mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 4.8
b5e40318db
Release-readiness hardening. - redaction.py (zero-dep): redact_secrets masks provider API keys, AWS/GitHub/Slack/ Google tokens, bearer tokens, URL-embedded credentials, PEM private keys, and sensitive key=value assignments. Wired into the trace writer and the markdown report (on by default), so scan artifacts never leak a credential quoted from source. - provider/openrouter.py: call_with_retry — exponential backoff on transient failures (HTTP 429/5xx, connection errors, timeouts); non-transient errors fail fast. Both the chat and embedding clients use it (max_attempts/retry_base_delay configurable). - config [hardening]: redact_secrets (default true) + max_findings (bounded-CI output cap, 0 = unlimited; truncation is severity-ordered and disclosed as a `budget` degradation). Agentic spend stays bounded by [harnessx] max_cost_usd/token_threshold. - docs/threat-model.md (trust boundaries, controls, sandbox limits) + docs/examples.md (six end-to-end walkthroughs); README "Security & hardening" section links both. - CI lint/typecheck/test/detection-gate/dagger gates already existed. tests/test_redaction.py, test_provider_retry.py, test_hardening_pipeline.py + config tests. 206 passed, 4 skipped; ruff + mypy clean; detection gate PASS. Co-Authored-By: Claude Opus 4.8 <[email protected]>
62 lines
2.5 KiB
Python
62 lines
2.5 KiB
Python
"""Hardening wired into the scan: redaction + bounded-CI finding budget (Phase 15)."""
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from openultrasast.cli import main
|
|
|
|
# Two vulnerable routes whose source quotes a live-looking secret. The secret is
|
|
# assembled at runtime so no scannable token literal lives in the repository.
|
|
_SECRET = "sk-" + "abcdEFGH1234567890zzzzzz"
|
|
_VULN_WITH_SECRET = (
|
|
f'API_KEY = "{_SECRET}"\n'
|
|
"@app.route('/a')\n"
|
|
"def a():\n"
|
|
" return eval(request.data)\n"
|
|
"@app.route('/b')\n"
|
|
"def b():\n"
|
|
" return eval(request.args['x'])\n"
|
|
)
|
|
|
|
|
|
def _run(tmp_path: Path, monkeypatch: pytest.MonkeyPatch, *, config_body: str | None) -> Path:
|
|
repo = tmp_path / "repo"
|
|
repo.mkdir(parents=True)
|
|
(repo / "app.py").write_text(_VULN_WITH_SECRET)
|
|
monkeypatch.setenv("OPENULTRASAST_RUNS_DIR", ".runs")
|
|
argv = ["scan", str(repo), "--mode", "quick"]
|
|
if config_body is not None:
|
|
cfg = tmp_path / "openultrasast.toml"
|
|
cfg.write_text(config_body)
|
|
argv += ["--config", str(cfg)]
|
|
assert main(argv) == 0
|
|
return sorted((repo / ".runs").iterdir())[-1]
|
|
|
|
|
|
def test_trace_does_not_leak_secrets_by_default(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
run_dir = _run(tmp_path, monkeypatch, config_body=None)
|
|
trace = (run_dir / "trace" / "events.jsonl").read_text()
|
|
assert _SECRET not in trace
|
|
|
|
|
|
def test_max_findings_budget_truncates_and_records_degradation(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
# The fixture yields two eval findings; cap to 1 and confirm truncation is disclosed.
|
|
uncapped = _run(tmp_path / "full", monkeypatch, config_body=None)
|
|
assert len(json.loads((uncapped / "findings.json").read_text())["findings"]) >= 2
|
|
|
|
run_dir = _run(tmp_path / "capped", monkeypatch, config_body="[hardening]\nmax_findings = 1\n")
|
|
findings = json.loads((run_dir / "findings.json").read_text())["findings"]
|
|
manifest = json.loads((run_dir / "manifest.json").read_text())
|
|
assert len(findings) == 1
|
|
budget = next(d for d in manifest["degradations"] if d["stage"] == "budget")
|
|
assert budget["reason"] == "max_findings_exceeded" and budget["actual"] >= 2
|
|
|
|
|
|
def test_redaction_can_be_disabled(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
run_dir = _run(tmp_path, monkeypatch, config_body="[hardening]\nredact_secrets = false\n")
|
|
trace = (run_dir / "trace" / "events.jsonl").read_text()
|
|
# With redaction off, the trace is not scrubbed (target path/source may appear verbatim).
|
|
assert "***REDACTED***" not in trace
|