mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 4.8
cf9f945992
Rebuild the quick-scan detection engine and ground-truth benchmarks to hit >=90% recall / <10% false positives for C/C++, Python, JavaScript, and Java. Engine (findings.py, preprocess.py): - Scope each PatternRule by language (fixes cross-language false positives such as the Python eval/exec rule firing on JS .exec()). - Add JavaScript/TypeScript rules (command exec, eval/Function, reflected XSS, SQLi, path traversal, SSRF, weak hash, deserialization); execFile/spawn-argv excluded as safe alternatives. - Add Java rules (Runtime exec, SQL string concatenation, weak hash, readObject) and a Groovy server-side template rule (yieldUnescaped of a bound variable). - Broaden C/C++ and Python coverage; precision guards for format strings and parameterised vs concatenated SQL; #-comment skipping; CWE in rationale. - Register .java/.groovy/.tpl source extensions. Benchmarks: - Add realistic corpora modeled on Damn Vulnerable C/C++, PyGoat/DVPWA, and NodeGoat, plus the real kiview/damn-vulnerable-spring-boot-app vendored verbatim (MIT, attribution in LICENSE/NOTICE.md). Each manifest carries complete, independently-labeled ground truth including genuinely hard-to-detect vulns (integer overflow, second-order SQLi, prototype pollution) so recall is measured honestly, plus safe-API files for precision. - Fix pre-existing smoke-manifest ground-truth errors (Python/JS line offsets, missing C/C++ strcpy entry, Java SQLi line). benchmark.py: - Fix sink matching to normalise the expected sink consistently so sinks with underscores (e.g. render_template_string) can match. Tests: - Add tests/test_detection_benchmarks.py enforcing the >=90% recall / <10% FP goal per language and overall. Measured: C/C++ 93.3%, Python 93.3%, JavaScript 92.3%, Java 100%; overall 93.6% recall, 0.0% false-positive rate. Co-Authored-By: Claude Opus 4.8 <[email protected]>
128 lines
2.7 KiB
TOML
128 lines
2.7 KiB
TOML
name = "python-vulnerable"
|
|
language = "python_web"
|
|
frameworks = ["flask"]
|
|
setup = ["pip install flask pyyaml requests"]
|
|
modes = ["quick", "standard"]
|
|
known_noise = []
|
|
baselines = []
|
|
|
|
[source]
|
|
type = "local"
|
|
path = "../fixtures/python-vulnerable"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "app.py"
|
|
line = 17
|
|
rule_id = "python-os-command"
|
|
sink = "os.system"
|
|
evidence = "os.system runs an attacker-controlled command"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-78"
|
|
class = "command injection"
|
|
path = "app.py"
|
|
line = 23
|
|
rule_id = "python-shell-true"
|
|
sink = "subprocess"
|
|
evidence = "subprocess runs an attacker-controlled command with shell=True"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-95"
|
|
class = "code injection"
|
|
path = "app.py"
|
|
line = 28
|
|
rule_id = "python-unsafe-eval"
|
|
sink = "eval"
|
|
evidence = "eval executes attacker-controlled input"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-502"
|
|
class = "insecure deserialization"
|
|
path = "app.py"
|
|
line = 33
|
|
rule_id = "python-unsafe-deserialization"
|
|
sink = "pickle.loads"
|
|
evidence = "pickle.loads deserializes the request body"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-502"
|
|
class = "insecure deserialization"
|
|
path = "app.py"
|
|
line = 38
|
|
rule_id = "python-unsafe-deserialization"
|
|
sink = "yaml.load"
|
|
evidence = "yaml.load deserializes untrusted input"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "app.py"
|
|
line = 44
|
|
rule_id = "python-sql-injection"
|
|
sink = "execute"
|
|
evidence = "execute concatenates request input into the SQL query"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "app.py"
|
|
line = 50
|
|
rule_id = "python-sql-injection"
|
|
sink = "execute"
|
|
evidence = "execute uses percent formatted request input in SQL"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-22"
|
|
class = "path traversal"
|
|
path = "app.py"
|
|
line = 55
|
|
rule_id = "python-path-traversal"
|
|
sink = "open"
|
|
evidence = "open reads an attacker-controlled file path"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-918"
|
|
class = "server-side request forgery"
|
|
path = "app.py"
|
|
line = 60
|
|
rule_id = "python-ssrf"
|
|
sink = "requests.get"
|
|
evidence = "requests.get fetches an attacker-controlled url"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-327"
|
|
class = "weak cryptography"
|
|
path = "app.py"
|
|
line = 65
|
|
rule_id = "python-weak-hash"
|
|
sink = "md5"
|
|
evidence = "hashlib.md5 is a weak hash"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-94"
|
|
class = "server-side template injection"
|
|
path = "app.py"
|
|
line = 70
|
|
rule_id = "python-ssti"
|
|
sink = "render_template_string"
|
|
evidence = "render_template_string evaluates attacker-controlled input"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-89"
|
|
class = "sql injection"
|
|
path = "app.py"
|
|
line = 77
|
|
sink = "execute"
|
|
evidence = "execute runs a SQL query string built from request input on a prior line"
|
|
|
|
[[expected]]
|
|
cwe = "CWE-489"
|
|
class = "insecure default"
|
|
path = "app.py"
|
|
line = 81
|
|
rule_id = "python-flask-debug"
|
|
sink = "debug"
|
|
evidence = "flask debug mode is enabled in production"
|