mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 4.8
cf9f945992
Rebuild the quick-scan detection engine and ground-truth benchmarks to hit >=90% recall / <10% false positives for C/C++, Python, JavaScript, and Java. Engine (findings.py, preprocess.py): - Scope each PatternRule by language (fixes cross-language false positives such as the Python eval/exec rule firing on JS .exec()). - Add JavaScript/TypeScript rules (command exec, eval/Function, reflected XSS, SQLi, path traversal, SSRF, weak hash, deserialization); execFile/spawn-argv excluded as safe alternatives. - Add Java rules (Runtime exec, SQL string concatenation, weak hash, readObject) and a Groovy server-side template rule (yieldUnescaped of a bound variable). - Broaden C/C++ and Python coverage; precision guards for format strings and parameterised vs concatenated SQL; #-comment skipping; CWE in rationale. - Register .java/.groovy/.tpl source extensions. Benchmarks: - Add realistic corpora modeled on Damn Vulnerable C/C++, PyGoat/DVPWA, and NodeGoat, plus the real kiview/damn-vulnerable-spring-boot-app vendored verbatim (MIT, attribution in LICENSE/NOTICE.md). Each manifest carries complete, independently-labeled ground truth including genuinely hard-to-detect vulns (integer overflow, second-order SQLi, prototype pollution) so recall is measured honestly, plus safe-API files for precision. - Fix pre-existing smoke-manifest ground-truth errors (Python/JS line offsets, missing C/C++ strcpy entry, Java SQLi line). benchmark.py: - Fix sink matching to normalise the expected sink consistently so sinks with underscores (e.g. render_template_string) can match. Tests: - Add tests/test_detection_benchmarks.py enforcing the >=90% recall / <10% FP goal per language and overall. Measured: C/C++ 93.3%, Python 93.3%, JavaScript 92.3%, Java 100%; overall 93.6% recall, 0.0% false-positive rate. Co-Authored-By: Claude Opus 4.8 <[email protected]>
39 lines
910 B
C++
39 lines
910 B
C++
// Memory-safety vulnerabilities modeled on Damn Vulnerable C/C++ Program.
|
|
#include <cstdio>
|
|
#include <cstdlib>
|
|
#include <cstring>
|
|
|
|
void copy_name(char *src) {
|
|
char dst[16];
|
|
strcpy(dst, src); // CWE-120 unbounded strcpy into fixed buffer
|
|
}
|
|
|
|
void greet(char *src) {
|
|
char dst[16];
|
|
strcat(dst, src); // CWE-120 unbounded strcat into fixed buffer
|
|
}
|
|
|
|
void read_line() {
|
|
char buf[32];
|
|
gets(buf); // CWE-120 gets has no bounds checking
|
|
}
|
|
|
|
void render(char *user) {
|
|
char out[64];
|
|
sprintf(out, "hello %s", user); // CWE-120 sprintf overflow
|
|
}
|
|
|
|
void copy_blob(char *dst, char *src, int len) {
|
|
memcpy(dst, src, len); // CWE-120 memcpy with attacker length
|
|
}
|
|
|
|
void parse_int() {
|
|
char name[8];
|
|
scanf("%s", name); // CWE-120 unbounded scanf %s
|
|
}
|
|
|
|
char *grow(int len, int count) {
|
|
// CWE-190 integer overflow in allocation size (no direct dangerous sink token)
|
|
return (char *)malloc(len * count);
|
|
}
|