marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(model-grounded-detection): parameter sources, so the measurement is like-for-like

Browse Source 
Only 11 of the 50 injection pairs contain a framework source token at all. The
other 39 receive untrusted input as a FUNCTION PARAMETER, because SVEN-style
pairs are function-level extractions:

    def add_user(username, password):
        os.system("useradd ... -p " + encPass + " " + username)

A framework-anchored source model finds nothing there, which caps entailment on
this slice near 22% by construction -- a property of the source model, not of
the engine. More to the point, the flat-IR baseline this feature is measured
against already counted these (source_kinds: ["parameter"]), so a run without
them is not comparable to the 2.2% it is supposed to beat.

The flag is opt-in and off by default, because the two settings are right in
different places: in a function-level pair the function boundary IS the trust
boundary, while across a whole repository most parameters carry internal
values and treating them all as untrusted is not sound. The corpus harness
opts in; a repository scan does not.

On the pair that exposed this the model now resolves both flows, including one
through an intermediate binding:
    username -> os.system(...)                       2 steps
    password -> crypt.crypt(...) -> encPass -> ...   7 steps

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-08 12:56:13 +02:00
co-authored by Claude Opus 5
parent 1765e51da1
commit e127e430ed
3 changed files with 62 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/model/taint.py
+14 -3
View File
@@ -19,11 +19,22 @@ from .ladder import Rung, Verdict
from .specs import TaintSpec
def verdict(cpg: CpgResult, spec: TaintSpec, *, function: str = "") -> Verdict | None:
"""The strongest verdict the taint query supports for ``spec`` in ``function``, or ``None`` to stay at suspicion."""
def verdict(cpg: CpgResult, spec: TaintSpec, *, function: str = "", parameter_sources: bool = False) -> Verdict | None:
"""The strongest verdict the taint query supports for ``spec`` in ``function``, or ``None`` to stay at suspicion.
``parameter_sources`` additionally treats the labeled function's own parameters as untrusted. That is right
for a function-level pair, where the function boundary *is* the trust boundary, and wrong for a whole
repository, where most parameters carry internal values — so it is off by default and the caller opts in.
"""
rows = cpg.run(
"taint",
{"sources": spec.sources, "sinks": spec.sinks, "sanitizers": spec.sanitizers, "function": function},
{
"sources": spec.sources,
"sinks": spec.sinks,
"sanitizers": spec.sanitizers,
"function": function,
"parameterSources": "true" if parameter_sources else "false",
},
)
flows = _flows(rows, function=function)
# A sink whose *shape* is safe is the fix, not the bug. `execute(sql, params)` binds rather than