marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 21:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(authorization-obligations): harvest mode handler_context and the obligation label

Browse Source 
Task 4.1. A new excerpt mode keeps the labeled handler with its decorators and
every statement outside it that registers the handler by name, so guards living
in decorators, routers and middleware travel with the pair. Comment and string
mentions never count.

The closed mechanism vocabulary gains the three obligation ids, catalog rows
accept an additive obligation field validated against the closed operation
kinds, and the pair scorer counts a finding tagged with that obligation inside
the labeled function as a detection. Rows without the label run the same code
as before.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-06 07:24:13 +02:00
co-authored by Claude Opus 5
parent 4bd59555ae
commit e219dd553d
7 changed files with 227 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/pairs/mechanisms.toml
+13 -1
View File
@@ -1,6 +1,6 @@
# Closed mechanism vocabulary for pair labels (pair-corpus-honesty, Req 2.1).
# Every [[pair.expected]] row names one of these ids. Bump `version` when the set changes.
version = "1"
version = "2"
[[mechanism]]
id = "source_reaches_sink"
@@ -78,6 +78,18 @@ definition = "A validator exists but accepts inputs it should reject; the fix st
id = "cross_artifact"
definition = "The bug is only decidable with an artifact outside the vendored files (a properties file, a schema, a build flag)."
[[mechanism]]
id = "unconstrained_protected_read"
definition = "A read of a protected resource reaches the store without an identity constraint or ownership check bound from the authenticated context (authorization-obligations, protected_read)."
[[mechanism]]
id = "unconstrained_protected_write"
definition = "A write to a protected resource reaches the store without an identity constraint or ownership check bound from the authenticated context (authorization-obligations, protected_write)."
[[mechanism]]
id = "unguarded_privileged_action"
definition = "A privileged action is reached by a handler without a dominating path guard or ownership check (authorization-obligations, privileged_action)."
[[mechanism]]
id = "other"
definition = "Not yet classified. Present so bulk-mined pairs load; review should replace it."