mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
af81bccc70
ruleset/frameworks.toml lists 19 framework and library ids (wordpress, flask, django, express,
spring, jakarta-servlet, react, vue and 11 libraries), each with its languages, dependency
package names and a symbol lexicon used only by the lint and for stratification.
Every framework/library entry of section 2 is tagged `framework`/`library`, and mixed entries
are split so a tag covers a whole entry (split pieces keep the entry's id and flags, in place):
semantic facts 38 tagged entries (wordpress 6, django 6, flask 4, express 4, jakarta-servlet 3,
pyyaml 2, one each for spring, sqlalchemy, requests, httpx, lodash, node-http-clients,
escape-html, sanitize-html, dompurify, esapi, commons-text, react, vue); the dispatch fact
behind the hook-as-source path is wordpress; the PHP layout row is renamed php_layout and stays
untagged (a product filter). Quick rules: 9 tagged (wordpress 6, flask, pyyaml,
node-http-clients); php-unserialize is split into php-unserialize and php-maybe-unserialize;
the lint also caught WordPress escapers in exclusions and axios/yaml.load in mixed rules, so
those keep their ids as tagged rules and gain a `fallback_for` language-level rule (6) that is
active only when the prior is off.
load_facts and load_ruleset take priors ("all" by default -- today's scan --, "off", or a set
of ids). tests/test_semantic_priors.py: the lint (no untagged entry contains a lexicon symbol
of its language), "off" removes exactly the tagged entries and activates the fallbacks, split
entries keep their language-level calls. Rule and layout counts in three existing tests follow the split and the rename.
Unchanged defaults: test_benchmark_output_is_byte_identical_to_golden_baseline passes, and the
quick findings of all 15 benchmark manifests (full StaticFinding records) are byte-identical
before and after. priors=off on the same manifests: 61 -> 57 findings; the 4 lost are js-ssrf
(axios), php-wpdb-sql-composition, python-ssti and python yaml.load; 5 PHP and 1 Python finding
move to their fallback rule at the same location. Semantic calls with priors off: php 75/92,
python 32/77, javascript 42/70, java 24/41, c 27/27 (the engine-side effect needs Joern and was
not measured).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
147 lines
4.2 KiB
TOML
147 lines
4.2 KiB
TOML
[[rule]]
|
|
rule_id = "js-command-exec"
|
|
title = "Node child_process command execution needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-78"
|
|
tags = ["syscall_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\b(exec|execSync)\s*\('''
|
|
|
|
[[rule]]
|
|
rule_id = "js-deserialize"
|
|
title = "JavaScript unsafe deserialization needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-502"
|
|
tags = ["deserialization"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\b(unserialize)\s*\('''
|
|
|
|
[[rule]]
|
|
rule_id = "js-dom-xss"
|
|
title = "DOM sink with untrusted input needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-79"
|
|
tags = ["injection"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\.(innerHTML|outerHTML)\s*=\s*[^\n]*\b(?:req|request|location|document\.location)'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-eval"
|
|
title = "Dynamic JavaScript evaluation needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-95"
|
|
tags = ["syscall_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\b(eval)\s*\('''
|
|
|
|
[[rule]]
|
|
rule_id = "js-function-constructor"
|
|
title = "JavaScript Function constructor needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-95"
|
|
tags = ["syscall_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''new\s+(Function)\s*\('''
|
|
|
|
[[rule]]
|
|
rule_id = "js-path-traversal"
|
|
title = "Node filesystem access with external input needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-22"
|
|
tags = ["filesystem_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\bfs\.(readFile|readFileSync|writeFile|writeFileSync|createReadStream|unlink|unlinkSync)\s*\(\s*[^\n]*\b(?:req|request)\.'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-spawn-shell"
|
|
title = "Node spawn with shell needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-78"
|
|
tags = ["syscall_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\b(spawn|spawnSync)\s*\([^\n]*shell\s*:\s*true'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-sql-injection"
|
|
title = "JavaScript SQL string composition needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-89"
|
|
tags = ["injection"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\.(query|execute)\s*\(\s*[^\n]*(?:\$\{|\+\s*[A-Za-z_$])'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-ssrf"
|
|
title = "JavaScript outbound request with external input needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-918"
|
|
tags = ["network_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
library = "node-http-clients"
|
|
pattern = '''\b(axios|fetch|got)\s*[.(][^\n]*\b(?:req|request)\.'''
|
|
|
|
# Active only when the rule above is dropped (priors off); status and precision are the tagged rule's measurement.
|
|
[[rule]]
|
|
rule_id = "js-ssrf-language"
|
|
title = "JavaScript outbound request with external input needs review (language-level)"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-918"
|
|
tags = ["network_entry"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
fallback_for = "js-ssrf"
|
|
pattern = '''\b(fetch)\s*[.(][^\n]*\b(?:req|request)\.'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-weak-hash"
|
|
title = "JavaScript weak hash needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-327"
|
|
tags = ["crypto"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''createHash\s*\(\s*[\"'](md5|sha1)[\"']'''
|
|
|
|
[[rule]]
|
|
rule_id = "js-xss-response"
|
|
title = "Unsanitized HTTP response reflection needs review"
|
|
languages = ["javascript", "typescript"]
|
|
cwe = "CWE-79"
|
|
tags = ["injection"]
|
|
status = "enabled"
|
|
min_evidence_level = "static_corroboration"
|
|
precision_estimate = 0.0
|
|
version = "1"
|
|
pattern = '''\.(send|write|end)\s*\(\s*[^\n]*\b(?:req|request)\.(?:query|params|body)'''
|