From d4ce17359252a6101da26a70e962173c96032d07 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Tue, 22 Sep 2026 19:34:49 +0200 Subject: [PATCH] measure(m3): the declared PHP target is detected, and the replay budget is sized classes/class.memberorder.php:936:getMemberOrderByCode, injection. A value concatenated into SQL with no prepare, which is the declared M3 target for PHP, found for the first time. Nothing about detection changed. The population became affordable: tier-zero pruning scoped to its partition, batches budgeted by the sink work they imply, a per-query timeout no longer cancelling the scan, and a reserve kept for arbitration. Before those this population completed zero questions at every budget tried. At 500 regions with a 3,600 s deadline: 271 of 406 questions completed, 213 findings, 2,950 s, and eight findings in the target file including the target itself. The earlier bounded attempt failed for a reason no budget increase could fix -- 25 regions of 4,461 is 0.6 percent of the population and the target was never asked about -- so this sizes the replay before spending hours on it. One scan at this budget is 2,950 s, a push transaction is two scans plus discovery and preparation, so the three declared comparisons are roughly five and a half hours. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- ...26-09-22-php-declared-target-in-scope.json | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 benchmarks/measurements/2026-09-22-php-declared-target-in-scope.json diff --git a/benchmarks/measurements/2026-09-22-php-declared-target-in-scope.json b/benchmarks/measurements/2026-09-22-php-declared-target-in-scope.json new file mode 100644 index 0000000..ee9ca72 --- /dev/null +++ b/benchmarks/measurements/2026-09-22-php-declared-target-in-scope.json @@ -0,0 +1,29 @@ +{ + "schema_version": 1, + "experiment": "php-declared-target-in-scope-v1", + "date": "2026-09-22", + "task": "pre-push-safety-net 13.3", + "claim_scope": "Sizing the population a bounded PHP transfer replay needs. One whole-repository scan, detection only, no comparison.", + "why": "The earlier bounded attempt failed for a reason no budget increase could fix: 25 regions of 4,461 is 0.6% of the population and the declared target was never asked about. A three-case replay costs hours, so the budget is established with one scan first.", + "result": { + "budget": { + "max_regions": 500, + "deadline_seconds": 3600 + }, + "questions_completed": 271, + "questions_arbitrated": 406, + "findings": 213, + "seconds": 2949.8, + "declared_target_found": true, + "target": "classes/class.memberorder.php:936:getMemberOrderByCode, injection", + "target_file_findings": 8 + }, + "the_target_itself": "`$wpdb->get_var(\"SELECT id FROM $wpdb->pmpro_membership_orders WHERE code = '\" . $code . \"' LIMIT 1\")`. A value concatenated into SQL with no prepare, which is the declared M3 target for PHP and is detected here for the first time.", + "what_changed_to_make_it_reachable": "Nothing about detection. The population became affordable: tier-zero pruning scoped to its partition (7.3), batches budgeted by the sink work they imply (7.7), a per-query timeout no longer cancelling the scan, and a reserve kept for arbitration. Before those, this population completed zero questions at any budget tried.", + "cost_implied_for_the_replay": "One whole-repository scan at this budget costs 2,950 s. A push transaction is two scans plus discovery and preparation, so a case is roughly 6,600 s and the three declared comparisons roughly five and a half hours. That is the price of the population that contains the target.", + "limits": [ + "Detection only. This scan makes no comparison and establishes no novelty, which is what the replay is for.", + "271 of 406 questions completed, so the population is examined but not exhausted.", + "PMPro is a development subject and qualifies nothing." + ] +}