mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
beb272a5ec
Codex delivery under spec access-control-prover. `semantic/obligations/paths.py` builds entry-to-function path records from the cached caller index; `mapping.py` names Stapler web methods and Jetty handlers as entries; `check_obligations` gains the opt-in premise `assume_entries_protected` with the label `unguarded_path`; `hunt/prover.py` proves a change with no model call and states its coverage; `benchmarks/valid/prover_arm.py` scores it with the valid-benchmark metrics. Two fixes after the first smoke run: a product file git holds empty is read, not unread (four changes failed on `__init__.py` and empty assets), and absent-input reasons are counted by name. Smoke on the 23 fix changes of the training pool: 7 pushes caught (30 percent, Wilson 16 to 51), 28 of 93 locations, precision 7 of 8 flagged, no instrument failure; three changes over the 120 second bound. Twelve of the 17 Jenkins fixes reach the fixed method but check no operation because the method is the operation; the spec now carries handler-named operations for delivery B. Co-Authored-By: Claude Fable 5.1 <[email protected]>
82 lines
4.1 KiB
TOML
82 lines
4.1 KiB
TOML
# Delivery A additionally checked actual calls in Git HEAD objects (2026-10-14):
|
|
# p4-plugin: CredentialsHelper.lookupCredentialsInItem, P4PasswordImpl and P4TicketImpl
|
|
# call ConnectionFactory.testConnection, ConnectionFactory calls connect, ReviewNotifier
|
|
# calls openConnection; zephyr-enterprise-test-management-plugin: ZephyrInstance calls
|
|
# getCredentialsFromId and UserService.verifyCredentials; azure-keyvault-plugin:
|
|
# AzureKeyVaultGlobalConfiguration.doTestConnection calls listPropertiesOfSecrets;
|
|
# rocketchatnotifier-plugin: RocketChatNotifier.doTestConnection calls publish.
|
|
# Each listed clone is under /home/mc/ousast-results/valid/train/hist/jenkinsci__*.
|
|
# No network documentation lookup was performed for this delivery. The existing
|
|
# documented checkAnyPermission row below is retained; it was not found in these HEADs.
|
|
# Closed authorization facts for Jenkins/Stapler, Spring Security and Servlet code.
|
|
# Checked Git HEAD source objects in /home/mc/ousast-results/valid/train/hist/:
|
|
# jenkinsci__analysis-core-plugin: DefaultGraphConfigurationView.checkPermission,
|
|
# AbstractAnnotation.hasPermission and GlobalSettings.save; android-signing-plugin:
|
|
# SignApksBuilder.lookupCredentials; ansible-plugin: AnsibleAdHocCommandBuilder.findCredentialById;
|
|
# blueocean-plugin: GitScm.getItemByFullName; cloud-stats-plugin: CloudStatistics.getConfigFile;
|
|
# job-import-plugin: JobImportAction.updateByXml. These are real calls, not prose matches.
|
|
# checkAnyPermission is documented by Jenkins AccessControlled, although absent from these HEADs:
|
|
# https://javadoc.jenkins.io/hudson/security/AccessControlled.html
|
|
# checkReadPermission was not found in the clones or API references and is not guessed here.
|
|
# Spring and Servlet are already named in ruleset/semantic/java.toml. Their identity/check APIs:
|
|
# https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/acls/model/Acl.html
|
|
# https://docs.spring.io/spring-security/site/docs/5.4.x/reference/html5/ (Servlet integration)
|
|
# Calls use trailing method names. Boolean predicates are ownership_check witnesses, requiring
|
|
# an exit before the operation under OrderDominance; only throwing checks are path_guard facts.
|
|
version = "1"
|
|
language = "java"
|
|
|
|
[[operation]]
|
|
id = "jenkins-credentials-read"
|
|
kind = "protected_read"
|
|
calls = ["lookupCredentials", "lookupCredentialsInItem", "findCredentialById", "getCredentialsFromId"]
|
|
requires = ["path_guard", "ownership_check", "identity_constraint"]
|
|
sensitivity = "high"
|
|
|
|
[[operation]]
|
|
# A Stapler doXxx handler is not itself a protected operation; its item lookup is.
|
|
id = "jenkins-item-read"
|
|
kind = "protected_read"
|
|
calls = ["getItemByFullName", "getConfigFile"]
|
|
requires = ["path_guard", "ownership_check", "identity_constraint"]
|
|
sensitivity = "high"
|
|
|
|
[[operation]]
|
|
id = "jenkins-item-write"
|
|
kind = "protected_write"
|
|
calls = ["updateByXml", "save"]
|
|
requires = ["path_guard", "ownership_check", "identity_constraint"]
|
|
sensitivity = "high"
|
|
|
|
[[operation]]
|
|
# JDBC access already named in semantic/java.toml; authorization is separate from SQL escaping.
|
|
id = "sql-access"
|
|
kind = "protected_read"
|
|
calls = ["executeQuery", "execute", "prepareCall"]
|
|
requires = ["path_guard", "ownership_check", "identity_constraint"]
|
|
sensitivity = "high"
|
|
|
|
[[operation]]
|
|
id = "jenkins-outbound-connection"
|
|
kind = "privileged_action"
|
|
calls = ["testConnection", "verifyCredentials", "listPropertiesOfSecrets", "openConnection", "connect", "publish"]
|
|
requires = ["path_guard", "ownership_check"]
|
|
sensitivity = "high"
|
|
|
|
[[discharger]]
|
|
id = "jenkins-permission-guard"
|
|
kind = "path_guard"
|
|
calls = ["checkPermission", "checkAnyPermission"]
|
|
|
|
[[discharger]]
|
|
id = "permission-predicate"
|
|
kind = "ownership_check"
|
|
calls = ["hasPermission", "isGranted", "isUserInRole"]
|
|
|
|
[[discharger]]
|
|
# Reading the security context alone is not an authorization guard.
|
|
id = "identity-from-context"
|
|
kind = "identity_constraint"
|
|
identity_sources = ["SecurityContextHolder.getContext().getAuthentication()", "Jenkins.getAuthentication()", "Jenkins.getAuthentication2()", "getUserPrincipal()"]
|
|
request_sources = ["getParameter(", "getHeader(", "getCookies(", "getQueryString("]
|