mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius CiepluchandClaude Opus 5
d63be34451
Sharding was triggered by `Failed to process` warnings. Those warnings are not
evidence about the finished graph:
a build reporting 2 drops -> 3 files, 139 methods, same size as a clean one
The file it warned about was in the graph the whole time. Acting on the
warning is not merely wasteful, it is destructive -- shards cannot see each
other's flows, so splitting a two-file WordPress pair on a false alarm cost it
CVE-2022-25148 outright. That is how this was found: the slices caught it, at
a scale small enough to check by hand, before the whole-repository run could
bury it.
So the build now takes a census of the graph (`census.sc`) when the frontend
warns, and splits only if the graph is actually short of the files handed to
it. A warning is a symptom to investigate, never a verdict. Conservative in
the only direction that matters: if the census cannot be taken, the caller
does the careful thing and splits.
wp-vuln 3 entailed incl. CVE at :225, NO shard (was: 2, sharded)
wp-fixed 2, that one absent
mwwpform 1 / 0
pmpro one-file 18 incl. CVE at :936
pmpro slice 18 incl. CVE at :936, sharded -- genuinely deficient here
The census costs one JVM, and only on a build that warned; a clean build pays
nothing.
849 tests pass; gates byte-identical.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
19 lines
979 B
Python
19 lines
979 B
Python
// How much of the repository actually made it into the graph (contributor-scan 5.10).
|
|
//
|
|
// A frontend can log `Failed to process` for a file that is nonetheless present -- measured: a build
|
|
// reporting two drops produced a graph holding both of its files and all 139 methods, byte-identical in
|
|
// size to a clean one. So the warning is a symptom to investigate, never a verdict, and the only thing that
|
|
// settles whether a graph is deficient is the graph.
|
|
//
|
|
// This matters because acting on the warning alone is destructive: it makes the driver split a repository
|
|
// into shards that cannot see each other's flows, and a two-file WordPress pair lost its CVE that way.
|
|
//
|
|
// Parameters: cpgFile.
|
|
// Output: fenced JSON {files, methods}.
|
|
@main def exec(cpgFile: String) = {
|
|
importCpg(cpgFile)
|
|
println("---OUSAST-CPG-BEGIN---")
|
|
println(ujson.write(ujson.Obj("files" -> cpg.file.size.toString, "methods" -> cpg.method.size.toString)))
|
|
println("---OUSAST-CPG-END---")
|
|
}
|