@hoanghainh/komagu 2.2.1 → 2.4.0

package/assess/lsa/scripts/redaction.py

@@ -0,0 +1,118 @@
+"""Secret redaction for code excerpts: Tier 1 snippets and every excerpt the headless agents send to a model (#350).
+
+Pattern-based, so it cannot catch every secret: the pilot runbook also leaves key and environment config files
+out of the source copy. Standard-library only (Python 3.8+ compatible).
+"""
+
+from __future__ import annotations
+
+import re
+from typing import List, Optional, Tuple
+
+MASK = "[REDACTED]"
+# Longer lines (minified bundles, generated data) are dropped whole: they are not useful to an auditor and
+# keep the regexes below from running on megabyte-long input
+MAX_LINE_CHARS = 4000
+
+# A secret-like key name; the lookahead keeps passwordPolicy, tokenizer and Passenger out
+_KW = r"(?:password|passwd|passphrase|pwd|pw|pass|secret|credential|api[_-]?key|token)(?![a-z])"
+_NAME_TAGS = r"(?:param-name|name|key)"
+_VALUE_TAGS = r"(?:param-value|value)"
+
+
+def _rx(pattern: str, flags: int = re.IGNORECASE) -> re.Pattern[str]:
+    return re.compile(pattern, flags)
+
+
+# (pattern, replacement); applied in order to each line
+_RULES: Tuple[Tuple[re.Pattern[str], str], ...] = (
+    # -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- on one line
+    (_rx(r"(-----BEGIN [A-Z ]*PRIVATE KEY-----).*?(-----END [A-Z ]*PRIVATE KEY-----)", 0), r"\1" + MASK + r"\2"),
+    # "password": "x", 'password' => 'x', pw = "x", keystorePass="x", setProperty("mail.smtp.password", "x")
+    (_rx(r"(?<![\w.\-])((['\"]?)[\w.\-]*?" + _KW + r"\2\s*(?:=>|->|[=:,])\s*)(['\"])[^'\"]+\3"), r"\1\3" + MASK + r"\3"),
+    # conn.setPassword("x"), setKeystorePass("x")
+    (_rx(r"(\bset\w*?" + _KW + r"\s*\(\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # DriverManager.getConnection(url, "sa", "x")
+    (_rx(r"(\bgetConnection\s*\([^,()]*,[^,()]*,\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # new PasswordAuthentication("u", "x".toCharArray())
+    (_rx(r"(\bPasswordAuthentication\s*\([^,()]*,\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # <property name="jdbc.password" value="x"/>
+    (_rx(r"(\bname\s*=\s*['\"][^'\"]*?" + _KW + r"[^'\"]*['\"][^>]*?\bvalue\s*=\s*)(['\"])[^'\"]*\2"),
+     r"\1\2" + MASK + r"\2"),
+    # <param-name>password</param-name><param-value>x</param-value>
+    (_rx(r"(<" + _NAME_TAGS + r">[^<]*?" + _KW + r"[^<]*</" + _NAME_TAGS + r">\s*<" + _VALUE_TAGS + r">)[^<]+"),
+     r"\1" + MASK),
+    # <password>x</password>
+    (_rx(r"(<([\w.\-:]*?" + _KW + r")\s*>)[^<]+(?=</\2\s*>)"), r"\1" + MASK),
+    # jdbc:sqlserver://h;password=x  ?pwd=x&  password={a;b}
+    (_rx(r"([;?&](?:password|passwd|pwd)=)(?:\{[^}]*\}|[^;\"'&\s]+)"), r"\1" + MASK),
+    # scheme://user:pass@host
+    (_rx(r"(?<![a-z0-9+.\-])([a-z][a-z0-9+.\-]*://[^/\s:@\"']+:)[^@\s\"'/]+@"), r"\1" + MASK + "@"),
+    # jdbc:oracle:thin:user/pass@host
+    (_rx(r"(\bjdbc:oracle:\w+:[^/\s:@\"']+/)[^@\s\"']+@"), r"\1" + MASK + "@"),
+    # Authorization: Basic xxx / Bearer xxx
+    (_rx(r"(\b(?:Basic|Bearer)\s+)[A-Za-z0-9._~+/=\-]{8,}"), r"\1" + MASK),
+    # Well-known token formats (case-sensitive)
+    (_rx(r"\b(?:AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_\w{20,}|sk-[A-Za-z0-9_\-]{20,}"
+         r"|AIza[0-9A-Za-z_\-]{35})\b", 0), MASK),
+    # Unquoted config values (.properties, YAML, .env) on their own line; ${PLACEHOLDER} and code are kept
+    (_rx(r"^(\s*[\w.\-]*?" + _KW + r"[\w.\-]*\s*[=:]\s*)(?![\"'$=\s])[^\s\"'(){}<>,;]+\s*(?:(?:#|//).*)?$"), r"\1" + MASK),
+    # Dotted config keys inside comments or strings: <%-- db.password=x --%>
+    (_rx(r"(?<![\w.\-])([\w\-]+\.[\w.\-]*?" + _KW + r"[\w\-]*\s*=\s*)(?![\"'$=\s])[^\s\"'(){}<>,;]+(?=\s|$|[\"'])"),
+     r"\1" + MASK),
+)
+
+_PRIVATE_KEY_BEGIN = _rx(r"-----BEGIN [A-Z ]*PRIVATE KEY-----", 0)
+_PRIVATE_KEY_END = _rx(r"-----END [A-Z ]*PRIVATE KEY-----", 0)
+# A secret name whose value follows on a later line: <property name="password"\n value="x"/>, web.xml params
+_PENDING_NAME = _rx(r"\bname\s*=\s*['\"][^'\"]*?" + _KW + r"[^'\"]*['\"]|<" + _NAME_TAGS + r">[^<]*?" + _KW)
+_PENDING_VALUE: Tuple[Tuple[re.Pattern[str], str], ...] = (
+    (_rx(r"(\bvalue\s*=\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    (_rx(r"(<" + _VALUE_TAGS + r">)[^<]+"), r"\1" + MASK),
+)
+_PENDING_LINES = 2
+
+
+def _too_long(s: str) -> Optional[str]:
+    return f"[line of {len(s)} characters omitted]" if len(s) > MAX_LINE_CHARS else None
+
+
+def redact(s: str) -> str:
+    """Mask secrets in one line of code or config."""
+    omitted = _too_long(s)
+    if omitted:
+        return omitted
+    for pattern, repl in _RULES:
+        s = pattern.sub(repl, s)
+    return s
+
+
+def _redact_pending(line: str) -> Tuple[str, bool]:
+    for pattern, repl in _PENDING_VALUE:
+        masked, n = pattern.subn(repl, line)
+        if n:
+            return masked, True
+    return line, False
+
+
+def redact_lines(lines: List[str]) -> List[str]:
+    """Redact each line, blank out private key bodies and mask values split from their names.
+
+    The line count stays the same, so line numbers in excerpts remain valid.
+    """
+    out: List[str] = []
+    in_key, pending = False, 0
+    for line in lines:
+        if in_key:
+            in_key = not _PRIVATE_KEY_END.search(line)
+            out.append(MASK if in_key else line)
+            continue
+        masked = redact(line)
+        if pending:
+            masked, done = _redact_pending(masked)
+            pending = 0 if done else pending - 1
+        if _PENDING_NAME.search(line) and MASK not in masked:
+            pending = _PENDING_LINES
+        in_key = bool(_PRIVATE_KEY_BEGIN.search(line)) and not _PRIVATE_KEY_END.search(line)
+        out.append(masked)
+    return out

package/assess/lsa/scripts/render_report.py

@@ -17,6 +17,14 @@ from typing import Any, Dict, List
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import KIT_VERSION, read_json  # noqa: E402
 from trend import render_trend_html, render_trend_md  # noqa: E402
+from attack_chains import render_attack_chains_html, render_attack_chains_md  # noqa: E402
+from forecast import render_forecast_html, render_forecast_md  # noqa: E402
+
+try:
+    from operate.inventory.api_inventory import render_inventory_html, render_inventory_md  # noqa: E402
+except (ImportError, ModuleNotFoundError):
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent.parent))
+    from operate.inventory.api_inventory import render_inventory_html, render_inventory_md  # noqa: E402
 
 SEV = ["critical", "high", "medium", "low", "info"]
 
@@ -68,6 +76,39 @@ def _load_trend(out: Path) -> Dict[str, Any]:
     return trend if trend.get("history") else {}
 
 
+def _load_attack_chains(out: Path) -> Dict[str, Any]:
+    """Attack chains from attack_chains.py (OUT/attack-chains.json)."""
+    path = out / "attack-chains.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
+def _load_forecast(out: Path) -> Dict[str, Any]:
+    """Security debt forecast from forecast.py (OUT/forecast.json)."""
+    path = out / "forecast.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
+def _load_inventory_diff(out: Path) -> Dict[str, Any]:
+    """API inventory diff from operate inventory (OUT/api-inventory-diff.json)."""
+    path = out / "api-inventory-diff.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
 def md_escape(s: str) -> str:
     return (s or "").replace("|", "\\|").replace("\n", " ")
 
@@ -130,6 +171,15 @@ def render_en(out: Path, project: str) -> str:
     trend = _load_trend(out)
     if trend:
         L += render_trend_md(trend, "en")
+    fc = _load_forecast(out)
+    if fc:
+        L += render_forecast_md(fc, "en")
+    inv = _load_inventory_diff(out)
+    if inv and inv.get("summary"):
+        L += render_inventory_md(inv, "en")
+    chains = _load_attack_chains(out)
+    if chains and chains.get("chains"):
+        L += render_attack_chains_md(chains, "en")
     L += ["## 3. Findings", "",
           "| ID | Sev | Conf | Status | Category | Endpoint | Location | Title |", "|---|---|---|---|---|---|---|---|"]
     for f in active:
@@ -223,6 +273,15 @@ def render_ja(out: Path, project: str) -> str:
     trend = _load_trend(out)
     if trend:
         L += render_trend_md(trend, "ja")
+    fc = _load_forecast(out)
+    if fc:
+        L += render_forecast_md(fc, "ja")
+    inv = _load_inventory_diff(out)
+    if inv and inv.get("summary"):
+        L += render_inventory_md(inv, "ja")
+    chains = _load_attack_chains(out)
+    if chains and chains.get("chains"):
+        L += render_attack_chains_md(chains, "ja")
     L += ["## 3. 検出事項の詳細", "",
           "| ID | 重要度 | 確信度 | ステータス | 脆弱性分類 | 対象エンドポイント | 該当箇所 | タイトル |",
           "|---|---|---|---|---|---|---|---|"]
@@ -427,6 +486,12 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     )
     trend = _load_trend(out)
     trend_card = render_trend_html(trend) if trend else ""
+    fc = _load_forecast(out)
+    forecast_card = render_forecast_html(fc) if fc else ""
+    inv = _load_inventory_diff(out)
+    inv_card = render_inventory_html(inv) if inv and inv.get("summary") else ""
+    chains = _load_attack_chains(out)
+    chains_card = render_attack_chains_html(chains) if chains and chains.get("chains") else ""
 
     # Build severity legend rows
     sev_colors = {
@@ -906,6 +971,21 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     font-size: 12px;
     color: #475569;
   }}
+  .chain-list-container {{ display: flex; flex-direction: column; gap: 16px; margin-top: 16px; }}
+  .chain-item-card {{ border: 1px solid var(--border); border-radius: 8px; padding: 16px; background: #fdfdfd; }}
+  .chain-item-header {{ font-size: 15px; margin-bottom: 12px; }}
+  .chain-flow-diagram {{ display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 12px 0; }}
+  .chain-step-node {{ background: #ffffff; border: 1px solid var(--border); border-radius: 6px; padding: 8px 12px; font-size: 12px; }}
+  .chain-step-badge {{ font-weight: 600; color: var(--accent); margin-bottom: 4px; }}
+  .chain-step-id {{ font-size: 13px; }}
+  .chain-step-loc {{ color: var(--muted); font-family: monospace; font-size: 11px; }}
+  .chain-arrow {{ font-size: 18px; color: var(--muted); font-weight: bold; }}
+  .chain-impact-desc {{ font-size: 13px; color: var(--muted); margin-top: 8px; }}
+  .forecast-stats-grid {{ display: flex; flex-wrap: wrap; gap: 16px; margin: 12px 0 18px; }}
+  .forecast-stat-box {{ background: #fdfdfd; border: 1px solid var(--border); border-radius: 8px; padding: 12px 18px; flex: 1; min-width: 140px; }}
+  .stat-lbl {{ font-size: 12px; color: var(--muted); }}
+  .stat-val {{ font-size: 20px; font-weight: 700; margin-top: 4px; }}
+  .forecast-alert {{ padding: 10px 14px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; font-size: 13px; }}
   @media print {{
     body {{ background: #fff; }}
     .btn-ctrl, .filter-bar, .btn-inspect, .btn-copy {{ display: none !important; }}
@@ -986,8 +1066,14 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     </div>
   </section>
 
+  {chains_card}
+
+  {inv_card}
+
   {trend_card}
 
+  {forecast_card}
+
   <section class="card" aria-label="Interactive Findings Table">
     <h2 class="card-title" data-en="Interactive Findings Explorer" data-ja="検出事項一覧・インタラクティブ検索 (Findings Explorer)">Interactive Findings Explorer</h2>
     <div class="filter-bar">

package/assess/lsa/tests/test_attack_chains.py

@@ -0,0 +1,292 @@
+#!/usr/bin/env python3
+"""Tests for attack chain synthesis (Issue #316).
+
+Verifies:
+1. attack-chain.schema.json schema conformity.
+2. 3-step chain synthesis (Mass assignment -> BFLA -> BOLA) with breaking fix calculation.
+3. Safe / disconnected findings produce no chains.
+4. Single findings never become a chain.
+5. Rejected findings are excluded.
+6. SARIF output enrichment with attackChains property.
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+KIT = HERE.parent
+sys.path.insert(0, str(KIT / "scripts"))
+
+from attack_chains import (  # noqa: E402
+    attach_chains_to_sarif,
+    build_attack_chains,
+    profile_finding,
+    render_attack_chains_html,
+    render_attack_chains_md,
+)
+from merge_findings import load_validator  # noqa: E402
+from render_report import render_en, render_html, render_ja  # noqa: E402
+
+
+class TestAttackChains(unittest.TestCase):
+    def setUp(self) -> None:
+        self.validate_schema = load_validator("attack-chain.schema.json")
+        self.validate_finding = load_validator("finding.schema.json")
+
+    def test_schema_validates_empty_chain_doc(self) -> None:
+        doc = build_attack_chains([])
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema errors: {errors}")
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+
+    def test_single_finding_never_becomes_chain(self) -> None:
+        finding = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "BOLA in orders",
+            "location": "Controllers/OrderController.cs:42",
+            "endpoint": "GET /api/orders/{id}",
+            "evidence": "db.Orders.Find(id)",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-639",
+            "recommendation": "Check owner",
+            "status": "confirmed",
+        }
+        doc = build_attack_chains([finding])
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+        self.assertEqual(self.validate_schema(doc), [])
+
+    def test_rejected_findings_are_excluded(self) -> None:
+        f1 = {
+            "finding_id": "MASS-001",
+            "category": "mass_assignment",
+            "subtype": "whole_object_binding",
+            "title": "Mass assignment on register",
+            "location": "register.php:10",
+            "endpoint": "POST /register",
+            "evidence": "extract($_POST)",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-915",
+            "recommendation": "Use allowlist",
+            "status": "rejected",  # Rejected by verifier
+            "attack_vector": {"fields": {"role": "admin"}},
+        }
+        f2 = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "BOLA in orders",
+            "location": "orders.php:20",
+            "endpoint": "GET /orders/{id}",
+            "evidence": "SELECT * FROM orders WHERE id = $id",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-639",
+            "recommendation": "Filter by user",
+            "status": "confirmed",
+        }
+        doc = build_attack_chains([f1, f2])
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+
+    def test_three_step_planted_attack_chain(self) -> None:
+        """Planted 3-step chain: Mass Assignment -> BFLA -> BOLA."""
+        step1_mass = {
+            "finding_id": "MASS-001",
+            "category": "mass_assignment",
+            "subtype": "whole_object_binding",
+            "title": "Mass assignment on registration allows role escalation",
+            "location": "php-plain/register.php:4",
+            "endpoint": "POST /register",
+            "evidence": "extract($_POST) overrides $role",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-915",
+            "recommendation": "Whitelist registration fields",
+            "status": "confirmed",
+            "attack_vector": {
+                "method": "POST",
+                "path": "/register",
+                "fields": {"role": "admin", "is_admin": True},
+            },
+        }
+
+        step2_bfla = {
+            "finding_id": "BFLA-001",
+            "category": "bfla",
+            "subtype": "missing_role_check",
+            "title": "Admin tenant list accessible without role check",
+            "location": "php-plain/admin/tenants.php:12",
+            "endpoint": "GET /admin/tenants",
+            "evidence": "Checks login session but not admin role",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-285",
+            "recommendation": "Add requireRole('admin') guard",
+            "status": "confirmed",
+        }
+
+        step3_bola = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "Customer records readable across tenants by ID",
+            "location": "php-plain/customers.php:25",
+            "endpoint": "GET /api/customers/{id}",
+            "evidence": "SELECT * FROM customers WHERE id = ?",
+            "severity": "high",
+            "confidence": "likely",
+            "cwe": "CWE-639",
+            "recommendation": "Bind tenant_id to authenticated user",
+            "status": "likely",
+        }
+
+        doc = build_attack_chains([step1_mass, step2_bfla, step3_bola])
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema validation failed: {errors}")
+
+        self.assertGreaterEqual(doc["summary"]["total_chains"], 1)
+        chain = doc["chains"][0]
+        self.assertEqual(chain["chain_id"], "chain-001")
+        self.assertEqual(chain["entry"], "anonymous")
+        self.assertEqual(chain["severity"], "critical")
+        # Confidence is weakest link (likely from step3)
+        self.assertEqual(chain["confidence"], "likely")
+
+        # Verify steps in order
+        step_ids = [s["finding_id"] for s in chain["steps"]]
+        self.assertIn("MASS-001", step_ids)
+        self.assertIn("BOLA-001", step_ids)
+
+        # Breaking fixes must include all chain findings
+        self.assertIn("MASS-001", chain["breaking_fixes"])
+        self.assertIn("BOLA-001", chain["breaking_fixes"])
+
+        # Check summary top breaking fixes
+        top_fixes = doc["summary"]["top_breaking_fixes"]
+        self.assertGreaterEqual(len(top_fixes), 1)
+        broken_counts = {tf["finding_id"]: tf["chains_broken"] for tf in top_fixes}
+        self.assertGreaterEqual(broken_counts.get("MASS-001", 0), 1)
+
+    def test_sarif_enrichment(self) -> None:
+        """Verify attach_chains_to_sarif adds properties.attackChains."""
+        sarif_mock = {
+            "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+                {
+                    "tool": {"driver": {"name": "komagu"}},
+                    "results": [
+                        {
+                            "ruleId": "BOLA-001",
+                            "message": {"text": "BOLA"},
+                            "partialFingerprints": {"komagu/v1": "kfp1:111111"},
+                        },
+                        {
+                            "ruleId": "INJ-001",
+                            "message": {"text": "Unlinked injection"},
+                        },
+                    ],
+                }
+            ],
+        }
+
+        chains_mock = {
+            "chains": [
+                {
+                    "chain_id": "chain-001",
+                    "steps": [
+                        {"finding_id": "MASS-001"},
+                        {"finding_id": "BOLA-001"},
+                    ],
+                }
+            ]
+        }
+
+        enriched = attach_chains_to_sarif(sarif_mock, chains_mock)
+        r0 = enriched["runs"][0]["results"][0]
+        self.assertEqual(r0.get("properties", {}).get("attackChains"), ["chain-001"])
+
+        r1 = enriched["runs"][0]["results"][1]
+        self.assertNotIn("attackChains", r1.get("properties", {}))
+
+    def test_markdown_and_html_rendering(self) -> None:
+        """Verify attack chains render properly in markdown (EN & JA) and HTML dashboard."""
+        mock_chains = {
+            "version": 1,
+            "generated_at": "2026-11-01T20:00:00Z",
+            "chains": [
+                {
+                    "chain_id": "chain-001",
+                    "title": "Mass Assignment → BFLA → BOLA targeting customers",
+                    "entry": "anonymous",
+                    "steps": [
+                        {
+                            "step_index": 1,
+                            "finding_id": "MASS-001",
+                            "category": "mass_assignment",
+                            "location": "register.php:4",
+                            "role_in_chain": "entry_point",
+                            "explanation": "Overwrites role to admin",
+                        },
+                        {
+                            "step_index": 2,
+                            "finding_id": "BOLA-001",
+                            "category": "bola",
+                            "location": "customers.php:25",
+                            "role_in_chain": "impact",
+                            "explanation": "Leaks other tenants",
+                        },
+                    ],
+                    "outcome": "Exfiltration of customer records",
+                    "business_impact": "Loss of customer trust and regulatory fine.",
+                    "severity": "critical",
+                    "confidence": "likely",
+                    "breaking_fixes": ["MASS-001", "BOLA-001"],
+                }
+            ],
+            "summary": {
+                "total_chains": 1,
+                "by_severity": {"critical": 1, "high": 0, "medium": 0, "low": 0},
+                "top_breaking_fixes": [
+                    {
+                        "finding_id": "MASS-001",
+                        "category": "mass_assignment",
+                        "location": "register.php:4",
+                        "chains_broken": 1,
+                    }
+                ],
+            },
+        }
+
+        # Test Markdown EN
+        md_en = "\n".join(render_attack_chains_md(mock_chains, "en"))
+        self.assertIn("Attack Chains", md_en)
+        self.assertIn("Top Breaking Fixes", md_en)
+        self.assertIn("MASS-001", md_en)
+        self.assertIn("chain-001", md_en)
+
+        # Test Markdown JA
+        md_ja = "\n".join(render_attack_chains_md(mock_chains, "ja"))
+        self.assertIn("攻撃チェーン", md_ja)
+        self.assertIn("最優先対策", md_ja)
+        self.assertIn("MASS-001", md_ja)
+        self.assertIn("chain-001", md_ja)
+
+        # Test HTML Card
+        html_card = render_attack_chains_html(mock_chains)
+        self.assertIn("Chained Attack Scenarios", html_card)
+        self.assertIn("Top Breaking Fixes", html_card)
+        self.assertIn("chain-001", html_card)
+        self.assertIn("MASS-001", html_card)
+
+
+if __name__ == "__main__":
+    unittest.main()