mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
21634ccf58
The analyzer was not run. freeze.py read each case's source at both pins: - both pins are commits in the repository and in the right order; - the declared sink site's file is present at the vulnerable pin, and its declared functions appear in it; - the fix touches a declared site file (Budibase's sites reordered so the changed file, queries.ts, comes first). Benign controls: - 12 are reviewed automatic proposals. - 3 automatic proposals were rejected as not benign: qwed's merged a ReDoS fix, ReactPress's corrected a SQL column whitelist, and Sulu's was a branch merge that can carry the fix. - Those three, plus cct-studio and Directorist (no automatic proposal), were chosen by hand. Directorist's comes from before the vulnerable pin, because only 3 commits follow its fix. freeze.py now accepts a recorded benign control instead of reporting that none was proposed. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo