marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

merge(search-with-proof): path demo must serve ${served_root} [skip ci]

Browse Source 
Agent guidance: point the app's served directory at the ${served_root} placeholder via
arg/env/config so the planted observable is reachable. Prompt strings only; 37 worker tests pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-07 10:29:40 +02:00
co-authored by Claude Opus 4.8
parent e387ca16a2 00d1c26f5f
commit ec09a39deb
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/search/worker.py
+7 -6
View File
@@ -98,12 +98,13 @@ DEMO_GUIDE = (
"point environment values at .demo/name. Allowed: .pem .key .json .yaml .yml .txt .env .ini .toml .db .sqlite .crt."
)
ORACLE_GUIDE = (
"The verifier injects the oracle fixture/observable at VERIFY time only, never during exploration. "
"Do not seek it in the explore checkout: absence never means unreachable or justifies ending the search. "
"Confirm the mechanism with explore tools using app code and, where useful, your own sandbox test data: "
"sink reachability and access to data the app should not expose, without the verifier observable. "
"Target its known verifier-time location below in the demo; only differential verification on both revisions proves it. "
"Path observes a private nonce file named canary in the parent of ${served_root} in app output. "
"Verifier observables exist at VERIFY time only: never seek them in exploration or stop for absence. "
"Explore reachability/disclosure using app code/own sandbox data; demos target below. "
"Only differential verification across revisions proves it. "
"Path observes app output for private nonce file canary in ${served_root}'s parent. "
"MUST set the app's served/root to exactly the ${served_root} placeholder via its command-line argument "
"(e.g. --dir ${served_root}), environment variable or config in start.files. "
"It lives relative to ${served_root}; serving elsewhere makes it unreachable: the search cannot succeed. "
"SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). "
"Command observes marker creation at marker location ${marker_dir}/marker. "
"SSRF observes the nonce URL at its loopback listener ${callback_url}. "