mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
742469d671
The verifier, not the artefact, observes the effect: SQL, path, command and SSRF oracles owned by the verifier (XSS needs a browser executor, else no_oracle); artefact exit code and output ignored; immutable checkout and dependencies; 3 runs per side; one-sided build or readiness failure is inconclusive. An isolation failure raises IsolationUnavailable instead of reading as could_not_build (the NPROC limit now applies inside the user namespace). 35 tests, including gaming attempts and 300 host processes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
"""CLI toy: arguments are its sole public interface; config belongs to the app."""
|
|
|
|
import os
|
|
import pathlib
|
|
import sqlite3
|
|
import subprocess
|
|
import sys
|
|
import urllib.request
|
|
|
|
fixed = pathlib.Path("/workspace/fixed").exists()
|
|
if sys.argv[1:] == ["--ready"]:
|
|
sys.exit(1 if pathlib.Path("/workspace/broken").exists() else 0)
|
|
family, payload = sys.argv[1:]
|
|
if family == "path":
|
|
root = pathlib.Path(os.environ["SERVED_ROOT"])
|
|
path = (root / payload).resolve()
|
|
if not fixed or path.is_relative_to(root):
|
|
value = path.read_text()
|
|
if not pathlib.Path("/workspace/flaky").exists() or value.startswith("a"):
|
|
print(value)
|
|
elif family == "sql":
|
|
with sqlite3.connect(os.environ["DATABASE"]) as db:
|
|
if fixed:
|
|
rows = db.execute("SELECT value FROM records WHERE public=1 AND name=?", (payload,))
|
|
else:
|
|
rows = db.execute("SELECT value FROM records WHERE public=1 AND name='" + payload + "'")
|
|
print(list(rows))
|
|
elif family == "command":
|
|
if not fixed:
|
|
subprocess.run("echo " + payload, shell=True, check=False)
|
|
elif family == "ssrf":
|
|
if not fixed:
|
|
print(urllib.request.urlopen(os.path.expandvars(payload), timeout=2).read())
|