mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
45d02ecf20
Quick mode has rules only for c/cpp, groovy, java, javascript/typescript and python, so every PHP case's "0 alerts" read as clean. The `alerts` task now records per language of the files read whether quick mode covers it (derived from the bundled ruleset, not a list): coverage quick | none, with file counts per pin, and `uncovered`. `remember` turns that into `coverage` memory rows (a new kind; the Run passes the alerts summary.json as input), loop-measure reports coverage per language, and improve/memory.py's M1/M2 skip a repository+pin whose coverage for the rule's language is only `none` (counted under `coverage_none` in the proposal's excluded). `ousast plane alerts-engine <Run.yaml> --source <frozen export>` (plane/engine_alerts.py) does the alerts task on the host for cases whose files include a language the engine covers but quick mode does not (PHP): exports both pins from the case cache, runs the quick scan and the openultrasast:dev engine container (finding_dump.py, --network none, --memory 3g, one at a time, per-pin deadline), writes engine findings in the alerts.jsonl row shape (rule_id engine:<family>, source engine, in_fix_range from case.json) with a summary (files read, questions, completed, seconds, degradations per pin), and marks the task done via reconciler.mark_done. No result, no files read, or questions == 0 fails loudly and leaves the run untouched. Refuses a git checkout as source. Runner image rebuilt and re-pinned (sha256:ebb40a9a...); validation-46 regenerated (digest only). Live, recorded in benchmarks/measurements/2026-09-30-php-engine-alerts/: froxlor 366 files, 130/130 questions per pin, 6 alerts per pin, 0 in the fix range; wp-gopay 19 files, 101/101 questions, 0 alerts. The loop: 32 run rows (coverage 8, php=engine), 0 proposals, gate no_proposals, $0. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
171 lines
3.4 KiB
JSON
171 lines
3.4 KiB
JSON
{
|
|
"inputs_bytes": {
|
|
"froxlor_admin_ip_second_order_sqli": 15137,
|
|
"wp_gopay_log_filter_sqli": 4027
|
|
},
|
|
"rows": {
|
|
"run": 32,
|
|
"snapshot": 191,
|
|
"union": 211
|
|
},
|
|
"run": "validation-46",
|
|
"run_metrics": {
|
|
"agreed": 3,
|
|
"alerts": {
|
|
"engine:injection": {
|
|
"fixed": 6,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 6
|
|
}
|
|
},
|
|
"candidates": 4,
|
|
"cases": 2,
|
|
"coverage": {
|
|
"javascript": {
|
|
"engine": 0,
|
|
"none": 0,
|
|
"quick": 4
|
|
},
|
|
"php": {
|
|
"engine": 4,
|
|
"none": 0,
|
|
"quick": 0
|
|
}
|
|
},
|
|
"declared_sites_agreed": 3,
|
|
"declared_sites_matched": 4,
|
|
"dispute_rate": {
|
|
"injection": {
|
|
"candidates": 4,
|
|
"disputed": 1,
|
|
"rate": 0.25
|
|
}
|
|
},
|
|
"disputed": 1,
|
|
"rejected": 0,
|
|
"tiebreaks": 3,
|
|
"usd": 0.10796,
|
|
"usd_per_candidate": 0.02699
|
|
},
|
|
"store_metrics": {
|
|
"agreed": 28,
|
|
"alerts": {
|
|
"c-shell-exec": {
|
|
"fixed": 2,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 2
|
|
},
|
|
"c-unsafe-memory-copy": {
|
|
"fixed": 2,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 2
|
|
},
|
|
"python-shell-true": {
|
|
"fixed": 1,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 1
|
|
},
|
|
"python-unsafe-deserialization": {
|
|
"fixed": 8,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 8
|
|
},
|
|
"python-unsafe-eval": {
|
|
"fixed": 23,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 23
|
|
}
|
|
},
|
|
"candidates": 43,
|
|
"cases": 14,
|
|
"coverage": {},
|
|
"declared_sites_agreed": 16,
|
|
"declared_sites_matched": 19,
|
|
"dispute_rate": {
|
|
"injection": {
|
|
"candidates": 38,
|
|
"disputed": 5,
|
|
"rate": 0.1316
|
|
},
|
|
"untrusted_destination": {
|
|
"candidates": 5,
|
|
"disputed": 0,
|
|
"rate": 0.0
|
|
}
|
|
},
|
|
"disputed": 5,
|
|
"rejected": 10,
|
|
"tiebreaks": 10,
|
|
"usd": 0.856679,
|
|
"usd_per_candidate": 0.019923
|
|
},
|
|
"union_metrics": {
|
|
"agreed": 28,
|
|
"alerts": {
|
|
"c-shell-exec": {
|
|
"fixed": 2,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 2
|
|
},
|
|
"c-unsafe-memory-copy": {
|
|
"fixed": 2,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 2
|
|
},
|
|
"engine:injection": {
|
|
"fixed": 6,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 6
|
|
},
|
|
"python-shell-true": {
|
|
"fixed": 1,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 1
|
|
},
|
|
"python-unsafe-deserialization": {
|
|
"fixed": 8,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 8
|
|
},
|
|
"python-unsafe-eval": {
|
|
"fixed": 23,
|
|
"fixed_in_fix_range": 0,
|
|
"vulnerable": 23
|
|
}
|
|
},
|
|
"candidates": 43,
|
|
"cases": 14,
|
|
"coverage": {
|
|
"javascript": {
|
|
"engine": 0,
|
|
"none": 0,
|
|
"quick": 4
|
|
},
|
|
"php": {
|
|
"engine": 4,
|
|
"none": 0,
|
|
"quick": 0
|
|
}
|
|
},
|
|
"declared_sites_agreed": 16,
|
|
"declared_sites_matched": 19,
|
|
"dispute_rate": {
|
|
"injection": {
|
|
"candidates": 38,
|
|
"disputed": 5,
|
|
"rate": 0.1316
|
|
},
|
|
"untrusted_destination": {
|
|
"candidates": 5,
|
|
"disputed": 0,
|
|
"rate": 0.0
|
|
}
|
|
},
|
|
"disputed": 5,
|
|
"rejected": 10,
|
|
"tiebreaks": 10,
|
|
"usd": 0.856679,
|
|
"usd_per_candidate": 0.019923
|
|
}
|
|
}
|