mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
c5bf52f47d
0 of 12 positives; 12.6 false alarms per 100 ordinary pushes (2.1 on changed lines only). The misses come from what the rules and facts express (access control lives in obligations, which do not convert; sources cover request objects only), not from the engine. Comparison arm only: a Semgrep miss is never evidence against a hunter finding. Co-Authored-By: Claude Opus 5.5 <[email protected]>
22 lines
453 B
YAML
22 lines
453 B
YAML
rules:
|
|
- id: ousast.groovy.regex.groovy-xss-unescaped
|
|
languages:
|
|
- generic
|
|
severity: WARNING
|
|
message: Groovy template unescaped output needs review
|
|
metadata:
|
|
family: output_encoding
|
|
cwe: CWE-79
|
|
origin: groovy-xss-unescaped
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- injection
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: (yieldUnescaped)\s+[A-Za-z_]
|
|
paths:
|
|
include:
|
|
- '*.groovy'
|
|
- '*.tpl'
|