mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
af81bccc70
ruleset/frameworks.toml lists 19 framework and library ids (wordpress, flask, django, express,
spring, jakarta-servlet, react, vue and 11 libraries), each with its languages, dependency
package names and a symbol lexicon used only by the lint and for stratification.
Every framework/library entry of section 2 is tagged `framework`/`library`, and mixed entries
are split so a tag covers a whole entry (split pieces keep the entry's id and flags, in place):
semantic facts 38 tagged entries (wordpress 6, django 6, flask 4, express 4, jakarta-servlet 3,
pyyaml 2, one each for spring, sqlalchemy, requests, httpx, lodash, node-http-clients,
escape-html, sanitize-html, dompurify, esapi, commons-text, react, vue); the dispatch fact
behind the hook-as-source path is wordpress; the PHP layout row is renamed php_layout and stays
untagged (a product filter). Quick rules: 9 tagged (wordpress 6, flask, pyyaml,
node-http-clients); php-unserialize is split into php-unserialize and php-maybe-unserialize;
the lint also caught WordPress escapers in exclusions and axios/yaml.load in mixed rules, so
those keep their ids as tagged rules and gain a `fallback_for` language-level rule (6) that is
active only when the prior is off.
load_facts and load_ruleset take priors ("all" by default -- today's scan --, "off", or a set
of ids). tests/test_semantic_priors.py: the lint (no untagged entry contains a lexicon symbol
of its language), "off" removes exactly the tagged entries and activates the fallbacks, split
entries keep their language-level calls. Rule and layout counts in three existing tests follow the split and the rename.
Unchanged defaults: test_benchmark_output_is_byte_identical_to_golden_baseline passes, and the
quick findings of all 15 benchmark manifests (full StaticFinding records) are byte-identical
before and after. priors=off on the same manifests: 61 -> 57 findings; the 4 lost are js-ssrf
(axios), php-wpdb-sql-composition, python-ssti and python yaml.load; 5 PHP and 1 Python finding
move to their fallback rule at the same location. Semantic calls with priors off: php 75/92,
python 32/77, javascript 42/70, java 24/41, c 27/27 (the engine-side effect needs Joern and was
not measured).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
161 lines
5.2 KiB
TOML
161 lines
5.2 KiB
TOML
# Framework and library ids for the ruleset's optional priors (learned-decision-engine Req 8, design section 2).
|
|
#
|
|
# Hand-written knowledge stays at the language level: superglobals, built-ins, process execution, raw database
|
|
# drivers, deserialisers, the standard library. An entry of `semantic/*.toml` or a quick `[[rule]]` that knows a
|
|
# framework or a library carries `framework = "<id>"` or `library = "<id>"` naming one row here, and loaders take
|
|
# `priors` ("all" -- today's scan --, "off", or a set of ids) to keep or drop the tagged entries.
|
|
#
|
|
# `symbols` is a lexicon with two uses only: the lint test (`tests/test_semantic_priors.py`) fails on an untagged
|
|
# entry that contains one, and repository stratification (with `packages`, the dependency names a manifest such as
|
|
# composer.json, requirements*.txt, pyproject.toml, package.json or pom.xml declares). It never feeds detection.
|
|
# A symbol matches as a whole token: not preceded or followed by a letter, digit or underscore.
|
|
|
|
version = "1"
|
|
|
|
[[framework]]
|
|
id = "wordpress"
|
|
kind = "framework"
|
|
languages = ["php"]
|
|
packages = ["johnpbloch/wordpress", "roots/wordpress", "wordpress/wordpress"]
|
|
# A plugin or theme checkout declares itself in a file header instead of a dependency manifest.
|
|
markers = ["Plugin Name:", "Theme Name:"]
|
|
symbols = [
|
|
"$wpdb", "wpdb->", "maybe_unserialize", "esc_sql", "absint", "esc_html", "esc_attr", "esc_url", "esc_js",
|
|
"sanitize_text_field", "wp_kses", "add_action", "add_filter", "add_shortcode", "apply_filters",
|
|
"apply_filters_ref_array", "do_action", "do_action_ref_array",
|
|
]
|
|
|
|
[[framework]]
|
|
id = "flask"
|
|
kind = "framework"
|
|
languages = ["python"]
|
|
packages = ["flask"]
|
|
symbols = [
|
|
"request.args", "request.form", "request.json", "request.values", "request.get_json", "request.files",
|
|
"send_file", "send_from_directory", "render_template_string", "Markup", "url_for",
|
|
]
|
|
|
|
[[framework]]
|
|
id = "django"
|
|
kind = "framework"
|
|
languages = ["python"]
|
|
packages = ["django", "djangorestframework"]
|
|
symbols = [
|
|
"request.GET", "request.POST", "request.COOKIES", "request.FILES", "request.META", "request.query_params",
|
|
"cleaned_data", "objects.raw", "RawSQL", "mark_safe", "format_html", "HttpResponse", "HttpResponseRedirect",
|
|
"FileResponse", "url_has_allowed_host_and_scheme", "is_safe_url", "reverse_lazy",
|
|
]
|
|
|
|
[[framework]]
|
|
id = "express"
|
|
kind = "framework"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["express"]
|
|
symbols = ["req.query", "req.body", "req.params", "req.cookies", "req.headers", "res.send", "response.send", "sendFile", "res.redirect"]
|
|
|
|
[[framework]]
|
|
id = "spring"
|
|
kind = "framework"
|
|
languages = ["java"]
|
|
packages = ["org.springframework:spring-web", "org.springframework.boot:spring-boot-starter-web"]
|
|
symbols = ["getForObject", "postForObject", "RestTemplate", "WebClient"]
|
|
|
|
[[framework]]
|
|
id = "jakarta-servlet"
|
|
kind = "framework"
|
|
languages = ["java"]
|
|
packages = ["jakarta.servlet:jakarta.servlet-api", "javax.servlet:javax.servlet-api"]
|
|
symbols = ["getParameter", "getQueryString", "getWriter", "sendRedirect", "HttpServletRequest", "HttpServletResponse"]
|
|
|
|
[[framework]]
|
|
id = "react"
|
|
kind = "framework"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["react", "react-dom"]
|
|
symbols = ["dangerouslySetInnerHTML"]
|
|
|
|
[[framework]]
|
|
id = "vue"
|
|
kind = "framework"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["vue"]
|
|
symbols = ["v-html"]
|
|
|
|
[[framework]]
|
|
id = "sqlalchemy"
|
|
kind = "library"
|
|
languages = ["python"]
|
|
packages = ["sqlalchemy"]
|
|
symbols = ["from_statement"]
|
|
|
|
[[framework]]
|
|
id = "pyyaml"
|
|
kind = "library"
|
|
languages = ["python"]
|
|
packages = ["pyyaml"]
|
|
symbols = ["yaml.load", "yaml.safe_load"]
|
|
|
|
[[framework]]
|
|
id = "requests"
|
|
kind = "library"
|
|
languages = ["python"]
|
|
packages = ["requests"]
|
|
symbols = ["requests.get", "requests.post", "requests.request"]
|
|
|
|
[[framework]]
|
|
id = "httpx"
|
|
kind = "library"
|
|
languages = ["python"]
|
|
packages = ["httpx"]
|
|
symbols = ["httpx.get", "httpx.post"]
|
|
|
|
[[framework]]
|
|
id = "lodash"
|
|
kind = "library"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["lodash", "lodash.merge", "lodash.set", "lodash.defaultsdeep"]
|
|
symbols = ["mergeDeep", "defaultsDeep", "setWith"]
|
|
|
|
# The Node HTTP client packages, one group: each is a thin wrapper over `http.request`, and they are known as a set.
|
|
[[framework]]
|
|
id = "node-http-clients"
|
|
kind = "library"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["axios", "got", "needle", "request", "superagent", "unirest", "undici"]
|
|
symbols = ["axios", "needle", "superagent", "unirest", "undici"]
|
|
|
|
[[framework]]
|
|
id = "escape-html"
|
|
kind = "library"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["escape-html"]
|
|
symbols = ["escapeHtml"]
|
|
|
|
[[framework]]
|
|
id = "sanitize-html"
|
|
kind = "library"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["sanitize-html"]
|
|
symbols = ["sanitizeHtml"]
|
|
|
|
[[framework]]
|
|
id = "dompurify"
|
|
kind = "library"
|
|
languages = ["javascript", "typescript"]
|
|
packages = ["dompurify", "isomorphic-dompurify"]
|
|
symbols = ["DOMPurify"]
|
|
|
|
[[framework]]
|
|
id = "esapi"
|
|
kind = "library"
|
|
languages = ["java"]
|
|
packages = ["org.owasp.esapi:esapi"]
|
|
symbols = ["ESAPI", "encodeForHTML", "encodeForURL"]
|
|
|
|
[[framework]]
|
|
id = "commons-text"
|
|
kind = "library"
|
|
languages = ["java"]
|
|
packages = ["org.apache.commons:commons-text", "org.apache.commons:commons-lang3"]
|
|
symbols = ["StringEscapeUtils"]
|