mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
328406ad41
The HTTP verifier could not distinguish a mis-wired or non-serving app from a genuine no-effect: both yielded `inconclusive`. This adds a positive control for the path oracle. - PathOracle plants a benign in-root marker file (random token from os.urandom, distinct from the secret canary) and exposes it via a new Oracle.control() hook (default None; only the path oracle implements it today). - On the first run of an HTTP side, _side runs a benign GET for that marker as its own fully-guarded app start. The marker returning proves the interface serves the fixture; its absence — or any control failure — is recorded in the new SideRecord.control_observed field but never changes the verdict, since a valid app may answer only its own routes. A crash is still caught by the existing could_not_run path. A 2xx-based "nothing served" block was rejected: the verifier deliberately treats any HTTP status as the app being alive (a 503-only app is a valid observed side), so status-based blocking would false-fail valid apps. Soundly converting a mis-wired-but-responding app into could_not_run requires a demo-declared control, which is a separate follow-up. Tests: new tests/test_search_control.py covers marker observed, absent marker not blocking, control failure not blocking a working attack, and crash still could_not_run. Full search-verify/probe/worker suites pass; ruff clean; mypy unchanged (only the pre-existing file_bindings lambda note). Co-Authored-By: Claude Opus 4.8 <[email protected]>