marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-19 13:10:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cpg): ask the graph before splitting it, not the frontend's log

Browse Source 
Sharding was triggered by `Failed to process` warnings. Those warnings are not
evidence about the finished graph:

    a build reporting 2 drops  ->  3 files, 139 methods, same size as a clean one

The file it warned about was in the graph the whole time. Acting on the
warning is not merely wasteful, it is destructive -- shards cannot see each
other's flows, so splitting a two-file WordPress pair on a false alarm cost it
CVE-2022-25148 outright. That is how this was found: the slices caught it, at
a scale small enough to check by hand, before the whole-repository run could
bury it.

So the build now takes a census of the graph (`census.sc`) when the frontend
warns, and splits only if the graph is actually short of the files handed to
it. A warning is a symptom to investigate, never a verdict. Conservative in
the only direction that matters: if the census cannot be taken, the caller
does the careful thing and splits.

    wp-vuln        3 entailed incl. CVE at :225, NO shard   (was: 2, sharded)
    wp-fixed       2, that one absent
    mwwpform       1 / 0
    pmpro one-file 18 incl. CVE at :936
    pmpro slice    18 incl. CVE at :936, sharded -- genuinely deficient here

The census costs one JVM, and only on a build that warned; a clean build pays
nothing.

849 tests pass; gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-10 08:28:42 +02:00
co-authored by Claude Opus 5
parent 7f83977add
commit d63be34451
3 changed files with 89 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/cpg/queries/census.sc
+18
View File
@@ -0,0 +1,18 @@
// How much of the repository actually made it into the graph (contributor-scan 5.10).
//
// A frontend can log `Failed to process` for a file that is nonetheless present -- measured: a build
// reporting two drops produced a graph holding both of its files and all 139 methods, byte-identical in
// size to a clean one. So the warning is a symptom to investigate, never a verdict, and the only thing that
// settles whether a graph is deficient is the graph.
//
// This matters because acting on the warning alone is destructive: it makes the driver split a repository
// into shards that cannot see each other's flows, and a two-file WordPress pair lost its CVE that way.
//
// Parameters: cpgFile.
// Output: fenced JSON {files, methods}.
@main def exec(cpgFile: String) = {
importCpg(cpgFile)
println("---OUSAST-CPG-BEGIN---")
println(ujson.write(ujson.Obj("files" -> cpg.file.size.toString, "methods" -> cpg.method.size.toString)))
println("---OUSAST-CPG-END---")
}