mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
52d28b5121
plane/memory.py: the MemoryStore interface with FileStore (index.jsonl, facts by content hash, repos/<host>__<owner>__<name>/<pin>.jsonl, idempotent ingest, deterministic row ids, refusal below 1 GiB free naming the path) and MinioStore (object metadata and tags, S3 Select pushdown probed once per process with a logged local fallback, object version ids on every row read, versioning and runs/ lifecycle helper, presigned URLs). OUSAST_MEMORY selects the backend; MINIO_* settings come from .env; the minio SDK is the optional extra `minio`. plane/tasks/remember.py: model-free rows (facts, verdict, unit_cost, alert) from a case's artifacts; remember_run computes them on the host for a recorded run without writing into it. reconciler.mark_done (477 lines total), seed before and ingest after `ousast plane run`, `ousast plane remember <run>`. The generator annotates each repo-facts Task with openultrasast.io/memory-key (repo, pin, candidates digest, image digest) and the Run with its population and split; plane/ regenerated. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
67 lines
2.3 KiB
JSON
67 lines
2.3 KiB
JSON
{
|
|
"family": "untrusted_destination",
|
|
"candidates": [
|
|
{
|
|
"candidate": "lmdeploy/vl/media/connection.py::_load_http_url",
|
|
"site": "lmdeploy/vl/media/connection.py:68:_load_http_url",
|
|
"a": true,
|
|
"b": true,
|
|
"c": null,
|
|
"agreed": true,
|
|
"disputed": false,
|
|
"site_match": true,
|
|
"usd": 0.022175,
|
|
"turns": 10,
|
|
"finding": {
|
|
"candidate": "lmdeploy/vl/media/connection.py::_load_http_url",
|
|
"site": "lmdeploy/vl/media/connection.py:68:_load_http_url",
|
|
"reported_at": "lmdeploy/vl/media/connection.py:68",
|
|
"family": "untrusted_destination",
|
|
"title": "SSRF guard bypass via HTTP redirect in _load_http_url",
|
|
"witness": "Source: an attacker-controlled HTTP request to the OpenAI-compatible RESTful API whose `messages` contain a multimodal c"
|
|
}
|
|
}
|
|
],
|
|
"agreed": [
|
|
{
|
|
"candidate": "lmdeploy/vl/media/connection.py::_load_http_url",
|
|
"site": "lmdeploy/vl/media/connection.py:68:_load_http_url",
|
|
"reported_at": "lmdeploy/vl/media/connection.py:68",
|
|
"family": "untrusted_destination",
|
|
"title": "SSRF guard bypass via HTTP redirect in _load_http_url",
|
|
"witness": "Source: an attacker-controlled HTTP request to the OpenAI-compatible RESTful API whose `messages` contain a multimodal c",
|
|
"passes": 2
|
|
}
|
|
],
|
|
"disputed": [],
|
|
"metrics": {
|
|
"candidates": 1,
|
|
"candidates_before_triage": 1,
|
|
"asked_in_both": 1,
|
|
"flagged_a": 1,
|
|
"flagged_b": 1,
|
|
"agreed": 1,
|
|
"disputed": 0,
|
|
"hunts": 2,
|
|
"declared_sites": 1,
|
|
"declared_sites_in_set": 1,
|
|
"declared_sites_matched": 1,
|
|
"declared_sites_matched_agreed": 1,
|
|
"site_matching": "assessed",
|
|
"usd_total": 0.022175,
|
|
"cost_per_candidate": 0.022175,
|
|
"recorded_triage_usd": 0.000768,
|
|
"recorded_triage_basis": "derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded",
|
|
"usd_total_with_recorded_triage": 0.022943,
|
|
"cost_per_candidate_with_recorded_triage": 0.022943,
|
|
"turns_per_hunt": 5.0,
|
|
"calls_per_hunt": 7.0,
|
|
"tiebreak": {
|
|
"asked": 0,
|
|
"flipped_to_agreed": 0,
|
|
"flipped_to_rejected": 0,
|
|
"rule": "a candidate asked in pass c is agreed when at least 2 of passes a, b, c flagged it; a candidate not asked in pass c is agreed when passes a and b both flagged it (pass c alone never decides)"
|
|
}
|
|
}
|
|
}
|