@hoanghainh/komagu 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (143) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/README.md +1 -1
  3. package/assess/lsa/examples/eval-run-4/ground-truth.json +823 -0
  4. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/ai-run-stats.json +58 -0
  5. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/coverage.json +85 -0
  6. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/findings/priv-privilege-001.json +822 -0
  7. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/findings/priv-privilege-002.json +393 -0
  8. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/findings.json +4477 -0
  9. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/mass-assignment.candidates.json +232 -0
  10. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-001.json +425 -0
  11. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-002.json +333 -0
  12. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-003.json +400 -0
  13. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-004.json +403 -0
  14. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-005.json +398 -0
  15. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/routes/routes-006.json +63 -0
  16. package/assess/lsa/examples/eval-run-4/iter0-gptoss-a/score.json +120 -0
  17. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/ai-run-stats.json +55 -0
  18. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/coverage.json +50 -0
  19. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/findings/priv-privilege-001.json +613 -0
  20. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/findings/priv-privilege-002.json +287 -0
  21. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/findings.json +4870 -0
  22. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/mass-assignment.candidates.json +232 -0
  23. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-001.json +425 -0
  24. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-002.json +333 -0
  25. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-003.json +400 -0
  26. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-004.json +403 -0
  27. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-005.json +398 -0
  28. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/routes/routes-006.json +63 -0
  29. package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/score.json +107 -0
  30. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/ai-run-stats.json +58 -0
  31. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/coverage.json +92 -0
  32. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/findings/priv-privilege-001.json +645 -0
  33. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/findings/priv-privilege-002.json +222 -0
  34. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/findings.json +4859 -0
  35. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/mass-assignment.candidates.json +232 -0
  36. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-001.json +425 -0
  37. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-002.json +333 -0
  38. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-003.json +400 -0
  39. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-004.json +403 -0
  40. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-005.json +398 -0
  41. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-006.json +63 -0
  42. package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/score.json +121 -0
  43. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/coverage.json +111 -0
  44. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/findings/priv-privilege-001.json +6 -0
  45. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/findings/priv-privilege-002.json +344 -0
  46. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/findings.json +3544 -0
  47. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/mass-assignment.candidates.json +232 -0
  48. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-001.json +425 -0
  49. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-002.json +333 -0
  50. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-003.json +400 -0
  51. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-004.json +403 -0
  52. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-005.json +398 -0
  53. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/routes/routes-006.json +63 -0
  54. package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/score.json +123 -0
  55. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/ai-run-stats.json +50 -0
  56. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/coverage.json +42 -0
  57. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/findings/priv-privilege-001.json +540 -0
  58. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/findings/priv-privilege-002.json +238 -0
  59. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/findings.json +4383 -0
  60. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/findings.sarif +8729 -0
  61. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/mass-assignment.candidates.json +232 -0
  62. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/report.ja.md +1911 -0
  63. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/report.md +1911 -0
  64. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-001.json +425 -0
  65. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-002.json +333 -0
  66. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-003.json +400 -0
  67. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-004.json +403 -0
  68. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-005.json +398 -0
  69. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/routes/routes-006.json +63 -0
  70. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/score.json +101 -0
  71. package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/stack-profile.json +226 -0
  72. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/ai-run-stats.json +54 -0
  73. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/coverage.json +66 -0
  74. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/findings/priv-privilege-001.json +440 -0
  75. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/findings/priv-privilege-002.json +229 -0
  76. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/findings.json +3424 -0
  77. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/mass-assignment.candidates.json +232 -0
  78. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-001.json +425 -0
  79. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-002.json +333 -0
  80. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-003.json +400 -0
  81. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-004.json +403 -0
  82. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-005.json +398 -0
  83. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/routes/routes-006.json +63 -0
  84. package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/score.json +120 -0
  85. package/assess/lsa/examples/eval-run-5/gptoss-a/ai-run-stats.json +88 -0
  86. package/assess/lsa/examples/eval-run-5/gptoss-a/coverage.json +36 -0
  87. package/assess/lsa/examples/eval-run-5/gptoss-a/findings/priv-privilege-001.json +530 -0
  88. package/assess/lsa/examples/eval-run-5/gptoss-a/findings/priv-privilege-002.json +248 -0
  89. package/assess/lsa/examples/eval-run-5/gptoss-a/findings.json +4766 -0
  90. package/assess/lsa/examples/eval-run-5/gptoss-a/findings.sarif +9326 -0
  91. package/assess/lsa/examples/eval-run-5/gptoss-a/mass-assignment.candidates.json +232 -0
  92. package/assess/lsa/examples/eval-run-5/gptoss-a/report.ja.md +2011 -0
  93. package/assess/lsa/examples/eval-run-5/gptoss-a/report.md +2011 -0
  94. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-001.json +425 -0
  95. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-002.json +333 -0
  96. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-003.json +400 -0
  97. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-004.json +403 -0
  98. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-005.json +398 -0
  99. package/assess/lsa/examples/eval-run-5/gptoss-a/routes/routes-006.json +63 -0
  100. package/assess/lsa/examples/eval-run-5/gptoss-a/score.json +80 -0
  101. package/assess/lsa/examples/eval-run-5/gptoss-a/stack-profile.json +226 -0
  102. package/assess/lsa/examples/eval-run-5/gptoss-b/ai-run-stats.json +83 -0
  103. package/assess/lsa/examples/eval-run-5/gptoss-b/coverage.json +44 -0
  104. package/assess/lsa/examples/eval-run-5/gptoss-b/findings/priv-privilege-001.json +579 -0
  105. package/assess/lsa/examples/eval-run-5/gptoss-b/findings/priv-privilege-002.json +268 -0
  106. package/assess/lsa/examples/eval-run-5/gptoss-b/findings.json +3913 -0
  107. package/assess/lsa/examples/eval-run-5/gptoss-b/mass-assignment.candidates.json +232 -0
  108. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-001.json +425 -0
  109. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-002.json +333 -0
  110. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-003.json +400 -0
  111. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-004.json +403 -0
  112. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-005.json +398 -0
  113. package/assess/lsa/examples/eval-run-5/gptoss-b/routes/routes-006.json +63 -0
  114. package/assess/lsa/examples/eval-run-5/gptoss-b/score.json +94 -0
  115. package/assess/lsa/examples/eval-run-5/ground-truth.json +823 -0
  116. package/assess/lsa/knowledge/injection-patterns.md +8 -1
  117. package/assess/lsa/knowledge/stacks/nextjs.md +62 -0
  118. package/assess/lsa/prompts/35-privilege-auditor.md +3 -1
  119. package/assess/lsa/prompts/_shared-rules.md +1 -0
  120. package/assess/lsa/scripts/detect_stack.py +5 -1
  121. package/assess/lsa/scripts/find_injection.py +34 -5
  122. package/assess/lsa/scripts/lsa_common.py +9 -2
  123. package/assess/lsa/scripts/make_batches.py +2 -1
  124. package/assess/lsa/scripts/map_routes.py +10 -2
  125. package/assess/lsa/scripts/nextjs_routes.py +236 -0
  126. package/assess/lsa/templates/audit-config.json +1 -1
  127. package/assess/lsa/tests/EVAL-RESULTS.md +156 -0
  128. package/assess/lsa/tests/score_findings.py +58 -0
  129. package/assess/lsa/tests/test_default_scope.py +86 -0
  130. package/assess/lsa/tests/test_eval_run_4.py +73 -0
  131. package/assess/lsa/tests/test_eval_run_5.py +73 -0
  132. package/assess/lsa/tests/test_js_tagged_sql.py +112 -0
  133. package/assess/lsa/tests/test_nextjs.py +198 -0
  134. package/assess/lsa/tests/test_privilege_tier2.py +30 -0
  135. package/operate/ai/anchoring.py +130 -0
  136. package/operate/ai/client.py +13 -0
  137. package/operate/ai/context.py +105 -0
  138. package/operate/ai/runner.py +197 -69
  139. package/operate/cli/__init__.py +1 -1
  140. package/operate/cli/commands/scan.py +1 -1
  141. package/operate/tests/test_ai_anchoring.py +184 -0
  142. package/operate/tests/test_headless_ai.py +148 -1
  143. package/package.json +1 -1
@@ -0,0 +1,333 @@
1
+ {
2
+ "routes": [
3
+ {
4
+ "route_id": "R-0020",
5
+ "method": [
6
+ "POST"
7
+ ],
8
+ "path": "/account/save",
9
+ "path_source": "declared",
10
+ "handler": {
11
+ "file": "java-legacy/src/com/acme/web/AccountController.java",
12
+ "line": 13
13
+ },
14
+ "id_inputs": [
15
+ {
16
+ "name": "id",
17
+ "source": "path"
18
+ }
19
+ ],
20
+ "guards": [],
21
+ "data_ops": [
22
+ {
23
+ "op": "read"
24
+ }
25
+ ],
26
+ "needs_bola_audit": true
27
+ },
28
+ {
29
+ "route_id": "R-0021",
30
+ "method": [
31
+ "POST"
32
+ ],
33
+ "path": "/account/rename",
34
+ "path_source": "declared",
35
+ "handler": {
36
+ "file": "java-legacy/src/com/acme/web/AccountController.java",
37
+ "line": 19
38
+ },
39
+ "id_inputs": [
40
+ {
41
+ "name": "id",
42
+ "source": "path"
43
+ }
44
+ ],
45
+ "guards": [],
46
+ "data_ops": [
47
+ {
48
+ "op": "read"
49
+ }
50
+ ],
51
+ "needs_bola_audit": true
52
+ },
53
+ {
54
+ "route_id": "R-0022",
55
+ "method": [
56
+ "PUT"
57
+ ],
58
+ "path": "/account/api",
59
+ "path_source": "declared",
60
+ "handler": {
61
+ "file": "java-legacy/src/com/acme/web/AccountController.java",
62
+ "line": 25
63
+ },
64
+ "id_inputs": [
65
+ {
66
+ "name": "id",
67
+ "source": "path"
68
+ }
69
+ ],
70
+ "guards": [],
71
+ "data_ops": [
72
+ {
73
+ "op": "read"
74
+ }
75
+ ],
76
+ "needs_bola_audit": true
77
+ },
78
+ {
79
+ "route_id": "R-0023",
80
+ "method": [
81
+ "POST"
82
+ ],
83
+ "path": "/admin/users/{id}/delete",
84
+ "path_source": "declared",
85
+ "handler": {
86
+ "file": "java-legacy/src/com/acme/web/AdminUserController.java",
87
+ "line": 13
88
+ },
89
+ "id_inputs": [
90
+ {
91
+ "name": "id",
92
+ "source": "path"
93
+ },
94
+ {
95
+ "name": "id",
96
+ "source": "path"
97
+ }
98
+ ],
99
+ "guards": [],
100
+ "data_ops": [
101
+ {
102
+ "op": "read"
103
+ }
104
+ ],
105
+ "needs_bola_audit": true
106
+ },
107
+ {
108
+ "route_id": "R-0024",
109
+ "method": [
110
+ "POST"
111
+ ],
112
+ "path": "/admin/users/{id}/role",
113
+ "path_source": "declared",
114
+ "handler": {
115
+ "file": "java-legacy/src/com/acme/web/AdminUserController.java",
116
+ "line": 20
117
+ },
118
+ "id_inputs": [
119
+ {
120
+ "name": "id",
121
+ "source": "path"
122
+ },
123
+ {
124
+ "name": "role",
125
+ "source": "query"
126
+ },
127
+ {
128
+ "name": "id",
129
+ "source": "path"
130
+ }
131
+ ],
132
+ "guards": [],
133
+ "data_ops": [
134
+ {
135
+ "op": "read"
136
+ }
137
+ ],
138
+ "needs_bola_audit": true
139
+ },
140
+ {
141
+ "route_id": "R-0025",
142
+ "method": [
143
+ "GET"
144
+ ],
145
+ "path": "/invoices/{id}",
146
+ "path_source": "declared",
147
+ "handler": {
148
+ "file": "java-legacy/src/com/acme/web/InvoiceController.java",
149
+ "line": 15
150
+ },
151
+ "id_inputs": [
152
+ {
153
+ "name": "id",
154
+ "source": "path"
155
+ },
156
+ {
157
+ "name": "id",
158
+ "source": "path"
159
+ }
160
+ ],
161
+ "guards": [],
162
+ "data_ops": [
163
+ {
164
+ "op": "read"
165
+ }
166
+ ],
167
+ "needs_bola_audit": true
168
+ },
169
+ {
170
+ "route_id": "R-0026",
171
+ "method": [
172
+ "GET"
173
+ ],
174
+ "path": "/invoices/mine/{id}",
175
+ "path_source": "declared",
176
+ "handler": {
177
+ "file": "java-legacy/src/com/acme/web/InvoiceController.java",
178
+ "line": 21
179
+ },
180
+ "id_inputs": [
181
+ {
182
+ "name": "id",
183
+ "source": "path"
184
+ },
185
+ {
186
+ "name": "id",
187
+ "source": "path"
188
+ }
189
+ ],
190
+ "guards": [],
191
+ "data_ops": [
192
+ {
193
+ "op": "read"
194
+ }
195
+ ],
196
+ "needs_bola_audit": true
197
+ },
198
+ {
199
+ "route_id": "R-0027",
200
+ "method": [
201
+ "GET"
202
+ ],
203
+ "path": "/invoices/search",
204
+ "path_source": "declared",
205
+ "handler": {
206
+ "file": "java-legacy/src/com/acme/web/InvoiceController.java",
207
+ "line": 27
208
+ },
209
+ "id_inputs": [
210
+ {
211
+ "name": "customer",
212
+ "source": "query"
213
+ }
214
+ ],
215
+ "guards": [],
216
+ "data_ops": [
217
+ {
218
+ "op": "read"
219
+ }
220
+ ],
221
+ "needs_bola_audit": true
222
+ },
223
+ {
224
+ "route_id": "R-0028",
225
+ "method": [
226
+ "GET"
227
+ ],
228
+ "path": "/order/view",
229
+ "path_source": "declared",
230
+ "handler": {
231
+ "file": "java-legacy/src/com/acme/web/OrderServlet.java",
232
+ "line": 8
233
+ },
234
+ "id_inputs": [
235
+ {
236
+ "name": "orderId",
237
+ "source": "any"
238
+ }
239
+ ],
240
+ "guards": [],
241
+ "data_ops": [
242
+ {
243
+ "op": "read"
244
+ }
245
+ ],
246
+ "needs_bola_audit": true
247
+ },
248
+ {
249
+ "route_id": "R-0030",
250
+ "method": [
251
+ "POST"
252
+ ],
253
+ "path": "/admin/users/:id/delete",
254
+ "path_source": "declared",
255
+ "handler": {
256
+ "file": "node-express/routes/admin.js",
257
+ "line": 8
258
+ },
259
+ "id_inputs": [
260
+ {
261
+ "name": "id",
262
+ "source": "path"
263
+ },
264
+ {
265
+ "name": "id",
266
+ "source": "path"
267
+ }
268
+ ],
269
+ "guards": [],
270
+ "data_ops": [
271
+ {
272
+ "op": "read"
273
+ }
274
+ ],
275
+ "needs_bola_audit": true
276
+ },
277
+ {
278
+ "route_id": "R-0031",
279
+ "method": [
280
+ "POST"
281
+ ],
282
+ "path": "/admin/users/:id/ban",
283
+ "path_source": "declared",
284
+ "handler": {
285
+ "file": "node-express/routes/admin.js",
286
+ "line": 12
287
+ },
288
+ "id_inputs": [
289
+ {
290
+ "name": "id",
291
+ "source": "path"
292
+ },
293
+ {
294
+ "name": "id",
295
+ "source": "path"
296
+ }
297
+ ],
298
+ "guards": [],
299
+ "data_ops": [
300
+ {
301
+ "op": "read"
302
+ }
303
+ ],
304
+ "needs_bola_audit": true
305
+ },
306
+ {
307
+ "route_id": "R-0032",
308
+ "method": [
309
+ "GET"
310
+ ],
311
+ "path": "/reports/export",
312
+ "path_source": "declared",
313
+ "handler": {
314
+ "file": "node-express/routes/admin.js",
315
+ "line": 16
316
+ },
317
+ "id_inputs": [
318
+ {
319
+ "name": "isAdmin",
320
+ "source": "query"
321
+ }
322
+ ],
323
+ "guards": [],
324
+ "data_ops": [
325
+ {
326
+ "op": "read"
327
+ }
328
+ ],
329
+ "needs_bola_audit": true
330
+ }
331
+ ],
332
+ "rejected": []
333
+ }