mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
af81bccc70
ruleset/frameworks.toml lists 19 framework and library ids (wordpress, flask, django, express,
spring, jakarta-servlet, react, vue and 11 libraries), each with its languages, dependency
package names and a symbol lexicon used only by the lint and for stratification.
Every framework/library entry of section 2 is tagged `framework`/`library`, and mixed entries
are split so a tag covers a whole entry (split pieces keep the entry's id and flags, in place):
semantic facts 38 tagged entries (wordpress 6, django 6, flask 4, express 4, jakarta-servlet 3,
pyyaml 2, one each for spring, sqlalchemy, requests, httpx, lodash, node-http-clients,
escape-html, sanitize-html, dompurify, esapi, commons-text, react, vue); the dispatch fact
behind the hook-as-source path is wordpress; the PHP layout row is renamed php_layout and stays
untagged (a product filter). Quick rules: 9 tagged (wordpress 6, flask, pyyaml,
node-http-clients); php-unserialize is split into php-unserialize and php-maybe-unserialize;
the lint also caught WordPress escapers in exclusions and axios/yaml.load in mixed rules, so
those keep their ids as tagged rules and gain a `fallback_for` language-level rule (6) that is
active only when the prior is off.
load_facts and load_ruleset take priors ("all" by default -- today's scan --, "off", or a set
of ids). tests/test_semantic_priors.py: the lint (no untagged entry contains a lexicon symbol
of its language), "off" removes exactly the tagged entries and activates the fallbacks, split
entries keep their language-level calls. Rule and layout counts in three existing tests follow the split and the rename.
Unchanged defaults: test_benchmark_output_is_byte_identical_to_golden_baseline passes, and the
quick findings of all 15 benchmark manifests (full StaticFinding records) are byte-identical
before and after. priors=off on the same manifests: 61 -> 57 findings; the 4 lost are js-ssrf
(axios), php-wpdb-sql-composition, python-ssti and python yaml.load; 5 PHP and 1 Python finding
move to their fallback rule at the same location. Semantic calls with priors off: php 75/92,
python 32/77, javascript 42/70, java 24/41, c 27/27 (the engine-side effect needs Joern and was
not measured).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
92 lines
4.3 KiB
Python
92 lines
4.3 KiB
Python
"""The `[[layout]]` facts: which paths are somebody else's code, which are tests -- rows, not constants."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
|
|
def test_layout_rows_load_and_match() -> None:
|
|
from openultrasast.model.layout import is_test_path, is_vendored, layout_facts
|
|
|
|
rows = layout_facts("php")
|
|
assert [r.id for r in rows] == ["php_layout"]
|
|
assert is_vendored("includes/vendor/whichbrowser/parser/data/profiles.php", rows)
|
|
assert is_vendored("vendor/autoload.php", rows)
|
|
assert not is_vendored("classes/class.mail.php", rows)
|
|
assert is_test_path("test-mail.php", rows) and is_test_path("tests/unit/MailTest.php", rows)
|
|
assert is_test_path("classes/FooTest.php", rows)
|
|
assert not is_test_path("classes/class.mail.php", rows) and not is_test_path("includes/testimonials.php", rows)
|
|
|
|
|
|
def test_a_layout_row_without_an_id_is_refused(tmp_path: Path) -> None:
|
|
from openultrasast.semantic.facts import FactLoadError, load_facts
|
|
|
|
(tmp_path / "php.toml").write_text('[[layout]]\nvendored = ["vendor/"]\n')
|
|
with pytest.raises(FactLoadError):
|
|
load_facts(tmp_path)
|
|
|
|
|
|
def test_vendored_trees_leave_the_targets(tmp_path: Path) -> None:
|
|
"""A bundled library is a separate unit -- analysed as one or not at all, never as part of the project
|
|
that bundles it. Measured before the row: 207 of WP Statistics's 357 PHP files were vendored."""
|
|
from openultrasast.preprocess import preprocess_repository
|
|
|
|
(tmp_path / "classes").mkdir()
|
|
(tmp_path / "classes" / "a.php").write_text("<?php\n")
|
|
(tmp_path / "includes" / "vendor" / "lib").mkdir(parents=True)
|
|
(tmp_path / "includes" / "vendor" / "lib" / "b.php").write_text("<?php\n")
|
|
_, targets = preprocess_repository(tmp_path)
|
|
assert sorted(t.path for t in targets) == ["classes/a.php"]
|
|
|
|
|
|
def test_vendored_directories_are_named_shallowest_first(tmp_path: Path) -> None:
|
|
from openultrasast.model.layout import vendored_directories
|
|
|
|
(tmp_path / "includes" / "vendor" / "x" / "vendor").mkdir(parents=True)
|
|
(tmp_path / "vendor").mkdir()
|
|
(tmp_path / "src").mkdir()
|
|
assert vendored_directories(tmp_path) == ("includes/vendor", "vendor")
|
|
|
|
|
|
def test_test_regions_are_not_product_and_order_last() -> None:
|
|
"""In scope -- a test that reaches a sink still names the sink -- but after the product's regions."""
|
|
from openultrasast.model.layout import with_layout
|
|
from openultrasast.model.regions import ScanRegion
|
|
|
|
product = ScanRegion(path="classes/class.mail.php", function="_delete_files", language="php", families=("path",), rank=0.3, source="x")
|
|
test = ScanRegion(path="test-mail.php", function="hook_mwform_admin_mail", language="php", families=("path",), rank=0.3, source="x")
|
|
declared = ScanRegion(path="tests/fixture.php", function="f", language="php", families=("path",), rank=0.3, source="x", shipped=True)
|
|
out = {r.path: r.shipped for r in with_layout([product, test])}
|
|
assert out == {"classes/class.mail.php": True, "test-mail.php": False}
|
|
assert with_layout([declared])[0].shipped is False, (
|
|
"a test path is a test path; only a manifest that lists it as a source would say otherwise, and it is applied first"
|
|
)
|
|
|
|
|
|
def test_the_scan_excludes_vendored_trees_before_the_build(tmp_path: Path) -> None:
|
|
from openultrasast.model.regions import ScanRegion
|
|
from openultrasast.model.scan import ScanBudget, scan_repository
|
|
|
|
(tmp_path / "vendor").mkdir()
|
|
(tmp_path / "a.php").write_bytes(b"<?php echo 1;")
|
|
(tmp_path / "vendor/b.php").write_bytes(b"<?php vendor_secret();")
|
|
seen: dict[str, object] = {}
|
|
|
|
class _Backend:
|
|
def available(self) -> bool:
|
|
return True
|
|
|
|
def build(self, root, *, language="", exclude=()): # type: ignore[no-untyped-def]
|
|
from openultrasast.cpg.backend import CpgResult
|
|
|
|
seen["exclude"] = tuple(exclude)
|
|
seen["files"] = tuple(p.relative_to(root).as_posix() for p in root.rglob("*") if p.is_file())
|
|
return CpgResult(cpg_path=Path("cpg.bin"), run=lambda q, p: [], run_batch=lambda q, r: {rid: [] for rid in r})
|
|
|
|
region = ScanRegion(path="a.php", function="f", language="php", families=("injection",), rank=0.5, source="x")
|
|
scan_repository(tmp_path, [region], backend=_Backend(), budget=ScanBudget(max_model_calls=0))
|
|
assert seen["exclude"] == ()
|
|
assert seen["files"] == ("a.php",)
|