mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
7e3f12bc00
JVM startup, not analysis, is what a push scan spends its time on: each disposable script invocation costs 13 to 23 seconds while the work takes under a second. The session owns one Joern server per transaction on loopback with an OS-chosen port and no published port. Three properties are load-bearing, and the probe that settled the design demonstrated why each is needed. An HTTP status is not an answer. The server returns success even for a compile error, with the diagnostic in its body, so every request redirects the evaluated code's console output into a fresh private file behind a nonce, and the nonce is verified before the answer is accepted. The engine's body is retained for exactly the case where the receipt is missing, without which that failure explains nothing. A poisoned session answers nothing afterwards, and cancellation kills the process group rather than the launcher, which this project has already run a machine out of memory by neglecting. What the probe established about the engine, after three iterations that each failed loudly: runScript is absent from the server REPL; a shipped @main script cannot be nested in a block expression, so definitions go to the top level unwrapped; and the REPL shadows Console with io.joern.console.Console, which has no withOut, so capture must qualify scala.Console. With that fixed, both mechanisms answer identically to the disposable invocation, 0.8 s against 9.8 s. The backend routes batch and single queries through the session only when session_transport is enabled, which it is not by default. Any failure falls back to the disposable invocation rather than reporting a zero, and each script is defined under its own name because every script declares exec. Equivalence for taint, dominance and configuration is task 11.2 and gates any measured run. 1,391 tests passed, nine skipped. Rollout stays NO-GO. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
152 lines
5.9 KiB
JSON
152 lines
5.9 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"experiment": "session-script-execution-v2",
|
|
"purpose": "Which in-session mechanism runs a shipped @main script with parameters",
|
|
"scope": "One JavaScript graph, census script; no security-query equivalence and no latency claim",
|
|
"instrument_note": "v1 of this probe sent two candidates as Scala string literals instead of code and reported NO_MECHANISM_FOUND. It did establish that runScript is absent from the server REPL.",
|
|
"attempts": [
|
|
{
|
|
"mechanism": "main_annotation_kept",
|
|
"definition_sent": true,
|
|
"definition_output": "def exec(cpgFile: String): Unit\n",
|
|
"call_seconds": 2.0279543119249865,
|
|
"payload": {
|
|
"files": "19",
|
|
"methods": "229",
|
|
"calls": "1683",
|
|
"file_names": [
|
|
"assets/js/chart/chart-data-morris.js",
|
|
"assets/js/tour/redirects-steps.js",
|
|
"data/allocations-dao.js",
|
|
"data/benefits-dao.js",
|
|
"data/contributions-dao.js",
|
|
"data/memos-dao.js",
|
|
"data/profile-dao.js",
|
|
"data/research-dao.js",
|
|
"data/user-dao.js",
|
|
"routes/allocations.js",
|
|
"routes/benefits.js",
|
|
"routes/contributions.js",
|
|
"routes/error.js",
|
|
"routes/index.js",
|
|
"routes/memos.js",
|
|
"routes/profile.js",
|
|
"routes/research.js",
|
|
"routes/session.js",
|
|
"routes/tutorial.js"
|
|
],
|
|
"overlays": "base,controlflow,typerel,callgraph,dataflowOss",
|
|
"maxHeapMB": "1536"
|
|
},
|
|
"stdout_tail": "llocations.js\",\"routes/benefits.js\",\"routes/contributions.js\",\"routes/error.js\",\"routes/index.js\",\"routes/memos.js\",\"routes/profile.js\",\"routes/research.js\",\"routes/session.js\",\"routes/tutorial.js\"],\"overlays\":\"base,controlflow,typerel,callgraph,dataflowOss\",\"maxHeapMB\":\"1536\"}\n---OUSAST-CPG-END---\n",
|
|
"payload_matches_disposable": true,
|
|
"seconds": 3.2417371519841254
|
|
},
|
|
{
|
|
"mechanism": "main_annotation_stripped",
|
|
"definition_sent": true,
|
|
"definition_output": "def ousastCensus(cpgFile: String): Unit\n",
|
|
"call_seconds": 0.7982574889902025,
|
|
"payload": {
|
|
"files": "19",
|
|
"methods": "229",
|
|
"calls": "1683",
|
|
"file_names": [
|
|
"assets/js/chart/chart-data-morris.js",
|
|
"assets/js/tour/redirects-steps.js",
|
|
"data/allocations-dao.js",
|
|
"data/benefits-dao.js",
|
|
"data/contributions-dao.js",
|
|
"data/memos-dao.js",
|
|
"data/profile-dao.js",
|
|
"data/research-dao.js",
|
|
"data/user-dao.js",
|
|
"routes/allocations.js",
|
|
"routes/benefits.js",
|
|
"routes/contributions.js",
|
|
"routes/error.js",
|
|
"routes/index.js",
|
|
"routes/memos.js",
|
|
"routes/profile.js",
|
|
"routes/research.js",
|
|
"routes/session.js",
|
|
"routes/tutorial.js"
|
|
],
|
|
"overlays": "base,controlflow,typerel,callgraph,dataflowOss",
|
|
"maxHeapMB": "1536"
|
|
},
|
|
"stdout_tail": "llocations.js\",\"routes/benefits.js\",\"routes/contributions.js\",\"routes/error.js\",\"routes/index.js\",\"routes/memos.js\",\"routes/profile.js\",\"routes/research.js\",\"routes/session.js\",\"routes/tutorial.js\"],\"overlays\":\"base,controlflow,typerel,callgraph,dataflowOss\",\"maxHeapMB\":\"1536\"}\n---OUSAST-CPG-END---\n",
|
|
"payload_matches_disposable": true,
|
|
"seconds": 1.0805925760651007
|
|
}
|
|
],
|
|
"verdict": {
|
|
"status": "PASS",
|
|
"working": [
|
|
"main_annotation_kept",
|
|
"main_annotation_stripped"
|
|
],
|
|
"warm_call_seconds": [
|
|
2.0279543119249865,
|
|
0.7982574889902025
|
|
],
|
|
"disposable_seconds": 9.838564986013807,
|
|
"note": "Census only. A working mechanism must still be proven equivalent for taint, dominance and configuration before any production switch, which is task 11.2."
|
|
},
|
|
"source": {
|
|
"root": "/cache/nodegoat/c5cb68a7084e/app",
|
|
"files": 25,
|
|
"bytes": 318000,
|
|
"sha256": "459f6fd19c7d4700094f0b834eb5474ff94923014055c22385de9de3332c9d53"
|
|
},
|
|
"build": {
|
|
"exit_code": 0,
|
|
"graph_bytes": 425453,
|
|
"stderr": "Picked up JAVA_TOOL_OPTIONS: -Xmx1536m\n"
|
|
},
|
|
"disposable": {
|
|
"seconds": 9.838564986013807,
|
|
"exit_code": 0,
|
|
"payload": {
|
|
"files": "19",
|
|
"methods": "229",
|
|
"calls": "1683",
|
|
"file_names": [
|
|
"assets/js/chart/chart-data-morris.js",
|
|
"assets/js/tour/redirects-steps.js",
|
|
"data/allocations-dao.js",
|
|
"data/benefits-dao.js",
|
|
"data/contributions-dao.js",
|
|
"data/memos-dao.js",
|
|
"data/profile-dao.js",
|
|
"data/research-dao.js",
|
|
"data/user-dao.js",
|
|
"routes/allocations.js",
|
|
"routes/benefits.js",
|
|
"routes/contributions.js",
|
|
"routes/error.js",
|
|
"routes/index.js",
|
|
"routes/memos.js",
|
|
"routes/profile.js",
|
|
"routes/research.js",
|
|
"routes/session.js",
|
|
"routes/tutorial.js"
|
|
],
|
|
"overlays": "base,controlflow,typerel,callgraph,dataflowOss",
|
|
"maxHeapMB": "1536"
|
|
}
|
|
},
|
|
"session_startup_seconds": 9.547755968989804,
|
|
"milestone": "M2 task 11.1",
|
|
"engine_findings": [
|
|
"runScript is absent from the server REPL, so a script cannot be invoked by name.",
|
|
"The server answers success even for a compile error and returns the diagnostic in its body, so an HTTP status is worthless as an error signal and the receipt file is the only proof.",
|
|
"A shipped @main script cannot be nested inside a block expression; definitions must go to the top level unwrapped, with or without the annotation.",
|
|
"The Joern REPL shadows Console with io.joern.console.Console, which has no withOut, so output capture must fully qualify scala.Console.withOut."
|
|
],
|
|
"limits": [
|
|
"Census script on one JavaScript graph. Taint, dominance and configuration equivalence is task 11.2.",
|
|
"Timings are from one machine under no controlled load; they are not the hook latency gate."
|
|
]
|
|
}
|