mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-20 05:29:28 +00:00
Marius CiepluchandClaude Opus 5.5
6c03b4a38c
Found on PMPro's re-added class-pmpro-levels.php:87: every REST handler casts the level id, `isset($p["id"]) ? intval($p["id"]) : null`, and the flow was reported unsanitized. Traced, the engine steps from intval's argument straight to the conditional, so `intval` is never a path element and the element-wise sanitizer check never saw it. - sanitizedBetween: where a path element contains the previous one, the syntax between them is what the value was wrapped in; a sanitizer there sanitizes the flow. A sanitizer elsewhere in the expression (the other branch of a conditional) does not count. Used by the sink query and the hook join; the field join already matched sanitizer text. - The test exposed the conditional itself as a source: isSourceCall matched any operator by its full text. Of the operators only an access (field/index) names its own value; a conditional or concatenation built from `$_GET` is not a source. A real-Joern control covers the cast inside a conditional (sanitized) and a sanitizer in the other branch (not); 20 query tests pass. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo