mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 4.8
cf9f945992
Rebuild the quick-scan detection engine and ground-truth benchmarks to hit >=90% recall / <10% false positives for C/C++, Python, JavaScript, and Java. Engine (findings.py, preprocess.py): - Scope each PatternRule by language (fixes cross-language false positives such as the Python eval/exec rule firing on JS .exec()). - Add JavaScript/TypeScript rules (command exec, eval/Function, reflected XSS, SQLi, path traversal, SSRF, weak hash, deserialization); execFile/spawn-argv excluded as safe alternatives. - Add Java rules (Runtime exec, SQL string concatenation, weak hash, readObject) and a Groovy server-side template rule (yieldUnescaped of a bound variable). - Broaden C/C++ and Python coverage; precision guards for format strings and parameterised vs concatenated SQL; #-comment skipping; CWE in rationale. - Register .java/.groovy/.tpl source extensions. Benchmarks: - Add realistic corpora modeled on Damn Vulnerable C/C++, PyGoat/DVPWA, and NodeGoat, plus the real kiview/damn-vulnerable-spring-boot-app vendored verbatim (MIT, attribution in LICENSE/NOTICE.md). Each manifest carries complete, independently-labeled ground truth including genuinely hard-to-detect vulns (integer overflow, second-order SQLi, prototype pollution) so recall is measured honestly, plus safe-API files for precision. - Fix pre-existing smoke-manifest ground-truth errors (Python/JS line offsets, missing C/C++ strcpy entry, Java SQLi line). benchmark.py: - Fix sink matching to normalise the expected sink consistently so sinks with underscores (e.g. render_template_string) can match. Tests: - Add tests/test_detection_benchmarks.py enforcing the >=90% recall / <10% FP goal per language and overall. Measured: C/C++ 93.3%, Python 93.3%, JavaScript 92.3%, Java 100%; overall 93.6% recall, 0.0% false-positive rate. Co-Authored-By: Claude Opus 4.8 <[email protected]>
82 lines
1.9 KiB
Python
82 lines
1.9 KiB
Python
"""Vulnerable Flask app modeled on PyGoat / DVPWA."""
|
|
import hashlib
|
|
import os
|
|
import pickle
|
|
import subprocess
|
|
|
|
import requests
|
|
import yaml
|
|
from flask import Flask, render_template_string, request
|
|
|
|
app = Flask(__name__)
|
|
|
|
|
|
@app.get("/ping")
|
|
def ping():
|
|
host = request.args["host"]
|
|
return os.system("ping -c 1 " + host) # CWE-78 os.system command injection
|
|
|
|
|
|
@app.get("/run")
|
|
def run():
|
|
cmd = request.args["cmd"]
|
|
return subprocess.check_output(cmd, shell=True) # CWE-78 subprocess shell=True
|
|
|
|
|
|
@app.get("/calc")
|
|
def calc():
|
|
return str(eval(request.args["expr"])) # CWE-95 eval of user input
|
|
|
|
|
|
@app.get("/load")
|
|
def load():
|
|
return pickle.loads(request.data) # CWE-502 pickle deserialization of request body
|
|
|
|
|
|
@app.get("/config")
|
|
def config():
|
|
return yaml.load(request.data) # CWE-502 yaml.load of untrusted input
|
|
|
|
|
|
@app.get("/user")
|
|
def user(db):
|
|
name = request.args["name"]
|
|
return db.execute("select * from users where name = '" + name + "'") # CWE-89 SQL injection
|
|
|
|
|
|
@app.get("/report")
|
|
def report(db):
|
|
uid = request.args["id"]
|
|
return db.execute("select * from reports where id = %s" % uid) # CWE-89 SQL injection via %
|
|
|
|
|
|
@app.get("/read")
|
|
def read():
|
|
return open(request.args["path"]).read() # CWE-22 path traversal from request
|
|
|
|
|
|
@app.get("/fetch")
|
|
def fetch():
|
|
return requests.get(request.args["url"]).text # CWE-918 SSRF from request url
|
|
|
|
|
|
@app.get("/token")
|
|
def token():
|
|
return hashlib.md5(request.args["pw"].encode()).hexdigest() # CWE-327 weak hash
|
|
|
|
|
|
@app.get("/render")
|
|
def render():
|
|
return render_template_string("Hello " + request.args["name"]) # CWE-94 SSTI
|
|
|
|
|
|
@app.get("/search")
|
|
def search(db):
|
|
term = request.args["q"]
|
|
query = "select * from items where title like '%" + term + "%'"
|
|
return db.execute(query) # CWE-89 second-order: query built on prior line (regex blind spot)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
app.run(debug=True) # CWE-489 debug mode in production
|