mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 5.5
32eb46f297
Source-only selection on the v2 vulnerable pins, compared on the same cases: - ranker top-20 entry points: the vulnerable file was in scope in 1/17; - shipped-vocabulary sink-first: the declared site was a candidate in 2/17; - model-classified sinks (deepseek-flash, no vocabulary): the declared site was a candidate in 15/17, and a fix or site file in 16/17. Every chunk was classified; $14.42. Misses: User Registration (file in scope, not the function) and Sulu (JCR-SQL2 query builder). The cost of this reach is volume: 3-1037 candidate functions per repository, 4,762 in total. The next stage must decide which candidates are fed by attacker data without a guard. v2 is spent for tuning; this qualifies nothing. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
332 lines
8.4 KiB
JSON
332 lines
8.4 KiB
JSON
{
|
|
"measurement": "model-classified sink selection on population v2 vulnerable pins (source only, deepseek-flash, model_sinks.py @ 05d5699)",
|
|
"declared_site_in_candidates": [
|
|
15,
|
|
17
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
16,
|
|
17
|
|
],
|
|
"compare": {
|
|
"ranker_top20_file_in_scope": [
|
|
1,
|
|
17
|
|
],
|
|
"vocabulary_sink_first_site": [
|
|
2,
|
|
17
|
|
]
|
|
},
|
|
"candidate_functions_total": 4757,
|
|
"spent_usd": 14.42,
|
|
"note": "v2 is spent for tuning; informs design, qualifies nothing",
|
|
"cases": [
|
|
{
|
|
"id": "pgadmin-maintenance-sqli",
|
|
"family": "injection",
|
|
"files": 948,
|
|
"chunks": 1251,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 1037,
|
|
"candidate_files": 196,
|
|
"declared_site_in_candidates": [
|
|
"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"web/pgadmin/tools/maintenance/__init__.py"
|
|
],
|
|
"usd": 1.293,
|
|
"seconds": 148.6
|
|
},
|
|
{
|
|
"id": "qwed-sympy-eval",
|
|
"family": "injection",
|
|
"files": 152,
|
|
"chunks": 197,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 84,
|
|
"candidate_files": 33,
|
|
"declared_site_in_candidates": [
|
|
"src/qwed_new/core/batch.py::_verify_item"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"src/qwed_new/api/main.py",
|
|
"src/qwed_new/core/batch.py",
|
|
"src/qwed_new/core/validator.py",
|
|
"src/qwed_new/core/verifier.py"
|
|
],
|
|
"usd": 0.2178,
|
|
"seconds": 21.7
|
|
},
|
|
{
|
|
"id": "contextforge-prompt-ssti",
|
|
"family": "injection",
|
|
"files": 607,
|
|
"chunks": 978,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 444,
|
|
"candidate_files": 134,
|
|
"declared_site_in_candidates": [
|
|
"mcpgateway/services/prompt_service.py::_compile_jinja_template",
|
|
"mcpgateway/services/prompt_service.py::_render_template"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"mcpgateway/services/prompt_service.py"
|
|
],
|
|
"usd": 1.3444,
|
|
"seconds": 112.8
|
|
},
|
|
{
|
|
"id": "lmdeploy-media-url-ssrf",
|
|
"family": "untrusted_destination",
|
|
"files": 617,
|
|
"chunks": 762,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 115,
|
|
"candidate_files": 50,
|
|
"declared_site_in_candidates": [
|
|
"lmdeploy/vl/media/connection.py::_load_http_url"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"lmdeploy/serve/openai/api_server.py",
|
|
"lmdeploy/serve/processors/multimodal.py",
|
|
"lmdeploy/vl/media/connection.py"
|
|
],
|
|
"usd": 0.7622,
|
|
"seconds": 79.3
|
|
},
|
|
{
|
|
"id": "winml-cli-serve-cors",
|
|
"family": "config_secrets",
|
|
"files": 452,
|
|
"chunks": 642,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 3,
|
|
"candidate_files": 3,
|
|
"declared_site_in_candidates": [
|
|
"src/winml/modelkit/serve/cli_api.py::<global>"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"src/winml/modelkit/serve/cli_api.py"
|
|
],
|
|
"usd": 0.813,
|
|
"seconds": 67.5
|
|
},
|
|
{
|
|
"id": "reactpress-findall-column-sqli",
|
|
"family": "injection",
|
|
"files": 492,
|
|
"chunks": 507,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 97,
|
|
"candidate_files": 48,
|
|
"declared_site_in_candidates": [
|
|
"server/src/modules/article/article.service.ts::findAll"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"server/src/modules/article/article.service.ts",
|
|
"server/src/modules/comment/comment.service.ts",
|
|
"server/src/modules/file/file.service.ts",
|
|
"server/src/modules/knowledge/knowledge.service.ts",
|
|
"server/src/modules/page/page.service.ts"
|
|
],
|
|
"usd": 0.2499,
|
|
"seconds": 50.6
|
|
},
|
|
{
|
|
"id": "fuxa-tdengine-escape-sqli",
|
|
"family": "injection",
|
|
"files": 398,
|
|
"chunks": 490,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 89,
|
|
"candidate_files": 33,
|
|
"declared_site_in_candidates": [
|
|
"server/runtime/storage/tdengine/index.js::getDaqValue"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"server/runtime/storage/tdengine/index.js"
|
|
],
|
|
"usd": 0.4613,
|
|
"seconds": 52.0
|
|
},
|
|
{
|
|
"id": "budibase-mongo-template-nosqli",
|
|
"family": "injection",
|
|
"files": 1926,
|
|
"chunks": 2063,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 565,
|
|
"candidate_files": 204,
|
|
"declared_site_in_candidates": [
|
|
"packages/server/src/integrations/mongodb.ts::read",
|
|
"packages/server/src/sdk/workspace/queries/queries.ts::enrichContext"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"packages/server/src/integrations/mongodb.ts",
|
|
"packages/server/src/sdk/workspace/queries/queries.ts",
|
|
"packages/string-templates/src/index.ts"
|
|
],
|
|
"usd": 1.0743,
|
|
"seconds": 213.6
|
|
},
|
|
{
|
|
"id": "unleash-addon-webhook-ssrf",
|
|
"family": "untrusted_destination",
|
|
"files": 4893,
|
|
"chunks": 4999,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 491,
|
|
"candidate_files": 312,
|
|
"declared_site_in_candidates": [
|
|
"src/lib/addons/addon.ts::fetchRetry"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"src/lib/addons/addon.ts",
|
|
"src/lib/addons/new-relic.ts",
|
|
"src/lib/addons/teams-workflow.ts",
|
|
"src/lib/addons/teams.ts"
|
|
],
|
|
"usd": 1.5115,
|
|
"seconds": 502.7
|
|
},
|
|
{
|
|
"id": "medplum-external-auth-open-redirect",
|
|
"family": "untrusted_destination",
|
|
"files": 973,
|
|
"chunks": 1120,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 332,
|
|
"candidate_files": 189,
|
|
"declared_site_in_candidates": [
|
|
"packages/server/src/auth/external.ts::externalCallbackHandler"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"packages/server/src/auth/external.ts"
|
|
],
|
|
"usd": 1.0018,
|
|
"seconds": 123.8
|
|
},
|
|
{
|
|
"id": "cct-studio-server-cmdi",
|
|
"family": "injection",
|
|
"files": 1061,
|
|
"chunks": 1255,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 328,
|
|
"candidate_files": 161,
|
|
"declared_site_in_candidates": [
|
|
"cli-tool/src/sandbox-server.js::checkAndInstallAgent",
|
|
"cli-tool/src/sandbox-server.js::executeLocalTask"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"cli-tool/src/sandbox-server.js"
|
|
],
|
|
"usd": 1.1606,
|
|
"seconds": 144.4
|
|
},
|
|
{
|
|
"id": "wp-gopay-log-filter-sqli",
|
|
"family": "injection",
|
|
"files": 19,
|
|
"chunks": 26,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 12,
|
|
"candidate_files": 6,
|
|
"declared_site_in_candidates": [
|
|
"admin/views/log.php::<global>"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"admin/views/log.php"
|
|
],
|
|
"usd": 0.0037,
|
|
"seconds": 6.2
|
|
},
|
|
{
|
|
"id": "wp-user-registration-login-redirect",
|
|
"family": "untrusted_destination",
|
|
"files": 679,
|
|
"chunks": 1036,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 224,
|
|
"candidate_files": 92,
|
|
"declared_site_in_candidates": [],
|
|
"fix_or_site_file_in_candidates": [
|
|
"includes/Functions/CoreFunctions.php"
|
|
],
|
|
"usd": 1.3749,
|
|
"seconds": 118.7
|
|
},
|
|
{
|
|
"id": "wp-directorist-avatar-ssrf",
|
|
"family": "untrusted_destination",
|
|
"files": 620,
|
|
"chunks": 829,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 100,
|
|
"candidate_files": 64,
|
|
"declared_site_in_candidates": [
|
|
"includes/rest-api/functions.php::directorist_rest_upload_image_from_url"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"includes/rest-api/Version1/class-users-controller.php",
|
|
"includes/rest-api/functions.php"
|
|
],
|
|
"usd": 0.8386,
|
|
"seconds": 92.6
|
|
},
|
|
{
|
|
"id": "wp-groundhogg-confirm-redirect",
|
|
"family": "untrusted_destination",
|
|
"files": 653,
|
|
"chunks": 940,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 179,
|
|
"candidate_files": 84,
|
|
"declared_site_in_candidates": [
|
|
"templates/preferences.php::<global>"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"templates/preferences.php"
|
|
],
|
|
"usd": 0.23,
|
|
"seconds": 107.4
|
|
},
|
|
{
|
|
"id": "froxlor-admin-ip-second-order-sqli",
|
|
"family": "injection",
|
|
"files": 333,
|
|
"chunks": 463,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 345,
|
|
"candidate_files": 115,
|
|
"declared_site_in_candidates": [
|
|
"lib/Froxlor/Api/Commands/Domains.php::validateIpAddresses",
|
|
"lib/Froxlor/Api/Commands/IpsAndPorts.php::listing",
|
|
"lib/Froxlor/Api/Commands/IpsAndPorts.php::listingCount"
|
|
],
|
|
"fix_or_site_file_in_candidates": [
|
|
"lib/Froxlor/Api/Commands/Admins.php",
|
|
"lib/Froxlor/Api/Commands/Domains.php",
|
|
"lib/Froxlor/Api/Commands/IpsAndPorts.php"
|
|
],
|
|
"usd": 0.7755,
|
|
"seconds": 62.4
|
|
},
|
|
{
|
|
"id": "sulu-smart-content-sql2-injection",
|
|
"family": "injection",
|
|
"files": 2904,
|
|
"chunks": 3014,
|
|
"unclassified_chunks": 0,
|
|
"candidate_functions": 312,
|
|
"candidate_files": 164,
|
|
"declared_site_in_candidates": [],
|
|
"fix_or_site_file_in_candidates": [],
|
|
"usd": 1.3089,
|
|
"seconds": 329.9
|
|
}
|
|
]
|
|
}
|