mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 5.5
af81bccc70
ruleset/frameworks.toml lists 19 framework and library ids (wordpress, flask, django, express,
spring, jakarta-servlet, react, vue and 11 libraries), each with its languages, dependency
package names and a symbol lexicon used only by the lint and for stratification.
Every framework/library entry of section 2 is tagged `framework`/`library`, and mixed entries
are split so a tag covers a whole entry (split pieces keep the entry's id and flags, in place):
semantic facts 38 tagged entries (wordpress 6, django 6, flask 4, express 4, jakarta-servlet 3,
pyyaml 2, one each for spring, sqlalchemy, requests, httpx, lodash, node-http-clients,
escape-html, sanitize-html, dompurify, esapi, commons-text, react, vue); the dispatch fact
behind the hook-as-source path is wordpress; the PHP layout row is renamed php_layout and stays
untagged (a product filter). Quick rules: 9 tagged (wordpress 6, flask, pyyaml,
node-http-clients); php-unserialize is split into php-unserialize and php-maybe-unserialize;
the lint also caught WordPress escapers in exclusions and axios/yaml.load in mixed rules, so
those keep their ids as tagged rules and gain a `fallback_for` language-level rule (6) that is
active only when the prior is off.
load_facts and load_ruleset take priors ("all" by default -- today's scan --, "off", or a set
of ids). tests/test_semantic_priors.py: the lint (no untagged entry contains a lexicon symbol
of its language), "off" removes exactly the tagged entries and activates the fallbacks, split
entries keep their language-level calls. Rule and layout counts in three existing tests follow the split and the rename.
Unchanged defaults: test_benchmark_output_is_byte_identical_to_golden_baseline passes, and the
quick findings of all 15 benchmark manifests (full StaticFinding records) are byte-identical
before and after. priors=off on the same manifests: 61 -> 57 findings; the 4 lost are js-ssrf
(axios), php-wpdb-sql-composition, python-ssti and python yaml.load; 5 PHP and 1 Python finding
move to their fallback rule at the same location. Semantic calls with priors off: php 75/92,
python 32/77, javascript 42/70, java 24/41, c 27/27 (the engine-side effect needs Joern and was
not measured).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
69 lines
2.8 KiB
Python
69 lines
2.8 KiB
Python
"""Rules-as-data store and the loop-owned ledger overlay (Phase 2 tasks 3.1, 4.3)."""
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from openultrasast.cli import main
|
|
from openultrasast.ruleset import (
|
|
DEFAULT_RULESET_DIR,
|
|
PatternRule,
|
|
load_ruleset,
|
|
read_rule_ledger,
|
|
write_rule_ledger,
|
|
write_ruleset,
|
|
)
|
|
|
|
|
|
def test_default_ruleset_loads_as_data() -> None:
|
|
rules = load_ruleset(DEFAULT_RULESET_DIR)
|
|
php = [rule for rule in rules if rule.languages == ("php",)]
|
|
assert len(rules) == 32 + len(php) and len(php) == 14 # php-unserialize split in two (decision-engine task 2)
|
|
assert all(rule.status == "enabled" for rule in rules if rule not in php), "PHP rules carry their measured status"
|
|
assert all(not hasattr(rule, "severity") for rule in rules) # severity is policy-governed, not rule-local
|
|
|
|
|
|
def test_empty_ledger_is_byte_identical() -> None:
|
|
assert load_ruleset(DEFAULT_RULESET_DIR) == load_ruleset(DEFAULT_RULESET_DIR, None)
|
|
|
|
|
|
def test_ledger_overlay_changes_only_targeted_rule(tmp_path: Path) -> None:
|
|
ledger = tmp_path / "rule_policy.json"
|
|
ledger.write_text(json.dumps({"python-unsafe-eval": {"status": "disabled", "precision_estimate": 0.3}}))
|
|
|
|
rules = {rule.rule_id: rule for rule in load_ruleset(DEFAULT_RULESET_DIR, ledger)}
|
|
|
|
assert rules["python-unsafe-eval"].status == "disabled"
|
|
assert rules["python-unsafe-eval"].precision_estimate == 0.3
|
|
assert rules["c-shell-exec"].status == "enabled" # untargeted rule untouched
|
|
|
|
|
|
def test_rule_ledger_round_trips(tmp_path: Path) -> None:
|
|
ledger = tmp_path / "rule_policy.json"
|
|
entries = {"python-unsafe-eval": {"status": "shadow", "precision_estimate": 0.41}}
|
|
write_rule_ledger(ledger, entries)
|
|
assert read_rule_ledger(ledger) == entries
|
|
|
|
|
|
def test_write_ruleset_round_trips(tmp_path: Path) -> None:
|
|
rule = PatternRule(rule_id="x-demo", title="Demo", languages=("python",), cwe="CWE-89", tags=("injection",), pattern=r"\bfoo\(")
|
|
write_ruleset(tmp_path / "r" / "rules.toml", [rule])
|
|
assert load_ruleset(tmp_path / "r")[0] == rule
|
|
|
|
|
|
def test_disabled_rule_via_ledger_does_not_fire_in_scan(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
repo = tmp_path / "repo"
|
|
repo.mkdir()
|
|
(repo / "app.py").write_text("def f(x):\n return eval(x)\n")
|
|
ledger_dir = repo / ".openultrasast" / "calibration"
|
|
ledger_dir.mkdir(parents=True)
|
|
(ledger_dir / "rule_policy.json").write_text(json.dumps({"python-unsafe-eval": {"status": "disabled"}}))
|
|
monkeypatch.setenv("OPENULTRASAST_RUNS_DIR", ".runs")
|
|
|
|
assert main(["scan", str(repo), "--mode", "quick"]) == 0
|
|
|
|
run_dir = sorted((repo / ".runs").iterdir())[-1]
|
|
findings = json.loads((run_dir / "findings.json").read_text())["findings"]
|
|
assert all(not finding["finding_id"].startswith("python-unsafe-eval:") for finding in findings)
|