@hoanghainh/komagu 2.0.0 → 2.1.0

package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/stack-profile.json

@@ -0,0 +1,226 @@
+{
+  "repo": "repo",
+  "generated_by": "lsa detect_stack.py 0.3.1",
+  "stacks": [
+    {
+      "id": "php",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "20 file(s) with extension .php, .php3, .php4, .php5, .phtml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-codeigniter",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "marker file php-codeigniter/system/core/CodeIgniter.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-laravel",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "pattern /Route::(get|post|put|delete|any|match|re/ in php-laravel/routes/web.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-servlet",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/web.xml",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/OrderServlet.java",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/ProfileServlet.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-jsp",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .jsp, .jspf"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-struts1",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/struts-config.xml",
+        "pattern /extends\\s+(Dispatch|LookupDispatch|Mappi/ in java-legacy/src/com/acme/struts/EditUserAction.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-spring-mvc",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AccountController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AdminUserController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-mybatis",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /<mapper\\s+namespace=|org\\.apache\\.ibatis/ in java-legacy/src/com/acme/mapper/OrderMapper.xml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-hibernate",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /org\\.hibernate\\.|\\.hbm\\.xml|createQuery\\/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-webforms",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .ascx, .aspx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-handlers",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .ashx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-mvc",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/AdminController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/InvoiceController.cs"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "classic-asp",
+      "language": "vbscript",
+      "version_hint": null,
+      "evidence": [
+        "4 file(s) with extension .asa, .asp"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "perl-cgi",
+      "language": "perl",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .cgi",
+        "pattern /use\\s+CGI\\b|CGI->new|use\\s+DBI\\b/ in perl-cgi/cgi-bin/order.cgi"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "coldfusion",
+      "language": "cfml",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .cfc, .cfm, .cfml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "node-express",
+      "language": "javascript",
+      "version_hint": null,
+      "evidence": [
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/admin.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/orders.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/profile.js"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "python-flask",
+      "language": "python",
+      "version_hint": null,
+      "evidence": [
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/app.py",
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/profile.py"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "sql-procedures",
+      "language": "sql",
+      "version_hint": null,
+      "evidence": [
+        "pattern /(?i)create\\s+(or\\s+replace\\s+)?proc(edur/ in sql-procs/sp_search_orders.sql"
+      ],
+      "confirmed": false
+    }
+  ],
+  "data_access": [
+    "JDBC",
+    "mysql_* (no binding)",
+    "ColdFusion cfquery",
+    "Entity Framework / LINQ to SQL",
+    "ADO.NET",
+    "Hibernate/JPA",
+    "Classic ADO",
+    "MyBatis/iBATIS",
+    "TypeORM (Node/TS)",
+    "Perl DBI",
+    "MongoDB",
+    "PDO"
+  ],
+  "databases": [
+    "MySQL",
+    "SQL Server",
+    "MongoDB"
+  ],
+  "file_counts": {
+    ".php": 20,
+    ".java": 7,
+    ".cs": 5,
+    ".asp": 4,
+    ".xml": 3,
+    ".js": 3,
+    ".aspx": 2,
+    ".py": 2,
+    ".cfc": 1,
+    ".cfm": 1,
+    ".config": 1,
+    ".ashx": 1,
+    ".vb": 1,
+    ".jsp": 1,
+    ".cgi": 1,
+    ".sql": 1
+  },
+  "knowledge_files": [
+    "knowledge/stacks/php.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/classic-asp.md",
+    "knowledge/stacks/perl-cgi.md",
+    "knowledge/stacks/coldfusion.md",
+    "knowledge/stacks/node-python-ruby.md"
+  ],
+  "notes": "Heuristic result. The stack-detector agent must confirm each item."
+}

package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/ai-run-stats.json

@@ -0,0 +1,54 @@
+{
+  "model": "gpt-oss:20b",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 75.873,
+      "calls": 1,
+      "prompt_tokens": 3118,
+      "completion_tokens": 3257
+    },
+    "3-route-mapper": {
+      "seconds": 0.009,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 1384.418,
+      "calls": 6,
+      "prompt_tokens": 51185,
+      "completion_tokens": 47018
+    },
+    "4b-injection-auditor": {
+      "seconds": 522.78,
+      "calls": 2,
+      "prompt_tokens": 15801,
+      "completion_tokens": 19535
+    },
+    "4c-privilege-auditor": {
+      "seconds": 323.148,
+      "calls": 2,
+      "prompt_tokens": 18930,
+      "completion_tokens": 11162
+    },
+    "5-finding-verifier": {
+      "seconds": 1071.669,
+      "calls": 18,
+      "prompt_tokens": 120283,
+      "completion_tokens": 27649
+    }
+  },
+  "totals": {
+    "calls": 29,
+    "prompt_tokens": 209317,
+    "completion_tokens": 108621,
+    "seconds": 3377.468
+  },
+  "parse_failures": {
+    "4a-bola-auditor": [
+      "routes-001"
+    ]
+  },
+  "call_errors": {}
+}

package/assess/lsa/examples/eval-run-4/iter2-gptoss-b/coverage.json

@@ -0,0 +1,66 @@
+{
+  "route_candidates": 74,
+  "inventoried": 74,
+  "rejected": 0,
+  "missing_from_inventory": [],
+  "bola_routes_to_audit": 74,
+  "bola_routes_without_verdict": [
+    "R-0001",
+    "R-0002",
+    "R-0003",
+    "R-0004",
+    "R-0005",
+    "R-0006",
+    "R-0007",
+    "R-0008",
+    "R-0009",
+    "R-0013",
+    "R-0014",
+    "R-0015",
+    "R-0017",
+    "R-0018",
+    "R-0019"
+  ],
+  "bfla_routes_to_audit": 0,
+  "bfla_routes_without_verdict": [],
+  "injection_candidates": 38,
+  "injection_candidates_without_verdict": [],
+  "mass_candidates": 15,
+  "mass_candidates_without_verdict": [],
+  "findings_without_verification": [],
+  "duplicates_removed": [
+    {
+      "kept": "INJ-I-0020",
+      "dropped": "INJ-I-0022"
+    },
+    {
+      "kept": "INJ-I-0021",
+      "dropped": "INJ-I-0023"
+    },
+    {
+      "kept": "INJ-I-0027",
+      "dropped": "INJ-I-0028"
+    },
+    {
+      "kept": "INJ-I-0029",
+      "dropped": "INJ-I-0030"
+    },
+    {
+      "kept": "MASS-M-0006-1",
+      "dropped": "MASS-M-0007-1"
+    },
+    {
+      "kept": "MASS-M-0011-1",
+      "dropped": "MASS-M-0012-1"
+    }
+  ],
+  "validation_errors": [
+    "bola-routes-004.json:BOLA-R-0055-needs_review: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "bola-routes-004.json:BOLA-R-0056-needs_review: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "bola-routes-004.json:BOLA-R-0052-needs_review: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "bola-routes-004.json:BOLA-R-0053-needs_review: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']",
+    "bola-routes-004.json:BOLA-R-0054-needs_review: subtype: 'needs_review' not in ['missing_ownership_check', 'ownership_check_bypassable', 'id_from_request_used_as_identity', 'no_authentication', 'parent_checked_child_not', 'check_result_ignored', 'string_concatenation', 'string_interpolation', 'format_string', 'template_placeholder', 'dynamic_identifier', 'operator_injection', 'js_injection', 'second_order', 'stored_procedure_dynamic_sql', 'missing_role_check', 'role_from_request', 'client_side_role_check', 'whole_object_binding', 'privileged_field_writable']"
+  ],
+  "new_issues_from_verifier": [],
+  "out_of_scope_notes": []
+}