mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-21 14:09:27 +00:00
Marius CiepluchandClaude Opus 4.8
27a7c12ca1
ousast scan --mode deep (DeepSeek deepseek-flash, model layer + tool_hunter, 60-call bound) on bedrock + graphiti, the two sound pilot targets the static engine missed: - graphiti: HIT -- falkordb_driver.py:207, tag family:cypher-injection; rationale traces build_fulltext_query concatenating user input into a Cypher string at line 278 (inside the labelled function, location-matches). The static engine produced zero findings here. - bedrock: miss -- 12 suspicions on adjacent concerns (network-PUBLIC, download_file), never named the install_packages -> pip command injection. Cost is a non-issue: ~$0.007/repo, 64 model calls for a whole-repo deep scan. BUT everything stopped at suspicion rung -- the proof arm did not elevate to proven; release-grade BLOCK needs proven findings. Direction (maintainer): prompt evolution is a core lever -- a DSPy-based loop (GEPA/MIPRO, pluggable; evolving field) whose objective is to learn what hints/annotations steer the model to the real sink, sourced from the framework knowledge already shipped (no new user annotation), with LLM-proposed boundaries graduating into the facts. Next: measure proof-arm lift on graphiti; stand up the DSPy hint loop + re-run bedrock; widen the hunter to the 23 sound targets for a catch rate; then a change-scoped + proven run. Co-Authored-By: Claude Opus 4.8 <[email protected]>
282 lines
12 KiB
JSON
282 lines
12 KiB
JSON
{
|
|
"findings": [
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-unsafe-eval:tests/bedrock_agentcore/evaluation/integrations/strands_agents_evals/test_end_to_end.py:26",
|
|
"function_name": null,
|
|
"line": 26,
|
|
"path": "tests/bedrock_agentcore/evaluation/integrations/strands_agents_evals/test_end_to_end.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 2.9,
|
|
"rationale": "Static pattern python-unsafe-eval (CWE-95) matched eval on line 26; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"auth boundary file tag"
|
|
],
|
|
"access_level": "authenticated",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "privileged_surface",
|
|
"line": null,
|
|
"name": "auth_boundary",
|
|
"path": "tests/bedrock_agentcore/evaluation/integrations/strands_agents_evals/test_end_to_end.py",
|
|
"provenance": "entrypoint:privileged_surface:authenticated",
|
|
"rationale": "privileged_surface surface classified as authenticated at identity_boundary",
|
|
"registered_by": "",
|
|
"trust_boundary": "identity_boundary"
|
|
}
|
|
],
|
|
"reachability_status": "inferred-file-surface",
|
|
"rung": "suspicion",
|
|
"severity": "critical",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"auth_boundary",
|
|
"syscall_entry"
|
|
],
|
|
"title": "Dynamic Python execution needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-unsafe-eval:tests_integ/evaluation/integrations/strands_agents_evals/test_strands_evaluation.py:30",
|
|
"function_name": null,
|
|
"line": 30,
|
|
"path": "tests_integ/evaluation/integrations/strands_agents_evals/test_strands_evaluation.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-unsafe-eval (CWE-95) matched eval on line 30; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "critical",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"syscall_entry"
|
|
],
|
|
"title": "Dynamic Python execution needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/async/interactive_async_strands.py:159:path.open",
|
|
"function_name": null,
|
|
"line": 159,
|
|
"path": "tests_integ/async/interactive_async_strands.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink path.open reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: path.open"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/async/interactive_async_strands.py:170:path.open",
|
|
"function_name": null,
|
|
"line": 170,
|
|
"path": "tests_integ/async/interactive_async_strands.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink path.open reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: path.open"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/async/interactive_async_strands.py:211:path.open",
|
|
"function_name": null,
|
|
"line": 211,
|
|
"path": "tests_integ/async/interactive_async_strands.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink path.open reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: path.open"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/runtime/base_test.py:44:os.system",
|
|
"function_name": null,
|
|
"line": 44,
|
|
"path": "tests_integ/runtime/base_test.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink os.system reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "critical",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: os.system"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/runtime/http_client.py:34:outbound.request",
|
|
"function_name": null,
|
|
"line": 34,
|
|
"path": "tests_integ/runtime/http_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests_integ/runtime/http_client.py:44:outbound.request",
|
|
"function_name": null,
|
|
"line": 44,
|
|
"path": "tests_integ/runtime/http_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/bedrock_agentcore/tools/code_interpreter_client.py:114",
|
|
"function_name": null,
|
|
"line": 114,
|
|
"path": "src/bedrock_agentcore/tools/code_interpreter_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "grep_repo and read_file show create_code_interpreter builds request_params with networkConfiguration=network_configuration or {\"networkMode\": \"PUBLIC\"} (line 173). The flagged test test_create_code_interpreter_minimal asserts exactly this PUBLIC default (test file line 120), so the tests corroborate that omitting network_configuration silently provisions a publicly networked interpreter rather than failing closed. This is the production behavior the hotspot tests exercise.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:insecure-default network configuration"
|
|
],
|
|
"title": "create_code_interpreter defaults networkConfiguration to PUBLIC"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/bedrock_agentcore/tools/code_interpreter_client.py:188",
|
|
"function_name": null,
|
|
"line": 188,
|
|
"path": "src/bedrock_agentcore/tools/code_interpreter_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "read_file shows delete_code_interpreter(interpreter_id, client_token) forwards client_token verbatim into request_params[\"clientToken\"] (line 208) with no format/length validation, and the flagged test test_delete_code_interpreter_with_client_token passes \"test-token\" through. The same pattern exists in browser_client.py lines 186-206. This is an idempotency-token passthrough, not a credential, so impact is limited, but it is the production path the flagged tests cover.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:unvalidated idempotency token passthrough"
|
|
],
|
|
"title": "delete_code_interpreter accepts caller-supplied client_token without validation"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/bedrock_agentcore/tools/code_interpreter_client.py:583",
|
|
"function_name": null,
|
|
"line": 583,
|
|
"path": "src/bedrock_agentcore/tools/code_interpreter_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "grep_repo locates download_file at line 583 and download_files at line 621 in src/bedrock_agentcore/tools/code_interpreter_client.py, matching the flagged tests test_download_file_text (test line 988), test_download_file_binary (1025), test_download_file_not_found (1059) and test_download_files_empty_result (1116). The tests mock the data plane client, so the filesystem_entry tag on the hotspots refers to sandbox-side file paths passed as strings; no local filesystem write was observed in the inspected source.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sandbox file download surface"
|
|
],
|
|
"title": "download_file/download_files are the production targets of the flagged download tests"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:tests/bedrock_agentcore/tools/test_code_interpreter_client.py:1",
|
|
"function_name": null,
|
|
"line": 1,
|
|
"path": "tests/bedrock_agentcore/tools/test_code_interpreter_client.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 19.983,
|
|
"rationale": "All eight flagged functions (test_create_code_interpreter_minimal, test_create_code_interpreter_with_all_options, test_delete_code_interpreter, test_delete_code_interpreter_with_client_token, test_download_file_binary, test_download_file_not_found, test_download_file_text, test_download_files_empty_result) live in tests/bedrock_agentcore/tools/test_code_interpreter_client.py. Reading the file confirms they are pytest test methods that mock boto3, get_control_plane_endpoint and get_data_plane_endpoint, so the auth_boundary/crypto/filesystem_entry/network_entry/parser tags reflect the mocked production surface, not reachable production code. The high score is driven by file-level loc=1139 and nesting=7 shared across all entries, not by per-function complexity.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:test-only complexity hotspot"
|
|
],
|
|
"title": "Complexity hotspots are all test functions in a single test file"
|
|
}
|
|
]
|
|
}
|