mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
e219dd553d
Task 4.1. A new excerpt mode keeps the labeled handler with its decorators and every statement outside it that registers the handler by name, so guards living in decorators, routers and middleware travel with the pair. Comment and string mentions never count. The closed mechanism vocabulary gains the three obligation ids, catalog rows accept an additive obligation field validated against the closed operation kinds, and the pair scorer counts a finding tagged with that obligation inside the labeled function as a detection. Rows without the label run the same code as before. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
96 lines
3.6 KiB
TOML
96 lines
3.6 KiB
TOML
# Closed mechanism vocabulary for pair labels (pair-corpus-honesty, Req 2.1).
|
|
# Every [[pair.expected]] row names one of these ids. Bump `version` when the set changes.
|
|
version = "2"
|
|
|
|
[[mechanism]]
|
|
id = "source_reaches_sink"
|
|
definition = "A fact-listed source flows by name into a fact-listed sink without a sanitizer."
|
|
|
|
[[mechanism]]
|
|
id = "container_taint"
|
|
definition = "Taint travels through a mutable container or config object (list.append, dict[key], ConfigParser.set/get) before the sink."
|
|
|
|
[[mechanism]]
|
|
id = "config_sink_weak_literal"
|
|
definition = "A configuration sink is dangerous because of a literal argument (hashlib.new('md5'), MessageDigest 'SHA-1', debug=True)."
|
|
|
|
[[mechanism]]
|
|
id = "unchecked_length_copy"
|
|
definition = "A copy or read uses a length or index that is not bounded by a dominating check."
|
|
|
|
[[mechanism]]
|
|
id = "unchecked_alloc_size"
|
|
definition = "An allocation size derives from untrusted or unbounded input."
|
|
|
|
[[mechanism]]
|
|
id = "null_deref_unguarded"
|
|
definition = "A pointer that may be NULL is dereferenced without a dominating NULL test."
|
|
|
|
[[mechanism]]
|
|
id = "signed_size_operand"
|
|
definition = "A signed or narrower type feeds a size or length operand and can wrap."
|
|
|
|
[[mechanism]]
|
|
id = "fixed_buffer_capacity"
|
|
definition = "A fixed-size buffer receives data larger than its declared capacity."
|
|
|
|
[[mechanism]]
|
|
id = "identity_from_request_body"
|
|
definition = "A user or owner identity is taken from the request body or query instead of the authenticated context."
|
|
|
|
[[mechanism]]
|
|
id = "missing_auth_guard"
|
|
definition = "A route or handler performs a privileged action with no authentication or authorization guard on its path."
|
|
|
|
[[mechanism]]
|
|
id = "secret_in_client"
|
|
definition = "A secret or privileged key is shipped to client-side code or committed configuration."
|
|
|
|
[[mechanism]]
|
|
id = "permissive_default"
|
|
definition = "A security control is left at a permissive default (RLS off, CORS wildcard, debug mode, open bucket)."
|
|
|
|
[[mechanism]]
|
|
id = "path_join_user_input"
|
|
definition = "A filesystem path is built from user input without normalization or containment."
|
|
|
|
[[mechanism]]
|
|
id = "prototype_pollution"
|
|
definition = "Attacker-controlled keys reach a recursive merge or assignment that writes Object.prototype."
|
|
|
|
[[mechanism]]
|
|
id = "redos"
|
|
definition = "A regular expression with catastrophic backtracking is applied to untrusted input."
|
|
|
|
[[mechanism]]
|
|
id = "uaf"
|
|
definition = "Memory is used after it was released."
|
|
|
|
[[mechanism]]
|
|
id = "type_confusion"
|
|
definition = "A value is interpreted as a type it is not."
|
|
|
|
[[mechanism]]
|
|
id = "validation_strength"
|
|
definition = "A validator exists but accepts inputs it should reject; the fix strengthens the check."
|
|
|
|
[[mechanism]]
|
|
id = "cross_artifact"
|
|
definition = "The bug is only decidable with an artifact outside the vendored files (a properties file, a schema, a build flag)."
|
|
|
|
[[mechanism]]
|
|
id = "unconstrained_protected_read"
|
|
definition = "A read of a protected resource reaches the store without an identity constraint or ownership check bound from the authenticated context (authorization-obligations, protected_read)."
|
|
|
|
[[mechanism]]
|
|
id = "unconstrained_protected_write"
|
|
definition = "A write to a protected resource reaches the store without an identity constraint or ownership check bound from the authenticated context (authorization-obligations, protected_write)."
|
|
|
|
[[mechanism]]
|
|
id = "unguarded_privileged_action"
|
|
definition = "A privileged action is reached by a handler without a dominating path guard or ownership check (authorization-obligations, privileged_action)."
|
|
|
|
[[mechanism]]
|
|
id = "other"
|
|
definition = "Not yet classified. Present so bulk-mined pairs load; review should replace it."
|