marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 19:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

perf(taint): ask the caller check only of a parameter that starts a flow into the field

Browse Source 
Asked of every parameter up front, 6ebbc89's caller check ran a repository-
wide flow query per parameter of every method in a file and cut PMPro's
completed injection questions from 272 to 67 in the same budget -- so its
48 -> 26 findings could not be read as precision. The flow into the field
is asked once as before; only a parameter at the head of an unsanitized
flow is checked against its callers. finding_dump now records completed
regions so runs compare only where both answered.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-23 22:49:44 +02:00
co-authored by Claude Opus 5.5
parent 6ebbc89d64
commit e0c260ca5f
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/push/finding_dump.py
+7 -1
View File
@@ -81,11 +81,17 @@ def main() -> int:
"seconds": round(time.monotonic() - started, 1),
"questions": len(outcomes),
"completed": sum(1 for o in outcomes if o.status == "completed"),
# Which questions answered, so two runs can be compared only where BOTH answered: a finding that
# vanishes because its question went unasked is lost coverage, not gained precision.
"completed_regions": sorted({f"{o.identity.path}:{o.identity.function or ''}" for o in outcomes if o.status == "completed"}),
"degradations": sorted({str(d.get("reason")) for d in result.degradations}),
"findings": findings,
}
args.out.write_text(json.dumps(record, indent=2) + "\n")
print(json.dumps({k: v for k, v in record.items() if k != "findings"} | {"findings": len(findings)}), flush=True)
print(
json.dumps({k: v for k, v in record.items() if k not in ("findings", "completed_regions")} | {"findings": len(findings)}),
flush=True,
)
if not outcomes:
raise SystemExit("no question was asked: the dump measured nothing")
return 0