mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
943 lines
38 KiB
JSON
943 lines
38 KiB
JSON
{
|
|
"recorded_at": "2026-09-13T08:40:22.821019+00:00",
|
|
"task": "3.3",
|
|
"image_id": "sha256:a30d41f7e0cde5d3c9b634889fef07f8c3aa089be176362f73645c3bda1e5953",
|
|
"build_exit_code": 0,
|
|
"cross_file_smoke_exit_code": 0,
|
|
"negative_regression_exit_code": 0,
|
|
"packaged_source_hashes": {
|
|
"openultrasast.cpg.backend": "2e327d26958efd592932bbe5a84aa122d969c0e49a1c13469a4d956b621a9a34",
|
|
"openultrasast.model.scan": "c803fa05a9f190b66df194616ed327043a592883c9f746a902768c89b253d36f",
|
|
"openultrasast.model.regions": "1ecafa9080ac537383d91d02147f204eadc72c5241618f357ed30c5a5ff79cc1",
|
|
"openultrasast.push.snapshot": "c6891f6de9221f63e534372c3009190d227172ca0b006bfb68bb6cffd7bf38f3",
|
|
"taint.sc": "d09b5608870571c57b5ec82b9e886943ad6df0fd2510a7c56cec4bcaa352d116"
|
|
},
|
|
"packaged_sources_match_workspace": true,
|
|
"supporting_script_hashes": {
|
|
"ops/smoke_context.py": "4d515258c01e44e2a30ee71f8de8de2df06c88dac2e0ded6f2904f7682e347d9",
|
|
"ops/smoke_context_boundaries.py": "35cc2cabbfbdfe843c3f82c776efe43dfd0db8418eda4ce6e045bd3269d4cb6e"
|
|
},
|
|
"cross_file_runtime": {
|
|
"purpose": "Committed removed-guard context reaches real ranked questions; not semantic novelty or admission proof",
|
|
"shared_budget_seconds": 900,
|
|
"languages": {
|
|
"php": {
|
|
"base_revision": "3d894f361e33b1801a770addb7e068f69dab7ee4",
|
|
"head_revision": "c6dee5e55aef86153a52e27835d51f8675eda0c8",
|
|
"source_bytes": 124,
|
|
"source_sha256": "e41333ddd3e341d08603a5cc6a3a9faedb442e6ef3b14627cd00516cdf12cedb",
|
|
"helper_bytes": 48,
|
|
"helper_sha256": "4eb14937fd2b027cc11bd5a79c5de38f572d9a5af8ee36a46d4a0e499817ae76",
|
|
"input_context": {
|
|
"base_revision": "3d894f361e33b1801a770addb7e068f69dab7ee4",
|
|
"head_revision": "c6dee5e55aef86153a52e27835d51f8675eda0c8",
|
|
"changed_paths": [
|
|
"6170692e706870"
|
|
],
|
|
"deleted_paths": [],
|
|
"spans": [
|
|
{
|
|
"path": "6170692e706870",
|
|
"start_line": 4,
|
|
"end_line": 4,
|
|
"side": "base"
|
|
}
|
|
],
|
|
"renames": [],
|
|
"declaration_paths": [],
|
|
"relationships": [],
|
|
"unresolved_boundaries": [],
|
|
"path_encoding": "filesystem-bytes-hex",
|
|
"line_correspondences": [
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 1,
|
|
"base_end_line": 1,
|
|
"head_start_line": 1
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 2,
|
|
"base_end_line": 2,
|
|
"head_start_line": 2
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 3,
|
|
"base_end_line": 3,
|
|
"head_start_line": 3
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 5,
|
|
"base_end_line": 5,
|
|
"head_start_line": 4
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 6,
|
|
"base_end_line": 6,
|
|
"head_start_line": 5
|
|
}
|
|
]
|
|
},
|
|
"result": {
|
|
"findings": [
|
|
{
|
|
"site": "helper.php:2:helper",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "$req -> eval($value) in helper.php (line 2, 4 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
}
|
|
],
|
|
"by_rung": {
|
|
"suspicion": 0,
|
|
"model_corroborated": 0,
|
|
"model_entailed": 1,
|
|
"execution_confirmed": 0
|
|
},
|
|
"regions_scanned": 1,
|
|
"regions_unjudged": 0,
|
|
"regions_unasked": 0,
|
|
"model_calls": 0,
|
|
"cost_usd": 0.0,
|
|
"seconds": 63.48,
|
|
"build_seconds": 28.21,
|
|
"query_seconds": 18.0,
|
|
"query_seconds_by_kind": {
|
|
"evidence": 17.21,
|
|
"taint": 18.0
|
|
},
|
|
"degradations": [],
|
|
"tiers": [
|
|
[
|
|
"api.php",
|
|
"handler",
|
|
"injection",
|
|
4
|
|
]
|
|
],
|
|
"tier_counts": {
|
|
"4": 1
|
|
},
|
|
"requests_pruned": 0,
|
|
"change_context": {
|
|
"base_revision": "3d894f361e33b1801a770addb7e068f69dab7ee4",
|
|
"head_revision": "c6dee5e55aef86153a52e27835d51f8675eda0c8",
|
|
"changed_paths": [
|
|
"6170692e706870"
|
|
],
|
|
"deleted_paths": [],
|
|
"spans": [
|
|
{
|
|
"path": "6170692e706870",
|
|
"start_line": 4,
|
|
"end_line": 4,
|
|
"side": "base"
|
|
}
|
|
],
|
|
"renames": [],
|
|
"declaration_paths": [],
|
|
"relationships": [
|
|
{
|
|
"source": {
|
|
"unit": "context-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"base_span:api.php:4-4",
|
|
"unchanged_line:3;lexical_only",
|
|
"unchanged_line:4;lexical_only",
|
|
"unchanged_line:5;lexical_only"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": [],
|
|
"path_encoding": "filesystem-bytes-hex",
|
|
"line_correspondences": [
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 1,
|
|
"base_end_line": 1,
|
|
"head_start_line": 1
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 2,
|
|
"base_end_line": 2,
|
|
"head_start_line": 2
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 3,
|
|
"base_end_line": 3,
|
|
"head_start_line": 3
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 5,
|
|
"base_end_line": 5,
|
|
"head_start_line": 4
|
|
},
|
|
{
|
|
"base_path": "6170692e706870",
|
|
"head_path": "6170692e706870",
|
|
"base_start_line": 6,
|
|
"base_end_line": 6,
|
|
"head_start_line": 5
|
|
}
|
|
]
|
|
},
|
|
"scope": {
|
|
"ranker_version": "existing-static-evidence-v1",
|
|
"ranking_mode": "evidence",
|
|
"population_complete": true,
|
|
"selected": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"priority": 0.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"mysqli_prepare\",\"mysqli_stmt_bind_param\",\"pg_execute\",\"pg_prepare\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval($value)\",\"line\":2,\"method\":\"helper\"}],\"source_local\":false,\"source_near\":false}",
|
|
"tier=4",
|
|
"score=2.5",
|
|
"change_sites={\"base_revision\":\"3d894f361e33b1801a770addb7e068f69dab7ee4\",\"changed_paths\":[\"6170692e706870\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"c6dee5e55aef86153a52e27835d51f8675eda0c8\",\"path_encoding\":\"filesystem-bytes-hex\"}",
|
|
"affected_relationship={\"evidence\":[\"base_span:api.php:4-4\",\"unchanged_line:3;lexical_only\",\"unchanged_line:4;lexical_only\",\"unchanged_line:5;lexical_only\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"handler\",\"language\":\"php\",\"path\":\"api.php\",\"unit\":\"context-smoke\"},\"target\":{\"family\":\"injection\",\"function\":\"handler\",\"language\":\"php\",\"path\":\"api.php\",\"unit\":\"context-smoke\"}}"
|
|
],
|
|
"tier": 4,
|
|
"score": 2.5
|
|
}
|
|
],
|
|
"deferred": [],
|
|
"unresolved_boundaries": []
|
|
},
|
|
"question_outcomes": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-smoke",
|
|
"language": "php",
|
|
"path": "api.php",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"status": "completed",
|
|
"reason": "query_answered_and_arbitrated",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":4,\"paths\":1,\"sanitized\":false,\"sink\":\"eval($value)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"helper.php\",\"sinkLine\":\"2\",\"sinkMethod\":\"helper\",\"source\":\"$req\",\"sourceKind\":\"parameter\"}]"
|
|
}
|
|
],
|
|
"family_coverage": [
|
|
{
|
|
"unit": "context-smoke",
|
|
"language": "php",
|
|
"family": "injection",
|
|
"selected": 1,
|
|
"completed": 1,
|
|
"unanswered": 0,
|
|
"deferred": 0,
|
|
"unsupported": 0
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"javascript": {
|
|
"base_revision": "2f8c5857f56009b1bf3cc7e56b3579fd87a90239",
|
|
"head_revision": "cbec42fd18a83f3a29943f7084760437fbe971f2",
|
|
"source_bytes": 133,
|
|
"source_sha256": "ee6b40b0c84f84cda86b2f5d7d118f39504bc7237450d30e5c189f6b3517c965",
|
|
"helper_bytes": 47,
|
|
"helper_sha256": "173055ccb4d1b0cb76378bcb674ac9944bad02f848bf20139923775b57e7634d",
|
|
"input_context": {
|
|
"base_revision": "2f8c5857f56009b1bf3cc7e56b3579fd87a90239",
|
|
"head_revision": "cbec42fd18a83f3a29943f7084760437fbe971f2",
|
|
"changed_paths": [
|
|
"6170692e6a73"
|
|
],
|
|
"deleted_paths": [],
|
|
"spans": [
|
|
{
|
|
"path": "6170692e6a73",
|
|
"start_line": 3,
|
|
"end_line": 3,
|
|
"side": "base"
|
|
}
|
|
],
|
|
"renames": [],
|
|
"declaration_paths": [],
|
|
"relationships": [],
|
|
"unresolved_boundaries": [],
|
|
"path_encoding": "filesystem-bytes-hex",
|
|
"line_correspondences": [
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 1,
|
|
"base_end_line": 1,
|
|
"head_start_line": 1
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 2,
|
|
"base_end_line": 2,
|
|
"head_start_line": 2
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 4,
|
|
"base_end_line": 4,
|
|
"head_start_line": 3
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 5,
|
|
"base_end_line": 5,
|
|
"head_start_line": 4
|
|
}
|
|
]
|
|
},
|
|
"result": {
|
|
"findings": [
|
|
{
|
|
"site": "helper.js:1:helper",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "req -> eval(value) in helper.js (line 1, 4 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
}
|
|
],
|
|
"by_rung": {
|
|
"suspicion": 0,
|
|
"model_corroborated": 0,
|
|
"model_entailed": 1,
|
|
"execution_confirmed": 0
|
|
},
|
|
"regions_scanned": 1,
|
|
"regions_unjudged": 0,
|
|
"regions_unasked": 0,
|
|
"model_calls": 0,
|
|
"cost_usd": 0.0,
|
|
"seconds": 39.63,
|
|
"build_seconds": 5.76,
|
|
"query_seconds": 17.2,
|
|
"query_seconds_by_kind": {
|
|
"evidence": 16.65,
|
|
"taint": 17.2
|
|
},
|
|
"degradations": [],
|
|
"tiers": [
|
|
[
|
|
"api.js",
|
|
"handler",
|
|
"injection",
|
|
4
|
|
]
|
|
],
|
|
"tier_counts": {
|
|
"4": 1
|
|
},
|
|
"requests_pruned": 0,
|
|
"change_context": {
|
|
"base_revision": "2f8c5857f56009b1bf3cc7e56b3579fd87a90239",
|
|
"head_revision": "cbec42fd18a83f3a29943f7084760437fbe971f2",
|
|
"changed_paths": [
|
|
"6170692e6a73"
|
|
],
|
|
"deleted_paths": [],
|
|
"spans": [
|
|
{
|
|
"path": "6170692e6a73",
|
|
"start_line": 3,
|
|
"end_line": 3,
|
|
"side": "base"
|
|
}
|
|
],
|
|
"renames": [],
|
|
"declaration_paths": [],
|
|
"relationships": [
|
|
{
|
|
"source": {
|
|
"unit": "context-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"base_span:api.js:3-3",
|
|
"unchanged_line:2;lexical_only",
|
|
"unchanged_line:3;lexical_only",
|
|
"unchanged_line:4;lexical_only"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": [],
|
|
"path_encoding": "filesystem-bytes-hex",
|
|
"line_correspondences": [
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 1,
|
|
"base_end_line": 1,
|
|
"head_start_line": 1
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 2,
|
|
"base_end_line": 2,
|
|
"head_start_line": 2
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 4,
|
|
"base_end_line": 4,
|
|
"head_start_line": 3
|
|
},
|
|
{
|
|
"base_path": "6170692e6a73",
|
|
"head_path": "6170692e6a73",
|
|
"base_start_line": 5,
|
|
"base_end_line": 5,
|
|
"head_start_line": 4
|
|
}
|
|
]
|
|
},
|
|
"scope": {
|
|
"ranker_version": "existing-static-evidence-v1",
|
|
"ranking_mode": "evidence",
|
|
"population_complete": true,
|
|
"selected": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"priority": 0.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval(value)\",\"line\":1,\"method\":\"helper\"}],\"source_local\":false,\"source_near\":false}",
|
|
"tier=4",
|
|
"score=2.5",
|
|
"change_sites={\"base_revision\":\"2f8c5857f56009b1bf3cc7e56b3579fd87a90239\",\"changed_paths\":[\"6170692e6a73\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"cbec42fd18a83f3a29943f7084760437fbe971f2\",\"path_encoding\":\"filesystem-bytes-hex\"}",
|
|
"affected_relationship={\"evidence\":[\"base_span:api.js:3-3\",\"unchanged_line:2;lexical_only\",\"unchanged_line:3;lexical_only\",\"unchanged_line:4;lexical_only\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"handler\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-smoke\"},\"target\":{\"family\":\"injection\",\"function\":\"handler\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-smoke\"}}"
|
|
],
|
|
"tier": 4,
|
|
"score": 2.5
|
|
}
|
|
],
|
|
"deferred": [],
|
|
"unresolved_boundaries": []
|
|
},
|
|
"question_outcomes": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-smoke",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "handler",
|
|
"family": "injection"
|
|
},
|
|
"status": "completed",
|
|
"reason": "query_answered_and_arbitrated",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":4,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(value)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"helper.js\",\"sinkLine\":\"1\",\"sinkMethod\":\"helper\",\"source\":\"req\",\"sourceKind\":\"parameter\"}]"
|
|
}
|
|
],
|
|
"family_coverage": [
|
|
{
|
|
"unit": "context-smoke",
|
|
"language": "javascript",
|
|
"family": "injection",
|
|
"selected": 1,
|
|
"completed": 1,
|
|
"unanswered": 0,
|
|
"deferred": 0,
|
|
"unsupported": 0
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"negative_runtime": {
|
|
"source_bytes": 255,
|
|
"source_sha256": "2460518ef54c6ae3a31007801a28fc75b0c374cdb579bfa31d3e425e48b6a9b4",
|
|
"result": {
|
|
"findings": [
|
|
{
|
|
"site": "api.js:2:unknownSink",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "eval(req.body) -> unknown(eval(req.body)) in api.js (line 2, 1 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
},
|
|
{
|
|
"site": "api.js:4:knownSink",
|
|
"family": "injection",
|
|
"rung": "model_entailed",
|
|
"witness": "req.body -> eval(req.body) in api.js (line 4, 1 steps)",
|
|
"contradiction": "",
|
|
"reached_from": 1
|
|
}
|
|
],
|
|
"by_rung": {
|
|
"suspicion": 0,
|
|
"model_corroborated": 0,
|
|
"model_entailed": 2,
|
|
"execution_confirmed": 0
|
|
},
|
|
"regions_scanned": 4,
|
|
"regions_unjudged": 1,
|
|
"regions_unasked": 0,
|
|
"model_calls": 0,
|
|
"cost_usd": 0.0,
|
|
"seconds": 58.88,
|
|
"build_seconds": 8.53,
|
|
"query_seconds": 24.91,
|
|
"query_seconds_by_kind": {
|
|
"evidence": 25.38,
|
|
"taint": 24.91
|
|
},
|
|
"degradations": [],
|
|
"tiers": [
|
|
[
|
|
"api.js",
|
|
"knownSanitizer",
|
|
"injection",
|
|
0
|
|
],
|
|
[
|
|
"api.js",
|
|
"knownSink",
|
|
"injection",
|
|
4
|
|
],
|
|
[
|
|
"api.js",
|
|
"unknownSanitizer",
|
|
"injection",
|
|
0
|
|
],
|
|
[
|
|
"api.js",
|
|
"unknownSink",
|
|
"injection",
|
|
4
|
|
],
|
|
[
|
|
"api.js",
|
|
"unknownSource",
|
|
"injection",
|
|
0
|
|
]
|
|
],
|
|
"tier_counts": {
|
|
"0": 3,
|
|
"4": 2
|
|
},
|
|
"requests_pruned": 1,
|
|
"change_context": {
|
|
"base_revision": "base",
|
|
"head_revision": "head",
|
|
"changed_paths": [
|
|
"api.js"
|
|
],
|
|
"deleted_paths": [],
|
|
"spans": [
|
|
{
|
|
"path": "api.js",
|
|
"start_line": 1,
|
|
"end_line": 5,
|
|
"side": "head"
|
|
}
|
|
],
|
|
"renames": [],
|
|
"declaration_paths": [],
|
|
"relationships": [
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSink",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSink",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSink",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSink",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"kind": "guard",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"kind": "guard",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
},
|
|
{
|
|
"source": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSource",
|
|
"family": "injection"
|
|
},
|
|
"target": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSource",
|
|
"family": "injection"
|
|
},
|
|
"kind": "entry",
|
|
"evidence": [
|
|
"head_span:api.js:1-5"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": [
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:71905af15166a20401cb2e53ffd500f3307c2a76da41017a64bc9ef47afce2e7",
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:cb4c6cecef36f957c9646d31def81d962d9ff2d1d1455275a0a6e9b20b8ed0ea",
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:460011e339d204cda534bca278ebc1936596121cec7924cc88a9c179c4d2c681"
|
|
],
|
|
"path_encoding": "text",
|
|
"line_correspondences": []
|
|
},
|
|
"scope": {
|
|
"ranker_version": "existing-static-evidence-v1",
|
|
"ranking_mode": "evidence",
|
|
"population_complete": true,
|
|
"selected": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSink",
|
|
"family": "injection"
|
|
},
|
|
"priority": 0.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"unknown(eval(req.body))\",\"line\":2,\"method\":\"unknownSink\"},{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval(req.body)\",\"line\":2,\"method\":\"unknownSink\"}],\"source_local\":true,\"source_near\":true}",
|
|
"tier=4",
|
|
"score=6.5",
|
|
"change_sites={\"base_revision\":\"base\",\"changed_paths\":[\"api.js\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"head\",\"path_encoding\":\"text\"}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"unknownSink\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"unknownSink\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}",
|
|
"change_context_incomplete"
|
|
],
|
|
"tier": 4,
|
|
"score": 6.5
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSink",
|
|
"family": "injection"
|
|
},
|
|
"priority": -1.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[{\"arg0_literal\":false,\"arity\":1,\"cleansed_on_call\":false,\"code\":\"eval(req.body)\",\"line\":4,\"method\":\"knownSink\"}],\"source_local\":true,\"source_near\":true}",
|
|
"tier=4",
|
|
"score=5.5",
|
|
"change_sites={\"base_revision\":\"base\",\"changed_paths\":[\"api.js\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"head\",\"path_encoding\":\"text\"}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"knownSink\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"knownSink\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}"
|
|
],
|
|
"tier": 4,
|
|
"score": 5.5
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"priority": -2.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[],\"source_local\":false,\"source_near\":false}",
|
|
"tier=0",
|
|
"score=0.0",
|
|
"change_sites={\"base_revision\":\"base\",\"changed_paths\":[\"api.js\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"head\",\"path_encoding\":\"text\"}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"unknownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"unknownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"guard\",\"source\":{\"family\":\"injection\",\"function\":\"unknownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"unknownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}",
|
|
"change_context_incomplete"
|
|
],
|
|
"tier": 0,
|
|
"score": 0.0
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSource",
|
|
"family": "injection"
|
|
},
|
|
"priority": -3.0,
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[],\"source_local\":true,\"source_near\":true}",
|
|
"tier=0",
|
|
"score=0.0",
|
|
"change_sites={\"base_revision\":\"base\",\"changed_paths\":[\"api.js\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"head\",\"path_encoding\":\"text\"}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"unknownSource\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"unknownSource\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}",
|
|
"change_context_incomplete"
|
|
],
|
|
"tier": 0,
|
|
"score": 0.0
|
|
}
|
|
],
|
|
"deferred": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"reason": "tier_zero",
|
|
"evidence": [
|
|
"static_rank=1.0",
|
|
"normalized_evidence={\"access_declared_public\":true,\"bound_names\":[\"execute\",\"query\"],\"carried\":false,\"carried_weak\":false,\"entry\":true,\"family_in_repo\":true,\"shipped\":true,\"sinks\":[],\"source_local\":true,\"source_near\":true}",
|
|
"tier=0",
|
|
"score=0.0",
|
|
"change_sites={\"base_revision\":\"base\",\"changed_paths\":[\"api.js\"],\"declaration_paths\":[],\"deleted_paths\":[],\"head_revision\":\"head\",\"path_encoding\":\"text\"}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"entry\",\"source\":{\"family\":\"injection\",\"function\":\"knownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"knownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}",
|
|
"affected_relationship={\"evidence\":[\"head_span:api.js:1-5\"],\"kind\":\"guard\",\"source\":{\"family\":\"injection\",\"function\":\"knownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"},\"target\":{\"family\":\"injection\",\"function\":\"knownSanitizer\",\"language\":\"javascript\",\"path\":\"api.js\",\"unit\":\"context-boundaries\"}}"
|
|
]
|
|
}
|
|
],
|
|
"unresolved_boundaries": [
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:71905af15166a20401cb2e53ffd500f3307c2a76da41017a64bc9ef47afce2e7",
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:cb4c6cecef36f957c9646d31def81d962d9ff2d1d1455275a0a6e9b20b8ed0ea",
|
|
"dynamic_external_or_depth_context_unresolved:contributor-scan:460011e339d204cda534bca278ebc1936596121cec7924cc88a9c179c4d2c681"
|
|
]
|
|
},
|
|
"question_outcomes": [
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSink",
|
|
"family": "injection"
|
|
},
|
|
"status": "unresolved",
|
|
"reason": "change_context_incomplete",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":1,\"paths\":2,\"sanitized\":false,\"sink\":\"unknown(eval(req.body))\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"unknownSink\",\"source\":\"eval(req.body)\",\"sourceKind\":\"framework\"},{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":2,\"paths\":2,\"sanitized\":false,\"sink\":\"unknown(eval(req.body))\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"unknownSink\",\"source\":\"req.body\",\"sourceKind\":\"framework\"},{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":3,\"paths\":2,\"sanitized\":false,\"sink\":\"unknown(eval(req.body))\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"unknownSink\",\"source\":\"req\",\"sourceKind\":\"parameter\"},{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":1,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(req.body)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"unknownSink\",\"source\":\"req.body\",\"sourceKind\":\"framework\"},{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":2,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(req.body)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"2\",\"sinkMethod\":\"unknownSink\",\"source\":\"req\",\"sourceKind\":\"parameter\"}]"
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "knownSink",
|
|
"family": "injection"
|
|
},
|
|
"status": "completed",
|
|
"reason": "query_answered_and_arbitrated",
|
|
"raw_rows_json": "[{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":1,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(req.body)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"4\",\"sinkMethod\":\"knownSink\",\"source\":\"req.body\",\"sourceKind\":\"framework\"},{\"bound\":\"\",\"bounded\":false,\"inLabeledScope\":true,\"length\":2,\"paths\":1,\"sanitized\":false,\"sink\":\"eval(req.body)\",\"sinkArg0Literal\":false,\"sinkArity\":1,\"sinkFile\":\"api.js\",\"sinkLine\":\"4\",\"sinkMethod\":\"knownSink\",\"source\":\"req\",\"sourceKind\":\"parameter\"}]"
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSanitizer",
|
|
"family": "injection"
|
|
},
|
|
"status": "unresolved",
|
|
"reason": "change_context_incomplete",
|
|
"raw_rows_json": "[]"
|
|
},
|
|
{
|
|
"identity": {
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"path": "api.js",
|
|
"function": "unknownSource",
|
|
"family": "injection"
|
|
},
|
|
"status": "unresolved",
|
|
"reason": "change_context_incomplete",
|
|
"raw_rows_json": "[]"
|
|
}
|
|
],
|
|
"family_coverage": [
|
|
{
|
|
"unit": "context-boundaries",
|
|
"language": "javascript",
|
|
"family": "injection",
|
|
"selected": 4,
|
|
"completed": 1,
|
|
"unanswered": 3,
|
|
"deferred": 1,
|
|
"unsupported": 0
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"review_repair": {
|
|
"red_exit_code": 1,
|
|
"red_symptom": "unknownSource was excluded as tier_zero with no unresolved boundaries",
|
|
"repair": "Only directly invoked fact-modeled calls can exempt an external call; argument/subtree mentions cannot.",
|
|
"additional_parent_assertions": "Direct knownSanitizer remains tier_zero with no question context gap; verified against captured GREEN output."
|
|
},
|
|
"limits": [
|
|
"Controlled declared entry regions, not full mapper/workload replay.",
|
|
"Lexical change-to-question relationships do not prove semantic guard removal or novelty.",
|
|
"Current field/hook abstraction limits preserved; missing dominance/config/deleted dependencies remain explicit.",
|
|
"No hook latency, capability admission or broad Joern reliability claim."
|
|
]
|
|
}
|