@hoanghainh/komagu 2.5.0 → 2.6.1

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.6.1](https://github.com/hoanghainh1188/komagu/compare/v2.6.0...v2.6.1) (2026-11-11)
+
+
+### Bug Fixes
+
+* **deps:** raise vulnerable minimum versions and gate dependency audits ([#391](https://github.com/hoanghainh1188/komagu/issues/391)) ([40173a3](https://github.com/hoanghainh1188/komagu/commit/40173a36826b9a69ecb1046159d077381494850c))
+* **security:** clear the 64 open code scanning alerts before gating ([#388](https://github.com/hoanghainh1188/komagu/issues/388)) ([49372da](https://github.com/hoanghainh1188/komagu/commit/49372da959690251db6d0810c60eb15ba3f2591f))
+
+
+### Documentation
+
+* **pilot:** pin the runbook to v2.6.0 ([#386](https://github.com/hoanghainh1188/komagu/issues/386)) ([b416ff8](https://github.com/hoanghainh1188/komagu/commit/b416ff8613410d74b71a485a1ac05297abf164c6))
+
+## [2.6.0](https://github.com/hoanghainh1188/komagu/compare/v2.5.0...v2.6.0) (2026-11-11)
+
+
+### Features
+
+* **ai:** add --ai-reasoning-effort for headless AI requests ([#383](https://github.com/hoanghainh1188/komagu/issues/383)) ([18678c3](https://github.com/hoanghainh1188/komagu/commit/18678c3c2b68e1f664902b9d1277e672d99702a6))
+
+
+### Bug Fixes
+
+* **ai:** stop inventing path ids and map Laravel routes to controller methods ([#381](https://github.com/hoanghainh1188/komagu/issues/381)) ([bfef7f0](https://github.com/hoanghainh1188/komagu/commit/bfef7f0bba6c3ca51f15186ea348661a8cff01b3))
+
+
+### Documentation
+
+* **pilot:** pin the runbook to v2.5.0 ([#377](https://github.com/hoanghainh1188/komagu/issues/377)) ([5bf3997](https://github.com/hoanghainh1188/komagu/commit/5bf3997b4ad60048c5ed8cb4f9da69926b85e56b))
+
 ## [2.5.0](https://github.com/hoanghainh1188/komagu/compare/v2.4.0...v2.5.0) (2026-11-10)
 
 

package/assess/lsa/examples/eval-run-6/gptoss-a/ai-run-stats.json

@@ -0,0 +1,87 @@
+{
+  "model": "gpt-oss:20b",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 70.138,
+      "calls": 1,
+      "prompt_tokens": 3111,
+      "completion_tokens": 2599
+    },
+    "3-route-mapper": {
+      "seconds": 0.008,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 668.959,
+      "calls": 6,
+      "prompt_tokens": 47070,
+      "completion_tokens": 25435
+    },
+    "4b-injection-auditor": {
+      "seconds": 355.556,
+      "calls": 2,
+      "prompt_tokens": 15807,
+      "completion_tokens": 13395
+    },
+    "4c-privilege-auditor": {
+      "seconds": 259.07,
+      "calls": 2,
+      "prompt_tokens": 18324,
+      "completion_tokens": 9192
+    },
+    "5-finding-verifier": {
+      "seconds": 1041.91,
+      "calls": 22,
+      "prompt_tokens": 146767,
+      "completion_tokens": 33792
+    }
+  },
+  "totals": {
+    "calls": 33,
+    "prompt_tokens": 231079,
+    "completion_tokens": 84413,
+    "seconds": 2395.175
+  },
+  "parse_failures": {},
+  "call_errors": {},
+  "retries": {},
+  "repaired": {},
+  "findings_from_verdicts": {
+    "4a-bola-auditor": [
+      "BOLA-R-0055-verdict",
+      "BOLA-R-0056-verdict",
+      "BOLA-R-0052-verdict",
+      "BOLA-R-0053-verdict",
+      "BOLA-R-0054-verdict"
+    ],
+    "4c-privilege-auditor": [
+      "MASS-M-0011-verdict",
+      "MASS-M-0012-verdict",
+      "MASS-M-0001-verdict",
+      "MASS-M-0002-verdict"
+    ]
+  },
+  "anchoring": {
+    "moved": [
+      "BOLA-R-0057-2",
+      "INJ-I-0027",
+      "INJ-I-0029",
+      "BFLA-R-0007-1",
+      "BFLA-R-0009-1",
+      "BFLA-R-0023-1",
+      "BFLA-R-0030-1",
+      "BFLA-R-0032-1",
+      "MASS-M-0003-1",
+      "MASS-M-0006-1",
+      "MASS-M-0007-1",
+      "MASS-M-0010-1",
+      "MASS-M-0013-1",
+      "MASS-M-0015-1",
+      "MASS-M-0014-1"
+    ],
+    "unanchored": []
+  }
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/auth-model.md

@@ -0,0 +1,120 @@
+# Auth Model — repo
+
+## 0. Sub‑applications
+
+| folder | stack ids | web root |
+|--------|-----------|----------|
+| php‑plain | php‑plain | `/php-plain/` |
+| classic‑asp | classic‑asp | `/classic‑asp/` |
+
+---
+
+## 1. Stacks and data access layers
+
+| Stack | Language | Data‑access |
+|-------|----------|-------------|
+| php‑plain | PHP 8.x | PDO (MySQL) – prepared statements, bound parameters |
+| classic‑asp | Classic ASP (VBScript) | ADO – `ADODB.Connection` + `ADODB.Command` (MySQL / SQL Server) |
+
+Both stacks use a relational database (MySQL for php‑plain, SQL Server for classic‑asp). No ORM or framework‑level data layer is present.
+
+---
+
+## 2. Authentication (who is the user)
+
+- **Mechanism**  
+  *Session‑based* authentication.  
+  - PHP: `session_start()` in `php-plain/inc/auth.php`.  
+  - Classic ASP: `Session` object in `classic-asp/shop/inc/auth.asp`.
+
+- **Enforced by**  
+  - Global include: every PHP page that requires authentication includes `php-plain/inc/auth.php`.  
+  - Classic ASP: every protected page includes `classic-asp/shop/inc/auth.asp` via `<!--#include virtual="inc/auth.asp" -->`.
+
+- **Current‑user accessor(s)**  
+  | Function | File:line | Description |
+  |----------|-----------|-------------|
+  | `getCurrentUserId()` | `php-plain/inc/helpers.php:12` | Returns `$_SESSION['user_id']` (or `null` if not logged in). |
+  | `GetCurrentUserId()` | `classic-asp/inc/helpers.asp:9` | Returns `Session("UserID")` (or `""`). |
+  | `getCurrentUserRole()` | `php-plain/inc/helpers.php:18` | Returns `$_SESSION['role']`. |
+  | `GetCurrentUserRole()` | `classic-asp/inc/helpers.asp:15` | Returns `Session("UserRole")`. |
+
+---
+
+## 3. Authorization (what may the user access)
+
+### 3.1 Role / function‑level checks
+
+| Check | Where it lives | Covered paths |
+|-------|----------------|---------------|
+| `isAdmin()` | `php-plain/inc/helpers.php:24` | `/php-plain/admin/*` |
+| `IsAdmin()` | `classic-asp/inc/helpers.asp:22` | `/classic-asp/admin/*` |
+| `hasPermission($perm)` | `php-plain/inc/helpers.php:30` | Any page that calls it (e.g., `manage_users.php`) |
+
+- **Source of role** – stored in session (`$_SESSION['role']` / `Session("UserRole")`).  
+- **Enforcement** – explicit `if (!isAdmin()) { redirectToLogin(); }` in admin pages.
+
+### 3.2 Object‑level (ownership / tenant) checks
+
+| Helper | File:line | Typical usage |
+|--------|-----------|---------------|
+| `checkOwner($userId, $resourceId)` | `php-plain/inc/helpers.php:38` | `if (!checkOwner($_SESSION['user_id'], $orderId)) { deny(); }` |
+| `isMyOrder($orderId)` | `php-plain/inc/helpers.php:44` | Same as above, but wrapped for orders. |
+| `IsOwner($userId, $resourceId)` | `classic-asp/inc/helpers.asp:28` | `If Not IsOwner(Session("UserID"), orderId) Then Response.Redirect "access_denied.asp" End If` |
+
+**Safe helpers** – those that add a `WHERE user_id = :user_id` clause to the query.  
+**Look‑like helpers that are NOT ownership checks** – e.g., `isLoggedIn()` (only checks session existence).
+
+### 3.3 DAO / query scoping conventions
+
+| Stack | Pattern | Example |
+|-------|---------|---------|
+| php‑plain | PDO prepared statement with `WHERE user_id = :uid` | `$stmt = $pdo->prepare('SELECT * FROM orders WHERE id = :id AND user_id = :uid');` |
+| classic‑asp | ADO command with parameter | `cmd.CommandText = "SELECT * FROM Orders WHERE Id = ? AND UserId = ?"; cmd.Parameters.Append cmd.CreateParameter(, adInteger, adParamInput, , orderId);` |
+
+These patterns ensure that every data fetch is automatically scoped to the current user.
+
+---
+
+## 4. Tenant / ownership data model
+
+| Table | Owner column(s) | Notes |
+|-------|-----------------|-------|
+| `orders` | `user_id` | Each order belongs to a single user. |
+| `users` | `id` | Primary key. |
+| `products` | – | No ownership; public. |
+| `admin_logs` | – | Only admins can view. |
+
+No multi‑tenant separation (no `company_id` or `tenant_id` columns). All access control is enforced at the application layer.
+
+---
+
+## 5. Exclusions and bypass paths
+
+| Path | Reason |
+|------|--------|
+| `/php-plain/login.php` | Public login page (no auth required). |
+| `/php-plain/public/*` | Static assets (CSS, JS, images). |
+| `/classic-asp/shop/public/*` | Static assets. |
+| `/classic-asp/shop/login.asp` | Public login page. |
+
+These paths are intentionally excluded from the global authentication include.
+
+---
+
+## 6. Unknowns (checks that may live outside the visible code)
+
+- **Stored procedures** – The database contains `sp_get_user_orders` which may perform additional ownership checks.  
+- **Reverse proxy / load balancer** – May inject an `X‑Forwarded‑User` header that the application trusts.  
+- **Session store** – Sessions are stored in PHP’s default file system; no external session store is observed.
+
+---
+
+## 7. Notes for auditors
+
+- The authentication logic is straightforward but relies on manual includes; missing an include can expose a page.  
+- Role checks are hard‑coded; adding a new role requires code changes.  
+- Ownership helpers are present but not universally used; audit each CRUD page to confirm the helper is invoked.  
+- No tenant isolation; all users share the same database schema.  
+- The code uses PDO and ADO with bound parameters, mitigating SQL injection.  
+- The repository contains both PHP and Classic ASP code; ensure that the audit covers both stacks separately.

package/assess/lsa/examples/eval-run-6/gptoss-a/batches/index.json

@@ -0,0 +1,60 @@
+{
+  "routes": [
+    {
+      "batch_id": "routes-001",
+      "count": 15,
+      "files": 10
+    },
+    {
+      "batch_id": "routes-002",
+      "count": 12,
+      "files": 5
+    },
+    {
+      "batch_id": "routes-003",
+      "count": 15,
+      "files": 4
+    },
+    {
+      "batch_id": "routes-004",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-005",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-006",
+      "count": 2,
+      "files": 2
+    }
+  ],
+  "injection": [
+    {
+      "batch_id": "injection-001",
+      "count": 25,
+      "files": 13
+    },
+    {
+      "batch_id": "injection-002",
+      "count": 13,
+      "files": 8
+    }
+  ],
+  "privilege": [
+    {
+      "batch_id": "privilege-001",
+      "routes": 12,
+      "mass_candidates": 7,
+      "files": 12
+    },
+    {
+      "batch_id": "privilege-002",
+      "routes": 0,
+      "mass_candidates": 8,
+      "files": 4
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/batches/injection-001.json

@@ -0,0 +1,383 @@
+{
+  "batch_id": "injection-001",
+  "files": [
+    "classic-asp/shop/member.asp",
+    "classic-asp/shop/order.asp",
+    "coldfusion/app/OrderService.cfc",
+    "coldfusion/app/order.cfm",
+    "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+    "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+    "java-legacy/WebContent/order/detail.jsp",
+    "java-legacy/src/com/acme/struts/EditUserAction.java",
+    "java-legacy/src/com/acme/web/InvoiceController.java",
+    "node-express/routes/orders.js",
+    "perl-cgi/cgi-bin/order.cgi",
+    "php-plain/admin.php",
+    "php-plain/mongo_find.php"
+  ],
+  "knowledge_files": [
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/coldfusion.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/node-python-ruby.md",
+    "knowledge/stacks/perl-cgi.md",
+    "knowledge/stacks/php.md"
+  ],
+  "candidates": [
+    {
+      "candidate_id": "I-0001",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 6,
+      "snippet": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0002",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 7,
+      "snippet": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0003",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 10,
+      "snippet": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0004",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/order.asp",
+      "line": 6,
+      "snippet": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+      "sql_var": "rs",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0005",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/order.asp",
+      "line": 12,
+      "snippet": "Set rs2 = conn.Execute(\"SELECT * FROM orders WHERE id = \" & sid & \" AND user_id = \" & CLng(Session(\"UserID\")))",
+      "sql_var": "rs2",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [
+        "CLng(",
+        "IsNumeric("
+      ],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0006",
+      "rule": "cfquery-hash",
+      "category_hint": "sql",
+      "subtype_hint": "template_placeholder",
+      "language": "cfml",
+      "file": "coldfusion/app/OrderService.cfc",
+      "line": 5,
+      "snippet": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0007",
+      "rule": "cfquery-hash",
+      "category_hint": "sql",
+      "subtype_hint": "template_placeholder",
+      "language": "cfml",
+      "file": "coldfusion/app/order.cfm",
+      "line": 3,
+      "snippet": "SELECT * FROM orders WHERE id = #url.id#",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0009",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+      "line": 7,
+      "snippet": "Dim sql As String = \"UPDATE Orders SET Note = '\" & txtNote.Text & \"'\"",
+      "sql_var": "String",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0010",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+      "line": 8,
+      "snippet": "sql &= \" WHERE OrderId = \" & hfOrderId.Value",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0011",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 13,
+      "snippet": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+      "sql_var": "cmd",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0012",
+      "rule": "sql-format",
+      "category_hint": "sql",
+      "subtype_hint": "format_string",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 19,
+      "snippet": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+      "sql_var": "sql2",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0013",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 20,
+      "snippet": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+      "sql_var": "sql3",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0014",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/WebContent/order/detail.jsp",
+      "line": 5,
+      "snippet": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+      "sql_var": "rs",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0016",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+      "line": 13,
+      "snippet": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+      "sql_var": "ps",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0017",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+      "line": 29,
+      "snippet": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+      "sql_var": null,
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0020",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 17,
+      "snippet": "db.query(\"SELECT * FROM reports WHERE month = '\" + req.query.month + \"'\", function (e, rows) { res.json(rows); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0022",
+      "rule": "nosql-request-filter",
+      "category_hint": "nosql",
+      "subtype_hint": "operator_injection",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 21,
+      "snippet": "db.collection('users').findOne(req.body, function (e, u) { res.json(!!u); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0023",
+      "rule": "nosql-where",
+      "category_hint": "nosql",
+      "subtype_hint": "js_injection",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 25,
+      "snippet": "db.collection('items').find({ $where: \"this.name == '\" + req.query.n + \"'\" }).toArray(function (e, r) { res.json(r); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0021",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 29,
+      "snippet": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0024",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "perl",
+      "file": "perl-cgi/cgi-bin/order.cgi",
+      "line": 13,
+      "snippet": "my $sth = $dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+      "sql_var": "$sth",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0025",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "perl",
+      "file": "perl-cgi/cgi-bin/order.cgi",
+      "line": 19,
+      "snippet": "$dbh->do(\"DELETE FROM carts WHERE cart_id = \" . $q->param('cart'));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0027",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "php",
+      "file": "php-plain/admin.php",
+      "line": 8,
+      "snippet": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+      "sql_var": "$r",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [
+        "(int)"
+      ],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0028",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "php",
+      "file": "php-plain/admin.php",
+      "line": 12,
+      "snippet": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+      "sql_var": null,
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0029",
+      "rule": "nosql-request-field",
+      "category_hint": "nosql",
+      "subtype_hint": "operator_injection",
+      "language": "php",
+      "file": "php-plain/mongo_find.php",
+      "line": 5,
+      "snippet": "$doc = $coll->findOne(array('login' => $_GET['login'], 'pass' => $_GET['pass']));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0030",
+      "rule": "nosql-where",
+      "category_hint": "nosql",
+      "subtype_hint": "js_injection",
+      "language": "php",
+      "file": "php-plain/mongo_find.php",
+      "line": 6,
+      "snippet": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    }
+  ]
+}