mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
af81bccc70
ruleset/frameworks.toml lists 19 framework and library ids (wordpress, flask, django, express,
spring, jakarta-servlet, react, vue and 11 libraries), each with its languages, dependency
package names and a symbol lexicon used only by the lint and for stratification.
Every framework/library entry of section 2 is tagged `framework`/`library`, and mixed entries
are split so a tag covers a whole entry (split pieces keep the entry's id and flags, in place):
semantic facts 38 tagged entries (wordpress 6, django 6, flask 4, express 4, jakarta-servlet 3,
pyyaml 2, one each for spring, sqlalchemy, requests, httpx, lodash, node-http-clients,
escape-html, sanitize-html, dompurify, esapi, commons-text, react, vue); the dispatch fact
behind the hook-as-source path is wordpress; the PHP layout row is renamed php_layout and stays
untagged (a product filter). Quick rules: 9 tagged (wordpress 6, flask, pyyaml,
node-http-clients); php-unserialize is split into php-unserialize and php-maybe-unserialize;
the lint also caught WordPress escapers in exclusions and axios/yaml.load in mixed rules, so
those keep their ids as tagged rules and gain a `fallback_for` language-level rule (6) that is
active only when the prior is off.
load_facts and load_ruleset take priors ("all" by default -- today's scan --, "off", or a set
of ids). tests/test_semantic_priors.py: the lint (no untagged entry contains a lexicon symbol
of its language), "off" removes exactly the tagged entries and activates the fallbacks, split
entries keep their language-level calls. Rule and layout counts in three existing tests follow the split and the rename.
Unchanged defaults: test_benchmark_output_is_byte_identical_to_golden_baseline passes, and the
quick findings of all 15 benchmark manifests (full StaticFinding records) are byte-identical
before and after. priors=off on the same manifests: 61 -> 57 findings; the 4 lost are js-ssrf
(axios), php-wpdb-sql-composition, python-ssti and python yaml.load; 5 PHP and 1 Python finding
move to their fallback rule at the same location. Semantic calls with priors off: php 75/92,
python 32/77, javascript 42/70, java 24/41, c 27/27 (the engine-side effect needs Joern and was
not measured).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
99 lines
2.7 KiB
TOML
99 lines
2.7 KiB
TOML
version = "1"
|
|
language = "java"
|
|
|
|
[[source]]
|
|
id = "servlet"
|
|
framework = "jakarta-servlet"
|
|
patterns = ["getParameter", "getHeader", "getCookies", "getQueryString"]
|
|
|
|
# A request body or a console read line by line: the reader, not the servlet API.
|
|
[[source]]
|
|
id = "servlet"
|
|
patterns = ["readLine"]
|
|
|
|
[[sink]]
|
|
id = "exec"
|
|
cwe = "CWE-78"
|
|
calls = ["exec"]
|
|
rule_ids = ["java-command-exec"]
|
|
|
|
[[sink]]
|
|
id = "executeQuery"
|
|
cwe = "CWE-89"
|
|
calls = ["executeQuery", "execute", "prepareCall"]
|
|
rule_ids = ["java-sql-injection"]
|
|
|
|
[[sink]]
|
|
id = "readObject"
|
|
cwe = "CWE-502"
|
|
calls = ["readObject"]
|
|
rule_ids = ["java-deserialization"]
|
|
|
|
[[sink]]
|
|
id = "MessageDigest"
|
|
cwe = "CWE-327"
|
|
calls = ["getInstance"]
|
|
rule_ids = ["java-weak-hash"]
|
|
weak_literals = ["MD5", "SHA-1", "SHA1"]
|
|
|
|
# --- model-grounded-detection: Java web sinks --------------------------------------------------------------
|
|
# Java shipped with injection, deserialization and crypto sinks only, so the path and output_encoding families
|
|
# had nothing routing to them by CWE and a Java pair in either was unreadable (hutool-cve-2018-17297 reported
|
|
# "no path spec for java"). Documented dangerous APIs of the JDK and the servlet API, provenance per entry.
|
|
|
|
[[sink]]
|
|
# CWE-22. The JDK's filesystem entry points that accept a caller-supplied path.
|
|
id = "file.open"
|
|
cwe = "CWE-22"
|
|
calls = ["File", "FileInputStream", "FileOutputStream", "FileReader", "FileWriter", "RandomAccessFile", "Paths.get", "Files.newInputStream", "Files.readAllBytes"]
|
|
rule_ids = []
|
|
|
|
[[sink]]
|
|
# CWE-79. Servlet response writers: what reaches these reaches the browser unescaped.
|
|
id = "response.write"
|
|
framework = "jakarta-servlet"
|
|
cwe = "CWE-79"
|
|
calls = ["println", "print", "write", "getWriter", "setHeader", "addHeader"]
|
|
rule_ids = []
|
|
|
|
[[sink]]
|
|
# CWE-918 / CWE-601: outbound requests and redirects to a caller-supplied destination.
|
|
id = "outbound.request"
|
|
cwe = "CWE-918"
|
|
calls = ["openConnection", "openStream"]
|
|
rule_ids = []
|
|
|
|
[[sink]]
|
|
id = "outbound.request"
|
|
framework = "jakarta-servlet"
|
|
cwe = "CWE-918"
|
|
calls = ["sendRedirect"]
|
|
rule_ids = []
|
|
|
|
[[sink]]
|
|
id = "outbound.request"
|
|
framework = "spring"
|
|
cwe = "CWE-918"
|
|
calls = ["getForObject", "exchange"]
|
|
rule_ids = []
|
|
|
|
[[sanitizer]]
|
|
# CWE-22 / CWE-79. The documented normalising and encoding APIs; ESAPI is what the OWASP suite itself uses.
|
|
id = "java.escape"
|
|
calls = ["getCanonicalPath", "normalize", "URLEncoder.encode"]
|
|
|
|
[[sanitizer]]
|
|
id = "java.escape"
|
|
library = "esapi"
|
|
calls = ["ESAPI.encoder", "encodeForHTML", "encodeForURL"]
|
|
|
|
[[sanitizer]]
|
|
id = "java.escape"
|
|
library = "commons-text"
|
|
calls = ["StringEscapeUtils.escapeHtml4"]
|
|
|
|
[[sanitizer]]
|
|
id = "parameterized_statement"
|
|
calls = ["prepareStatement", "setString", "setInt"]
|
|
parameterized = true
|