marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(learning-harness): amend the taxonomy name and carry the flat-taxonomy caveat

Browse Source 
The maintainer settled both items the group 1 review escalated.

The family that covers server-side request forgery is named untrusted
destination and also covers open redirect, because both are untrusted input
choosing where a request goes and the corpus carries 34 open-redirect rows that
would otherwise be unclassifiable. The requirement, the brief and the design
example now say so, and the approval note records the amendment.

The shipped taxonomy is flat, so no answer can earn hierarchical partial credit.
Rather than leave that as prose, two new acceptance criteria require every
agreement figure and every family figure to say it, and both report types now
carry the flag, computed from the taxonomy rather than asserted. A taxonomy that
later declares a parent flips it without any other change.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-06 10:22:33 +02:00
co-authored by Claude Opus 5
parent 86ed54c2e4
commit e44d45f488
9 changed files with 46 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_learning_aggregation.py
+18
View File
@@ -96,3 +96,21 @@ def test_the_sign_test_is_two_sided_and_symmetric() -> None:
assert sign_test(0, 0) == 1.0
assert sign_test(6, 0) == sign_test(0, 6) < 0.05
assert sign_test(1, 0) > 0.05 and sign_test(3, 3) == 1.0
def test_every_family_figure_says_when_hierarchical_credit_could_not_apply() -> None:
"""Req 3.7: with a flat taxonomy no answer can earn partial credit, and the number must carry that."""
from openultrasast.learning.families import Family, FamilyTaxonomy
from openultrasast.learning.scoring import aggregate
flat = load_families()
metrics = aggregate([_score("a", "pair_correct")], taxonomy=flat)["access_control"]
assert metrics.hierarchical_credit is False and metrics.to_dict()["hierarchical_credit"] is False
nested = FamilyTaxonomy(
version="test",
families=(
Family(id="injection", description="d", cwes=frozenset(), mechanisms=frozenset(), verifier="none"),
Family(id="access_control", description="d", cwes=frozenset(), mechanisms=frozenset(), verifier="none", parent="injection"),
),
)
assert aggregate([_score("a", "pair_correct")], taxonomy=nested)["access_control"].hierarchical_credit is True