mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
62052b9525
Feeds the day's measurements back into the spec and reorders the roadmap around what is actually blocking. STATUS. Three CVEs found on real WordPress plugins -- CVE-2023-23488, CVE-2023-6559, CVE-2022-25148 -- each entailed by the graph with no model in the loop and each absent from its fixed side. Two of them require the two-stage join and would be invisible without it. The detector is not the problem. The repository is. A 637-file plugin builds in 76s to a 4.25MB graph, dominance and config answer, taint does not finish. Three blockers in the order they bite: cost (6.63 s/request), ranking (84% of regions share one rank, ordered alphabetically), coverage (access_control never asked for PHP, output_encoding untrustworthy while the sanitizer list is flat). And what is NOT a blocker, contrary to most of what this file said this morning: php2cpg. One genuine defect, 0.2% of files, detected and excluded and reported. Everything else attributed to the frontend was a local php shim proxying stdio, which cost four wrong diagnoses in a day. NEW TASK 5.14, and it is the cheapest thing on the board. 53% of taint requests are put to a family whose sinks are not in scope -- all 487 of PMPro's deserialization requests go to a repository that never calls unserialize. Skipping them cannot lose a finding, because a family with no sink cannot produce a flow. 4.6 hours -> 2.2, before any ranking work. ROADMAP reordered around one question: the shortest path to a scan of a real plugin that reports its CVE. Prune the impossible questions, then rank (an LLM job, and safe as one because ranking cannot manufacture a finding, with the closed-loop problem treated as a design requirement rather than a caveat), then attack the per-request cost only if those two are not enough. 857 tests pass. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG