mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
389 lines
14 KiB
JSON
389 lines
14 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"selection_date": "2026-09-12",
|
|
"selection_basis": "PMPro optimization plus NodeGoat documented eval injection; Ghost independent production Node module/async reserve. No scanner results used for new selection.",
|
|
"capability_prerequisites": {
|
|
"php/wordpress/injection": [
|
|
"Independent untouched PHP/WordPress vulnerable/fixed/benign population missing."
|
|
],
|
|
"python/flask/injection": [
|
|
"Independent untouched Python/Flask paired changes missing."
|
|
],
|
|
"python/flask/access_control": [
|
|
"Independent untouched Python/Flask paired changes missing."
|
|
],
|
|
"javascript/express/injection": [
|
|
"Ghost supported-family pair review missing; NodeGoat is inspected teaching data."
|
|
],
|
|
"c/libpng/memory_safety": [
|
|
"Unsupported abstract domain; envelope cannot earn detection admission."
|
|
]
|
|
},
|
|
"snapshots": [
|
|
{
|
|
"id": "pmpro-vulnerable",
|
|
"recipe": "../repos/pmpro.toml",
|
|
"files": [
|
|
{
|
|
"path": "license.txt",
|
|
"size": 1039,
|
|
"sha256": "98424ae7dd8610cd5e3a29dd2775347552444e4793653823bc74c010d39265ff"
|
|
},
|
|
{
|
|
"path": "classes/class.memberorder.php",
|
|
"size": 55918,
|
|
"sha256": "3d32b8414eb9a6bfe8962aafa8ab2caf826d2816811caf51d299db3398f54c26"
|
|
},
|
|
{
|
|
"path": "includes/rest-api.php",
|
|
"size": 36224,
|
|
"sha256": "f52c146967d1d154b65dc5fb289ee831a7a0d31d7a9bba4876f40eee903624b0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "pmpro-fixed",
|
|
"recipe": "../repos/pmpro.toml",
|
|
"files": [
|
|
{
|
|
"path": "license.txt",
|
|
"size": 1039,
|
|
"sha256": "98424ae7dd8610cd5e3a29dd2775347552444e4793653823bc74c010d39265ff"
|
|
},
|
|
{
|
|
"path": "classes/class.memberorder.php",
|
|
"size": 56202,
|
|
"sha256": "6877bdc6f9322fe990be8aedfd1778718fc3e06b67c96eff47be16824eb9b312"
|
|
},
|
|
{
|
|
"path": "includes/rest-api.php",
|
|
"size": 36224,
|
|
"sha256": "f52c146967d1d154b65dc5fb289ee831a7a0d31d7a9bba4876f40eee903624b0"
|
|
}
|
|
],
|
|
"commit": "2f65530f9442b4d7ccfb56821836b056217358c1"
|
|
},
|
|
{
|
|
"id": "pmpro-benign",
|
|
"recipe": "../repos/pmpro.toml",
|
|
"files": [
|
|
{
|
|
"path": "license.txt",
|
|
"size": 1039,
|
|
"sha256": "98424ae7dd8610cd5e3a29dd2775347552444e4793653823bc74c010d39265ff"
|
|
},
|
|
{
|
|
"path": "classes/class.memberorder.php",
|
|
"original_sha256": "3d32b8414eb9a6bfe8962aafa8ab2caf826d2816811caf51d299db3398f54c26",
|
|
"edit": {
|
|
"before": "function getMemberOrderByCode($code)",
|
|
"after": "/* Load an order by its external code. */\n\t\tfunction getMemberOrderByCode($code)",
|
|
"provenance": "authored comment-only change; existing SQL injection remains"
|
|
},
|
|
"size": 55962,
|
|
"sha256": "457cfa61eddb5d339502143ab59fd93db93d577a1557f6552081c6a6fc2ebf8b"
|
|
},
|
|
{
|
|
"path": "includes/rest-api.php",
|
|
"size": 36224,
|
|
"sha256": "f52c146967d1d154b65dc5fb289ee831a7a0d31d7a9bba4876f40eee903624b0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "nodegoat-vulnerable",
|
|
"recipe": "../repos/nodegoat.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 10273,
|
|
"sha256": "73ba74dfaa520b49a401b5d21459a8523a146f3b7518a833eea5efa85130bf68"
|
|
},
|
|
{
|
|
"path": "package.json",
|
|
"size": 1979,
|
|
"sha256": "138377cf0f19b955d6ba043e49c24fb5eec4041a789fea5134e1fecda620c829"
|
|
},
|
|
{
|
|
"path": "app/routes/index.js",
|
|
"size": 3149,
|
|
"sha256": "3ab970b2888bc1501515db24a83cc7851ac9c09d00948c652300401515185eb5"
|
|
},
|
|
{
|
|
"path": "app/routes/contributions.js",
|
|
"size": 2485,
|
|
"sha256": "196bdeaa22da4cfe8a851b1b932710b2fcedd21f14ed75d70b739ba759a01003"
|
|
},
|
|
{
|
|
"path": "app/data/contributions-dao.js",
|
|
"size": 2791,
|
|
"sha256": "363065e8b3c32f0997ce2dcb17341eb3e40b7f43b00b72c576dfebf73f551c85"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "nodegoat-fixed",
|
|
"recipe": "../repos/nodegoat.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 10273,
|
|
"sha256": "73ba74dfaa520b49a401b5d21459a8523a146f3b7518a833eea5efa85130bf68"
|
|
},
|
|
{
|
|
"path": "package.json",
|
|
"size": 1979,
|
|
"sha256": "138377cf0f19b955d6ba043e49c24fb5eec4041a789fea5134e1fecda620c829"
|
|
},
|
|
{
|
|
"path": "app/routes/index.js",
|
|
"size": 3149,
|
|
"sha256": "3ab970b2888bc1501515db24a83cc7851ac9c09d00948c652300401515185eb5"
|
|
},
|
|
{
|
|
"path": "app/routes/contributions.js",
|
|
"original_sha256": "196bdeaa22da4cfe8a851b1b932710b2fcedd21f14ed75d70b739ba759a01003",
|
|
"edit": {
|
|
"before": "const preTax = eval(req.body.preTax);\n const afterTax = eval(req.body.afterTax);\n const roth = eval(req.body.roth);",
|
|
"after": "const preTax = Number(req.body.preTax);\n const afterTax = Number(req.body.afterTax);\n const roth = Number(req.body.roth);",
|
|
"provenance": "authored numeric conversion repair removes evaluation of JavaScript; not an upstream CVE fix"
|
|
},
|
|
"size": 2491,
|
|
"sha256": "9dc0a0bc147adc4c76c27faae75f316dd537ddaf4fb35fa693002450bd4b4e92"
|
|
},
|
|
{
|
|
"path": "app/data/contributions-dao.js",
|
|
"size": 2791,
|
|
"sha256": "363065e8b3c32f0997ce2dcb17341eb3e40b7f43b00b72c576dfebf73f551c85"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "nodegoat-benign",
|
|
"recipe": "../repos/nodegoat.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 10273,
|
|
"sha256": "73ba74dfaa520b49a401b5d21459a8523a146f3b7518a833eea5efa85130bf68"
|
|
},
|
|
{
|
|
"path": "package.json",
|
|
"size": 1979,
|
|
"sha256": "138377cf0f19b955d6ba043e49c24fb5eec4041a789fea5134e1fecda620c829"
|
|
},
|
|
{
|
|
"path": "app/routes/index.js",
|
|
"size": 3149,
|
|
"sha256": "3ab970b2888bc1501515db24a83cc7851ac9c09d00948c652300401515185eb5"
|
|
},
|
|
{
|
|
"path": "app/routes/contributions.js",
|
|
"original_sha256": "196bdeaa22da4cfe8a851b1b932710b2fcedd21f14ed75d70b739ba759a01003",
|
|
"edit": {
|
|
"before": "//validate contributions",
|
|
"after": "// Validate contribution percentages.",
|
|
"provenance": "authored comment-only change; existing eval injection remains"
|
|
},
|
|
"size": 2498,
|
|
"sha256": "66b97183be80e55fa3d690d2fc7103aabddb4e10ef9db439c22bce6c7651bcc4"
|
|
},
|
|
{
|
|
"path": "app/data/contributions-dao.js",
|
|
"size": 2791,
|
|
"sha256": "363065e8b3c32f0997ce2dcb17341eb3e40b7f43b00b72c576dfebf73f551c85"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "vampi-regression",
|
|
"recipe": "../repos/vampi.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 1063,
|
|
"sha256": "e3e05b9d17e397de650aa7a9a9784cf076ba8bf566efebe88a0e24ecb2d2b92a"
|
|
},
|
|
{
|
|
"path": "models/user_model.py",
|
|
"size": 3642,
|
|
"sha256": "4ce47b9850812e47140b2d2f2e20c08ae4b5338d168ce72f23e3127986ef6e1b"
|
|
},
|
|
{
|
|
"path": "api_views/users.py",
|
|
"size": 9257,
|
|
"sha256": "46006eb7207ebbae163f5320b13e3bf0ec464cef201a51fb2cd43b5cfdb4116c"
|
|
},
|
|
{
|
|
"path": "api_views/books.py",
|
|
"size": 3043,
|
|
"sha256": "78e2eb77d655573f03b7a4d0bca73dc27383b0c5ec7882a5aa8608caa52828e8"
|
|
},
|
|
{
|
|
"path": "app.py",
|
|
"size": 536,
|
|
"sha256": "ad26b12cfbdaab311bea86942f5ebd368dca331a0f4cdba803393739baadf42e"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "libpng-envelope",
|
|
"recipe": "../repos/libpng.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 5345,
|
|
"sha256": "16d9daaafbf63a31a5bdc91d4600972548fef5aaa1244202393288dbd079c49a"
|
|
},
|
|
{
|
|
"path": "pngread.c",
|
|
"size": 141758,
|
|
"sha256": "c12022962f04abe1f7156753315bf68091398711025450803d0506dcefda3552"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "ghost-reserved",
|
|
"recipe": "ghost-reserved.toml",
|
|
"files": [
|
|
{
|
|
"path": "LICENSE",
|
|
"size": 1065,
|
|
"sha256": "56df280a26071c1e84578abcb1e7dce02502d27816bce1184617e93ee5b086bf"
|
|
},
|
|
{
|
|
"path": "ghost/core/package.json",
|
|
"size": 12646,
|
|
"sha256": "f63492ad63f64ecf0c3648f57e196b904af1d79855d296ec3db659aae8cd5701"
|
|
},
|
|
{
|
|
"path": "ghost/core/core/server/api/endpoints/posts.js",
|
|
"size": 8008,
|
|
"sha256": "f51acc472f2fb217acd99a3bd378f6b6117d19f4c50233c58cf22538f3ea864f"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cases": [
|
|
{
|
|
"id": "pmpro-introduce",
|
|
"base": "pmpro-fixed",
|
|
"tip": "pmpro-vulnerable",
|
|
"label": "vulnerable",
|
|
"role": "development",
|
|
"capability": "php/wordpress/injection",
|
|
"provenance": "Authored replay direction reintroducing the reviewed operation; not a claim about the historical introducing commit.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "pmpro-repair",
|
|
"base": "pmpro-vulnerable",
|
|
"tip": "pmpro-fixed",
|
|
"label": "fixed",
|
|
"role": "development",
|
|
"capability": "php/wordpress/injection",
|
|
"provenance": "PMPro upstream2.9.7 to2.9.8 parameter binding fix for CVE-2023-23488.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "pmpro-benign",
|
|
"base": "pmpro-vulnerable",
|
|
"tip": "pmpro-benign",
|
|
"label": "benign",
|
|
"role": "development",
|
|
"capability": "php/wordpress/injection",
|
|
"provenance": "Authored comment-only change: no new defect; vulnerable backlog remains. This label does not mean repository-clean.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "nodegoat-introduce",
|
|
"base": "nodegoat-fixed",
|
|
"tip": "nodegoat-vulnerable",
|
|
"label": "vulnerable",
|
|
"role": "transfer",
|
|
"capability": "javascript/express/injection",
|
|
"provenance": "Authored replay direction reintroducing the reviewed operation; not a claim about the historical introducing commit.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "nodegoat-repair",
|
|
"base": "nodegoat-vulnerable",
|
|
"tip": "nodegoat-fixed",
|
|
"label": "fixed",
|
|
"role": "transfer",
|
|
"capability": "javascript/express/injection",
|
|
"provenance": "Authored replacement of three eval calls with Number conversion; source tutorial also documents alternate numeric parsing.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "nodegoat-benign",
|
|
"base": "nodegoat-vulnerable",
|
|
"tip": "nodegoat-benign",
|
|
"label": "benign",
|
|
"role": "transfer",
|
|
"capability": "javascript/express/injection",
|
|
"provenance": "Authored comment-only change: no new defect; vulnerable backlog remains. This label does not mean repository-clean.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "VAmPI-SQLI",
|
|
"base": "vampi-regression",
|
|
"tip": "vampi-regression",
|
|
"label": "regression",
|
|
"role": "regression",
|
|
"capability": "python/flask/injection",
|
|
"provenance": "Existing recipe known target, full target population retained; environment vulnerable=1. Snapshot regression, not an introducing push.",
|
|
"prerequisites": [
|
|
"Reviewed independent vulnerable/fixed/benign push pair required before hook admission."
|
|
]
|
|
},
|
|
{
|
|
"id": "VAmPI-BOLA",
|
|
"base": "vampi-regression",
|
|
"tip": "vampi-regression",
|
|
"label": "regression",
|
|
"role": "regression",
|
|
"capability": "python/flask/access_control",
|
|
"provenance": "Existing recipe known target, full target population retained; environment vulnerable=1. Snapshot regression, not an introducing push.",
|
|
"prerequisites": [
|
|
"Reviewed independent vulnerable/fixed/benign push pair required before hook admission."
|
|
]
|
|
},
|
|
{
|
|
"id": "VAmPI-BOLA-BOOKS",
|
|
"base": "vampi-regression",
|
|
"tip": "vampi-regression",
|
|
"label": "regression",
|
|
"role": "regression",
|
|
"capability": "python/flask/access_control",
|
|
"provenance": "Existing recipe known target, full target population retained; environment vulnerable=1. Snapshot regression, not an introducing push.",
|
|
"prerequisites": [
|
|
"Reviewed independent vulnerable/fixed/benign push pair required before hook admission."
|
|
]
|
|
},
|
|
{
|
|
"id": "libpng-CVE-2025-66293",
|
|
"base": "libpng-envelope",
|
|
"tip": "libpng-envelope",
|
|
"label": "unsupported",
|
|
"role": "envelope",
|
|
"capability": "c/libpng/memory_safety",
|
|
"provenance": "Arithmetic/bounds is outside the current abstract domain; measures graph/cost envelope only.",
|
|
"prerequisites": []
|
|
},
|
|
{
|
|
"id": "ghost-reserved-population",
|
|
"base": "ghost-reserved",
|
|
"tip": "ghost-reserved",
|
|
"label": "unreviewed",
|
|
"role": "reserved_holdout",
|
|
"capability": "javascript/express/unreviewed",
|
|
"provenance": "Reserved from production API/module/async shape and public security-fix history before scanner results. Manifest6.64.0-rc.0, Express4.22.2. Not an ESM or Express5 coverage claim.",
|
|
"prerequisites": [
|
|
"Review and freeze supported positive/fixed/benign changes from independent history; select family before scanning.",
|
|
"Freeze core and existing facts after development; preserve reservation and record any contamination."
|
|
]
|
|
}
|
|
]
|
|
}
|