mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
295 lines
10 KiB
JSON
295 lines
10 KiB
JSON
{
|
|
"recorded_at": "2026-09-13T08:14:51.777108+00:00",
|
|
"task": "3.2",
|
|
"image_id": "sha256:0078b93b0caf7cb2587e47fa922225852bad2d42a594344a0de0161cf178b690",
|
|
"build_exit_code": 0,
|
|
"smoke_exit_code": 0,
|
|
"packaged_source_hashes": {
|
|
"openultrasast.cpg.backend": "2e327d26958efd592932bbe5a84aa122d969c0e49a1c13469a4d956b621a9a34",
|
|
"openultrasast.model.scan": "ceeb9aa2e1419565642ed11e5de6be6a80ca242f574eb533baa0b11aa79ff651",
|
|
"openultrasast.model.contracts": "0965fb3f0a365f91f2d0984666dc0fcf772344da51741367ea3b74fd7ed885d9",
|
|
"openultrasast.cli": "0a881f981d6a50d0c030ce75ddeb773a9434c6f93a9a4e059149d77f2c1f7736"
|
|
},
|
|
"packaged_sources_match_workspace": true,
|
|
"smoke_script_sha256": "5183231d42ae4acea57399bc4de3285f5510c0d95466bf8f289e35dd5289280d",
|
|
"runtime": {
|
|
"purpose": "Real PHP/JavaScript scope smoke; declared entry regions, no admission or latency claim",
|
|
"shared_budget_seconds": 900,
|
|
"languages": {
|
|
"php": {
|
|
"source_bytes": 78,
|
|
"source_sha256": "9f73839b8b5b3861611a4a627e7fb1e252e2450b861b187d43bd9e8bfd9a5f9a",
|
|
"selected_question_ids": [
|
|
"df64a78dd4ad131c49dd84b93e5371d01cbf9dd555c172d527f809b5ddebf474"
|
|
],
|
|
"result": {
|
|
"findings": [
|
|
{
|
|
"site": "api.php:3:risky",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "$req -> eval($req) in api.php (line 3, 2 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
}
|
|
],
|
|
"by_rung": {
|
|
"suspicion": 0,
|
|
"model_corroborated": 0,
|
|
"model_entailed": 1,
|
|
"execution_confirmed": 0
|
|
},
|
|
"regions_scanned": 1,
|
|
"regions_unjudged": 1,
|
|
"regions_unasked": 0,
|
|
"model_calls": 0,
|
|
"cost_usd": 0.0,
|
|
"seconds": 61.57,
|
|
"build_seconds": 28.68,
|
|
"query_seconds": 16.09,
|
|
"query_seconds_by_kind": {
|
|
"evidence": 16.75,
|
|
"taint": 16.09
|
|
},
|
|
"degradations": [
|
|
{
|
|
"stage": "model",
|
|
"reason": "regions_truncated",
|
|
"examined": 1,
|
|
"total": 2
|
|
}
|
|
],
|
|
"tiers": [
|
|
[
|
|
"api.php",
|
|
"safe",
|
|
"injection",
|
|
0
|
|
],
|
|
[
|
|
"api.php",
|
|
"risky",
|
|
"injection",
|
|
4
|
|
]
|
|
],
|
|
"tier_counts": {
|
|
"0": 1,
|
|
"4": 1
|
|
},
|
|
"requests_pruned": 0,
|
|
"scope": {
|
|
"ranker_version": "existing-static-evidence-v1",
|
|
"ranking_mode": "evidence",
|
|
"population_complete": true,
|
|
"selected": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "risky",
|
|
"family": "injection"
|
|
},
|
|
"priority": 0.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"mysqli_prepare\",\"mysqli_stmt_bind_param\",\"pg_execute\",\"pg_prepare\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval($req)\",\"line\":3,\"method\":\"risky\"}],\"source_local\":false,\"source_near\":false}",
|
|
"tier=4",
|
|
"score=2.5"
|
|
],
|
|
"tier": 4,
|
|
"score": 2.5
|
|
}
|
|
],
|
|
"deferred": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "safe",
|
|
"family": "injection"
|
|
},
|
|
"reason": "region_budget",
|
|
"evidence": [
|
|
"static_rank=2.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"mysqli_prepare\",\"mysqli_stmt_bind_param\",\"pg_execute\",\"pg_prepare\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[],\"source_local\":false,\"source_near\":false}",
|
|
"tier=0",
|
|
"score=0.0"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": []
|
|
},
|
|
"question_outcomes": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "risky",
|
|
"family": "injection"
|
|
},
|
|
"status": "completed",
|
|
"reason": "query_answered_and_arbitrated",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":2,\"paths\":1,\"sanitized\":false,\"sink\":\"eval($req)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.php\",\"sinkLine\":\"3\",\"sinkMethod\":\"risky\",\"source\":\"$req\",\"sourceKind\":\"parameter\"}]"
|
|
}
|
|
],
|
|
"family_coverage": [
|
|
{
|
|
"unit": "scope-smoke",
|
|
"language": "php",
|
|
"family": "injection",
|
|
"selected": 1,
|
|
"completed": 1,
|
|
"unanswered": 0,
|
|
"deferred": 1,
|
|
"unsupported": 0
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"javascript": {
|
|
"source_bytes": 69,
|
|
"source_sha256": "d3e956e2b4b4f29c51afb9c1ba45fe207dae93c11fd3b7d50171121a121c85c6",
|
|
"selected_question_ids": [
|
|
"f29db1d7c33c22f09e10d8915be1772af4d2ff7856807e59b85678306d5b1269"
|
|
],
|
|
"result": {
|
|
"findings": [
|
|
{
|
|
"site": "api.js:2:risky",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "req -> eval(req) in api.js (line 2, 2 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
}
|
|
],
|
|
"by_rung": {
|
|
"suspicion": 0,
|
|
"model_corroborated": 0,
|
|
"model_entailed": 1,
|
|
"execution_confirmed": 0
|
|
},
|
|
"regions_scanned": 1,
|
|
"regions_unjudged": 1,
|
|
"regions_unasked": 0,
|
|
"model_calls": 0,
|
|
"cost_usd": 0.0,
|
|
"seconds": 51.27,
|
|
"build_seconds": 6.47,
|
|
"query_seconds": 23.0,
|
|
"query_seconds_by_kind": {
|
|
"evidence": 21.76,
|
|
"taint": 23.0
|
|
},
|
|
"degradations": [
|
|
{
|
|
"stage": "model",
|
|
"reason": "regions_truncated",
|
|
"examined": 1,
|
|
"total": 2
|
|
}
|
|
],
|
|
"tiers": [
|
|
[
|
|
"api.js",
|
|
"safe",
|
|
"injection",
|
|
0
|
|
],
|
|
[
|
|
"api.js",
|
|
"risky",
|
|
"injection",
|
|
4
|
|
]
|
|
],
|
|
"tier_counts": {
|
|
"0": 1,
|
|
"4": 1
|
|
},
|
|
"requests_pruned": 0,
|
|
"scope": {
|
|
"ranker_version": "existing-static-evidence-v1",
|
|
"ranking_mode": "evidence",
|
|
"population_complete": true,
|
|
"selected": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "risky",
|
|
"family": "injection"
|
|
},
|
|
"priority": 0.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval(req)\",\"line\":2,\"method\":\"risky\"}],\"source_local\":false,\"source_near\":false}",
|
|
"tier=4",
|
|
"score=2.5"
|
|
],
|
|
"tier": 4,
|
|
"score": 2.5
|
|
}
|
|
],
|
|
"deferred": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "safe",
|
|
"family": "injection"
|
|
},
|
|
"reason": "region_budget",
|
|
"evidence": [
|
|
"static_rank=2.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[],\"source_local\":false,\"source_near\":false}",
|
|
"tier=0",
|
|
"score=0.0"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": []
|
|
},
|
|
"question_outcomes": [
|
|
{
|
|
"identity": {
|
|
"unit": "scope-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "risky",
|
|
"family": "injection"
|
|
},
|
|
"status": "completed",
|
|
"reason": "query_answered_and_arbitrated",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":2,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(req)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"risky\",\"source\":\"req\",\"sourceKind\":\"parameter\"}]"
|
|
}
|
|
],
|
|
"family_coverage": [
|
|
{
|
|
"unit": "scope-smoke",
|
|
"language": "javascript",
|
|
"family": "injection",
|
|
"selected": 1,
|
|
"completed": 1,
|
|
"unanswered": 0,
|
|
"deferred": 1,
|
|
"unsupported": 0
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"limits": [
|
|
"Manually declared controlled entry regions, not source-mapper validation.",
|
|
"Not PMPro/NodeGoat replay, detector admission, or hook latency.",
|
|
"Selected means scheduled; completed means answered and arbitrated, not safe or admitted."
|
|
]
|
|
}
|