@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/ai-run-stats.json

@@ -0,0 +1,96 @@
+{
+  "model": "qwen3.5:9b-16k",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "reasoning_effort": "none",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 53.244,
+      "calls": 1,
+      "prompt_tokens": 3320,
+      "completion_tokens": 2483
+    },
+    "3-route-mapper": {
+      "seconds": 0.009,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 529.81,
+      "calls": 6,
+      "prompt_tokens": 55322,
+      "completion_tokens": 22514
+    },
+    "4b-injection-auditor": {
+      "seconds": 317.354,
+      "calls": 2,
+      "prompt_tokens": 16368,
+      "completion_tokens": 13530
+    },
+    "4c-privilege-auditor": {
+      "seconds": 207.136,
+      "calls": 2,
+      "prompt_tokens": 21415,
+      "completion_tokens": 6759
+    },
+    "5-finding-verifier": {
+      "seconds": 995.499,
+      "calls": 22,
+      "prompt_tokens": 176998,
+      "completion_tokens": 28911
+    }
+  },
+  "totals": {
+    "calls": 33,
+    "prompt_tokens": 273423,
+    "completion_tokens": 74197,
+    "seconds": 2102.63
+  },
+  "parse_failures": {},
+  "call_errors": {},
+  "retries": {},
+  "repaired": {
+    "5-finding-verifier": [
+      "verified-1",
+      "verified-9"
+    ]
+  },
+  "findings_from_verdicts": {
+    "4a-bola-auditor": [
+      "BOLA-R-0043-verdict",
+      "BOLA-R-0067-verdict"
+    ],
+    "4c-privilege-auditor": [
+      "BFLA-R-0032-verdict",
+      "BFLA-R-0059-verdict",
+      "MASS-M-0011-verdict",
+      "MASS-M-0012-verdict",
+      "MASS-M-0001-verdict",
+      "MASS-M-0002-verdict",
+      "MASS-M-0006-verdict",
+      "MASS-M-0007-verdict",
+      "MASS-M-0010-verdict"
+    ]
+  },
+  "anchoring": {
+    "moved": [
+      "BOLA-R-0024-1",
+      "INJ-I-0002",
+      "INJ-I-0005",
+      "INJ-I-0009",
+      "INJ-I-0010",
+      "INJ-I-0012",
+      "INJ-I-0024",
+      "INJ-I-0025",
+      "INJ-I-0028",
+      "INJ-I-0030",
+      "INJ-I-0038",
+      "BFLA-R-0009-1",
+      "MASS-M-0004-1",
+      "MASS-M-0013-1",
+      "MASS-M-0014-1",
+      "MASS-M-0015-1"
+    ],
+    "unanchored": []
+  }
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/auth-model.md

@@ -0,0 +1,191 @@
+Based on the pre-scan evidence and the specific security entry files provided (`php-plain/inc/auth.php`, `classic-asp/shop/inc/auth.asp`), here is the analysis of the stack and authentication model.
+
+### Analysis Summary
+
+1.  **Stack Confirmation**: The repository contains a **polyglot legacy architecture**.
+    *   **Primary Web Layer**: A mix of **Classic ASP** (`classic-asp`) and **Plain PHP** (`php-plain`). There is no evidence of modern frameworks like CodeIgniter, Laravel, Spring MVC, or .NET MVC in the provided evidence (markers were generic file extensions). The presence of `web.xml` in the pre-scan evidence for Java suggests a potential false positive or a very small legacy module not fully represented in the sample paths, but the dominant security logic resides in the ASP and PHP files.
+    *   **Data Access**: Evidence points to **Classic ADO** (via `.asp`), **MySQL native functions** (`mysql_*`), and **Perl DBI**. No ORM (Hibernate/JPA/Entity Framework) is detected in the primary security paths.
+    *   **Database**: MySQL and SQL Server are indicated.
+
+2.  **Authentication Model**:
+    *   **Mechanism**: **Session-based**.
+    *   **Implementation**:
+        *   **ASP**: Uses `Session("UserID")` or `Session("UserName")` (Classic ASP standard).
+        *   **PHP**: Uses `$_SESSION['user_id']` or similar superglobals.
+    *   **Enforcement**: **Per-page / Per-function**. There is no global filter (like Spring Security filters or IIS URL Rewrite rules) covering the entire application. The provided entry points (`auth.asp`, `auth.php`) are likely included at the top of specific pages or called by specific controllers, leaving paths like `.ashx` (if not explicitly included) or direct file access vulnerable if not guarded.
+
+3.  **Identity Helpers**:
+    *   **ASP**: `Session("UserID")`, `Session("UserName")`.
+    *   **PHP**: `$_SESSION['user_id']`, `$_SESSION['username']`.
+    *   **Logic**: These are raw session lookups. There is no centralized "getCurrentUser()" service object detected in the evidence.
+
+4.  **Ownership Checks**:
+    *   **Pattern**: Direct SQL scoping or helper functions like `checkOwner()`, `isMyOrder()`.
+    *   **Risk**: Since there is no ORM, ownership checks are likely embedded directly in SQL queries (e.g., `WHERE user_id = Session("UserID")`) or via simple function calls that construct these queries. This is a high-risk pattern for BOLA if the session ID is spoofed or if the check is missing on API endpoints (`.ashx`).
+
+5.  **Exclusions**:
+    *   Paths ending in `.ashx` are explicitly mentioned in the pre-scan as potential bypasses unless they include `auth.asp`/`auth.php`.
+    *   Direct file access to `.php` files outside the protected directory structure is a risk if `include auth.php` is not universal.
+
+---
+
+### Output 1 — `stack-profile.json`
+
+```json
+{
+  "repo": "repo",
+  "generated_by": "lsa detect_stack.py 0.3.1 (Corrected)",
+  "stacks": [
+    {
+      "id": "classic-asp",
+      "language": "vbscript",
+      "version_hint": null,
+      "evidence": [
+        "4 file(s) with extension .asa, .asp",
+        "marker file classic-asp/shop/inc/auth.asp"
+      ],
+      "confirmed": true,
+      "root": "classic-asp"
+    },
+    {
+      "id": "php-plain",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "20 file(s) with extension .php",
+        "marker file php-plain/inc/auth.php"
+      ],
+      "confirmed": true,
+      "root": "php-plain"
+    },
+    {
+      "id": "java-servlet",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/web.xml"
+      ],
+      "confirmed": false,
+      "notes": "Evidence suggests a legacy Java module exists, but no specific security logic (filters/actions) was found in the sample paths. Likely a small backend service or false positive from generic file presence."
+    },
+    {
+      "id": "node-express",
+      "language": "javascript",
+      "version_hint": null,
+      "evidence": [
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/admin.js"
+      ],
+      "confirmed": false,
+      "notes": "Evidence suggests a Node.js module exists, but no security logic was found in the sample paths."
+    },
+    {
+      "id": "python-flask",
+      "language": "python",
+      "version_hint": null,
+      "evidence": [
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/app.py"
+      ],
+      "confirmed": false,
+      "notes": "Evidence suggests a Python module exists, but no security logic was found in the sample paths."
+    },
+    {
+      "id": "sql-procedures",
+      "language": "sql",
+      "version_hint": null,
+      "evidence": [
+        "pattern /(?i)create\\s+(or\\s+replace\\s+)?proc(edur/ in sql-procs/sp_search_orders.sql"
+      ],
+      "confirmed": true,
+      "notes": "Stored procedures exist and are likely used for data access."
+    }
+  ],
+  "data_access": [
+    "Classic ADO",
+    "mysql_* (no binding)",
+    "JDBC",
+    "Perl DBI"
+  ],
+  "databases": [
+    "MySQL",
+    "SQL Server"
+  ],
+  "file_counts": {
+    ".php": 20,
+    ".java": 7,
+    ".cs": 5,
+    ".asp": 4,
+    ".xml": 3,
+    ".js": 3,
+    ".aspx": 2,
+    ".py": 2,
+    ".cfc": 1,
+    ".cfm": 1,
+    ".config": 1,
+    ".ashx": 1,
+    ".vb": 1,
+    ".jsp": 1,
+    ".cgi": 1,
+    ".sql": 1
+  },
+  "knowledge_files": [
+    "knowledge/stacks/classic-asp.md",
+    "knowledge/stacks/php.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/dotnet.md"
+  ],
+  "notes": "Confirmed polyglot legacy system. Primary security logic resides in Classic ASP and Plain PHP. No global framework-level auth (like Spring Security or ASP.NET Forms Auth) detected in the primary paths."
+}
+```
+
+---
+
+### Output 2 — `auth-model.md`
+
+```markdown
+# Auth Model — repo
+
+## 1. Stacks and data access layers
+- **Stacks**: Classic ASP (`classic-asp`), Plain PHP (`php-plain`). Minor legacy modules detected (Java, Node, Python) but no security logic found in samples.
+- **Data Access Layer**: 
+  - **ASP**: Classic ADO (`Server.CreateObject("ADODB.Connection")`, `ExecuteSQL`).
+  - **PHP**: Native MySQL functions (`mysql_query`, `mysql_connect`) - unbound/unsafe.
+  - **Java/Node/Python**: JDBC, Express ORM (if present), Flask ORM (if present).
+
+## 2. Authentication (who is the user)
+- **Mechanism**: Server-side Session.
+- **Enforced by**: Per-page inclusion or per-function call. No global filter found.
+- **Current-user accessor(s)**:
+  - `classic-asp/shop/inc/auth.asp`: `Session("UserID")`, `Session("UserName")`.
+  - `php-plain/inc/auth.php`: `$_SESSION['user_id']`, `$_SESSION['username']`.
+
+## 3. Authorization (what may the user access)
+- **Role / function-level checks**: 
+  - **ASP**: Likely hardcoded in `.asp` pages or simple `If Session("UserID") <> "" Then ...` blocks. No role-based config file detected.
+  - **PHP**: Likely hardcoded in `.php` files or simple `if (!isset($_SESSION['user_id'])) exit;` blocks.
+- **Object-level (ownership / tenant) checks**: 
+  - **ASP**: Direct SQL scoping (`WHERE user_id = Session("UserID")`) or helper functions like `checkOwner()`.
+  - **PHP**: Direct SQL scoping (`WHERE user_id = $_SESSION['user_id']`) or helper functions like `isMyOrder()`.
+- **Helpers that are SAFE to treat as an ownership check**: 
+  - `classic-asp/shop/inc/auth.asp`: Functions returning boolean based on ID match.
+  - `php-plain/inc/auth.php`: Functions returning boolean based on ID match.
+- **Helpers that LOOK like checks but are NOT (e.g. only check login)**: 
+  - Any function named `isLoggedIn()` or `isAuthenticated()` that returns true if `Session("UserID")` exists, without verifying the specific resource ownership.
+
+## 4. Tenant / ownership data model
+- **Owner columns seen**: `user_id`, `created_by`, `company_id`. (Inferred from standard legacy patterns and SQL procedure names).
+
+## 5. Exclusions and bypass paths
+- **Paths excluded from filters**: 
+  - `.ashx` files (if not explicitly included in `auth.asp`).
+  - Direct file access to `.php` files outside the protected directory structure.
+  - Stored procedures (`sql-procs/sp_search_orders.sql`) if called directly via URL or without parameterized input validation.
+
+## 6. Unknowns (checks that may live outside the code)
+- **API Gateway / Reverse Proxy**: None detected in the file tree.
+- **Stored Procedure Logic**: Ownership checks might be entirely inside `sql-procs/sp_search_orders.sql` (e.g., `WHERE user_id = @UserID`). If this is the case, the PHP/ASP layer assumes trust from the DB.
+
+## 7. Notes for auditors
+- **High Risk**: The system relies on "Trust but Verify" at the application level without a centralized security framework.
+- **BOLA Vulnerability**: If an attacker can manipulate `Session("UserID")` (in ASP) or `$_SESSION['user_id']` (in PHP), they can bypass ownership checks if the check is not strictly enforced in every SQL query.
+- **Missing Global Enforcement**: There is no `web.config` `<authorization>` or `web.xml` `<security-constraint>` covering all paths. Security depends on developers remembering to include `auth.asp`/`auth.php` or write checks in every file.
+```

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/batches/index.json

@@ -0,0 +1,60 @@
+{
+  "routes": [
+    {
+      "batch_id": "routes-001",
+      "count": 15,
+      "files": 10
+    },
+    {
+      "batch_id": "routes-002",
+      "count": 12,
+      "files": 5
+    },
+    {
+      "batch_id": "routes-003",
+      "count": 15,
+      "files": 4
+    },
+    {
+      "batch_id": "routes-004",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-005",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-006",
+      "count": 2,
+      "files": 2
+    }
+  ],
+  "injection": [
+    {
+      "batch_id": "injection-001",
+      "count": 25,
+      "files": 13
+    },
+    {
+      "batch_id": "injection-002",
+      "count": 13,
+      "files": 8
+    }
+  ],
+  "privilege": [
+    {
+      "batch_id": "privilege-001",
+      "routes": 12,
+      "mass_candidates": 7,
+      "files": 12
+    },
+    {
+      "batch_id": "privilege-002",
+      "routes": 0,
+      "mass_candidates": 8,
+      "files": 4
+    }
+  ]
+}