mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
docs(pre-push-safety-net): record the model-driven pipeline result on v2 and stop
Exploratory, 7 of 17 cases, stopped when the account emptied: - source-only scope: a model reading every product file puts the vulnerable function among the candidates in 15/17 (ranker 1/17, vocabulary 2/17); - per-file triage + per-file 6-step hunts + two-pass agreement: 12/15 candidate cases on the validation set; 4/7 on the full run, two more in one pass of two; - precision: 5 pgAdmin agreed findings read against source, 3 true (privileged), 2 false with self-contradicting rationales; agreement cannot catch an error both passes make; - cost: $0.009-0.022 per candidate for two passes. Four instrument defects fixed on the way (model id, provider routing, JSON-mode final turn, unbounded tool output) void the earlier hunter number. No gate is met; qualification needs population v3 and a protocol that states the judge stage, the pass rule and a config-family question. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
6acd354311
commit
ec7a5ed90d
@@ -82,3 +82,39 @@ declared sites, which would leak the answer).
|
||||
1. Direction: run the hunter experiment first (recommended), or choose A, B or C now.
|
||||
2. For the experiment: the scope handed to the model per pin, the model, and the cost ceiling.
|
||||
3. Whether the roadmap's M1b/M2 work (rendering, runtime) pauses until the direction is chosen.
|
||||
|
||||
|
||||
## 7. Update 2026-09-29: what the experiment showed
|
||||
|
||||
Recorded in `benchmarks/independent/results-v2-model-pipeline.json` (exploratory; v2 is spent for tuning).
|
||||
|
||||
**Instrument first.** Four defects had made every model-backed result since 2026-09-10 unmeasured: the default
|
||||
model id was the product name and the API rejected it (cf57995); the hunter reached the embeddings provider, not
|
||||
the chat provider (cf57995); the final-answer turn used the provider's JSON mode and the answers were lost
|
||||
(3ffb8b4); one grep match in a minified bundle overflowed the model's context (8794884). The "hunter 1/17" number
|
||||
in section 5's experiment was produced through the broken answer turn and is void.
|
||||
|
||||
**Scope selection, source only.** The declared vulnerable function is among the candidates for: the ranker's
|
||||
top-20 entry points 1/17; the shipped sink vocabulary 2/17; a model reading every product file 15/17 ($14). The
|
||||
vocabulary route (option A) is confirmed not to converge on this population.
|
||||
|
||||
**Verification.** Per-file triage, one 6-step tool hunt per file, two independent passes, report only agreement:
|
||||
- validation set: 16 of 20 declared sites agreed, 12 of 15 cases; the 26 pgAdmin candidates that flickered
|
||||
between single runs reduce to 9 stable, 4 disputed, 13 quiet;
|
||||
- full run, 7 of 17 cases before the account emptied ($23): detected 4/7 (pgAdmin, qwed, LMDeploy,
|
||||
ReactPress); ContextForge and FUXA found in one pass of two; winml missed because a CORS literal is triaged
|
||||
"constant" -- the config family needs its own question, not the reachability one;
|
||||
- cost: $0.009-0.022 per candidate for two passes (old single-pass design: $0.017); a full two-pass run of the
|
||||
population is roughly $45-50.
|
||||
|
||||
**Precision is the open problem.** 196 agreed findings across 7 cases (pgAdmin alone 126 of 875 verified). Five
|
||||
pgAdmin findings read against source: three true (privileged; raw `{{ data.* }}` in SQL templates, unescaped
|
||||
stored `schema_res`), two false with rationales that contradict their own verdict (an ORM call the model itself
|
||||
calls parameterized; a pickle from the signed session). Agreement cannot catch a mistake both passes make. The
|
||||
proposed next filter is a no-tools judge over each agreed finding's rationale and code (~$0.002 per finding),
|
||||
which was not run. Two-pass agreement is itself not stable between runs (ContextForge, FUXA).
|
||||
|
||||
**Standing.** Recall: the model route reaches 12/15 candidate-site cases where the engine reached 0/17 and the
|
||||
vocabulary 2/17; that decides between options A and B in the model's favour for recall. Precision, fixed-pin
|
||||
behaviour and cost at product scale are unmeasured. No gate is met. Any qualification needs population v3 and
|
||||
a pre-registered protocol that also states the judge stage, the pass rule and the config-family question.
|
||||
|
||||
@@ -0,0 +1,114 @@
|
||||
{
|
||||
"measurement": "model-driven pipeline on population v2 (exploratory; v2 is spent for tuning): model-classified sinks -> per-file triage -> per-file 6-step tool hunts -> two-pass agreement. Stopped by the maintainer after the account emptied; 7 of 17 cases complete.",
|
||||
"analyzer": "6acd354 (hunter fixes cf57995, 3ffb8b4, 8794884; verify_batched.py 072a102)",
|
||||
"spend_usd": {
|
||||
"stage1_model_sinks": 14.42,
|
||||
"validation_46_candidates": 1.01,
|
||||
"full_run_7_cases_plus_budibase_partial": 23.36
|
||||
},
|
||||
"stage1_reach": {
|
||||
"declared_site_among_candidates": [
|
||||
15,
|
||||
17
|
||||
],
|
||||
"note": "ranker top-20: 1/17; vocabulary sink-first: 2/17"
|
||||
},
|
||||
"validation_set": {
|
||||
"declared_sites_agreed": [
|
||||
16,
|
||||
20
|
||||
],
|
||||
"cases": [
|
||||
12,
|
||||
15
|
||||
],
|
||||
"flickering_pgadmin_26": {
|
||||
"triaged_out": 2,
|
||||
"agreed": 9,
|
||||
"disputed": 4,
|
||||
"quiet": 13
|
||||
}
|
||||
},
|
||||
"full_run_7_cases": {
|
||||
"recall": [
|
||||
4,
|
||||
7
|
||||
],
|
||||
"recall_wilson95": [
|
||||
0.25,
|
||||
0.842
|
||||
],
|
||||
"detected": [
|
||||
"pgadmin-maintenance-sqli",
|
||||
"qwed-sympy-eval",
|
||||
"lmdeploy-media-url-ssrf",
|
||||
"reactpress-findall-column-sqli"
|
||||
],
|
||||
"unstable_one_pass_only": [
|
||||
"contextforge-prompt-ssti",
|
||||
"fuxa-tdengine-escape-sqli"
|
||||
],
|
||||
"missed": [
|
||||
"winml-cli-serve-cors (triage: constant; the reachability question does not fit config_secrets)"
|
||||
],
|
||||
"agreed_findings_pooled": 196,
|
||||
"pgadmin": {
|
||||
"candidates": 1037,
|
||||
"triaged_out": 162,
|
||||
"agreed": 126,
|
||||
"disputed": 238,
|
||||
"usd": 8.91
|
||||
},
|
||||
"not_run": [
|
||||
"budibase-mongo-template-nosqli",
|
||||
"unleash-addon-webhook-ssrf",
|
||||
"medplum-external-auth-open-redirect",
|
||||
"cct-studio-server-cmdi",
|
||||
"wp-gopay-log-filter-sqli",
|
||||
"wp-user-registration-login-redirect",
|
||||
"wp-directorist-avatar-ssrf",
|
||||
"wp-groundhogg-confirm-redirect",
|
||||
"froxlor-admin-ip-second-order-sqli",
|
||||
"sulu-smart-content-sql2-injection"
|
||||
],
|
||||
"fixed_side_alerts": "not measured (no recheck run)"
|
||||
},
|
||||
"precision": {
|
||||
"formal_sample": "66 drawn, not adjudicated (stopped)",
|
||||
"spot_check_pgadmin_5": [
|
||||
{
|
||||
"site": "web/pgadmin/authenticate/mfa/utils.py:370:mfa_add",
|
||||
"verdict": "False, guarded",
|
||||
"why": "SQLAlchemy ORM, parameterized; the rationale says so and reports anyway"
|
||||
},
|
||||
{
|
||||
"site": "web/pgadmin/browser/server_groups/servers/databases/schemas/__init__.py:533:nodes",
|
||||
"verdict": "True, privileged",
|
||||
"why": "stored schema_res split and quoted without escaping into nsp.nspname in (...)"
|
||||
},
|
||||
{
|
||||
"site": "web/pgadmin/browser/server_groups/servers/databases/schemas/tables/compound_triggers/__init__.py:662:update",
|
||||
"verdict": "True, privileged",
|
||||
"why": "update.sql interpolates {{ data.prosrc }} raw; witness did not name the field"
|
||||
},
|
||||
{
|
||||
"site": "web/pgadmin/browser/server_groups/servers/databases/schemas/tables/indexes/utils.py:286:get_sql",
|
||||
"verdict": "True, privileged",
|
||||
"why": "update.sql interpolates {{data.fillfactor}} and other storage parameters raw"
|
||||
},
|
||||
{
|
||||
"site": "web/pgadmin/misc/cloud/biganimal/__init__.py:528:deploy_on_biganimal",
|
||||
"verdict": "False, not attacker",
|
||||
"why": "pickle.loads of an app-produced value in the signed Flask session"
|
||||
}
|
||||
],
|
||||
"note": "two-pass agreement does not catch a mistake both passes make; a no-tools judge over rationale + code is the proposed next filter"
|
||||
},
|
||||
"stability": "contextforge and fuxa were agreed in the validation run and only disputed in the full run: two-pass agreement varies between runs",
|
||||
"cost_per_candidate_two_passes_usd": {
|
||||
"validation_set": 0.022,
|
||||
"pgadmin_full": 0.0086,
|
||||
"old_single_pass_design": 0.0167
|
||||
},
|
||||
"gates": "none met or measurable: 7/17 cases run, precision unadjudicated, fixed pins unchecked"
|
||||
}
|
||||
Reference in New Issue
Block a user