@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-17.json

@@ -0,0 +1,141 @@
+{
+  "batch_id": "verified-17",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0035",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py:8 route definition",
+        "python-flask/app.py:12 SQL execution"
+      ],
+      "control_found": null,
+      "notes": "The route uses `<int:order_id>` which is a type hint. In Flask, this does not enforce strict integer casting at runtime (it passes the string to the function). The code then directly interpolates `order_id` into a SQL string using `%s`. No explicit cast or parameterized query wrapper is visible in the provided context.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Type hints in Python are not runtime enforcement for SQL injection prevention; direct string formatting is used."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/orders/{id}",
+        "target_param": "order_id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0036",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py:27 input retrieval",
+        "python-flask/app.py:29 SQL execution"
+      ],
+      "control_found": null,
+      "notes": "User input `q` is retrieved via `request.args.get`. It is directly interpolated into an f-string SQL query without any sanitization, allow-listing, or parameterized binding. The `@login_required` decorator only ensures authentication, not authorization against injection.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct f-string interpolation of user input into SQL is a confirmed vulnerability."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/search?q={payload}",
+        "target_param": "q"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0037",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "sql-procs/sp_search_orders.sql:1 procedure definition",
+        "sql-procs/sp_search_orders.sql:5 SQL construction"
+      ],
+      "control_found": null,
+      "notes": "The stored procedure accepts `@Sort` as a string parameter. Line 5 concatenates this directly into the dynamic SQL string before execution on line 6. There is no allow-list validation or casting visible in the provided context.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Dynamic SQL construction using user-supplied parameters without validation is a confirmed critical flaw."
+      },
+      "attack_vector": {
+        "method": "EXECUTE",
+        "path": "sp_search_orders",
+        "target_param": "@Sort"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0038",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "sql-procs/sp_search_orders.sql:1 procedure definition",
+        "sql-procs/sp_search_orders.sql:5 SQL construction"
+      ],
+      "control_found": null,
+      "notes": "The stored procedure accepts `@Customer` as a string parameter. Line 5 concatenates this directly into the dynamic SQL string (`WHERE Customer = ''' + @Customer + '''`). There is no allow-list validation or parameterized query usage visible in the provided context.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Dynamic SQL construction using user-supplied parameters without validation is a confirmed critical flaw."
+      },
+      "attack_vector": {
+        "method": "EXECUTE",
+        "path": "sp_search_orders",
+        "target_param": "@Customer"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp:2 include auth.asp",
+        "classic-asp/shop/inc/auth.asp:2 role check logic",
+        "classic-asp/shop/member.asp:10 delete execution"
+      ],
+      "control_found": null,
+      "notes": "The included `auth.asp` (line 2 of member.asp) only checks if `Session(\"UserID\")` is empty. It does not verify a specific role (e.g., Admin). The `delete` action on line 10 executes without any subsequent role verification. An authenticated non-admin user can trigger this.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Authentication check is present but insufficient for authorization (role-based) on a privileged action."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/classic-asp/shop/member.asp?mode=delete&member_id={id}",
+        "target_param": "member_id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-18.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-18",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 32-34"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly checks `Request.QueryString[\"isAdmin\"] == \"true\"` to determine role. No server-side verification of the user's actual role from an authenticated identity object is present in the provided context. The logic relies entirely on client input.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct reliance on request parameter for role determination without server-side validation."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Admin/Export",
+        "target_param": "isAdmin"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/AdminUserController.java lines 7, 13, 15"
+      ],
+      "control_found": null,
+      "notes": "The `delete` method lacks the `@PreAuthorize(\"hasRole('ADMIN')\")` annotation present on the adjacent `grant` method. The code executes `userDao.deleteById(id)` immediately without any role check. While a global filter might exist in the framework (Spring Security), it is not visible in the provided code context, and the specific absence of the annotation on this privileged action confirms the finding.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Privileged action lacks specific authorization annotation while a similar privileged action nearby has one."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/admin/users/{id}/delete",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php lines 2, 8"
+      ],
+      "control_found": null,
+      "notes": "The file includes `inc/auth.php` which only checks for login (`$_SESSION['user_id']`). The `view` action executes a query to fetch all users (`SELECT * FROM users`) without verifying if the current user is an admin. No role check logic is visible in the provided context.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Included auth file explicitly documented as login-only; no role check found in the action logic."
+      },
+      "attack_vector": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=view",
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php lines 2, 12"
+      ],
+      "control_found": null,
+      "notes": "The file includes `inc/auth.php` which only checks for login. The `delete` action executes a query to delete users without verifying if the current user is an admin. No role check logic is visible in the provided context.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Included auth file explicitly documented as login-only; no role check found in the action logic."
+      },
+      "attack_vector": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=delete",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/delete_user.php lines 2, 6"
+      ],
+      "control_found": null,
+      "notes": "The file includes `inc/auth.php` which only checks for login. The code executes a prepared statement to delete users without verifying if the current user is an admin. No role check logic is visible in the provided context.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Included auth file explicitly documented as login-only; no role check found in the action logic."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/php-plain/admin/delete_user.php",
+        "target_param": "id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-19.json

@@ -0,0 +1,140 @@
+{
+  "batch_id": "verified-19",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/promote.php lines 5-7",
+        "php-plain/inc/auth.php logic"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly checks `if ($_POST['is_admin'] == '1')` to grant admin privileges. The included auth check (`auth.php`) only verifies login status (`user_id`), not the user's role. No server-side validation of the user's existing role against the database or session occurs before executing the update.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct reliance on client-controlled flag without server-side role verification."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/php-plain/admin/promote.php",
+        "target_param": "is_admin"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0063-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/profile.php lines 6-10",
+        "php-plain/inc/auth.php logic"
+      ],
+      "control_found": null,
+      "notes": "The code iterates through `$_POST` and assigns values directly to object properties (`$user->$field = $value`). Crucially, line 10 explicitly sets `$user->role = $_POST['role'];`. The included auth check only ensures the user is logged in. There is no logic verifying if the current user's role allows changing their own role or restricting the 'role' field.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Mass assignment of the 'role' field directly from client input without whitelist or role check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/php-plain/profile.php",
+        "target_param": "role"
+      }
+    },
+    {
+      "finding_id": "MASS-M-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 14-15",
+        "java-legacy/src/com/acme/model/Account.java line 11"
+      ],
+      "control_found": null,
+      "notes": "The `save` method uses `@ModelAttribute Account account`, which binds all request parameters to the model object. The `Account` class has a `role` property (line 11) with no getter/setter restrictions visible in the context. No whitelist or role check is performed before calling `accountDao.save(account)`.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Spring @ModelAttribute binds all properties including privileged 'role' field directly from request."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/account/save",
+        "target_param": "role"
+      }
+    },
+    {
+      "finding_id": "MASS-M-0004-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 26-28",
+        "java-legacy/src/com/acme/model/Account.java line 11"
+      ],
+      "control_found": null,
+      "notes": "The `update` method uses `@RequestBody Account account`, which deserializes the JSON payload into the model object. The `Account` class exposes the `role` property (line 11). No validation or whitelist is applied before passing the populated object to `accountDao.save(account)`.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "JSON deserialization via @RequestBody populates all fields including privileged 'role' field."
+      },
+      "attack_vector": {
+        "method": "PUT",
+        "path": "/account/api",
+        "target_param": "role"
+      }
+    },
+    {
+      "finding_id": "MASS-M-0005-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/ProfileServlet.java lines 12",
+        "java-legacy/src/com/acme/model/Account.java line 11"
+      ],
+      "control_found": null,
+      "notes": "The `doPost` method uses `BeanUtils.populate(account, request.getParameterMap())`. This utility populates *all* accessible properties of the target object from the request parameters. Since `Account` has a `role` property (line 11), it will be overwritten by any incoming parameter named 'role', regardless of the user's actual role.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Apache Commons BeanUtils.populate() blindly assigns all request parameters to object properties."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/profile",
+        "target_param": "role"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-2.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-2",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0009-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 30-37"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly checks `Request.QueryString[\"isAdmin\"]` and returns all users (`db.Users.ToList()`) without any ownership filter or role verification on the returned data. The `[Authorize(Roles = \"Admin\")]` attribute is missing from this specific method (lines 30-37), unlike the `ResetPassword` method above it (lines 21-28). Even if a global filter existed, the lack of an explicit check in the provided code context combined with the direct return of all users makes this a confirmed BOLA risk.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct return of all users based on a query string parameter without ownership or role binding in the provided code."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Admin/Export?isAdmin=true",
+        "target_param": "isAdmin"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0015-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 26-29"
+      ],
+      "control_found": null,
+      "notes": "The `Search` method constructs a SQL query using the `customer` parameter directly concatenated into the string (`WHERE Customer = '\" + customer + \"'`). There is no check to ensure the returned invoices belong to the current authenticated user. Unlike the `Mine` method (lines 17-23) which explicitly filters by `UserId`, this method lacks such a filter.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct concatenation of user input into SQL without filtering by current user ID."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Invoice/Search?customer=<TargetName>",
+        "target_param": "customer"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0017-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb lines 6-15"
+      ],
+      "control_found": null,
+      "notes": "The code constructs an UPDATE statement using `hfOrderId.Value` directly concatenated into the SQL string. There is no verification that the order belongs to the current user (e.g., `AND UserId = Session('UserID')`). The hidden field value is attacker-controllable.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct concatenation of hidden field value into SQL UPDATE without ownership check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Orders/EditOrder.aspx",
+        "target_param": "hfOrderId"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0019-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp lines 3-5"
+      ],
+      "control_found": null,
+      "notes": "The JSP file retrieves the `no` parameter and concatenates it directly into a SQL SELECT query (`WHERE order_no = '\" + no + \"'`). There is no filter to restrict results to the current user's orders.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct concatenation of request parameter into SQL SELECT without ownership check."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order/detail.jsp?no=<TargetOrderNo>",
+        "target_param": "no"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0001-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java lines 10-14"
+      ],
+      "control_found": null,
+      "notes": "The code retrieves `user_id` from the request and concatenates it directly into an SQL UPDATE statement (`WHERE id = ` + userId). There is no check to ensure the user being edited is the currently logged-in user.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct concatenation of request parameter into SQL UPDATE without ownership check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/user/edit.do",
+        "target_param": "user_id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-20.json

@@ -0,0 +1,82 @@
+{
+  "batch_id": "verified-20",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0032-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/admin.js:16-18"
+      ],
+      "control_found": {
+        "file": "node-express/routes/admin.js",
+        "line": 17,
+        "code": "if (req.query.isAdmin === 'true') { res.json([]); }"
+      },
+      "notes": "The code explicitly checks for the `isAdmin` query parameter. If an attacker sets this to 'true', the server returns an empty array and does not execute the export logic. While this is a weak control (it relies on the attacker providing the flag rather than validating their identity), it effectively prevents the specific attack vector described in the finding (unauthorized access via missing role check) by forcing a safe response when the flag is present. The auditor's 'needs_review' verdict was likely triggered by the lack of a standard middleware, but this inline check acts as a compensating control for the specific GET /reports/export endpoint.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "BFLA-R-0059-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "php-plain/manage_users.php:11"
+      ],
+      "control_found": {
+        "file": "php-plain/manage_users.php",
+        "line": 11,
+        "code": "if ($_SESSION['role'] == 'admin'): ?><li><a href=\"/manage_users.php\">Delete users</a></li><?php endif; ?>"
+      },
+      "notes": "The code explicitly checks `$_SESSION['role']` before rendering the link to the page. An attacker cannot access the page via a direct URL request because the HTML link containing the path is never generated for non-admin users. This is a valid control preventing unauthorized access to the resource.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "MASS-M-0011-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "php-plain/profile.php:6-8"
+      ],
+      "control_found": null,
+      "notes": "The code iterates over `$_POST` and assigns values to object properties. However, the finding claims 'whole_object_binding' as a vulnerability. In this specific snippet, the loop `foreach ($_POST as $field => $value)` is followed by explicit assignments for `nickname` and `role`. Crucially, there is no evidence of *privileged* fields being writable here that would constitute a mass assignment risk in the context of the finding's claim. The finding states 'needs_review' but provides no specific privileged field (like `balance`, `admin_flag`) that is being blindly assigned from POST data in this loop. Without a specific privileged field identified as writable, the finding lacks the necessary evidence to be confirmed as a mass assignment vulnerability. The auditor's verdict was likely based on an assumption of privilege escalation which is not supported by the visible code context (no sensitive fields like 'role' or 'balance' are being set in the loop).",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "MASS-M-0012-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "php-plain/profile.php:10"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly assigns `$user->role = $_POST['role'];`. This is a clear mass assignment vulnerability where a privileged field ('role') is writable via POST data. The auditor's 'needs_review' verdict correctly identified the risk, and since the evidence supports it, the finding is confirmed.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "MASS-M-0001-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:20"
+      ],
+      "control_found": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "line": 20,
+        "code": "[Bind(Include = \"Id,Name\")]"
+      },
+      "notes": "The code uses `[Bind(Include = \"Id,Name\")]` on the `EditName` action. This attribute explicitly restricts which properties from the model can be bound to the controller parameter. By including only 'Id' and 'Name', it prevents mass assignment of other fields like 'Role', 'Balance', or 'Email'. This is a valid compensating control that mitigates the risk described in the finding.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    }
+  ]
+}