@hoanghainh/komagu 2.4.0 → 2.6.0

package/assess/lsa/tests/test_java_legacy_realistic.py

@@ -0,0 +1,453 @@
+#!/usr/bin/env python3
+"""Tier 1 gaps found by comparing the pre-scan with real Java legacy applications (Issue #364).
+
+Each test is a minimal reproduction of a pattern observed in a public application:
+Apache Roller, Apache Struts 1, JEECG, JeeSite 1.x and OpenMRS 1.9. No third-party code is copied here.
+"""
+
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from typing import Dict, List
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(REPO_ROOT / "assess" / "lsa" / "scripts"))
+
+from detect_stack import detect  # noqa: E402
+from find_injection import find_injection  # noqa: E402
+from lsa_common import iter_source_files, load_config  # noqa: E402
+from map_routes import map_routes  # noqa: E402
+
+CONFIG_XML_HEADER = '<?xml version="1.0"?>\n'
+
+
+def write_repo(root: Path, files: Dict[str, str]) -> None:
+    for rel, text in files.items():
+        path = root / rel
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+
+
+def scan_routes(files: Dict[str, str]) -> List[Dict]:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        write_repo(root, files)
+        return map_routes(root, load_config(None), workers=1)["candidates"]
+
+
+def scan_stack(files: Dict[str, str]) -> Dict:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        write_repo(root, files)
+        return detect(root, load_config(None))
+
+
+def scan_injection(files: Dict[str, str]) -> Dict:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        write_repo(root, files)
+        return find_injection(root, load_config(None), workers=1)
+
+
+def scoped_files(files: Dict[str, str]) -> List[str]:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        write_repo(root, files)
+        return [rel for _, rel in iter_source_files(root, load_config(None))]
+
+
+def paths_of(routes: List[Dict], stack: str) -> List[str]:
+    return sorted(r["path"] for r in routes if r["stack"] == stack)
+
+
+def controller(body: str, class_annotations: str = "") -> Dict[str, str]:
+    source = (
+        "package com.acme.web;\n"
+        "@Controller\n"
+        f"{class_annotations}\n"
+        "public class ItemController {\n"
+        f"{body}\n"
+        "}\n"
+    )
+    return {"src/main/java/com/acme/web/ItemController.java": source}
+
+
+class TestScope(unittest.TestCase):
+    def test_java_package_named_like_a_build_directory_is_scanned(self) -> None:
+        scanned = scoped_files({
+            "src/main/java/com/acme/vendor/VendorController.java": "class A {}\n",
+            "src/main/java/com/acme/modules/test/web/TestController.java": "class B {}\n",
+            "src/com/acme/build/BuildDao.java": "class C {}\n",
+        })
+        self.assertEqual(len(scanned), 3)
+
+    def test_jsp_in_a_web_directory_named_test_is_scanned(self) -> None:
+        scanned = scoped_files({"src/main/webapp/test/mailer_test.jsp": "<html/>\n"})
+        self.assertEqual(scanned, ["src/main/webapp/test/mailer_test.jsp"])
+
+    def test_real_test_and_vendor_trees_stay_excluded(self) -> None:
+        scanned = scoped_files({
+            "src/test/java/com/acme/FooTest.java": "class T {}\n",
+            "test/com/acme/BarTest.java": "class U {}\n",
+            "target/classes/com/acme/Baz.java": "class V {}\n",
+            "src/main/webapp/test/helper.js": "var a = 1;\n",
+            "src/main/webapp/static/vendor/lib.js": "var b = 1;\n",
+        })
+        self.assertEqual(scanned, [])
+
+
+class TestStackDetection(unittest.TestCase):
+    def test_java_ternary_is_not_dotnet_mvc(self) -> None:
+        profile = scan_stack({"src/A.java": "class A { Object c = ok ? other : Controller.NONE; }\n"})
+        self.assertNotIn("dotnet-mvc", [s["id"] for s in profile["stacks"]])
+
+    def test_commented_import_is_not_struts2(self) -> None:
+        profile = scan_stack({"src/A.java": "//import com.opensymphony.xwork2.ognl.OgnlUtil;\nclass A {}\n"})
+        self.assertNotIn("java-struts2", [s["id"] for s in profile["stacks"]])
+
+    def test_hibernate_validator_is_not_the_orm(self) -> None:
+        profile = scan_stack({"src/A.java": "import org.hibernate.validator.constraints.Length;\nclass A {}\n"})
+        self.assertNotIn("java-hibernate", [s["id"] for s in profile["stacks"]])
+        self.assertNotIn("Hibernate/JPA", profile["data_access"])
+
+    def test_mybatis_sql_command_type_is_not_ado_net(self) -> None:
+        profile = scan_stack({"src/A.java": "class A { SqlCommandType type; }\n"})
+        self.assertNotIn("ADO.NET", profile["data_access"])
+
+    def test_real_dotnet_and_orm_still_detected(self) -> None:
+        profile = scan_stack({
+            "Web/HomeController.cs": "class HomeController : Controller { SqlCommand c; }\n",
+            "src/A.java": "import org.hibernate.Session;\nclass A {}\n",
+        })
+        self.assertIn("dotnet-mvc", [s["id"] for s in profile["stacks"]])
+        self.assertIn("java-hibernate", [s["id"] for s in profile["stacks"]])
+        self.assertIn("ADO.NET", profile["data_access"])
+
+
+class TestXmlRoutes(unittest.TestCase):
+    def test_commented_out_mappings_are_not_routes(self) -> None:
+        web = CONFIG_XML_HEADER + (
+            "<web-app>\n<!--\n<servlet><servlet-name>cxf</servlet-name><servlet-class>a.Cxf</servlet-class></servlet>\n"
+            "<servlet-mapping><servlet-name>cxf</servlet-name><url-pattern>/cxf/*</url-pattern></servlet-mapping>\n-->\n</web-app>\n"
+        )
+        struts = CONFIG_XML_HEADER + (
+            '<struts-config><action-mappings><action path="/live" type="a.Live"/>\n'
+            '<!-- <action path="/dead" type="a.Dead"/> -->\n</action-mappings></struts-config>\n'
+        )
+        routes = scan_routes({"WEB-INF/web.xml": web, "WEB-INF/struts-config.xml": struts})
+        self.assertEqual(paths_of(routes, "java-servlet"), [])
+        self.assertEqual(paths_of(routes, "java-struts1"), ["/live.do"])
+
+    def test_servlet_with_description_and_several_url_patterns(self) -> None:
+        web = CONFIG_XML_HEADER + (
+            "<web-app><servlet><description>x</description><servlet-name>s</servlet-name><servlet-class>com.acme.Img</servlet-class></servlet>\n"
+            "<servlet-mapping><servlet-name>s</servlet-name><url-pattern>/a/*</url-pattern><url-pattern>/b/*</url-pattern></servlet-mapping>\n"
+            "<servlet-mapping><servlet-name>s</servlet-name><url-pattern>/c/*</url-pattern></servlet-mapping></web-app>\n"
+        )
+        servlet = "package com.acme;\npublic class Img extends HttpServlet {\n  public void doGet(HttpServletRequest r) {}\n}\n"
+        routes = scan_routes({"WEB-INF/web.xml": web, "src/com/acme/Img.java": servlet})
+        self.assertEqual(paths_of(routes, "java-servlet"), ["/a/*", "/b/*", "/c/*"])
+        self.assertTrue(all(r["handler"]["file"].endswith("Img.java") for r in routes))
+
+    def test_handler_is_resolved_by_package_not_simple_name(self) -> None:
+        struts = CONFIG_XML_HEADER + (
+            '<struts-config><action-mappings><action path="/a" type="com.acme.one.ListAction"/>'
+            '<action path="/b" type="com.acme.two.ListAction"/>'
+            '<action path="/lib" type="org.other.ListAction"/></action-mappings></struts-config>\n'
+        )
+        routes = scan_routes({
+            "WEB-INF/struts-config.xml": struts,
+            "src/com/acme/one/ListAction.java": "package com.acme.one;\nclass ListAction {}\n",
+            "src/com/acme/two/ListAction.java": "package com.acme.two;\nclass ListAction {}\n",
+        })
+        handlers = {r["path"]: r["handler"]["file"] for r in routes}
+        self.assertEqual(handlers["/a.do"], "src/com/acme/one/ListAction.java")
+        self.assertEqual(handlers["/b.do"], "src/com/acme/two/ListAction.java")
+        self.assertEqual(handlers["/lib.do"], "WEB-INF/struts-config.xml")
+
+    def test_struts2_included_file_and_custom_extension(self) -> None:
+        main = CONFIG_XML_HEADER + (
+            "<struts><include file=\"struts-order.xml\"/>\n"
+            '<package name="m" namespace="/m"><action name="home" class="a.Home"/></package></struts>\n'
+        )
+        included = (
+            CONFIG_XML_HEADER
+            + '<!DOCTYPE struts PUBLIC "x" "y">\n<struts><package name="o" namespace="/o"><action name="view" class="a.View"/></package></struts>\n'
+        )
+        routes = scan_routes({
+            "src/main/resources/struts.xml": main,
+            "src/main/resources/struts-order.xml": included,
+            "src/main/resources/struts.properties": "struts.action.extension=rol\n",
+        })
+        self.assertEqual(paths_of(routes, "java-struts2"), ["/m/home.rol", "/o/view.rol"])
+
+    def test_struts2_extension_from_constant_with_blank_alternative(self) -> None:
+        xml = CONFIG_XML_HEADER + (
+            '<struts><constant name="struts.action.extension" value="do,,"/>\n'
+            '<package name="m" namespace="/m"><action name="home" class="a.Home"/></package></struts>\n'
+        )
+        routes = scan_routes({"src/main/resources/struts.xml": xml})
+        self.assertEqual(paths_of(routes, "java-struts2"), ["/m/home.do"])
+
+    def test_struts1_module_prefix_comes_from_web_xml(self) -> None:
+        web = CONFIG_XML_HEADER + (
+            "<web-app><servlet><servlet-name>a</servlet-name><servlet-class>org.apache.struts.action.ActionServlet</servlet-class>\n"
+            "<init-param><param-name>config/admin</param-name><param-value>/WEB-INF/admin/struts-config.xml</param-value></init-param>\n"
+            "</servlet></web-app>\n"
+        )
+        admin = CONFIG_XML_HEADER + '<struts-config><action-mappings><action path="/edit" type="a.Edit"/></action-mappings></struts-config>\n'
+        root = CONFIG_XML_HEADER + '<struts-config><action-mappings><action path="/home" type="a.Home"/></action-mappings></struts-config>\n'
+        routes = scan_routes({
+            "app/WEB-INF/web.xml": web,
+            "app/WEB-INF/admin/struts-config.xml": admin,
+            "app/WEB-INF/struts-config.xml": root,
+        })
+        self.assertEqual(paths_of(routes, "java-struts1"), ["/admin/edit.do", "/home.do"])
+
+    def test_spring_simple_url_handler_mapping(self) -> None:
+        servlet = CONFIG_XML_HEADER + (
+            '<beans><bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">\n'
+            '<property name="interceptors"><list><bean class="com.acme.Audit"></bean></list></property>\n'
+            '<property name="mappings"><props><prop key="/admin/order.form">orderForm</prop></props></property></bean>\n'
+            '<bean id="orderForm" class="com.acme.OrderFormController"/>\n</beans>\n'
+        )
+        routes = scan_routes({
+            "WEB-INF/app-servlet.xml": servlet,
+            "src/com/acme/OrderFormController.java": 'package com.acme;\nclass OrderFormController { void f() { getParameter("orderId"); } }\n',
+        })
+        spring = [r for r in routes if r["stack"] == "java-spring-mvc"]
+        self.assertEqual([r["path"] for r in spring], ["/admin/order.form"])
+        self.assertEqual(spring[0]["handler"]["file"], "src/com/acme/OrderFormController.java")
+        self.assertIn("orderId", [p["name"] for p in spring[0]["id_params"]])
+
+
+class TestSpringAnnotations(unittest.TestCase):
+    def test_annotation_between_modifier_and_return_type(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping("/q/h")\n  public @ResponseBody\n  List<Map<String, Object>> list(@RequestParam("itemId") int id) { return null; }\n'
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/q/h"])
+        self.assertEqual(routes[0]["handler"]["symbol"], "list")
+
+    def test_array_of_paths_gives_one_route_each(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping(value = {"list", ""})\n  public String list() { return ""; }\n',
+            '@RequestMapping(value = "/sys/user")',
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/sys/user", "/sys/user/list"])
+
+    def test_params_is_a_query_string_not_a_path(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping(params = "doDel")\n  public String del() { return ""; }\n'
+            '  @RequestMapping(value = "/x", params = "action=up")\n  public String up() { return ""; }\n',
+            '@RequestMapping("/item")',
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/item/x?action=up", "/item?doDel"])
+
+    def test_produces_is_not_a_path(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping(method = RequestMethod.POST, produces = "application/json")\n  public String p() { return ""; }\n',
+            '@RequestMapping("/item")',
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/item"])
+        self.assertEqual(routes[0]["method"], ["POST"])
+
+    def test_class_literal_in_a_method_does_not_become_the_class_prefix(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping(value = "export")\n  public String e() { new Excel(User.class); return ""; }\n'
+            '  @RequestMapping(value = "info")\n  public String i() { return ""; }\n',
+            '@RequestMapping(value = "/sys/user")',
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/sys/user/export", "/sys/user/info"])
+
+    def test_string_constant_path_is_resolved(self) -> None:
+        routes = scan_routes(controller(
+            '  private static final String PATH = "/admin/settings";\n'
+            '  @RequestMapping(value = PATH + "/save", method = RequestMethod.POST)\n  public String s() { return ""; }\n'
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/admin/settings/save"])
+
+    def test_placeholder_is_not_an_id_parameter(self) -> None:
+        routes = scan_routes(controller(
+            '  @RequestMapping(value = "{tenantId}/view")\n  public String v() { return ""; }\n',
+            '@RequestMapping(value = "${adminPath}/sys/user")',
+        ))
+        self.assertEqual([p["name"] for p in routes[0]["id_params"]], ["tenantId"])
+
+    def test_commented_out_annotation_is_not_a_route(self) -> None:
+        routes = scan_routes(controller(
+            '  // @RequestMapping(value = "old")\n  public String old() { return ""; }\n'
+            '  /*\n  @RequestMapping(value = "dead")\n  public String dead() { return ""; }\n  */\n'
+            '  @RequestMapping(value = "live")\n  public String live() { return ""; }\n',
+            '@RequestMapping("/item")',
+        ))
+        self.assertEqual(paths_of(routes, "java-spring-mvc"), ["/item/live"])
+
+
+class TestJspEntryPoints(unittest.TestCase):
+    def test_jsp_under_web_inf_is_not_a_route(self) -> None:
+        routes = scan_routes({"app/src/main/webapp/WEB-INF/jsps/editor/Entries.jsp": "<html/>\n"})
+        self.assertEqual(paths_of(routes, "java-jsp"), [])
+
+    def test_public_jsp_in_an_include_like_directory_is_a_route(self) -> None:
+        routes = scan_routes({"src/main/webapp/webpage/cgform/config/list.jsp": "<html/>\n"})
+        self.assertEqual(paths_of(routes, "java-jsp"), ["/webpage/cgform/config/list.jsp"])
+
+    def test_path_is_relative_to_the_web_root(self) -> None:
+        routes = scan_routes({"app/WebContent/order/detail.jsp": "<html/>\n"})
+        self.assertEqual(paths_of(routes, "java-jsp"), ["/order/detail.jsp"])
+
+
+class TestInjectionPrecision(unittest.TestCase):
+    def test_html_select_builder_is_not_sql(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  String f(String v) {\n"
+            "    StringBuffer sb = new StringBuffer();\n"
+            '    sb.append("<select name=\\"" + v + "\\">");\n'
+            '    sb.append("<option value=\\"" + v + "\\">" + v);\n'
+            "    return sb.toString();\n"
+            "  }\n"
+            "}\n"
+        )})
+        self.assertEqual(result["candidates"], [])
+
+    def test_freemarker_generator_template_is_not_a_mapper(self) -> None:
+        result = scan_injection({"src/main/resources/templates/gen/mapper.xml": (
+            '<template><content><![CDATA[\n<mapper namespace="${pkg}">\n<select id="x">\n'
+            "SELECT * FROM ${table.name} <#if flag>WHERE a = 1</#if>\n</select></mapper>\n]]></content></template>\n"
+        )})
+        self.assertEqual(result["candidates"], [])
+
+    def test_real_mapper_dollar_still_flagged(self) -> None:
+        result = scan_injection({"src/ItemDao.xml": (
+            '<mapper namespace="a.ItemDao">\n<select id="x">\nSELECT * FROM item ORDER BY ${page.orderBy}\n</select></mapper>\n'
+        )})
+        self.assertEqual([c["rule"] for c in result["candidates"]], ["mybatis-dollar"])
+
+    def test_positional_parameter_index_is_suppressed(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  String f(int size, String sortBy) {\n"
+            '    StringBuilder q = new StringBuilder("SELECT e FROM Entry e WHERE ");\n'
+            '    q.append(" AND e.name = ?").append(size);\n'
+            '    q.append(" ORDER BY ").append(sortBy);\n'
+            "    return q.toString();\n"
+            "  }\n"
+            "}\n"
+        )})
+        self.assertEqual([c["line"] for c in result["candidates"]], [5])
+        self.assertEqual([s["line"] for s in result["suppressed"]], [4])
+
+
+class TestInjectionRecall(unittest.TestCase):
+    def test_operand_on_a_continuation_line_is_flagged(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  void f(Connection c, String name) throws Exception {\n"
+            '    c.prepareStatement("INSERT INTO t (a) VALUES("\n'
+            "        + name + \",?)\");\n"
+            "  }\n"
+            "}\n"
+        )})
+        self.assertEqual([c["line"] for c in result["candidates"]], [4])
+
+    def test_leading_operand_call_on_a_continuation_line_is_flagged(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  int f(Connection c, Name n) {\n"
+            '    return get(c, "SELECT count(*) FROM concept WHERE locale = \'"\n'
+            "        + quote(n.getLocale())\n"
+            '        + "\'");\n'
+            "  }\n"
+            "}\n"
+        )})
+        self.assertIn(4, [c["line"] for c in result["candidates"]])
+
+    def test_constant_on_a_continuation_line_is_not_flagged(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  int f(Connection c) {\n"
+            '    return get(c, "SELECT count(*) FROM concept WHERE kind = \'"\n'
+            "        + ConceptNameType.FULLY_SPECIFIED\n"
+            '        + "\'");\n'
+            "  }\n"
+            "}\n"
+        )})
+        self.assertEqual(result["candidates"], [])
+
+    def test_jpql_literal_ending_in_where_is_flagged(self) -> None:
+        result = scan_injection({"src/A.java": (
+            "class A {\n"
+            "  String f(StringBuilder whereClause) {\n"
+            '    return "FROM MediaFile m WHERE " + whereClause;\n'
+            "  }\n"
+            "}\n"
+        )})
+        self.assertEqual([c["line"] for c in result["candidates"]], [3])
+
+
+class XmlDeclaredHandlerLineTests(unittest.TestCase):
+    """The headless auditor reads 15 lines around handler.line, so it must point at the entry method (#374)."""
+
+    IMPORTS = "".join(f"import a.b.C{n};\n" for n in range(30))
+
+    def handler_line(self, config_rel: str, config: str, source_rel: str, source: str) -> int:
+        routes = scan_routes({config_rel: CONFIG_XML_HEADER + config, source_rel: source})
+        return next(r["handler"]["line"] for r in routes if r["handler"]["file"] == source_rel)
+
+    def test_struts1_action_points_at_execute(self) -> None:
+        source = "package a;\n" + self.IMPORTS + (
+            "public class ViewAction extends Action {\n"
+            "  public ActionForward execute(ActionMapping m, ActionForm f,\n"
+            "      HttpServletRequest request, HttpServletResponse response) {\n"
+            '    return load(request.getParameter("id"));\n'
+            "  }\n"
+            "}\n"
+        )
+        line = self.handler_line(
+            "WEB-INF/struts-config.xml",
+            '<struts-config><action-mappings><action path="/view" type="a.ViewAction"/></action-mappings></struts-config>',
+            "src/a/ViewAction.java", source)
+        self.assertEqual(line, 33)
+
+    def test_struts2_action_points_at_the_declared_method(self) -> None:
+        source = "package a;\n" + self.IMPORTS + (
+            "public class ViewAction extends ActionSupport {\n"
+            "  public String execute() { return list(); }\n"
+            "  public String show() { return load(id); }\n"
+            "}\n"
+        )
+        line = self.handler_line(
+            "src/struts.xml",
+            '<struts><package name="p"><action name="view" class="a.ViewAction" method="show"/></package></struts>',
+            "src/a/ViewAction.java", source)
+        self.assertEqual(line, 34)
+
+    def test_servlet_from_web_xml_points_at_do_post(self) -> None:
+        source = "package a;\n" + self.IMPORTS + (
+            "public class ViewServlet extends HttpServlet {\n"
+            "  protected void doPost(HttpServletRequest req, HttpServletResponse res) { load(req); }\n"
+            "}\n"
+        )
+        line = self.handler_line(
+            "WEB-INF/web.xml",
+            "<web-app><servlet><servlet-name>v</servlet-name><servlet-class>a.ViewServlet</servlet-class></servlet>"
+            "<servlet-mapping><servlet-name>v</servlet-name><url-pattern>/view</url-pattern></servlet-mapping></web-app>",
+            "src/a/ViewServlet.java", source)
+        self.assertEqual(line, 33)
+
+    def test_class_without_a_known_entry_method_keeps_line_one(self) -> None:
+        source = "package a;\npublic class Helper {\n  void run() {}\n}\n"
+        line = self.handler_line(
+            "WEB-INF/struts-config.xml",
+            '<struts-config><action-mappings><action path="/h" type="a.Helper"/></action-mappings></struts-config>',
+            "src/a/Helper.java", source)
+        self.assertEqual(line, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_laravel_routes.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Laravel routes map to the controller method they name, not to their declaration (#380)."""
+
+from __future__ import annotations
+
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(TESTS_DIR.parent / "scripts"))
+from laravel_routes import route_action  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+from map_routes import map_routes  # noqa: E402
+
+ROUTES = """<?php
+use App\\Http\\Controllers\\OrderController;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/orders/{id}', [OrderController::class, 'show']);
+Route::post('/orders', 'OrderController@store');
+Route::get('/missing', [GoneController::class, 'index']);
+Route::get('/ping', function () { return 'ok'; });
+"""
+
+CONTROLLER = """<?php
+namespace App\\Http\\Controllers;
+
+use App\\Models\\Order;
+use Illuminate\\Http\\Request;
+
+class OrderController extends Controller
+{
+    public function show($id)
+    {
+        return Order::find($id);
+    }
+
+    public function store(Request $request)
+    {
+        return Order::create(['customer_id' => $request->input('customer_id')]);
+    }
+}
+"""
+
+
+class TestRouteAction(unittest.TestCase):
+    def test_array_and_string_actions(self) -> None:
+        self.assertEqual(route_action("Route::get('/a', [OrderController::class, 'show'])"), "OrderController@show")
+        self.assertEqual(route_action("Route::get('/a', [\\App\\Http\\Controllers\\OrderController::class, 'show'])"),
+                         "OrderController@show")
+        self.assertEqual(route_action("Route::post('/a', 'App\\Http\\Controllers\\OrderController@store')"),
+                         "OrderController@store")
+        self.assertIsNone(route_action("Route::get('/a', function () { return 1; })"))
+
+
+class TestLaravelHandlers(unittest.TestCase):
+    def setUp(self) -> None:
+        self.root = Path(tempfile.mkdtemp(prefix="lsa_laravel_"))
+        (self.root / "routes").mkdir()
+        (self.root / "app/Http/Controllers").mkdir(parents=True)
+        (self.root / "routes/web.php").write_text(ROUTES, encoding="utf-8")
+        (self.root / "app/Http/Controllers/OrderController.php").write_text(CONTROLLER, encoding="utf-8")
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def routes(self) -> dict:
+        found = map_routes(self.root, load_config(None), {"php-laravel"}, workers=1)["candidates"]
+        return {r["path"]: r for r in found if r["stack"] == "php-laravel"}
+
+    def test_route_points_at_the_controller_method(self) -> None:
+        show = self.routes()["/orders/{id}"]
+        self.assertEqual(show["handler"], {"file": "app/Http/Controllers/OrderController.php", "line": 9,
+                                           "symbol": "OrderController@show"})
+        self.assertEqual(show["notes"], "declared in routes/web.php:5")
+        self.assertIn("id", [p["name"] for p in show["id_params"]])
+
+    def test_string_action_and_body_inputs(self) -> None:
+        store = self.routes()["/orders"]
+        self.assertEqual((store["handler"]["file"], store["handler"]["line"]),
+                         ("app/Http/Controllers/OrderController.php", 14))
+        self.assertIn("customer_id", [p["name"] for p in store["id_params"]])
+
+    def test_unresolved_routes_keep_their_declaration(self) -> None:
+        routes = self.routes()
+        self.assertEqual(routes["/missing"]["handler"], {"file": "routes/web.php", "line": 7,
+                                                         "symbol": "GoneController@index"})
+        self.assertEqual(routes["/ping"]["handler"]["file"], "routes/web.php")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/contracts/schemas/persona-suite.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "operate/persona-suite.schema.json",
   "title": "Komagu test suite v2 (persona matrix)",
-  "description": "Personas and, per route, the personas allowed to call it. Every other persona must be refused (BFLA). Tokens come only from environment variables.",
+  "description": "Personas and, per route, the personas allowed to call it. Every other persona must be refused (BFLA). Tokens come only from environment variables; session cookies come from an environment variable or a file.",
   "type": "object",
   "required": [
     "version",
@@ -29,6 +29,15 @@
             "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
             "description": "Environment variable that holds this persona's bearer token. Omit for an anonymous persona."
           },
+          "cookie_env": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
+            "description": "Environment variable that holds this persona's Cookie value, e.g. JSESSIONID=... Use for session-based apps instead of token_env."
+          },
+          "cookie_file": {
+            "type": "string",
+            "description": "Path to a file that holds this persona's Cookie value."
+          },
           "description": {
             "type": "string"
           }
@@ -75,7 +84,7 @@
           },
           "payload": {
             "type": "object",
-            "description": "JSON body for writes."
+            "description": "Body fields for writes, encoded as set by body_format."
           },
           "allow": {
             "type": "array",
@@ -106,6 +115,33 @@
                 "description": "Request that returns the stored object, e.g. 'GET /api/profile' (default: GET on the route path)."
               }
             }
+          },
+          "body_format": {
+            "enum": [
+              "json",
+              "form"
+            ],
+            "default": "json",
+            "description": "Body encoding. form sends application/x-www-form-urlencoded."
+          },
+          "csrf": {
+            "type": "object",
+            "required": [
+              "page",
+              "field"
+            ],
+            "additionalProperties": false,
+            "description": "Fetch this page before each write and send the token found in the named field.",
+            "properties": {
+              "page": {
+                "type": "string",
+                "pattern": "^/"
+              },
+              "field": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
           }
         }
       }

package/examples/member-portal/backend-dotnet/Dockerfile

@@ -10,6 +10,7 @@ RUN dotnet publish examples/member-portal/backend-dotnet/MemberPortal.Backend.cs
 FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
 WORKDIR /app
 COPY --from=build /app/publish .
-RUN mkdir -p /app/data
+RUN mkdir -p /app/data && chown app:app /app/data
 EXPOSE 5001
+USER app
 ENTRYPOINT ["dotnet", "MemberPortal.Backend.dll"]

package/examples/member-portal/backend-spring/Dockerfile

@@ -9,5 +9,7 @@ RUN gradle -p examples/member-portal/backend-spring bootJar --no-daemon
 FROM eclipse-temurin:17-jre-alpine AS final
 WORKDIR /app
 COPY --from=build /home/gradle/src/examples/member-portal/backend-spring/build/libs/*.jar app.jar
+RUN addgroup -S komagu && adduser -S -G komagu komagu
 EXPOSE 5002
+USER komagu
 ENTRYPOINT ["java", "-jar", "app.jar"]

package/examples/member-portal/docker-compose.yml

@@ -49,7 +49,7 @@ services:
       dockerfile: Dockerfile
     container_name: komagu-demo-frontend
     ports:
-      - "3000:80"
+      - "3000:8080"
     depends_on:
       - backend-dotnet
 

package/examples/member-portal/frontend/Dockerfile

@@ -5,7 +5,8 @@ RUN npm install
 COPY . .
 RUN npm run build
 
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
 COPY --from=build /app/dist /usr/share/nginx/html
-EXPOSE 80
+EXPOSE 8080
+USER 101
 CMD ["nginx", "-g", "daemon off;"]