mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
90e0098a94
Verified root cause: the pilot repos are libraries whose untrusted input is public-API parameters, not HTTP requests. Python taint sources (ruleset/semantic/python.toml) are web/CLI only; the parameter-as-source mode (_parameters_are_input) fires only for recognised entry points, and the pilot vuln regions are entry:false -- so their params are deliberately not sources. Widening that statically would reintroduce the WordPress/PMPro false-SQL-injection flood the docstring documents. So the static engine cannot safely source library APIs on its own -- which is exactly the seam for the maintainer's '2 guided by 1' directive: the LLM adjudicates which library parameter is a trust boundary, the taint engine traces that source->sink as proof (not LLM say-so), and repeated source shapes graduate to guarded static facts. First increment (pending budget): LLM-guided-source mode on the 5 pilot regions, measuring source naming, traced finding, catch lift vs regex 1/5, and false-alarm on ordinary changes; staged. Co-Authored-By: Claude Opus 4.8 <[email protected]>