@hoanghainh/komagu 2.0.0 → 2.0.1

package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/ai-run-stats.json

@@ -0,0 +1,58 @@
+{
+  "model": "gpt-oss:20b",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 58.352,
+      "calls": 1,
+      "prompt_tokens": 3118,
+      "completion_tokens": 2576
+    },
+    "3-route-mapper": {
+      "seconds": 0.009,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 1052.622,
+      "calls": 6,
+      "prompt_tokens": 49349,
+      "completion_tokens": 36984
+    },
+    "4b-injection-auditor": {
+      "seconds": 1258.593,
+      "calls": 2,
+      "prompt_tokens": 15801,
+      "completion_tokens": 44405
+    },
+    "4c-privilege-auditor": {
+      "seconds": 489.26,
+      "calls": 2,
+      "prompt_tokens": 17690,
+      "completion_tokens": 16881
+    },
+    "5-finding-verifier": {
+      "seconds": 1971.769,
+      "calls": 11,
+      "prompt_tokens": 53067,
+      "completion_tokens": 71282
+    }
+  },
+  "totals": {
+    "calls": 22,
+    "prompt_tokens": 139025,
+    "completion_tokens": 172128,
+    "seconds": 4830.395
+  },
+  "parse_failures": {
+    "4b-injection-auditor": [
+      "injection-002"
+    ],
+    "5-finding-verifier": [
+      "verified-2",
+      "verified-10"
+    ]
+  },
+  "call_errors": {}
+}

package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/coverage.json

@@ -0,0 +1,85 @@
+{
+  "route_candidates": 74,
+  "inventoried": 74,
+  "rejected": 0,
+  "missing_from_inventory": [],
+  "bola_routes_to_audit": 74,
+  "bola_routes_without_verdict": [],
+  "bfla_routes_to_audit": 0,
+  "bfla_routes_without_verdict": [],
+  "injection_candidates": 38,
+  "injection_candidates_without_verdict": [
+    "I-0008",
+    "I-0015",
+    "I-0018",
+    "I-0019",
+    "I-0026",
+    "I-0031",
+    "I-0032",
+    "I-0033",
+    "I-0034",
+    "I-0035",
+    "I-0036",
+    "I-0037",
+    "I-0038"
+  ],
+  "mass_candidates": 15,
+  "mass_candidates_without_verdict": [],
+  "findings_without_verification": [
+    "BOLA-R-0001-1",
+    "BOLA-R-0015-1",
+    "BOLA-R-0017-1",
+    "BOLA-R-0018-1",
+    "BOLA-R-0019-1",
+    "BOLA-R-0020",
+    "BOLA-R-0021",
+    "BOLA-R-0022",
+    "BOLA-R-0023",
+    "BOLA-R-0025",
+    "MASS-0012-1"
+  ],
+  "duplicates_removed": [
+    {
+      "kept": "INJ-I-0004-1",
+      "dropped": "INJ-I-0007-1"
+    },
+    {
+      "kept": "INJ-I-0011-2",
+      "dropped": "INJ-I-0012-1"
+    },
+    {
+      "kept": "INJ-I-0011-3",
+      "dropped": "INJ-I-0013-1"
+    },
+    {
+      "kept": "INJ-I-0020-3",
+      "dropped": "INJ-I-0021-1"
+    },
+    {
+      "kept": "INJ-I-0020-4",
+      "dropped": "INJ-I-0022-1"
+    },
+    {
+      "kept": "INJ-I-0020-2",
+      "dropped": "INJ-I-0023-1"
+    },
+    {
+      "kept": "INJ-I-0024-2",
+      "dropped": "INJ-I-0025-1"
+    }
+  ],
+  "validation_errors": [
+    "priv-privilege-001.json:MASS-0003-1: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "priv-privilege-001.json:MASS-0004-1: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "priv-privilege-001.json:MASS-0005-1: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "priv-privilege-002.json:MASS-M-0006-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0007-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0008-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0009-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0010-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0015-1: impact: expected ['string'], got list",
+    "priv-privilege-002.json:MASS-M-0014-1: impact: expected ['string'], got list"
+  ],
+  "new_issues_from_verifier": [],
+  "out_of_scope_notes": []
+}