mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
2ba1aaf649
"String-named callable" sounds like one gap and is at least two, so the
neighbouring forms were measured rather than assumed. All three came back
sound, and none of them is what breaks WP Statistics:
* taint SURVIVES a string-named callable -- array_map('trim', $_GET['a'])
and call_user_func('trim', $_GET['a']) both reach the sink and are
entailed, exactly like a plain call;
* a sanitizer named by a string IS recognised -- array_map('esc_sql', ...)
suppresses, which is the form PMPro actually writes;
* the textual sanitizer test does not over-suppress. A query where a SIBLING
value is esc_sql-wrapped is still entailed for the unwrapped one, and a
decoy 'esc_sql' literal flowing to the same sink does not suppress either,
because flow.elements are the nodes on that value's own path.
I expected the second and third to be defects and they are not. Recording the
negative result so the next reader does not spend the same hour on it.
The hook edge is different in kind, which is why it stays its own task:
`add_filter` and `apply_filters` are not one expression carrying a callback,
they are two statements in two files joined only through a hashtable inside
WordPress core -- code that is not even in the scanned tree.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG