marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

bench(independent): reserve population v3 (PHP, 16 cases) by rule

Browse Source 
Maintainer's selection 2026-09-30, "Recommended 16, minus v2 mentions": the
research's rule-based 16 with Winter, elFinder and Easy!Appointments replaced
by the next candidate in their family by the same rule (named fix first, then
newest first), v2-mentioned alternates (Grav, Backpack CRUD, Koel) skipped.
Winter -> mantisbt-tokenizer-eval-rce; elFinder -> pagible (inferred fix, to
be confirmed at freeze); Easy!Appointments -> empty slot (no remaining
untrusted_destination candidate), so 15 cases are reserved.

The reservation guard now covers v3: all six families, a declared-language
population, status "reserved".

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-30 18:03:07 +02:00
co-authored by Claude Opus 5.5
parent 1b291e81b7
commit d86ba281ec
4 changed files with 3080 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_independent_population.py
+9 -3
View File
@@ -17,7 +17,9 @@ import pytest
ROOT = Path(__file__).resolve().parents[1]
POPULATIONS = sorted((ROOT / "benchmarks" / "independent").glob("population-v*.toml"))
POPULATION = POPULATIONS[0]
FAMILIES = {"injection", "untrusted_destination", "config_secrets"}
# v1 and v2 score injection, untrusted_destination and config_secrets; v3 (PHP) adds the other four families that
# protocol-v3.md pre-registers matching rules for.
FAMILIES = {"injection", "untrusted_destination", "config_secrets", "path", "output_encoding", "access_control", "deserialization"}
SHA = re.compile(r"[0-9a-f]{40}")
@@ -28,7 +30,7 @@ def _population(path: Path = POPULATION) -> dict:
@pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem)
def test_the_reservation_is_well_formed(path: Path) -> None:
data = _population(path)
assert data["status"] in {"reserved-unscanned", "frozen"}
assert data["status"] in {"reserved-unscanned", "reserved", "frozen"}
cases = data["case"]
ids = [case["id"] for case in cases]
assert len(ids) == len(set(ids)) >= 10
@@ -46,7 +48,11 @@ def test_the_reservation_is_well_formed(path: Path) -> None:
assert SHA.fullmatch(benign.get("base", "")) and SHA.fullmatch(benign.get("tip", "")), case["id"]
assert (path.parent / data["freeze_record"]).is_file()
languages = {case["language"] for case in cases}
assert {"php", "python"} <= languages and languages & {"javascript", "typescript"}
if "language" in data:
# A single-language population (v3: PHP) declares its language, and every case is in it.
assert languages == {data["language"]}
else:
assert {"php", "python"} <= languages and languages & {"javascript", "typescript"}
@pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem)