marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(model): carried with provenance -- source-fed promotes a tier, parameter-fed only orders

Browse Source 
Structural carried (v3) measured: pmpro 391 -> 69, wpstatistics 504 -> 172, mwwpform 513 -> 68 -- and
tier 4 swollen to 555 and 569 regions, because "assigned from a parameter" was folded in with "assigned
from a source" and every constructor does the former. The query now reports carriedKind; the vector
promotes on "source" and gives "parameter" a within-tier weight of 0.75.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-11 13:11:00 +02:00
co-authored by Claude Fable 5.1
parent ce49bd877c
commit d1f37abadd
5 changed files with 3591 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/cpg/queries/taint.sc
+59 -44
View File
@@ -71,9 +71,9 @@
val sinkCandidatesMemo = scala.collection.mutable.Map.empty[String, List[io.shiftleft.codepropertygraph.generated.nodes.Call]]
val reachableMemo = scala.collection.mutable.Map.empty[(String, String, Int), Set[String]]
val methodSourceMemo = scala.collection.mutable.Map.empty[String, Boolean]
val fedFieldsMemo = scala.collection.mutable.Map.empty[String, Set[String]]
val fedFieldsMemo = scala.collection.mutable.Map.empty[String, Map[String, String]]
val sourceMethodsMemo = scala.collection.mutable.Map.empty[String, Set[String]]
val callbackFedMemo = scala.collection.mutable.Map.empty[String, Boolean]
val callbackFedMemo = scala.collection.mutable.Map.empty[String, String]
def rowsFor(
sourcesS: String,
@@ -543,9 +543,16 @@
// applied in scope have a registered callback whose body holds a source or such a field read (WP
// Statistics's `set_current_page`). Memoised per file and per callback for the batch. It orders; the
// arbiter still decides with the flow.
def prefixFed(code: String, fed: Set[String]): Boolean = {
// Provenance matters: "source" (assigned from a source expression, or from a same-file method that
// reads one) is the strong form and promotes a tier; "parameter" (assigned from a parameter of the
// assigning method -- every constructor does this) is weak and only orders within one. Measured: with
// the two folded together tier 4 held 555 of pmpro's regions and 569 of WP Statistics's.
def strongest(kinds: Iterable[String]): String =
if (kinds.exists(_ == "source")) "source" else if (kinds.exists(_ == "parameter")) "parameter" else ""
def prefixKind(code: String, fed: Map[String, String]): String = {
val parts = code.split("->").map(_.trim).filter(_.nonEmpty)
parts.length >= 2 && (2 to parts.length).exists(n => fed.contains(parts.take(n).mkString("->")))
if (parts.length < 2) "" else strongest((2 to parts.length).flatMap(n => fed.get(parts.take(n).mkString("->"))))
}
// Methods of a file whose body reads a source: one level of "assigned from a call". WP Statistics writes
@@ -556,50 +563,56 @@
methodsIn(fileName).filter(m => m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p)))).map(_.name).toSet
)
def fedFields(fileName: String): Set[String] =
def fedFields(fileName: String): Map[String, String] =
fedFieldsMemo.getOrElseUpdate(
fileName,
methodsIn(fileName).flatMap { m =>
val params = m.parameter.name.l.filterNot(_ == "this").toSet
fileName, {
val readers = sourceMethods(fileName)
m.ast.isCall.nameExact(ASSIGNMENT).l.flatMap { assignment =>
val args = assignment.argument.l
if (args.size < 2) None
else
args.head match {
case target: io.shiftleft.codepropertygraph.generated.nodes.Call if target.name == FIELD_ACCESS =>
val rhs = args(1)
val fromParameter = rhs match {
case id: io.shiftleft.codepropertygraph.generated.nodes.Identifier => params.contains(id.name)
case _ => false
}
val fromReader = readers.nonEmpty && rhs.ast.isCall.name.l.exists(readers.contains)
if (fromParameter || fromReader || sourcePatterns.exists(p => rhs.code.contains(p))) Some(target.code.trim) else None
case _ => None
}
}
}.toSet
)
def fieldCarriedStructurally: Boolean =
cpg.call.nameExact(FIELD_ACCESS).filter(c => inScope(c.method)).l.exists(r => prefixFed(r.code.trim, fedFields(r.method.filename)))
def callbackFed(callback: String): Boolean =
callbackFedMemo.getOrElseUpdate(
callback,
cpg.method.nameExact(callback).l.exists { m =>
m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p))) || {
val fed = fedFields(m.filename)
fed.nonEmpty && m.ast.isCall.nameExact(FIELD_ACCESS).code.l.exists(code => prefixFed(code.trim, fed))
}
methodsIn(fileName).flatMap { m =>
val params = m.parameter.name.l.filterNot(_ == "this").toSet
m.ast.isCall.nameExact(ASSIGNMENT).l.flatMap { assignment =>
val args = assignment.argument.l
if (args.size < 2) None
else
args.head match {
case target: io.shiftleft.codepropertygraph.generated.nodes.Call if target.name == FIELD_ACCESS =>
val rhs = args(1)
val fromParameter = rhs match {
case id: io.shiftleft.codepropertygraph.generated.nodes.Identifier => params.contains(id.name)
case _ => false
}
val fromSource = sourcePatterns.exists(p => rhs.code.contains(p)) || (readers.nonEmpty && rhs.ast.isCall.name.l.exists(readers.contains))
if (fromSource) Some(target.code.trim -> "source")
else if (fromParameter) Some(target.code.trim -> "parameter")
else None
case _ => None
}
}
}.groupBy(_._1).map { case (field, kinds) => field -> strongest(kinds.map(_._2)) }
}
)
def hookCarriedStructurally: Boolean =
hookTable.nonEmpty && hookApply.nonEmpty && cpg.call.filter(c => hookApply.contains(c.name)).filter(c => inScope(c.method)).l.exists { call =>
val hook = call.argument.l.headOption.map(a => unquote(a.code)).getOrElse("")
hookTable.getOrElse(hook, Nil).exists(callbackFed)
}
def fieldCarriedKind: String =
strongest(cpg.call.nameExact(FIELD_ACCESS).filter(c => inScope(c.method)).l.map(r => prefixKind(r.code.trim, fedFields(r.method.filename))))
def callbackFedKind(callback: String): String =
callbackFedMemo.getOrElseUpdate(
callback,
strongest(cpg.method.nameExact(callback).l.map { m =>
if (m.ast.isCall.exists(c => sourcePatterns.exists(p => c.code.contains(p)))) "source"
else {
val fed = fedFields(m.filename)
if (fed.isEmpty) "" else strongest(m.ast.isCall.nameExact(FIELD_ACCESS).code.l.map(code => prefixKind(code.trim, fed)))
}
})
)
def hookCarriedKind: String =
if (hookTable.isEmpty || hookApply.isEmpty) ""
else
strongest(cpg.call.filter(c => hookApply.contains(c.name)).filter(c => inScope(c.method)).l.flatMap { call =>
val hook = call.argument.l.headOption.map(a => unquote(a.code)).getOrElse("")
hookTable.getOrElse(hook, Nil).map(callbackFedKind)
})
// ---- EVIDENCE MODE: the same question without the dataflow (flow-aware-ranking, phase 0) --------------
//
@@ -630,13 +643,15 @@
// flow form was a wall. It puts `_delete_files()` (fed by `$this->attachments`) and `record()` (fed by
// a filter) where their sources say, instead of one tier below every region with a `$_GET` in its own
// body. Asked only where there is a sink to carry to, so a plugin's 21,000 tier-0 pairs pay nothing.
val carried = sinkList.nonEmpty && familyInRepo && (fieldCarriedStructurally || hookCarriedStructurally)
val carriedKind = if (sinkList.nonEmpty && familyInRepo) strongest(List(fieldCarriedKind, hookCarriedKind)) else ""
val carried = carriedKind.nonEmpty
val summary = ujson.Obj(
"kind" -> "summary",
"sinks" -> sinkList.size,
"sourceLocal" -> sourceLocal,
"sourceNear" -> sourceNear,
"carried" -> carried,
"carriedKind" -> carriedKind,
"familyInRepo" -> familyInRepo
)
val perSink = sinkList.map { sink =>
src/openultrasast/model/evidence.py
+8 -2
View File
@@ -28,6 +28,7 @@ WEIGHTS: dict[str, float] = {
"cleansed_sink": -0.5, # per sink call that is cleansed on the call or bound, up to CLEANSED_SINK_CAP
"source_local": 2.0, # a modelled source in the region's own body
"carried": 1.5, # stage one of the two-stage join says a field or dispatch value arrives tainted
"carried_weak": 0.75, # a field assigned from a parameter of its method: every constructor does it
"source_near": 1.0, # a modelled source within the arbiter's callDepth
"entry": 0.5, # parameters untrusted by contract
"access_declared_public": 1.0,
@@ -63,7 +64,8 @@ class Evidence:
source_near: bool = False # a modelled source within the arbiter's callDepth
entry: bool = False # parameters untrusted by contract
access_declared_public: bool = False # declared, not inferred -- "no decorator found" is not "public"
carried: bool | None = None # stage one of the two-stage join; None where it was not computed
carried: bool | None = None # stage one of the two-stage join, the STRONG form; None where it was not computed
carried_weak: bool = False # the weak form: a field assigned from a parameter of its method. Orders, never promotes.
bound_names: tuple[str, ...] = field(default=()) # sink names the shape test treats as bound at arity >= 2
@property
@@ -108,6 +110,7 @@ class Evidence:
+ w["cleansed_sink"] * min(sum(1 for s in self.sinks if s.cleansed_on_call or self.is_bound(s)), CLEANSED_SINK_CAP)
+ (w["source_local"] if self.source_local else 0.0)
+ (w["carried"] if self.carried else 0.0)
+ (w["carried_weak"] if self.carried_weak and not self.carried else 0.0)
+ (w["source_near"] if self.source_near else 0.0)
+ (w["entry"] if self.entry else 0.0)
+ (w["access_declared_public"] if self.access_declared_public else 0.0)
@@ -158,7 +161,10 @@ def evidence_from_rows(
access_declared_public=access_declared_public,
# The query's own answer when it gave one (phase 2: stage one of the two-stage join, reused);
# the caller's otherwise; None where neither knows, which is not False.
carried=_as_bool(summary["carried"]) if "carried" in summary else carried,
carried=(str(summary.get("carriedKind", "")) == "source" or (_as_bool(summary["carried"]) and "carriedKind" not in summary))
if "carried" in summary
else carried,
carried_weak=str(summary.get("carriedKind", "")) == "parameter",
bound_names=tuple(bound_names),
)