marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: the 637-file wall is the taint query, not memory and not vendored code

Browse Source 
Follow-up measurements, because the obvious explanations were all wrong.

Not memory: at 2GB AND 4GB the CPG never finishes loading, with no
OutOfMemoryError either time, both runs stopping in the same place --
Braintree\Util. What costs is Joern's dataflow overlay, recomputed per import.

Not scope, though scope is real and worth fixing on its own terms: 429 of the
637 files are vendored SDKs (Braintree, Stripe, each with its own LICENSE) and
31 are tests. PMPro's own code is 177 files, 62k lines. Auditing a plugin by
scanning the payment SDK it bundles is wrong regardless of cost -- those
findings are not the plugin's bugs -- and it is the same idea shipped.py
already applies to Makefile.am, which PHP has no equivalent of.

Scoping to authored code helps and does not fix it:

    regions 4,463 -> 1,324    total 996.6s -> 843.7s    findings still 0

600.3s of that 843.7s is the taint query hitting QUERY_TIMEOUT_SECONDS (300s)
on each of two shards. Two timeouts, not work.

So the wall is the per-request cost of the taint query at 2,500 requests. The
next measurement is what the two-stage joins cost at scale -- 1.6x on a slice
(62s -> 97s) and plausibly the dominant term here. Raising the timeout before
knowing that would only buy a slower way to find out.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
2026-09-10 09:06:03 +02:00
co-authored by Claude Opus 5
parent c03944f7dd
commit f3f41e2fa9
2 changed files with 36 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/repos/README.md
+16 -2
View File
@@ -216,8 +216,22 @@ obvious question is whether any of it survives on the whole plugin. Measured on
| CVE-2023-23488 | **not reported** |
The build is affordable; a CI runner can do this without a vertical-scale machine, which was the open
question. The scan is not: the taint query dies in `ForkJoinPool` after ten minutes, and so does a bare
`cpg.file.size` census, so it is the CPG under a 2 GB heap rather than the request payload.
question. The scan is not.
It is worth being precise about *why*, because the obvious answers are all wrong. It is not memory: at 2 GB
and at 4 GB the CPG never finishes loading, with no `OutOfMemoryError` in either case, both runs stopping in
the same place — `Braintree\Util`. It is not the request payload either. What costs is Joern's dataflow
overlay, recomputed on every import, over a graph two thirds of which is not the plugin's code at all:
**429 of the 637 files are vendored SDKs** (Braintree, Stripe) and 31 are tests, leaving 177 files of PMPro's
own. Auditing a plugin by scanning the payment SDK it bundles is wrong on its own terms.
Scoping to those 177 files helps and does not fix it:
regions 4,463 -> 1,324 total 996.6s -> 843.7s findings still 0
600.3s of that 843.7s is the taint query hitting its 300s timeout on each of two shards — two timeouts, not
work. The wall is the per-request cost of the taint query, and neither memory, nor the build, nor dropping
the vendored code moves it.
So the honest statement of PHP detection today is that **the slices find the CVEs and the repository does
not** — one file finds CVE-2023-23488, two files find it with a shard, and 637 files find nothing at all.