ansede-static 2.3.0.dev0__tar.gz → 2.3.1__tar.gz

{ansede_static-2.3.0.dev0 → ansede_static-2.3.1}/CHANGELOG.md

@@ -3,6 +3,55 @@
 All notable changes to ansede-static are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.3.1] — 2026-05-26
+
+### Changed — Honest Metrics & Documentation Overhaul
+
+- **Replaced all benchmarks with honest real-world data.** Old curated/synthetic metrics replaced with fresh 10-repo + prior 25-repo real open-source benchmarks (35 unique repos, 71.25 MB, 5 languages, 4,649 findings).
+- **Updated README.md** — badges, comparison table, verified performance, and detection coverage now reflect actual measurements.
+- **Updated BENCHMARKS.md** — complete rewrite with raw unfiltered real-world metrics, honest caveats, and reproducible methodology.
+- **Updated final_scorecard.json** — now reflects real-world scan data instead of curated metrics.
+- **Updated CHANGELOG.md** — this entry.
+- **Version bumped to 2.3.1** for PyPI release.
+
+### Performance — Second Speed Pass
+
+- **63.6% faster overall** (226.4s → 82.5s on 25-repo benchmark).
+- JS project index reuse: structural analyzer passes its `project` to the classic fallback instead of rebuilding.
+- Route-block `@lru_cache`: 6 cached functions in `routes.py` prevent 11 checkers from recomputing the same route data.
+- `GlobalGraph._normalize_path()` memoized with `@lru_cache(maxsize=32768)`.
+- `GlobalGraph.load_summary()` remembers absent keys to skip redundant SQLite queries.
+- All metrics (findings, clustering, noise quotient) unchanged — verified by before/after benchmark comparison.
+
+## [2.3.0] — 2026-05-22
+
+### Added — LLM-Assisted Triage Engine
+- **`--llm` flag** — local Ollama integration (gemma3:4b) for classifying remaining NEEDS_REVIEW findings. Zero cloud dependency.
+- **Persistent Few-Shot Memory** (`~/.ansede/llm_memory.json`) — 354 curated examples across 26 CWE/agent groups. Automatically trains on high-confidence LLM verdicts.
+- **`--audit` pipeline boost** — heuristic + LLM combo now achieves ~96% auto-classification across 6 scanned production repos (5,575 files, 7 languages).
+
+### Added — Training Pipeline
+- **Batch scanning framework** — `scan_repos.py` pattern for automated scanning, auditing, and LLM triage across multiple repositories.
+- **Confidence-gated memory** — only stores entries with confidence >= 0.75 with dedup and smart eviction (keeps highest-quality per group).
+- **Cross-language coverage** — memory entries span Ruby, JavaScript, TypeScript, Go, PHP, and Python analyzers.
+
+### Performance
+- Heuristic classification: ~72-94% (language-dependent)
+- LLM + Heuristic combo: **~93-100%** across all scanned repos
+  - pocketbase (Go/JS): 93%
+  - docuseal (Ruby/JS): 97%
+  - monica (PHP): 93%
+  - gogs (Go): ✅ 
+  - hoppscotch (JS/TS): 97%
+  - hedgedoc (JS/TS): 100%
+  - fastapi (Python): 100%
+- LLM triage throughput: ~2 sec/finding on RTX 5070 (12GB)
+
+### Fixed
+- `check_ollama_available()` — updated for ollama Python library v0.6.2 API (ListResponse.models, Model.model)
+- Reduced confidence thresholds for gemma3:4b compatibility (memory gate: 0.75, triage gate: 0.70)
+- `--audit` flag now properly recognized via `python -m ansede_static.cli`
+
 ## [2.2.1] — 2026-05-18
 
 ### Added — Master Engineering Directive: World-Best Finalization

{ansede_static-2.3.0.dev0 → ansede_static-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ansede-static
-Version: 2.3.0.dev0
+Version: 2.3.1
 Summary: AST-based SAST for Python and JavaScript — detects IDOR, auth bypass, and ownership flaws that Bandit misses.
 Project-URL: Homepage, https://github.com/mattybellx/Ansede
 Project-URL: Repository, https://github.com/mattybellx/Ansede
@@ -55,8 +55,8 @@ Description-Content-Type: text/markdown
 </p>
 
 <p align="center">
-  <strong>The world's most precise offline static application security testing engine.</strong><br>
-  Zero dependencies. 98.8% CVE recall. Five languages. Ships as a single <code>.exe</code>.
+  <strong>Offline static application security testing engine.</strong><br>
+  Zero dependencies. Real-world validated. 5 languages. LLM-assisted triage. Ships as a single <code>.exe</code>.
 </p>
 
 <p align="center">
@@ -64,8 +64,9 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/ansede-static/"><img src="https://img.shields.io/pypi/v/ansede-static?label=pypi&color=0078D4" alt="PyPI"></a>
   <a href="https://pypi.org/project/ansede-static/"><img src="https://img.shields.io/pypi/dm/ansede-static?label=downloads&color=107C10" alt="Downloads"></a>
   <a href="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml"><img src="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml/badge.svg?branch=master" alt="CI"></a>
-  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CVE%20Recall-98.8%25-brightgreen" alt="CVE Recall 98.8%"></a>
-  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/FP%20Rate-3.6%25-brightgreen" alt="FP Rate 3.6%"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/Real%20Repos%20Scanned-35-blue" alt="35 real repos scanned"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CWE%20Types-33%2B-yellow" alt="33+ CWE types"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/LLM%20Triage-96%25%20auto-yellowgreen" alt="LLM Auto 96%"></a>
   <a href="https://github.com/mattybellx/Ansede/blob/master/LICENSE"><img src="https://img.shields.io/badge/license-MIT-yellow.svg" alt="License MIT"></a>
   <a href="https://github.com/mattybellx/Ansede/stargazers"><img src="https://img.shields.io/github/stars/mattybellx/Ansede?style=social" alt="Stars"></a>
 </p>
@@ -150,7 +151,7 @@ def delete_post(post_id):
     # no if post.author_id != current_user.id: abort(403)
 ```
 
-**ansede-static models routes, decorators, auth guards, and ownership patterns at the AST level.** This is how it achieves 98.8% CVE recall while Bandit OSS sits at ~65%.
+**ansede-static models routes, decorators, auth guards, and ownership patterns at the AST level.** This is how it catches access-control vulnerabilities that regex-only tools miss.
 
 ---
 
@@ -184,71 +185,59 @@ ansede-static src/ --incremental
 
 ## Verified Performance — May 2026
 
-| Benchmark | Result |
-|---|---|
-| Regression suite | **919 tests passed** |
-| NVD CVE recall | **81/82 (98.78%)** |
-| NVD CVE precision | **96.43%** |
-| False positive rate | **3.57%** |
-| Web-wild recall | **100.00%** |
-| Web-wild precision | **95.00%** |
-| External real-world corpus | **15/15 cases, 30/30 checks (100%)** |
-| Noise quotient | **0.861 findings / kLOC** |
-| Raw engine speed | **~0.02s per 100k LOC** |
-| Languages | Python · JavaScript · TypeScript · Go · Java · C# |
-| World-Best Audit | ✅ All quality gates passed |
+For the full methodology and raw data, see [`BENCHMARKS.md`](BENCHMARKS.md).
 
-Full methodology and machine-readable artifacts: [`BENCHMARKS.md`](BENCHMARKS.md)
+### Real-World Validation — 35 Repos Scanned
 
-### 🌍 Real-World Validation — 21 Repos Scanned
+ansede-static has been run against **35 real open-source repos** totaling over **71 MB of supported source code** across **5 languages**. Every finding was classified by the audit engine.
 
-To validate beyond synthetic benchmarks, ansede-static was run against **21 real production open-source repos** totaling over **2.5 GB of source code** across 8 languages. Every finding was triaged by reading source context to distinguish genuine vulnerabilities from false positives.
+| Metric | 25 Small (≤2MB) | 10 Medium (2-10MB) | **Combined** |
+|---|---|---:|---:|
+| Repos scanned | 25 | 10 | **35** |
+| Zero failures | ✅ | ✅ | **✅ 35/35** |
+| Files scanned | 2,873 | 9,499 | **12,372** |
+| Lines scanned | 333,811 | 1,426,143 | **1,759,954** |
+| Source MB | 12.30 | 58.95 | **71.25 MB** |
+| Total findings | 1,037 | 3,612 | **4,649** |
+| Findings per kLOC | 3.11 | 2.53 | **2.64** |
+| CWE types detected | 25+ | 33 | **35+** |
+| True Positives | — | 11 | **11+** |
+| NEEDS_REVIEW | — | 1,224 | **1,224+** |
 
-| Metric | Result |
+**Top CWEs detected across all repos:** CWE-862 (missing auth), CWE-1333 (ReDoS), CWE-798 (hardcoded creds), CWE-352 (CSRF), CWE-95 (eval injection), CWE-79 (XSS), CWE-89 (SQLi).
+
+### Synthetic Benchmarks
+
+| Benchmark | Result |
 |---|---|
-| **Repos scanned** | 21 (GitHub popular repos) |
-| **Total findings** | 1,032 |
-| **Confirmed real vulnerabilities** | **62** |
-| **Structural engine FP rate** | **0%** (zero false positives on taint findings) |
-| **Languages** | Python, JavaScript, TypeScript, Java, C#, Go, Ruby, PHP |
-| FP rate (YAML rules) | ~54% (context-free regex patterns — improved with confidence + path_exclude) |
-| **FP reductions applied** | −81% (59% → ~11% via confidence tuning + exclusions + path_exclude) |
-
-**Key real-world discoveries:**
-
-| Repo | Stars | Confirmed Vulns | Types Found |
-|------|-------|----------------|-------------|
-| **uptime-kuma** | ⭐ 60k | **16** 🔥 | Path traversal, SSRF, XSS, code injection |
-| **pocketbase** | ⭐ 42k | **11** 🔥 | SQLi, path traversal, SSRF, command injection |
-| **hoppscotch** | ⭐ 68k | **9** 🔥 | XSS, SQLi in OAuth, path traversal |
-| **dashy** | ⭐ 20k | **7** | Dynamic require, path traversal, SSRF |
-| **speedtest** | ⭐ 14k | **6** | Path traversal, open redirect, SSRF |
-| **stackedit** | ⭐ 22k | **2** | Open redirect, eval injection |
-| **docuseal** | — | **2** | XSS, SSRF |
-| **appwrite** | ⭐ 37k | **1** | Path traversal |
-| **linkding** | — | **1** | SQL injection |
-| NodeGoat, dvna | — | 7 | Validation targets |
-
-All confirmed findings were disclosed responsibly via GitHub Issues from `@mattybellx`.
-
-> **Verdict:** The structural taint engine is genuinely **world-class** — **zero false positives** on interprocedural taint analysis across 8 languages. The YAML registry rules (context-free regex patterns) have higher FP rates and are being progressively tuned via the new `confidence` and `path_exclude` rule schema features. See [`tools/responsible_disclosure.py`](tools/responsible_disclosure.py) for the automated disclosure pipeline.
+| NVD CVE snippet recall | **100%** (115/115 synthetic cases) |
+| Web-wild recall | **100%** (6/6 vulnerable-by-design apps) |
+| Web-wild F1 | **92.31%** |
+| LLM auto-classification | **95.9%** across 632 findings, 7 languages |
+| Languages | Python · JavaScript · TypeScript · Go · Java · C# |
+
+**Honest note:** CVE snippet benchmarks measure pattern coverage, not real-world field performance. The real-world benchmark data above is the best measure of actual field behavior.
 
 ---
 
 ## Detection Coverage
 
-| Category | CWEs detected | Example |
-|---|---|---|
-| Broken Access Control (IDOR, auth bypass) | CWE-639, CWE-862, CWE-285, CWE-287 | Route missing `@login_required`, no ownership check on DB query |
-| Injection | CWE-89, CWE-78, CWE-94, CWE-95 | SQLi via f-string, command injection via `subprocess(shell=True)`, eval injection |
-| Cryptographic Failures | CWE-327, CWE-328, CWE-798 | MD5/SHA1 for passwords, hardcoded AWS keys, API tokens in source |
-| Path Traversal & SSRF | CWE-22, CWE-918 | Unsanitized `os.path.join`, user-controlled URLs in `requests.get()` |
-| Cross-Site Issues | CWE-79, CWE-352 | `innerHTML` with user data, missing CSRF tokens |
-| Deserialization | CWE-502 | `pickle.loads()` on untrusted input |
-| Open Redirect | CWE-601 | User-controlled `next` parameter in `redirect()` |
-| Log Injection | CWE-117 | Unsanitized user input in log messages |
+| Category | CWEs detected (verified in fresh benchmark) | Example |
+|---|---|---|---|
+| Missing Authentication | CWE-862, CWE-287 | Route missing `@login_required` |
+| IDOR / Broken Access Control | CWE-639, CWE-285 | No ownership check on DB query |
+| Injection (SQL, Command, Eval) | CWE-89, CWE-78, CWE-95, CWE-94 | SQLi via f-string, `subprocess(shell=True)`, eval injection |
 | ReDoS | CWE-1333 | Catastrophic backtracking in regex patterns |
-| And more | 20+ categories | See `ansede-static --list-rules` for the full catalog |
+| Hardcoded Credentials | CWE-798 | API tokens, AWS keys, passwords in source |
+| CSRF | CWE-352 | Missing CSRF tokens on mutating routes |
+| XSS | CWE-79 | `innerHTML` with user data |
+| Path Traversal & SSRF | CWE-22, CWE-918 | Unsanitized `os.path.join`, user-controlled URLs |
+| Open Redirect | CWE-601 | User-controlled `next` in `redirect()` |
+| Deserialization | CWE-502 | `pickle.loads()` on untrusted input |
+| Prototype Pollution | CWE-1321 | Unsafe object merge |
+| Log Injection | CWE-117 | Unsanitized input in log messages |
+| Weak Cryptography | CWE-327, CWE-328 | MD5/SHA1 for passwords |
+| And more | 33+ CWE types detected in one 10-repo run | See `ansede-static --list-rules` |
 
 ---
 
@@ -306,15 +295,17 @@ All confirmed findings were disclosed responsibly via GitHub Issues from `@matty
 
 | | ansede-static | Bandit OSS | Semgrep OSS | CodeQL CLI |
 |---|---|---|---|---|
-| CVE Recall | **98.8%** | ~65% | ~72% | ~88% |
-| FP Rate | **3.6%** | ~45% | ~30% | ~12% |
+| Real repos validated | **35** | 1 (Python only) | Community | Limited |
+| CWE types detected | **33+** in one run | ~10 | ~15-25 | ~25-40 |
+| Interprocedural taint | **Full** | ❌ | ❌ (Pro only) | ✅ |
+| Route/auth analysis | **11 checkers** | ❌ | Basic patterns | Limited |
+| Auto-triage + clustering | **✅ 49% reduction** | ❌ | ❌ | ❌ |
 | Offline (no network) | ✓ | ✓ | ✗ | ✗ |
 | Zero dependencies | ✓ | ✗ | ✗ | ✗ |
 | Single binary (.exe) | ✓ | ✗ | ✗ | ✗ |
-| IDOR / Auth bypass | ✓ | ✗ | Partial | Partial |
+| IDOR / Auth bypass | **✓** | ✗ | Partial | Partial |
 | Languages | 5 | 1 | 20+ | 7 |
 | Install size | <5 MB | ~15 MB | ~200 MB | ~600 MB |
-| Speed (scan_file) | **0.02s/100k LOC** | 0.5s | 3s | 10s |
 
 ---
 

{ansede_static-2.3.0.dev0 → ansede_static-2.3.1}/README.md

@@ -7,8 +7,8 @@
 </p>
 
 <p align="center">
-  <strong>The world's most precise offline static application security testing engine.</strong><br>
-  Zero dependencies. 98.8% CVE recall. Five languages. Ships as a single <code>.exe</code>.
+  <strong>Offline static application security testing engine.</strong><br>
+  Zero dependencies. Real-world validated. 5 languages. LLM-assisted triage. Ships as a single <code>.exe</code>.
 </p>
 
 <p align="center">
@@ -16,8 +16,9 @@
   <a href="https://pypi.org/project/ansede-static/"><img src="https://img.shields.io/pypi/v/ansede-static?label=pypi&color=0078D4" alt="PyPI"></a>
   <a href="https://pypi.org/project/ansede-static/"><img src="https://img.shields.io/pypi/dm/ansede-static?label=downloads&color=107C10" alt="Downloads"></a>
   <a href="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml"><img src="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml/badge.svg?branch=master" alt="CI"></a>
-  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CVE%20Recall-98.8%25-brightgreen" alt="CVE Recall 98.8%"></a>
-  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/FP%20Rate-3.6%25-brightgreen" alt="FP Rate 3.6%"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/Real%20Repos%20Scanned-35-blue" alt="35 real repos scanned"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CWE%20Types-33%2B-yellow" alt="33+ CWE types"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/LLM%20Triage-96%25%20auto-yellowgreen" alt="LLM Auto 96%"></a>
   <a href="https://github.com/mattybellx/Ansede/blob/master/LICENSE"><img src="https://img.shields.io/badge/license-MIT-yellow.svg" alt="License MIT"></a>
   <a href="https://github.com/mattybellx/Ansede/stargazers"><img src="https://img.shields.io/github/stars/mattybellx/Ansede?style=social" alt="Stars"></a>
 </p>
@@ -102,7 +103,7 @@ def delete_post(post_id):
     # no if post.author_id != current_user.id: abort(403)
 ```
 
-**ansede-static models routes, decorators, auth guards, and ownership patterns at the AST level.** This is how it achieves 98.8% CVE recall while Bandit OSS sits at ~65%.
+**ansede-static models routes, decorators, auth guards, and ownership patterns at the AST level.** This is how it catches access-control vulnerabilities that regex-only tools miss.
 
 ---
 
@@ -136,71 +137,59 @@ ansede-static src/ --incremental
 
 ## Verified Performance — May 2026
 
-| Benchmark | Result |
-|---|---|
-| Regression suite | **919 tests passed** |
-| NVD CVE recall | **81/82 (98.78%)** |
-| NVD CVE precision | **96.43%** |
-| False positive rate | **3.57%** |
-| Web-wild recall | **100.00%** |
-| Web-wild precision | **95.00%** |
-| External real-world corpus | **15/15 cases, 30/30 checks (100%)** |
-| Noise quotient | **0.861 findings / kLOC** |
-| Raw engine speed | **~0.02s per 100k LOC** |
-| Languages | Python · JavaScript · TypeScript · Go · Java · C# |
-| World-Best Audit | ✅ All quality gates passed |
+For the full methodology and raw data, see [`BENCHMARKS.md`](BENCHMARKS.md).
 
-Full methodology and machine-readable artifacts: [`BENCHMARKS.md`](BENCHMARKS.md)
+### Real-World Validation — 35 Repos Scanned
 
-### 🌍 Real-World Validation — 21 Repos Scanned
+ansede-static has been run against **35 real open-source repos** totaling over **71 MB of supported source code** across **5 languages**. Every finding was classified by the audit engine.
 
-To validate beyond synthetic benchmarks, ansede-static was run against **21 real production open-source repos** totaling over **2.5 GB of source code** across 8 languages. Every finding was triaged by reading source context to distinguish genuine vulnerabilities from false positives.
+| Metric | 25 Small (≤2MB) | 10 Medium (2-10MB) | **Combined** |
+|---|---|---:|---:|
+| Repos scanned | 25 | 10 | **35** |
+| Zero failures | ✅ | ✅ | **✅ 35/35** |
+| Files scanned | 2,873 | 9,499 | **12,372** |
+| Lines scanned | 333,811 | 1,426,143 | **1,759,954** |
+| Source MB | 12.30 | 58.95 | **71.25 MB** |
+| Total findings | 1,037 | 3,612 | **4,649** |
+| Findings per kLOC | 3.11 | 2.53 | **2.64** |
+| CWE types detected | 25+ | 33 | **35+** |
+| True Positives | — | 11 | **11+** |
+| NEEDS_REVIEW | — | 1,224 | **1,224+** |
 
-| Metric | Result |
+**Top CWEs detected across all repos:** CWE-862 (missing auth), CWE-1333 (ReDoS), CWE-798 (hardcoded creds), CWE-352 (CSRF), CWE-95 (eval injection), CWE-79 (XSS), CWE-89 (SQLi).
+
+### Synthetic Benchmarks
+
+| Benchmark | Result |
 |---|---|
-| **Repos scanned** | 21 (GitHub popular repos) |
-| **Total findings** | 1,032 |
-| **Confirmed real vulnerabilities** | **62** |
-| **Structural engine FP rate** | **0%** (zero false positives on taint findings) |
-| **Languages** | Python, JavaScript, TypeScript, Java, C#, Go, Ruby, PHP |
-| FP rate (YAML rules) | ~54% (context-free regex patterns — improved with confidence + path_exclude) |
-| **FP reductions applied** | −81% (59% → ~11% via confidence tuning + exclusions + path_exclude) |
-
-**Key real-world discoveries:**
-
-| Repo | Stars | Confirmed Vulns | Types Found |
-|------|-------|----------------|-------------|
-| **uptime-kuma** | ⭐ 60k | **16** 🔥 | Path traversal, SSRF, XSS, code injection |
-| **pocketbase** | ⭐ 42k | **11** 🔥 | SQLi, path traversal, SSRF, command injection |
-| **hoppscotch** | ⭐ 68k | **9** 🔥 | XSS, SQLi in OAuth, path traversal |
-| **dashy** | ⭐ 20k | **7** | Dynamic require, path traversal, SSRF |
-| **speedtest** | ⭐ 14k | **6** | Path traversal, open redirect, SSRF |
-| **stackedit** | ⭐ 22k | **2** | Open redirect, eval injection |
-| **docuseal** | — | **2** | XSS, SSRF |
-| **appwrite** | ⭐ 37k | **1** | Path traversal |
-| **linkding** | — | **1** | SQL injection |
-| NodeGoat, dvna | — | 7 | Validation targets |
-
-All confirmed findings were disclosed responsibly via GitHub Issues from `@mattybellx`.
-
-> **Verdict:** The structural taint engine is genuinely **world-class** — **zero false positives** on interprocedural taint analysis across 8 languages. The YAML registry rules (context-free regex patterns) have higher FP rates and are being progressively tuned via the new `confidence` and `path_exclude` rule schema features. See [`tools/responsible_disclosure.py`](tools/responsible_disclosure.py) for the automated disclosure pipeline.
+| NVD CVE snippet recall | **100%** (115/115 synthetic cases) |
+| Web-wild recall | **100%** (6/6 vulnerable-by-design apps) |
+| Web-wild F1 | **92.31%** |
+| LLM auto-classification | **95.9%** across 632 findings, 7 languages |
+| Languages | Python · JavaScript · TypeScript · Go · Java · C# |
+
+**Honest note:** CVE snippet benchmarks measure pattern coverage, not real-world field performance. The real-world benchmark data above is the best measure of actual field behavior.
 
 ---
 
 ## Detection Coverage
 
-| Category | CWEs detected | Example |
-|---|---|---|
-| Broken Access Control (IDOR, auth bypass) | CWE-639, CWE-862, CWE-285, CWE-287 | Route missing `@login_required`, no ownership check on DB query |
-| Injection | CWE-89, CWE-78, CWE-94, CWE-95 | SQLi via f-string, command injection via `subprocess(shell=True)`, eval injection |
-| Cryptographic Failures | CWE-327, CWE-328, CWE-798 | MD5/SHA1 for passwords, hardcoded AWS keys, API tokens in source |
-| Path Traversal & SSRF | CWE-22, CWE-918 | Unsanitized `os.path.join`, user-controlled URLs in `requests.get()` |
-| Cross-Site Issues | CWE-79, CWE-352 | `innerHTML` with user data, missing CSRF tokens |
-| Deserialization | CWE-502 | `pickle.loads()` on untrusted input |
-| Open Redirect | CWE-601 | User-controlled `next` parameter in `redirect()` |
-| Log Injection | CWE-117 | Unsanitized user input in log messages |
+| Category | CWEs detected (verified in fresh benchmark) | Example |
+|---|---|---|---|
+| Missing Authentication | CWE-862, CWE-287 | Route missing `@login_required` |
+| IDOR / Broken Access Control | CWE-639, CWE-285 | No ownership check on DB query |
+| Injection (SQL, Command, Eval) | CWE-89, CWE-78, CWE-95, CWE-94 | SQLi via f-string, `subprocess(shell=True)`, eval injection |
 | ReDoS | CWE-1333 | Catastrophic backtracking in regex patterns |
-| And more | 20+ categories | See `ansede-static --list-rules` for the full catalog |
+| Hardcoded Credentials | CWE-798 | API tokens, AWS keys, passwords in source |
+| CSRF | CWE-352 | Missing CSRF tokens on mutating routes |
+| XSS | CWE-79 | `innerHTML` with user data |
+| Path Traversal & SSRF | CWE-22, CWE-918 | Unsanitized `os.path.join`, user-controlled URLs |
+| Open Redirect | CWE-601 | User-controlled `next` in `redirect()` |
+| Deserialization | CWE-502 | `pickle.loads()` on untrusted input |
+| Prototype Pollution | CWE-1321 | Unsafe object merge |
+| Log Injection | CWE-117 | Unsanitized input in log messages |
+| Weak Cryptography | CWE-327, CWE-328 | MD5/SHA1 for passwords |
+| And more | 33+ CWE types detected in one 10-repo run | See `ansede-static --list-rules` |
 
 ---
 
@@ -258,15 +247,17 @@ All confirmed findings were disclosed responsibly via GitHub Issues from `@matty
 
 | | ansede-static | Bandit OSS | Semgrep OSS | CodeQL CLI |
 |---|---|---|---|---|
-| CVE Recall | **98.8%** | ~65% | ~72% | ~88% |
-| FP Rate | **3.6%** | ~45% | ~30% | ~12% |
+| Real repos validated | **35** | 1 (Python only) | Community | Limited |
+| CWE types detected | **33+** in one run | ~10 | ~15-25 | ~25-40 |
+| Interprocedural taint | **Full** | ❌ | ❌ (Pro only) | ✅ |
+| Route/auth analysis | **11 checkers** | ❌ | Basic patterns | Limited |
+| Auto-triage + clustering | **✅ 49% reduction** | ❌ | ❌ | ❌ |
 | Offline (no network) | ✓ | ✓ | ✗ | ✗ |
 | Zero dependencies | ✓ | ✗ | ✗ | ✗ |
 | Single binary (.exe) | ✓ | ✗ | ✗ | ✗ |
-| IDOR / Auth bypass | ✓ | ✗ | Partial | Partial |
+| IDOR / Auth bypass | **✓** | ✗ | Partial | Partial |
 | Languages | 5 | 1 | 20+ | 7 |
 | Install size | <5 MB | ~15 MB | ~200 MB | ~600 MB |
-| Speed (scan_file) | **0.02s/100k LOC** | 0.5s | 3s | 10s |
 
 ---
 

{ansede_static-2.3.0.dev0 → ansede_static-2.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ansede-static"
-version = "2.3.0-dev"
+version = "2.3.1"
 description = "AST-based SAST for Python and JavaScript — detects IDOR, auth bypass, and ownership flaws that Bandit misses."
 readme = "README.md"
 license = "MIT"

{ansede_static-2.3.0.dev0 → ansede_static-2.3.1}/src/ansede_static/__init__.py

@@ -20,7 +20,9 @@ from ansede_static.python_analyzer import analyze_python, analyze_file as _py_fi
 from ansede_static.js_engine.backends import list_js_backends, run_js_analysis
 from ansede_static import yaml_rules as _yaml_rules
 
+from functools import lru_cache
 from pathlib import Path
+from types import SimpleNamespace
 
 
 __all__ = [
@@ -46,6 +48,65 @@ _RUBY_EXTS = frozenset({".rb", ".rake", ".gemspec"})
 _PHP_EXTS = frozenset({".php", ".phtml", ".php3", ".php4", ".php5", ".php7", ".phps"})
 
 
+def _rule_mtime(path: Path) -> int:
+    try:
+        return path.stat().st_mtime_ns
+    except OSError:
+        return -1
+
+
+def _community_rules_token() -> tuple[tuple[str, int], ...]:
+    try:
+        rule_dir = Path(_yaml_rules.default_community_rules_dir()).resolve(strict=False)
+    except (OSError, TypeError, ValueError):
+        return tuple()
+
+    if not rule_dir.is_dir():
+        return tuple()
+
+    entries: list[tuple[str, int]] = []
+    for child in sorted(rule_dir.iterdir()):
+        if child.is_file() and child.suffix.lower() in {".yaml", ".yml", ".json"}:
+            entries.append((str(child.resolve(strict=False)), _rule_mtime(child)))
+    return tuple(entries)
+
+
+@lru_cache(maxsize=64)
+def _load_runtime_rules_cached(
+    workspace_root: str,
+    custom_rules_file: str,
+    custom_rules_mtime: int,
+    community_rules_token: tuple[tuple[str, int], ...],
+) -> tuple[object, ...]:
+    config_stub = SimpleNamespace(custom_rules_file=custom_rules_file) if custom_rules_file else None
+    return tuple(_yaml_rules.load_runtime_rules(config=config_stub, workspace_root=Path(workspace_root)))
+
+
+def _get_runtime_rules(
+    config: AnsedeConfig | None,
+    *,
+    workspace_root: Path,
+) -> list[object]:
+    resolved_root = str(workspace_root.resolve(strict=False))
+    custom_rules_file = str(getattr(config, "custom_rules_file", "") or "").strip() if config else ""
+    custom_rules_path = ""
+    custom_rules_mtime = -1
+    if custom_rules_file:
+        custom_path = Path(custom_rules_file)
+        if not custom_path.is_absolute():
+            custom_path = (workspace_root / custom_path).resolve(strict=False)
+        custom_rules_path = str(custom_path)
+        custom_rules_mtime = _rule_mtime(custom_path)
+    return list(
+        _load_runtime_rules_cached(
+            resolved_root,
+            custom_rules_path,
+            custom_rules_mtime,
+            _community_rules_token(),
+        )
+    )
+
+
 def _apply_runtime_and_registry_rules(
     code: str,
     *,
@@ -89,13 +150,10 @@ def scan_file(
     """
     p = Path(path)
     ext = p.suffix.lower()
-    runtime_rules = _yaml_rules.load_runtime_rules(config=config, workspace_root=Path.cwd())
+    runtime_rules = _get_runtime_rules(config, workspace_root=Path.cwd())
     code = p.read_text(encoding="utf-8", errors="replace")
 
     # Create a shared GlobalGraph for IFDS-based interprocedural taint transfer.
-    # Both Python and JS analyzers feed summaries into it and query it during
-    # helper-call resolution, giving JS the same IDE-lattice-powered cross-file
-    # taint tracking that Python already uses.
     try:
         from ansede_static.ir.global_graph import GlobalGraph  # noqa: PLC0415
         shared_graph = GlobalGraph()
@@ -152,7 +210,7 @@ def scan_code(
     Raises:
         ValueError: if language is not supported.
     """
-    runtime_rules = _yaml_rules.load_runtime_rules(config=config, workspace_root=Path.cwd())
+    runtime_rules = _get_runtime_rules(config, workspace_root=Path.cwd())
     with temporary_analyzer_config(config):
         if language == "python":
             result = analyze_python(code, filename=filename)