEmail", + "rank": 0.3 + }, + { + "position": 95, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendRefundedEmail", + "rank": 0.3 + }, + { + "position": 96, + "tier": 4, + "score": 7.0, + "site": "classes/class.pmproemail.php:sendTrialEndingEmail", + "rank": 0.3 + }, + { + "position": 97, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway.php:authorize", + "rank": 0.3 + }, + { + "position": 98, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway.php:charge", + "rank": 0.3 + }, + { + "position": 99, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_authorizenet.php:authorize", + "rank": 0.3 + }, + { + "position": 100, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_authorizenet.php:cancel", + "rank": 0.3 + }, + { + "position": 101, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_authorizenet.php:charge", + "rank": 0.3 + }, + { + "position": 102, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_authorizenet.php:subscribe", + "rank": 0.3 + }, + { + "position": 103, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_authorizenet.php:update", + "rank": 0.3 + }, + { + "position": 104, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_braintree.php:charge", + "rank": 0.3 + }, + { + "position": 105, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_braintree.php:pmpro_next_payment", + "rank": 0.3 + }, + { + "position": 106, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_check.php:authorize", + "rank": 0.3 + }, + { + "position": 107, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_check.php:charge", + "rank": 0.3 + }, + { + "position": 108, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypal.php:cancel", + "rank": 0.3 + }, + { + "position": 109, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:charge", + "rank": 0.3 + }, + { + "position": 110, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:confirm", + "rank": 0.3 + }, + { + "position": 111, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:getExpressCheckoutDetails", + "rank": 0.3 + }, + { + "position": 112, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:pmpro_next_payment", + "rank": 0.3 + }, + { + "position": 113, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:process", + "rank": 0.3 + }, + { + "position": 114, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:process_refund", + "rank": 0.3 + }, + { + "position": 115, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:setExpressCheckout", + "rank": 0.3 + }, + { + "position": 116, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_paypalexpress.php:subscribe", + "rank": 0.3 + }, + { + "position": 117, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:charge", + "rank": 0.3 + }, + { + "position": 118, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:get_customer_for_user", + "rank": 0.3 + }, + { + "position": 119, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_billing_preheader_stripe_checkout", + "rank": 0.3 + }, + { + "position": 120, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_checkout_before_processing", + "rank": 0.3 + }, + { + "position": 121, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_cron_stripe_subscription_updates", + "rank": 0.3 + }, + { + "position": 122, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:pmpro_next_payment", + "rank": 0.3 + }, + { + "position": 123, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:process", + "rank": 0.3 + }, + { + "position": 124, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:process_refund", + "rank": 0.3 + }, + { + "position": 125, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:refund", + "rank": 0.3 + }, + { + "position": 126, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:show_stripe_checkout_pending_warning", + "rank": 0.3 + }, + { + "position": 127, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:updateSubscription", + "rank": 0.3 + }, + { + "position": 128, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:update_customer_at_checkout", + "rank": 0.3 + }, + { + "position": 129, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:update_customer_from_user", + "rank": 0.3 + }, + { + "position": 130, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:user_profile_fields", + "rank": 0.3 + }, + { + "position": 131, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_stripe.php:void", + "rank": 0.3 + }, + { + "position": 132, + "tier": 4, + "score": 7.0, + "site": "classes/gateways/class.pmprogateway_twocheckout.php:cancel", + "rank": 0.3 + }, + { + "position": 133, + "tier": 4, + "score": 7.0, + "site": "includes/email.php:pmpro_email_templates_email_data", + "rank": 0.3 + }, + { + "position": 134, + "tier": 4, + "score": 7.0, + "site": "includes/filters.php:pmpro_pmpro_subscribe_order_startdate_limit", + "rank": 0.3 + }, + { + "position": 135, + "tier": 4, + "score": 7.0, + "site": "includes/functions.php:pmpro_build_order_for_checkout", + "rank": 0.3 + }, + { + "position": 136, + "tier": 4, + "score": 7.0, + "site": "includes/functions.php:pmpro_next_payment", + "rank": 0.3 + }, + { + "position": 137, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/GraphQL.php:request", + "rank": 0.3 + }, + { + "position": 138, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:_doRequest", + "rank": 0.3 + }, + { + "position": 139, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:_doUrlRequest", + "rank": 0.3 + }, + { + "position": 140, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:delete", + "rank": 0.3 + }, + { + "position": 141, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:get", + "rank": 0.3 + }, + { + "position": 142, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:post", + "rank": 0.3 + }, + { + "position": 143, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:postMultipart", + "rank": 0.3 + }, + { + "position": 144, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Http.php:put", + "rank": 0.3 + }, + { + "position": 145, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/Transaction.php:void", + "rank": 0.3 + }, + { + "position": 146, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Braintree/lib/Braintree/TransactionGateway.php:void", + "rank": 0.3 + }, + { + "position": 147, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Stripe/lib/Account.php:deauthorize", + "rank": 0.3 + }, + { + "position": 148, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Stripe/lib/ApiOperations/Request.php:_staticRequest", + "rank": 0.3 + }, + { + "position": 149, + "tier": 4, + "score": 7.0, + "site": "includes/lib/Stripe/lib/ApiRequestor.php:_requestRaw", + "rank": 0.3 + } + ], + "build_seconds": 87.9, + "evidence_seconds": 266.4, + "pairs": 22315, + "pairs_unanswered": 0, + "tier_counts": { + "0": 21275, + "1": 74, + "2": 86, + "3": 325, + "4": 555 + } + }, + { + "repo": "vampi", + "regions": 25, + "distinct_ranks": 5, + "largest_tier_share": 0.36, + "largest_tier_rank": 1.0, + "budget_at_recall": 16, + "known": [ + { + "id": "VAmPI-SQLI", + "family": "injection", + "site": "models/user_model.py:73:get_user", + "position": null, + "rank": null, + "in_scope": true, + "reached_transitively": true + }, + { + "id": "VAmPI-BOLA", + "family": "access_control", + "site": "api_views/users.py:187:update_password", + "position": 15, + "rank": 0.8, + "in_scope": true, + "reached_transitively": false + }, + { + "id": "VAmPI-BOLA-BOOKS", + "family": "access_control", + "site": "api_views/books.py:51:get_by_title", + "position": 10, + "rank": 0.8, + "in_scope": true, + "reached_transitively": false + } + ], + "head": [ + { + "position": 0, + "tier": 4, + "score": 2.5, + "site": "api_views/users.py:get_by_username", + "rank": 1.0 + }, + { + "position": 1, + "tier": 1, + "score": 3.0, + "site": "models/user_model.py:", + "rank": 1.0 + }, + { + "position": 2, + "tier": 0, + "score": 0.0, + "site": "api_views/books.py:get_all_books", + "rank": 1.0 + }, + { + "position": 3, + "tier": 0, + "score": 0.0, + "site": "api_views/main.py:basic", + "rank": 1.0 + }, + { + "position": 4, + "tier": 0, + "score": 0.0, + "site": "api_views/main.py:populate_db", + "rank": 1.0 + }, + { + "position": 5, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:debug", + "rank": 1.0 + }, + { + "position": 6, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:get_all_users", + "rank": 1.0 + }, + { + "position": 7, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:login_user", + "rank": 1.0 + }, + { + "position": 8, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:register_user", + "rank": 1.0 + }, + { + "position": 9, + "tier": 0, + "score": 0.0, + "site": "api_views/books.py:add_new_book", + "rank": 0.8 + }, + { + "position": 10, + "tier": 0, + "score": 0.0, + "site": "api_views/books.py:get_by_title", + "rank": 0.8 + }, + { + "position": 11, + "tier": 0, + "score": 0.0, + "site": "api_views/json_schemas.py:", + "rank": 0.8 + }, + { + "position": 12, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:delete_user", + "rank": 0.8 + }, + { + "position": 13, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:me", + "rank": 0.8 + }, + { + "position": 14, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:update_email", + "rank": 0.8 + }, + { + "position": 15, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:update_password", + "rank": 0.8 + }, + { + "position": 16, + "tier": 0, + "score": 0.0, + "site": "app.py:", + "rank": 0.2 + }, + { + "position": 17, + "tier": 0, + "score": 0.0, + "site": "api_views/books.py:", + "rank": 0.15 + }, + { + "position": 18, + "tier": 0, + "score": 0.0, + "site": "api_views/main.py:", + "rank": 0.15 + }, + { + "position": 19, + "tier": 0, + "score": 0.0, + "site": "api_views/users.py:", + "rank": 0.15 + }, + { + "position": 20, + "tier": 0, + "score": 0.0, + "site": "api_views/__init__.py:", + "rank": 0.1 + }, + { + "position": 21, + "tier": 0, + "score": 0.0, + "site": "config.py:", + "rank": 0.1 + }, + { + "position": 22, + "tier": 0, + "score": 0.0, + "site": "database/__init__.py:", + "rank": 0.1 + }, + { + "position": 23, + "tier": 0, + "score": 0.0, + "site": "models/__init__.py:", + "rank": 0.1 + }, + { + "position": 24, + "tier": 0, + "score": 0.0, + "site": "models/books_model.py:", + "rank": 0.1 + } + ], + "build_seconds": 6.0, + "evidence_seconds": 18.2, + "pairs": 125, + "pairs_unanswered": 0, + "tier_counts": { + "0": 123, + "1": 1, + "4": 1 + } + }, + { + "repo": "wpstatistics", + "regions": 1673, + "distinct_ranks": 6, + "largest_tier_share": 0.753, + "largest_tier_rank": 0.3, + "budget_at_recall": 172, + "known": [ + { + "id": "CVE-2022-25148", + "family": "injection", + "site": "includes/class-wp-statistics-pages.php:225:record", + "position": 171, + "rank": 0.3, + "in_scope": true, + "reached_transitively": false + } + ], + "head": [ + { + "position": 0, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-authors.php:__construct", + "rank": 0.3 + }, + { + "position": 1, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-authors.php:view", + "rank": 0.3 + }, + { + "position": 2, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-category.php:__construct", + "rank": 0.3 + }, + { + "position": 3, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-category.php:view", + "rank": 0.3 + }, + { + "position": 4, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-optimization.php:save", + "rank": 0.3 + }, + { + "position": 5, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-pages.php:__construct", + "rank": 0.3 + }, + { + "position": 6, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-refer.php:view", + "rank": 0.3 + }, + { + "position": 7, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-tags.php:__construct", + "rank": 0.3 + }, + { + "position": 8, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-tags.php:view", + "rank": 0.3 + }, + { + "position": 9, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-top-visitors-today.php:__construct", + "rank": 0.3 + }, + { + "position": 10, + "tier": 4, + "score": 10.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-visitors.php:view", + "rank": 0.3 + }, + { + "position": 11, + "tier": 4, + "score": 8.5, + "site": "includes/admin/class-wp-statistics-admin-ajax.php:visitors_page_filters_action_callback", + "rank": 0.3 + }, + { + "position": 12, + "tier": 4, + "score": 8.5, + "site": "includes/admin/class-wp-statistics-admin-assets.php:admin_scripts", + "rank": 0.3 + }, + { + "position": 13, + "tier": 4, + "score": 8.5, + "site": "includes/admin/class-wp-statistics-admin-assets.php:wps_global", + "rank": 0.3 + }, + { + "position": 14, + "tier": 4, + "score": 8.5, + "site": "includes/admin/class-wp-statistics-admin-export.php:export_data", + "rank": 0.3 + }, + { + "position": 15, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-optimization.php:optimize_table", + "rank": 0.3 + }, + { + "position": 16, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-plugins.php:view", + "rank": 0.3 + }, + { + "position": 17, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-settings.php:notice", + "rank": 0.3 + }, + { + "position": 18, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-settings.php:save_external_option", + "rank": 0.3 + }, + { + "position": 19, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-top-visitors-today.php:view", + "rank": 0.3 + }, + { + "position": 20, + "tier": 4, + "score": 8.5, + "site": "includes/admin/pages/class-wp-statistics-admin-page-words.php:view", + "rank": 0.3 + }, + { + "position": 21, + "tier": 4, + "score": 8.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-hitsmap.php:get", + "rank": 0.3 + }, + { + "position": 22, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-browsers.php:__construct", + "rank": 0.3 + }, + { + "position": 23, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-browsers.php:view", + "rank": 0.3 + }, + { + "position": 24, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-country.php:__construct", + "rank": 0.3 + }, + { + "position": 25, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-country.php:view", + "rank": 0.3 + }, + { + "position": 26, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-exclusions.php:__construct", + "rank": 0.3 + }, + { + "position": 27, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-exclusions.php:view", + "rank": 0.3 + }, + { + "position": 28, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-hits.php:__construct", + "rank": 0.3 + }, + { + "position": 29, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-hits.php:view", + "rank": 0.3 + }, + { + "position": 30, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-online.php:__construct", + "rank": 0.3 + }, + { + "position": 31, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-online.php:view", + "rank": 0.3 + }, + { + "position": 32, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-optimization.php:__construct", + "rank": 0.3 + }, + { + "position": 33, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-pages.php:custom_page_statistics", + "rank": 0.3 + }, + { + "position": 34, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-pages.php:view", + "rank": 0.3 + }, + { + "position": 35, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-platforms.php:__construct", + "rank": 0.3 + }, + { + "position": 36, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-platforms.php:view", + "rank": 0.3 + }, + { + "position": 37, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-plugins.php:__construct", + "rank": 0.3 + }, + { + "position": 38, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-refer.php:__construct", + "rank": 0.3 + }, + { + "position": 39, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-searches.php:__construct", + "rank": 0.3 + }, + { + "position": 40, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-searches.php:view", + "rank": 0.3 + }, + { + "position": 41, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-settings.php:__construct", + "rank": 0.3 + }, + { + "position": 42, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-visitors.php:__construct", + "rank": 0.3 + }, + { + "position": 43, + "tier": 4, + "score": 8.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-words.php:__construct", + "rank": 0.3 + }, + { + "position": 44, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics-geoip.php:getCity", + "rank": 0.3 + }, + { + "position": 45, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics-geoip.php:getCountry", + "rank": 0.3 + }, + { + "position": 46, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics-hits.php:__construct", + "rank": 0.3 + }, + { + "position": 47, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics-referred.php:get", + "rank": 0.3 + }, + { + "position": 48, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics-schedule.php:__construct", + "rank": 0.3 + }, + { + "position": 49, + "tier": 4, + "score": 8.0, + "site": "includes/class-wp-statistics.php:plugin_setup", + "rank": 0.3 + }, + { + "position": 50, + "tier": 4, + "score": 8.0, + "site": "includes/template-functions.php:wp_statistics_pages", + "rank": 0.3 + }, + { + "position": 51, + "tier": 4, + "score": 8.0, + "site": "includes/vendor/jaybizzle/crawler-detect/src/CrawlerDetect.php:__construct", + "rank": 0.3 + }, + { + "position": 52, + "tier": 4, + "score": 8.0, + "site": "includes/vendor/maxmind/web-service-common/src/WebService/Client.php:__construct", + "rank": 0.3 + }, + { + "position": 53, + "tier": 4, + "score": 7.5, + "site": "includes/admin/class-wp-statistics-admin-ajax.php:empty_table_action_callback", + "rank": 0.3 + }, + { + "position": 54, + "tier": 4, + "score": 7.0, + "site": "includes/admin/TinyMCE/class-wp-statistics-tinymce.php:__construct", + "rank": 0.3 + }, + { + "position": 55, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-ajax.php:__construct", + "rank": 0.3 + }, + { + "position": 56, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-assets.php:__construct", + "rank": 0.3 + }, + { + "position": 57, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-dashboard.php:__construct", + "rank": 0.3 + }, + { + "position": 58, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-dashboard.php:load_dashboard_widget", + "rank": 0.3 + }, + { + "position": 59, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-dashboard.php:set_user_hidden_dashboard_option", + "rank": 0.3 + }, + { + "position": 60, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-export.php:__construct", + "rank": 0.3 + }, + { + "position": 61, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-network.php:__construct", + "rank": 0.3 + }, + { + "position": 62, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-notices.php:__construct", + "rank": 0.3 + }, + { + "position": 63, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-post.php:__construct", + "rank": 0.3 + }, + { + "position": 64, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-taxonomy.php:__construct", + "rank": 0.3 + }, + { + "position": 65, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-template.php:DateRange", + "rank": 0.3 + }, + { + "position": 66, + "tier": 4, + "score": 7.0, + "site": "includes/admin/class-wp-statistics-admin-user.php:__construct", + "rank": 0.3 + }, + { + "position": 67, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-about.php:get", + "rank": 0.3 + }, + { + "position": 68, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-browsers.php:get", + "rank": 0.3 + }, + { + "position": 69, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-countries.php:get", + "rank": 0.3 + }, + { + "position": 70, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-exclusions.php:get", + "rank": 0.3 + }, + { + "position": 71, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-hits.php:get", + "rank": 0.3 + }, + { + "position": 72, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-pages-chart.php:get", + "rank": 0.3 + }, + { + "position": 73, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-pages.php:get", + "rank": 0.3 + }, + { + "position": 74, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-platforms.php:get", + "rank": 0.3 + }, + { + "position": 75, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-post.php:get", + "rank": 0.3 + }, + { + "position": 76, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-quickstats.php:get", + "rank": 0.3 + }, + { + "position": 77, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-referring.php:get", + "rank": 0.3 + }, + { + "position": 78, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-search.php:get", + "rank": 0.3 + }, + { + "position": 79, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-summary.php:get", + "rank": 0.3 + }, + { + "position": 80, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-top-pages-chart.php:get", + "rank": 0.3 + }, + { + "position": 81, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-top-visitors.php:get", + "rank": 0.3 + }, + { + "position": 82, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-useronline.php:get", + "rank": 0.3 + }, + { + "position": 83, + "tier": 4, + "score": 7.0, + "site": "includes/admin/meta-box/wp-statistics-meta-box-words.php:get", + "rank": 0.3 + }, + { + "position": 84, + "tier": 4, + "score": 7.0, + "site": "includes/admin/pages/class-wp-statistics-admin-page-overview.php:__construct", + "rank": 0.3 + }, + { + "position": 85, + "tier": 4, + "score": 7.0, + "site": "includes/api/v2/class-wp-statistics-api-hit.php:__construct", + "rank": 0.3 + }, + { + "position": 86, + "tier": 4, + "score": 7.0, + "site": "includes/api/v2/class-wp-statistics-api-meta-box.php:__construct", + "rank": 0.3 + }, + { + "position": 87, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-admin-bar.php:__construct", + "rank": 0.3 + }, + { + "position": 88, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-cli.php:online", + "rank": 0.3 + }, + { + "position": 89, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-exclusion.php:exclusion_robot_threshold", + "rank": 0.3 + }, + { + "position": 90, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-frontend.php:__construct", + "rank": 0.3 + }, + { + "position": 91, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-geoip.php:Loader", + "rank": 0.3 + }, + { + "position": 92, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-geoip.php:Update_GeoIP_Visitor", + "rank": 0.3 + }, + { + "position": 93, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-geoip.php:download", + "rank": 0.3 + }, + { + "position": 94, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-historical.php:get", + "rank": 0.3 + }, + { + "position": 95, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-menus.php:__construct", + "rank": 0.3 + }, + { + "position": 96, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-option.php:get", + "rank": 0.3 + }, + { + "position": 97, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-referred.php:__construct", + "rank": 0.3 + }, + { + "position": 98, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-referred.php:get_referer_from_domain", + "rank": 0.3 + }, + { + "position": 99, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-rest-api.php:__construct", + "rank": 0.3 + }, + { + "position": 100, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-search-engine.php:get", + "rank": 0.3 + }, + { + "position": 101, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-search-engine.php:getLastSearchWord", + "rank": 0.3 + }, + { + "position": 102, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-shortcode.php:__construct", + "rank": 0.3 + }, + { + "position": 103, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-uninstall.php:__construct", + "rank": 0.3 + }, + { + "position": 104, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-user-online.php:__construct", + "rank": 0.3 + }, + { + "position": 105, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-user-online.php:add_user_online", + "rank": 0.3 + }, + { + "position": 106, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-user-online.php:get", + "rank": 0.3 + }, + { + "position": 107, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-user.php:get", + "rank": 0.3 + }, + { + "position": 108, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-visitor.php:get", + "rank": 0.3 + }, + { + "position": 109, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics-widget.php:__construct", + "rank": 0.3 + }, + { + "position": 110, + "tier": 4, + "score": 7.0, + "site": "includes/class-wp-statistics.php:__construct", + "rank": 0.3 + }, + { + "position": 111, + "tier": 4, + "score": 7.0, + "site": "includes/template-functions.php:wp_statistics_get_top_pages", + "rank": 0.3 + }, + { + "position": 112, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/composer/autoload_real.php:getLoader", + "rank": 0.3 + }, + { + "position": 113, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Database/Reader.php:__construct", + "rank": 0.3 + }, + { + "position": 114, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Exception/HttpException.php:__construct", + "rank": 0.3 + }, + { + "position": 115, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Exception/InvalidRequestException.php:__construct", + "rank": 0.3 + }, + { + "position": 116, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/AbstractModel.php:__construct", + "rank": 0.3 + }, + { + "position": 117, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/AbstractModel.php:get", + "rank": 0.3 + }, + { + "position": 118, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/AnonymousIp.php:__construct", + "rank": 0.3 + }, + { + "position": 119, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/Asn.php:__construct", + "rank": 0.3 + }, + { + "position": 120, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/City.php:__construct", + "rank": 0.3 + }, + { + "position": 121, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/ConnectionType.php:__construct", + "rank": 0.3 + }, + { + "position": 122, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/Country.php:__construct", + "rank": 0.3 + }, + { + "position": 123, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/Domain.php:__construct", + "rank": 0.3 + }, + { + "position": 124, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Model/Isp.php:__construct", + "rank": 0.3 + }, + { + "position": 125, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Record/AbstractPlaceRecord.php:__construct", + "rank": 0.3 + }, + { + "position": 126, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Record/AbstractRecord.php:__construct", + "rank": 0.3 + }, + { + "position": 127, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/Record/Traits.php:__construct", + "rank": 0.3 + }, + { + "position": 128, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/geoip2/geoip2/src/WebService/Client.php:__construct", + "rank": 0.3 + }, + { + "position": 129, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind-db/reader/src/MaxMind/Db/Reader.php:__construct", + "rank": 0.3 + }, + { + "position": 130, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind-db/reader/src/MaxMind/Db/Reader.php:get", + "rank": 0.3 + }, + { + "position": 131, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind-db/reader/src/MaxMind/Db/Reader/Decoder.php:__construct", + "rank": 0.3 + }, + { + "position": 132, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind-db/reader/src/MaxMind/Db/Reader/Metadata.php:__construct", + "rank": 0.3 + }, + { + "position": 133, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind/web-service-common/src/Exception/HttpException.php:__construct", + "rank": 0.3 + }, + { + "position": 134, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind/web-service-common/src/Exception/InvalidRequestException.php:__construct", + "rank": 0.3 + }, + { + "position": 135, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind/web-service-common/src/WebService/Client.php:get", + "rank": 0.3 + }, + { + "position": 136, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind/web-service-common/src/WebService/Http/CurlRequest.php:__construct", + "rank": 0.3 + }, + { + "position": 137, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/maxmind/web-service-common/src/WebService/Http/CurlRequest.php:get", + "rank": 0.3 + }, + { + "position": 138, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/s1lentium/iptools/src/IP.php:__construct", + "rank": 0.3 + }, + { + "position": 139, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/s1lentium/iptools/src/Network.php:__construct", + "rank": 0.3 + }, + { + "position": 140, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/s1lentium/iptools/src/Range.php:__construct", + "rank": 0.3 + }, + { + "position": 141, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser.php:__construct", + "rank": 0.3 + }, + { + "position": 142, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser.php:analyse", + "rank": 0.3 + }, + { + "position": 143, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header.php:analyseHeaders", + "rank": 0.3 + }, + { + "position": 144, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header.php:analyseNewUCUserAgent", + "rank": 0.3 + }, + { + "position": 145, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header.php:analyseUserAgent", + "rank": 0.3 + }, + { + "position": 146, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header.php:analyseWapProfile", + "rank": 0.3 + }, + { + "position": 147, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header/Baidu.php:__construct", + "rank": 0.3 + }, + { + "position": 148, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header/BrowserId.php:__construct", + "rank": 0.3 + }, + { + "position": 149, + "tier": 4, + "score": 7.0, + "site": "includes/vendor/whichbrowser/parser/src/Analyser/Header/OperaMini.php:__construct", + "rank": 0.3 + } + ], + "build_seconds": 117.8, + "evidence_seconds": 168.2, + "pairs": 8359, + "pairs_unanswered": 0, + "tier_counts": { + "0": 7468, + "1": 77, + "2": 5, + "3": 240, + "4": 569 + } + } + ] +} diff --git a/src/openultrasast/cpg/queries/taint.sc b/src/openultrasast/cpg/queries/taint.sc index 599b78e..ed5de42 100644 --- a/src/openultrasast/cpg/queries/taint.sc +++ b/src/openultrasast/cpg/queries/taint.sc @@ -71,9 +71,9 @@ val sinkCandidatesMemo = scala.collection.mutable.Map.empty[String, List[io.shiftleft.codepropertygraph.generated.nodes.Call]] val reachableMemo = scala.collection.mutable.Map.empty[(String, String, Int), Set[String]] val methodSourceMemo = scala.collection.mutable.Map.empty[String, Boolean] - val fedFieldsMemo = scala.collection.mutable.Map.empty[String, Set[String]] + val fedFieldsMemo = scala.collection.mutable.Map.empty[String, Map[String, String]] val sourceMethodsMemo = scala.collection.mutable.Map.empty[String, Set[String]] - val callbackFedMemo = scala.collection.mutable.Map.empty[String, Boolean] + val callbackFedMemo = scala.collection.mutable.Map.empty[String, String] def rowsFor( sourcesS: String, @@ -543,9 +543,16 @@ // applied in scope have a registered callback whose body holds a source or such a field read (WP // Statistics's `set_current_page`). Memoised per file and per callback for the batch. It orders; the // arbiter still decides with the flow. - def prefixFed(code: String, fed: Set[String]): Boolean = { + // Provenance matters: "source" (assigned from a source expression, or from a same-file method that + // reads one) is the strong form and promotes a tier; "parameter" (assigned from a parameter of the + // assigning method -- every constructor does this) is weak and only orders within one. Measured: with + // the two folded together tier 4 held 555 of pmpro's regions and 569 of WP Statistics's. + def strongest(kinds: Iterable[String]): String = + if (kinds.exists(_ == "source")) "source" else if (kinds.exists(_ == "parameter")) "parameter" else "" + + def prefixKind(code: String, fed: Map[String, String]): String = { val parts = code.split("->").map(_.trim).filter(_.nonEmpty) - parts.length >= 2 && (2 to parts.length).exists(n => fed.contains(parts.take(n).mkString("->"))) + if (parts.length < 2) "" else strongest((2 to parts.length).flatMap(n => fed.get(parts.take(n).mkString("->")))) } // Methods of a file whose body reads a source: one level of "assigned from a call". WP Statistics writes @@ -556,50 +563,56 @@ methodsIn(fileName).filter(m => m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p)))).map(_.name).toSet ) - def fedFields(fileName: String): Set[String] = + def fedFields(fileName: String): Map[String, String] = fedFieldsMemo.getOrElseUpdate( - fileName, - methodsIn(fileName).flatMap { m => - val params = m.parameter.name.l.filterNot(_ == "this").toSet + fileName, { val readers = sourceMethods(fileName) - m.ast.isCall.nameExact(ASSIGNMENT).l.flatMap { assignment => - val args = assignment.argument.l - if (args.size < 2) None - else - args.head match { - case target: io.shiftleft.codepropertygraph.generated.nodes.Call if target.name == FIELD_ACCESS => - val rhs = args(1) - val fromParameter = rhs match { - case id: io.shiftleft.codepropertygraph.generated.nodes.Identifier => params.contains(id.name) - case _ => false - } - val fromReader = readers.nonEmpty && rhs.ast.isCall.name.l.exists(readers.contains) - if (fromParameter || fromReader || sourcePatterns.exists(p => rhs.code.contains(p))) Some(target.code.trim) else None - case _ => None - } - } - }.toSet - ) - - def fieldCarriedStructurally: Boolean = - cpg.call.nameExact(FIELD_ACCESS).filter(c => inScope(c.method)).l.exists(r => prefixFed(r.code.trim, fedFields(r.method.filename))) - - def callbackFed(callback: String): Boolean = - callbackFedMemo.getOrElseUpdate( - callback, - cpg.method.nameExact(callback).l.exists { m => - m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p))) || { - val fed = fedFields(m.filename) - fed.nonEmpty && m.ast.isCall.nameExact(FIELD_ACCESS).code.l.exists(code => prefixFed(code.trim, fed)) - } + methodsIn(fileName).flatMap { m => + val params = m.parameter.name.l.filterNot(_ == "this").toSet + m.ast.isCall.nameExact(ASSIGNMENT).l.flatMap { assignment => + val args = assignment.argument.l + if (args.size < 2) None + else + args.head match { + case target: io.shiftleft.codepropertygraph.generated.nodes.Call if target.name == FIELD_ACCESS => + val rhs = args(1) + val fromParameter = rhs match { + case id: io.shiftleft.codepropertygraph.generated.nodes.Identifier => params.contains(id.name) + case _ => false + } + val fromSource = sourcePatterns.exists(p => rhs.code.contains(p)) || (readers.nonEmpty && rhs.ast.isCall.name.l.exists(readers.contains)) + if (fromSource) Some(target.code.trim -> "source") + else if (fromParameter) Some(target.code.trim -> "parameter") + else None + case _ => None + } + } + }.groupBy(_._1).map { case (field, kinds) => field -> strongest(kinds.map(_._2)) } } ) - def hookCarriedStructurally: Boolean = - hookTable.nonEmpty && hookApply.nonEmpty && cpg.call.filter(c => hookApply.contains(c.name)).filter(c => inScope(c.method)).l.exists { call => - val hook = call.argument.l.headOption.map(a => unquote(a.code)).getOrElse("") - hookTable.getOrElse(hook, Nil).exists(callbackFed) - } + def fieldCarriedKind: String = + strongest(cpg.call.nameExact(FIELD_ACCESS).filter(c => inScope(c.method)).l.map(r => prefixKind(r.code.trim, fedFields(r.method.filename)))) + + def callbackFedKind(callback: String): String = + callbackFedMemo.getOrElseUpdate( + callback, + strongest(cpg.method.nameExact(callback).l.map { m => + if (m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p)))) "source" + else { + val fed = fedFields(m.filename) + if (fed.isEmpty) "" else strongest(m.ast.isCall.nameExact(FIELD_ACCESS).code.l.map(code => prefixKind(code.trim, fed))) + } + }) + ) + + def hookCarriedKind: String = + if (hookTable.isEmpty || hookApply.isEmpty) "" + else + strongest(cpg.call.filter(c => hookApply.contains(c.name)).filter(c => inScope(c.method)).l.flatMap { call => + val hook = call.argument.l.headOption.map(a => unquote(a.code)).getOrElse("") + hookTable.getOrElse(hook, Nil).map(callbackFedKind) + }) // ---- EVIDENCE MODE: the same question without the dataflow (flow-aware-ranking, phase 0) -------------- // @@ -630,13 +643,15 @@ // flow form was a wall. It puts `_delete_files()` (fed by `$this->attachments`) and `record()` (fed by // a filter) where their sources say, instead of one tier below every region with a `$_GET` in its own // body. Asked only where there is a sink to carry to, so a plugin's 21,000 tier-0 pairs pay nothing. - val carried = sinkList.nonEmpty && familyInRepo && (fieldCarriedStructurally || hookCarriedStructurally) + val carriedKind = if (sinkList.nonEmpty && familyInRepo) strongest(List(fieldCarriedKind, hookCarriedKind)) else "" + val carried = carriedKind.nonEmpty val summary = ujson.Obj( "kind" -> "summary", "sinks" -> sinkList.size, "sourceLocal" -> sourceLocal, "sourceNear" -> sourceNear, "carried" -> carried, + "carriedKind" -> carriedKind, "familyInRepo" -> familyInRepo ) val perSink = sinkList.map { sink => diff --git a/src/openultrasast/model/evidence.py b/src/openultrasast/model/evidence.py index d6ac80b..db14826 100644 --- a/src/openultrasast/model/evidence.py +++ b/src/openultrasast/model/evidence.py @@ -28,6 +28,7 @@ WEIGHTS: dict[str, float] = { "cleansed_sink": -0.5, # per sink call that is cleansed on the call or bound, up to CLEANSED_SINK_CAP "source_local": 2.0, # a modelled source in the region's own body "carried": 1.5, # stage one of the two-stage join says a field or dispatch value arrives tainted + "carried_weak": 0.75, # a field assigned from a parameter of its method: every constructor does it "source_near": 1.0, # a modelled source within the arbiter's callDepth "entry": 0.5, # parameters untrusted by contract "access_declared_public": 1.0, @@ -63,7 +64,8 @@ class Evidence: source_near: bool = False # a modelled source within the arbiter's callDepth entry: bool = False # parameters untrusted by contract access_declared_public: bool = False # declared, not inferred -- "no decorator found" is not "public" - carried: bool | None = None # stage one of the two-stage join; None where it was not computed + carried: bool | None = None # stage one of the two-stage join, the STRONG form; None where it was not computed + carried_weak: bool = False # the weak form: a field assigned from a parameter of its method. Orders, never promotes. bound_names: tuple[str, ...] = field(default=()) # sink names the shape test treats as bound at arity >= 2 @property @@ -108,6 +110,7 @@ class Evidence: + w["cleansed_sink"] * min(sum(1 for s in self.sinks if s.cleansed_on_call or self.is_bound(s)), CLEANSED_SINK_CAP) + (w["source_local"] if self.source_local else 0.0) + (w["carried"] if self.carried else 0.0) + + (w["carried_weak"] if self.carried_weak and not self.carried else 0.0) + (w["source_near"] if self.source_near else 0.0) + (w["entry"] if self.entry else 0.0) + (w["access_declared_public"] if self.access_declared_public else 0.0) @@ -158,7 +161,10 @@ def evidence_from_rows( access_declared_public=access_declared_public, # The query's own answer when it gave one (phase 2: stage one of the two-stage join, reused); # the caller's otherwise; None where neither knows, which is not False. - carried=_as_bool(summary["carried"]) if "carried" in summary else carried, + carried=(str(summary.get("carriedKind", "")) == "source" or (_as_bool(summary["carried"]) and "carriedKind" not in summary)) + if "carried" in summary + else carried, + carried_weak=str(summary.get("carriedKind", "")) == "parameter", bound_names=tuple(bound_names), ) diff --git a/tests/test_model_evidence.py b/tests/test_model_evidence.py index 6755efc..8182112 100644 --- a/tests/test_model_evidence.py +++ b/tests/test_model_evidence.py @@ -145,3 +145,33 @@ def test_the_query_may_answer_carried_itself() -> None: assert silent is not None and silent.carried is None and silent.tier == TIER_OPEN told = evidence_from_rows([{"kind": "summary", "sinks": 1, "sourceNear": True, "familyInRepo": True}, sink], carried=True) assert told is not None and told.carried is True + + +def test_carried_provenance_promotes_only_when_source_fed() -> None: + """A field fed from a source (or from a same-file method that reads one) is the strong `carried` and + promotes to tier 4; a field fed from a parameter of its method is the weak form, orders within the + tier, and never promotes -- every constructor assigns a field from a parameter.""" + from openultrasast.model.evidence import TIER_OPEN, TIER_OPEN_PUBLIC, WEIGHTS, evidence_from_rows + + sink = { + "kind": "sink", + "sink": "unlink($f)", + "sinkLine": "259", + "sinkMethod": "_delete_files", + "sinkArity": 1, + "sinkArg0Literal": False, + "cleansedOnCall": False, + } + strong = evidence_from_rows( + [{"kind": "summary", "sinks": 1, "sourceNear": True, "carried": True, "carriedKind": "source", "familyInRepo": True}, sink] + ) + weak = evidence_from_rows( + [{"kind": "summary", "sinks": 1, "sourceNear": True, "carried": True, "carriedKind": "parameter", "familyInRepo": True}, sink] + ) + none = evidence_from_rows( + [{"kind": "summary", "sinks": 1, "sourceNear": True, "carried": False, "carriedKind": "", "familyInRepo": True}, sink] + ) + assert strong is not None and strong.tier == TIER_OPEN_PUBLIC and strong.carried is True + assert weak is not None and weak.tier == TIER_OPEN and weak.carried is False and weak.carried_weak + assert none is not None and none.tier == TIER_OPEN and not none.carried_weak + assert weak.score - none.score == WEIGHTS["carried_weak"]