@hoanghainh/komagu 2.4.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/priv-privilege-002.json

@@ -0,0 +1,253 @@
+{
+  "batch_id": "privilege-002",
+  "findings": [
+    {
+      "finding_id": "MASS-M-0009-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Team owner_id is writable via mass assignment",
+      "candidate_id": "M-0009",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 23,
+          "why": "Whole object binding: Team::create($request->all());"
+        },
+        {
+          "file": "php-laravel/app/Models/Team.php",
+          "line": 8,
+          "why": "fillable includes privileged field owner_id"
+        }
+      ],
+      "impact": "Any authenticated user can set the owner_id of a Team, effectively taking ownership of any team.",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Remove owner_id from $fillable or set it server\u2011side after validating ownership.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0006-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0006",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 8,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review the User model definition and ensure privileged fields are not mass\u2011assignable.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0007-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0007",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 16,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review the User model definition and ensure privileged fields are not mass\u2011assignable.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0008-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0008",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 13,
+          "why": "Whole object binding: User::create($request->all());"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable due to missing field list.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Inspect the User model to confirm which fields are mass\u2011assignable and restrict privileged ones.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0010-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0010",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 36
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 23,
+          "why": "Whole object binding: Team::create($request->all());"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review the Team model definition and ensure privileged fields are not mass\u2011assignable.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0013-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0013",
+      "location": {
+        "file": "php-plain/register.php",
+        "start_line": 4
+      },
+      "evidence": [
+        {
+          "file": "php-plain/register.php",
+          "line": 4,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Avoid using extract() and bind all POST values; explicitly whitelist fields.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0015-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0015",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 27,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Validate and whitelist request fields before setting attributes.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    },
+    {
+      "finding_id": "MASS-M-0014-1",
+      "category": "mass_assignment",
+      "title": "Unknown model fields in whole object binding",
+      "candidate_id": "M-0014",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 10,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "Unable to determine if privileged fields are writable.",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Use a DTO or explicit field mapping to prevent mass assignment of privileged fields.",
+      "status": "needs_review",
+      "subtype": "whole_object_binding"
+    }
+  ],
+  "privilege_route_verdicts": [],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "M-0006",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0007",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0008",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0009",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0010",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0013",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0015",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0014",
+      "verdict": "needs_review"
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-1.json

@@ -0,0 +1,68 @@
+{
+  "batch_id": "verified-1",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0002",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp:6-8",
+        "classic-asp/shop/inc/auth.asp:1-3",
+        "classic-asp/shop/inc/conn.asp:1-4"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE statement uses Request.Form(\"member_id\") directly without any ownership check or parameter binding. No role or ownership helper is invoked in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0003",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp:9-11",
+        "classic-asp/shop/inc/auth.asp:1-3",
+        "classic-asp/shop/inc/conn.asp:1-4"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement concatenates Request.QueryString(\"member_id\") directly. No ownership verification is present in the shown code."
+    },
+    {
+      "finding_id": "BOLA-R-0004",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/order.asp:5-7",
+        "classic-asp/shop/order.asp:12-13",
+        "classic-asp/shop/inc/auth.asp:1-3",
+        "classic-asp/shop/inc/conn.asp:1-4"
+      ],
+      "control_found": null,
+      "notes": "The first SELECT retrieves the order by id without scoping to the current user and its result is output. The later scoped query is not used for output."
+    },
+    {
+      "finding_id": "BOLA-R-0005",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/OrderService.cfc:4-6"
+      ],
+      "control_found": null,
+      "notes": "The query interpolates #arguments.orderId# directly. No ownership check or parameter binding is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0006",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/order.cfm:2-4",
+        "coldfusion/app/order.cfm:5-9"
+      ],
+      "control_found": null,
+      "notes": "The unscoped query qOrder uses #url.id# and its result is displayed. The scoped query qMine is not used for output."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-10.json

@@ -0,0 +1,68 @@
+{
+  "batch_id": "verified-10",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0001",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-8",
+        "classic-asp/shop/inc/auth.asp lines 1-3"
+      ],
+      "control_found": null,
+      "notes": "No ownership or role check is visible in the code context. The authentication include only verifies that a user is logged in, not that the user owns the member record."
+    },
+    {
+      "finding_id": "INJ-I-0002",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-8",
+        "classic-asp/shop/inc/auth.asp lines 1-3"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the member_id from the form with no ownership or role guard shown in the context."
+    },
+    {
+      "finding_id": "INJ-I-0003",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp lines 9-11",
+        "classic-asp/shop/inc/auth.asp lines 1-3"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement uses a member_id from the query string with no visible ownership check."
+    },
+    {
+      "finding_id": "INJ-I-0004",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/order.asp lines 5-7",
+        "classic-asp/shop/inc/auth.asp lines 1-3"
+      ],
+      "control_found": null,
+      "notes": "The SELECT query uses an id from the request without casting or an ownership guard in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0005",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/order.asp lines 10-12"
+      ],
+      "control_found": {
+        "file": "classic-asp/shop/order.asp",
+        "line": 12,
+        "code": "Set rs2 = conn.Execute(\"SELECT * FROM orders WHERE id = \" & sid & \" AND user_id = \" & CLng(Session(\"UserID\")))"
+      },
+      "notes": "The query includes an ownership check by binding the user_id to the session value and casts the sid to a long, preventing injection and ensuring the user can only access their own orders."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-11.json

@@ -0,0 +1,61 @@
+{
+  "batch_id": "verified-11",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0006",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "coldfusion/app/OrderService.cfc:5"
+      ],
+      "control_found": null,
+      "notes": "The query interpolates the unsanitized argument directly into the SQL string. No ownership or role check, no parameter binding, and no integer cast is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0007",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "coldfusion/app/order.cfm:3"
+      ],
+      "control_found": null,
+      "notes": "The first query uses the raw URL parameter in the WHERE clause. Although a second query later uses cfqueryparam and includes a user_id check, the vulnerable query is executed and its result is output, providing an injection vector."
+    },
+    {
+      "finding_id": "INJ-I-0009",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb:7",
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb:8"
+      ],
+      "control_found": null,
+      "notes": "Both the Note and OrderId values are concatenated into the SQL string without any parameterization or ownership check. The subsequent safe query does not mitigate the earlier vulnerable execution."
+    },
+    {
+      "finding_id": "INJ-I-0010",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb:8"
+      ],
+      "control_found": null,
+      "notes": "The OrderId is concatenated directly into the SQL string. No ownership or role validation is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0011",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs:13"
+      ],
+      "control_found": null,
+      "notes": "The id from the query string is concatenated into the SQL command without parameterization or ownership verification. The later safe query does not prevent the execution of the vulnerable statement."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-12.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-12",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0012",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs:13-22"
+      ],
+      "control_found": null,
+      "notes": "The query string is built by string.Format with user-supplied Request[\"ref\"]. No parameter binding, no ownership or role check is visible in the code_context."
+    },
+    {
+      "finding_id": "INJ-I-0013",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs:13-22"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement concatenates Request.Form[\"cart\"] directly into the SQL. No compensating control is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0014",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp:1-6"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the request parameter \"no\" into the SQL string. No ownership or role check is shown."
+    },
+    {
+      "finding_id": "INJ-I-0016",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java:10-15"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE statement concatenates the email and userId parameters directly. No parameter binding or ownership check is visible."
+    },
+    {
+      "finding_id": "INJ-I-0017",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/InvoiceController.java:27-31"
+      ],
+      "control_found": null,
+      "notes": "The HQL query concatenates the customer request parameter. No ownership or role check is present in the code_context."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-13.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-13",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0020",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:17"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates user input directly into the SQL string with no sanitization, casting, or parameter binding. No ownership or role check is present on this route."
+    },
+    {
+      "finding_id": "INJ-I-0021",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:29"
+      ],
+      "control_found": null,
+      "notes": "The query interpolates req.query.shop directly into the SQL string. No cast, binding, or authorization guard is visible."
+    },
+    {
+      "finding_id": "INJ-I-0022",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:21"
+      ],
+      "control_found": null,
+      "notes": "The request body is passed directly to findOne without validation or sanitization. No role or ownership check is present."
+    },
+    {
+      "finding_id": "INJ-I-0023",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:25"
+      ],
+      "control_found": null,
+      "notes": "The $where string concatenates user input directly, enabling NoSQL injection. No validation or authorization guard is visible."
+    },
+    {
+      "finding_id": "INJ-I-0024",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi:13"
+      ],
+      "control_found": null,
+      "notes": "The prepared statement interpolates $id directly into the SQL string. No parameter binding or sanitization is used. The later safe query does not mitigate this earlier vulnerability."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-14.json

@@ -0,0 +1,66 @@
+{
+  "batch_id": "verified-14",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0025",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi:13-19"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement concatenates user input directly into the SQL string and no ownership or role check is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0027",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php:10-12",
+        "php-plain/inc/auth.php:1-7",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "The DELETE query uses unsanitized POST data and the included auth file only verifies login, not ownership or role."
+    },
+    {
+      "finding_id": "INJ-I-0028",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php:10-12",
+        "php-plain/inc/auth.php:1-7",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0027; no compensating control is visible."
+    },
+    {
+      "finding_id": "INJ-I-0029",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php:5-6",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "The $where clause concatenates user input; no ownership or role check is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0030",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php:5-6",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0029; no compensating control is visible."
+    }
+  ]
+}