@hoanghainh/komagu 2.0.0 → 2.1.0

package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-005.json

@@ -0,0 +1,398 @@
+{
+  "routes": [
+    {
+      "route_id": "R-0072",
+      "method": [
+        "POST"
+      ],
+      "path": "/users",
+      "path_source": "declared",
+      "handler": {
+        "file": "python-flask/profile.py",
+        "line": 8
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0073",
+      "method": [
+        "POST"
+      ],
+      "path": "/users/<int:uid>/name",
+      "path_source": "declared",
+      "handler": {
+        "file": "python-flask/profile.py",
+        "line": 16
+      },
+      "id_inputs": [
+        {
+          "name": "uid",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0074",
+      "method": [
+        "PATCH"
+      ],
+      "path": "/users/<int:uid>",
+      "path_source": "declared",
+      "handler": {
+        "file": "python-flask/profile.py",
+        "line": 24
+      },
+      "id_inputs": [
+        {
+          "name": "uid",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0010",
+      "method": [
+        "POST"
+      ],
+      "path": "/Customer/Edit",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "line": 12
+      },
+      "id_inputs": [
+        {
+          "name": "customer",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0011",
+      "method": [
+        "POST",
+        "POST"
+      ],
+      "path": "/Customer/EditName",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "line": 20
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0012",
+      "method": [
+        "POST",
+        "POST"
+      ],
+      "path": "/Customer/Refresh",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "line": 27
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0016",
+      "method": [
+        "ANY"
+      ],
+      "path": "/dotnet-legacy/Web/Handlers/GetFile.ashx",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Handlers/GetFile.ashx",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "file_id",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0029",
+      "method": [
+        "POST"
+      ],
+      "path": "<see web.xml servlet-mapping>",
+      "path_source": "declared",
+      "handler": {
+        "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+        "line": 9
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0039",
+      "method": [
+        "PUT"
+      ],
+      "path": "/profile",
+      "path_source": "declared",
+      "handler": {
+        "file": "node-express/routes/profile.js",
+        "line": 7
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0040",
+      "method": [
+        "PUT"
+      ],
+      "path": "/profile/name",
+      "path_source": "declared",
+      "handler": {
+        "file": "node-express/routes/profile.js",
+        "line": 11
+      },
+      "id_inputs": [
+        {
+          "name": "name",
+          "source": "body"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0041",
+      "method": [
+        "POST"
+      ],
+      "path": "/signup",
+      "path_source": "declared",
+      "handler": {
+        "file": "node-express/routes/profile.js",
+        "line": 15
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0042",
+      "method": [
+        "POST"
+      ],
+      "path": "/profile/settings",
+      "path_source": "declared",
+      "handler": {
+        "file": "node-express/routes/profile.js",
+        "line": 20
+      },
+      "id_inputs": [
+        {
+          "name": "theme",
+          "source": "body"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0063",
+      "method": [
+        "POST"
+      ],
+      "path": "/php-plain/profile.php",
+      "path_source": "declared",
+      "handler": {
+        "file": "php-plain/profile.php",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "nickname",
+          "source": "form"
+        },
+        {
+          "name": "role",
+          "source": "form"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0068",
+      "method": [
+        "POST"
+      ],
+      "path": "/php-plain/admin/settings.php",
+      "path_source": "declared",
+      "handler": {
+        "file": "php-plain/admin/settings.php",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "value",
+          "source": "form"
+        },
+        {
+          "name": "name",
+          "source": "form"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0060",
+      "method": [
+        "GET"
+      ],
+      "path": "/php-plain/mongo_find.php",
+      "path_source": "declared",
+      "handler": {
+        "file": "php-plain/mongo_find.php",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "login",
+          "source": "query"
+        },
+        {
+          "name": "pass",
+          "source": "query"
+        },
+        {
+          "name": "n",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    }
+  ],
+  "rejected": []
+}

package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/routes/routes-006.json

@@ -0,0 +1,63 @@
+{
+  "routes": [
+    {
+      "route_id": "R-0064",
+      "method": [
+        "ANY"
+      ],
+      "path": "/php-plain/register.php",
+      "path_source": "declared",
+      "handler": {
+        "file": "php-plain/register.php",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "path"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0065",
+      "method": [
+        "GET"
+      ],
+      "path": "/php-plain/search.php",
+      "path_source": "declared",
+      "handler": {
+        "file": "php-plain/search.php",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "q",
+          "source": "query"
+        },
+        {
+          "name": "sort",
+          "source": "query"
+        },
+        {
+          "name": "cat",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    }
+  ],
+  "rejected": []
+}

package/assess/lsa/examples/eval-run-4/iter1-gptoss-b/score.json

@@ -0,0 +1,121 @@
+{
+  "per_category": {
+    "bola": {
+      "truth_vulnerable": 25,
+      "found": 19,
+      "recall": 0.76,
+      "false_positive_on_safe_code": [],
+      "missed": [
+        "php-plain/admin.php:8",
+        "php-plain/admin.php:12",
+        "php-plain/order_detail.php:6",
+        "java-legacy/src/com/acme/web/OrderServlet.java:15",
+        "perl-cgi/cgi-bin/order.cgi:19",
+        "python-flask/app.py:12"
+      ]
+    },
+    "injection": {
+      "truth_vulnerable": 34,
+      "found": 28,
+      "recall": 0.824,
+      "false_positive_on_safe_code": [
+        "python-flask/app.py:12"
+      ],
+      "missed": [
+        "classic-asp/shop/member.asp:7",
+        "classic-asp/shop/member.asp:10",
+        "classic-asp/shop/order.asp:6",
+        "node-express/routes/orders.js:21",
+        "node-express/routes/orders.js:25",
+        "node-express/routes/orders.js:29"
+      ]
+    },
+    "bfla": {
+      "truth_vulnerable": 10,
+      "found": 5,
+      "recall": 0.5,
+      "false_positive_on_safe_code": [],
+      "missed": [
+        "java-legacy/src/com/acme/web/AdminUserController.java:15",
+        "dotnet-legacy/Web/Controllers/AdminController.cs:15",
+        "dotnet-legacy/Web/Controllers/AdminController.cs:32",
+        "node-express/routes/admin.js:9",
+        "node-express/routes/admin.js:17"
+      ]
+    },
+    "mass_assignment": {
+      "truth_vulnerable": 15,
+      "found": 5,
+      "recall": 0.333,
+      "false_positive_on_safe_code": [],
+      "missed": [
+        "php-plain/register.php:4",
+        "java-legacy/src/com/acme/web/AccountController.java:14",
+        "java-legacy/src/com/acme/web/AccountController.java:27",
+        "java-legacy/src/com/acme/web/ProfileServlet.java:12",
+        "php-laravel/app/Http/Controllers/AccountController.php:36",
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:12",
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:30",
+        "python-flask/profile.py:10",
+        "python-flask/profile.py:27",
+        "node-express/routes/profile.js:16"
+      ]
+    }
+  },
+  "active_findings": 84,
+  "matched_findings": 56,
+  "precision": 0.667,
+  "unmatched_findings": [
+    "BFLA-R-0003-1",
+    "BFLA-R-0007-1",
+    "BFLA-R-0009-1",
+    "BFLA-R-0023-1",
+    "BFLA-R-0030-1",
+    "BFLA-R-0032-1",
+    "BFLA-R-0063-1",
+    "INJ-I-0035",
+    "MASS-M-0014-1",
+    "MASS-M-0015-1",
+    "BOLA-R-0007",
+    "BOLA-R-0009",
+    "BOLA-R-0010",
+    "BOLA-R-0011",
+    "BOLA-R-0012",
+    "BOLA-R-0020",
+    "BOLA-R-0021",
+    "BOLA-R-0022",
+    "BOLA-R-0023",
+    "BOLA-R-0028",
+    "BOLA-R-0029",
+    "BOLA-R-0030",
+    "BOLA-R-0035",
+    "BOLA-R-0037",
+    "BOLA-R-0060",
+    "BOLA-R-0073",
+    "BOLA-R-0074",
+    "MASS-M-0001-1"
+  ],
+  "needs_review_not_scored": [
+    "MASS-M-0002-1",
+    "MASS-M-0003-1",
+    "MASS-M-0005-1"
+  ],
+  "verdict_level": {
+    "bfla": {
+      "truth_vulnerable": 10,
+      "found": 10,
+      "recall": 1.0,
+      "flagged_safe": [],
+      "missed": []
+    },
+    "mass_assignment": {
+      "truth_vulnerable": 15,
+      "found": 14,
+      "recall": 0.933,
+      "flagged_safe": [],
+      "missed": [
+        "php-plain/register.php:4"
+      ]
+    }
+  }
+}

package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/coverage.json

@@ -0,0 +1,111 @@
+{
+  "route_candidates": 74,
+  "inventoried": 74,
+  "rejected": 0,
+  "missing_from_inventory": [],
+  "bola_routes_to_audit": 74,
+  "bola_routes_without_verdict": [],
+  "bfla_routes_to_audit": 0,
+  "bfla_routes_without_verdict": [],
+  "injection_candidates": 38,
+  "injection_candidates_without_verdict": [],
+  "mass_candidates": 15,
+  "mass_candidates_without_verdict": [
+    "M-0001",
+    "M-0002",
+    "M-0003",
+    "M-0004",
+    "M-0005",
+    "M-0011",
+    "M-0012"
+  ],
+  "findings_without_verification": [
+    "BOLA-R-0027-1",
+    "BOLA-R-0028-1",
+    "BOLA-R-0030-1",
+    "BOLA-R-0031-1",
+    "BOLA-R-0032-1",
+    "BOLA-R-0033-1",
+    "BOLA-R-0035-1",
+    "BOLA-R-0037-1",
+    "BOLA-R-0038-1",
+    "BOLA-R-0043-1",
+    "BOLA-R-0044-1",
+    "BOLA-R-0046-1",
+    "BOLA-R-0057-1",
+    "BOLA-R-0058-1",
+    "BOLA-R-0059-1",
+    "BOLA-R-0061-1",
+    "BOLA-R-0066-1",
+    "BOLA-R-0067-1",
+    "BOLA-R-0069-1",
+    "INJ-I-0001-1",
+    "INJ-I-0002-1",
+    "INJ-I-0003-1",
+    "INJ-I-0004-1",
+    "INJ-I-0006-1",
+    "INJ-I-0007-1",
+    "INJ-I-0008",
+    "INJ-I-0009-1",
+    "INJ-I-0010-1",
+    "INJ-I-0011-1",
+    "INJ-I-0012-1",
+    "INJ-I-0013-1",
+    "INJ-I-0015",
+    "INJ-I-0016-1",
+    "INJ-I-0017-1",
+    "INJ-I-0018",
+    "INJ-I-0020-1",
+    "INJ-I-0021-1",
+    "INJ-I-0022-1",
+    "INJ-I-0023-1",
+    "INJ-I-0024-1",
+    "INJ-I-0025-1",
+    "INJ-I-0026",
+    "INJ-I-0028-1",
+    "INJ-I-0029-1",
+    "INJ-I-0030-1",
+    "INJ-I-0031",
+    "INJ-I-0032",
+    "INJ-I-0033",
+    "INJ-I-0034",
+    "INJ-I-0035",
+    "INJ-I-0036",
+    "INJ-I-0037"
+  ],
+  "duplicates_removed": [
+    {
+      "kept": "INJ-I-0012-1",
+      "dropped": "INJ-I-0014-1"
+    },
+    {
+      "kept": "INJ-I-0018",
+      "dropped": "INJ-I-0019"
+    },
+    {
+      "kept": "INJ-I-0037",
+      "dropped": "INJ-I-0038"
+    }
+  ],
+  "validation_errors": [
+    "bola-routes-005.json:BOLA-R-0073-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0074-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0010-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0011-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0012-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0016-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0029-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0063-1: status: missing required field 'status'",
+    "bola-routes-005.json:BOLA-R-0060-1: status: missing required field 'status'",
+    "priv-privilege-002.json:MASS-M-0006-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0007-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0008-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0009-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0010-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0013-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0014-1: evidence[1].line: expected ['integer'], got NoneType",
+    "priv-privilege-002.json:MASS-M-0015-1: evidence[1].line: expected ['integer'], got NoneType"
+  ],
+  "new_issues_from_verifier": [],
+  "out_of_scope_notes": []
+}

package/assess/lsa/examples/eval-run-4/iter1-qwen-a-incomplete/findings/priv-privilege-001.json

@@ -0,0 +1,6 @@
+{
+  "batch_id": "privilege-001",
+  "findings": [],
+  "privilege_route_verdicts": [],
+  "candidate_verdicts": []
+}