mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-19 21:19:28 +00:00
Marius CiepluchandClaude Opus 5.5
c5bf52f47d
0 of 12 positives; 12.6 false alarms per 100 ordinary pushes (2.1 on changed lines only). The misses come from what the rules and facts express (access control lives in obligations, which do not convert; sources cover request objects only), not from the engine. Comparison arm only: a Semgrep miss is never evidence against a hunter finding. Co-Authored-By: Claude Opus 5.5 <[email protected]>
217 lines
4.9 KiB
YAML
217 lines
4.9 KiB
YAML
rules:
|
|
- id: ousast.c.regex.c-exec-family
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: C exec command execution needs review
|
|
metadata:
|
|
family: injection
|
|
cwe: CWE-78
|
|
origin: c-exec-family
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- syscall_entry
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(execl|execlp|execle|execv|execvp|execvpe)\s*\(
|
|
- id: ousast.c.regex.c-shell-exec
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: C shell execution needs review
|
|
metadata:
|
|
family: injection
|
|
cwe: CWE-78
|
|
origin: c-shell-exec
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- syscall_entry
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(system|popen)\s*\(
|
|
- id: ousast.c.regex.c-unsafe-copy
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: Unsafe C string copy needs review
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-121
|
|
origin: c-unsafe-copy
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- memory_unsafe
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(gets|strcpy|strcat|sprintf)\s*\(
|
|
- id: ousast.c.regex.c-unsafe-format
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: Unsafe C format string needs review
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-134
|
|
origin: c-unsafe-format
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- memory_unsafe
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(printf|vprintf|vsprintf|vsnprintf|vfprintf|syslog)\s*\(\s*[A-Za-z_]
|
|
- id: ousast.c.regex.c-unsafe-memory-copy
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: Unsafe C memory copy needs review
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-121
|
|
origin: c-unsafe-memory-copy
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- memory_unsafe
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(memcpy|memmove|bcopy)\s*\(
|
|
- id: ousast.c.regex.c-unsafe-scanf
|
|
languages:
|
|
- c
|
|
- cpp
|
|
severity: WARNING
|
|
message: Unbounded C scanf needs review
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-121
|
|
origin: c-unsafe-scanf
|
|
precision_estimate: '0.0'
|
|
kind: regex
|
|
tags:
|
|
- memory_unsafe
|
|
status: enabled
|
|
version: '1'
|
|
pattern-regex: \b(scanf|fscanf|sscanf)\s*\([^\n]*%s
|
|
- id: ousast.c.taint.printf
|
|
mode: taint
|
|
languages: &id001
|
|
- c
|
|
- cpp
|
|
severity: ERROR
|
|
message: 'printf: untrusted input reaches fprintf, printf, sprintf, syslog, vprintf, vsprintf'
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-134
|
|
origin: sink:c:printf
|
|
precision_estimate: unmeasured
|
|
kind: taint
|
|
calls:
|
|
- fprintf
|
|
- printf
|
|
- sprintf
|
|
- syslog
|
|
- vprintf
|
|
- vsprintf
|
|
pattern-sources:
|
|
- pattern-either: &id002
|
|
- pattern: argv
|
|
- pattern: argv(...)
|
|
- pattern: getenv
|
|
- pattern: getenv(...)
|
|
- pattern: fgets
|
|
- pattern: fgets(...)
|
|
- pattern: gets
|
|
- pattern: gets(...)
|
|
- pattern: scanf
|
|
- pattern: scanf(...)
|
|
- pattern: fscanf
|
|
- pattern: fscanf(...)
|
|
pattern-sinks:
|
|
- pattern-either:
|
|
- patterns:
|
|
- pattern: fprintf($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- patterns:
|
|
- pattern: printf($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- patterns:
|
|
- pattern: sprintf($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- patterns:
|
|
- pattern: syslog($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- patterns:
|
|
- pattern: vprintf($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- patterns:
|
|
- pattern: vsprintf($FORMAT, ...)
|
|
- focus-metavariable: $FORMAT
|
|
- id: ousast.c.taint.strcpy
|
|
mode: taint
|
|
languages: *id001
|
|
severity: ERROR
|
|
message: 'strcpy: untrusted input reaches gets, sprintf, strcat, strcpy'
|
|
metadata:
|
|
family: memory
|
|
cwe: CWE-121
|
|
origin: sink:c:strcpy
|
|
precision_estimate: unmeasured
|
|
kind: taint
|
|
calls:
|
|
- gets
|
|
- sprintf
|
|
- strcat
|
|
- strcpy
|
|
pattern-sources:
|
|
- pattern-either: *id002
|
|
pattern-sinks:
|
|
- pattern-either:
|
|
- pattern: gets(...)
|
|
- pattern: $OBJ.gets(...)
|
|
- pattern: sprintf(...)
|
|
- pattern: $OBJ.sprintf(...)
|
|
- pattern: strcat(...)
|
|
- pattern: $OBJ.strcat(...)
|
|
- pattern: strcpy(...)
|
|
- pattern: $OBJ.strcpy(...)
|
|
- id: ousast.c.taint.system
|
|
mode: taint
|
|
languages: *id001
|
|
severity: ERROR
|
|
message: 'system: untrusted input reaches execl, execv, execvp, popen, system'
|
|
metadata:
|
|
family: injection
|
|
cwe: CWE-78
|
|
origin: sink:c:system
|
|
precision_estimate: unmeasured
|
|
kind: taint
|
|
calls:
|
|
- execl
|
|
- execv
|
|
- execvp
|
|
- popen
|
|
- system
|
|
pattern-sources:
|
|
- pattern-either: *id002
|
|
pattern-sinks:
|
|
- pattern-either:
|
|
- pattern: execl(...)
|
|
- pattern: $OBJ.execl(...)
|
|
- pattern: execv(...)
|
|
- pattern: $OBJ.execv(...)
|
|
- pattern: execvp(...)
|
|
- pattern: $OBJ.execvp(...)
|
|
- pattern: popen(...)
|
|
- pattern: $OBJ.popen(...)
|
|
- pattern: system(...)
|
|
- pattern: $OBJ.system(...)
|