@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-15.json

@@ -0,0 +1,69 @@
+{
+  "batch_id": "verified-15",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0031",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php:5-6",
+        "php-plain/inc/auth.php:3-6",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "The GET parameter is concatenated directly into a mysql_query without any sanitization, casting, or prepared statement. No ownership or role check is present."
+    },
+    {
+      "finding_id": "INJ-I-0032",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:6-9",
+        "php-plain/inc/auth.php:3-6",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "The ORDER BY clause is built from an unsanitized GET parameter with no allow\u2011list or integer cast. No ownership or role check is present."
+    },
+    {
+      "finding_id": "INJ-I-0033",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:6-9",
+        "php-plain/inc/auth.php:3-6",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0032: unsanitized ORDER BY input with no guard."
+    },
+    {
+      "finding_id": "INJ-I-0034",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:13-15",
+        "php-plain/inc/auth.php:3-6",
+        "php-plain/inc/db.php:1-4"
+      ],
+      "control_found": null,
+      "notes": "The heredoc interpolates a GET parameter directly into the SQL string. No escaping or parameterization is used."
+    },
+    {
+      "finding_id": "INJ-I-0036",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py:24-30",
+        "python-flask/app.py:10-20"
+      ],
+      "control_found": null,
+      "notes": "The search route uses an f\u2011string to build a query with user input. No parameter binding or sanitization is performed, and no ownership check is present."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-16.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-16",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0008",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs:26-28"
+      ],
+      "control_found": null,
+      "notes": "The code concatenates the user\u2011supplied customer string directly into the SQL query. No parameter binding, cast, or ownership/role check is visible in the provided context."
+    },
+    {
+      "finding_id": "INJ-I-0015",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/mapper/OrderMapper.xml:9"
+      ],
+      "control_found": null,
+      "notes": "The ORDER BY clause interpolates the ${orderBy} variable without any visible allow\u2011list or type enforcement in the snippet."
+    },
+    {
+      "finding_id": "INJ-I-0018",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java:15-17"
+      ],
+      "control_found": null,
+      "notes": "Both SQL statements build the query string by concatenating the request parameter `id` directly. No cast, parameter binding, or ownership check is shown."
+    },
+    {
+      "finding_id": "INJ-I-0019",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java:15-17"
+      ],
+      "control_found": null,
+      "notes": "Same code as INJ-I-0018; no visible mitigation."
+    },
+    {
+      "finding_id": "INJ-I-0026",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php:10"
+      ],
+      "control_found": null,
+      "notes": "The `view` method concatenates the `$id` variable directly into the query. No parameter binding, cast, or ownership check is present in the snippet."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-17.json

@@ -0,0 +1,61 @@
+{
+  "batch_id": "verified-17",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0037",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "sql-procs/sp_search_orders.sql line 5"
+      ],
+      "control_found": null,
+      "notes": "The stored procedure builds dynamic SQL from @Customer and @Sort without any visible sanitization or allow\u2011list. No ownership or role check is present in the provided code."
+    },
+    {
+      "finding_id": "INJ-I-0038",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "sql-procs/sp_search_orders.sql line 6"
+      ],
+      "control_found": null,
+      "notes": "Execution of the unsanitized @sql string is shown, but no control is visible in the snippet."
+    },
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 1-11",
+        "classic-asp/shop/inc/auth.asp line 2"
+      ],
+      "control_found": null,
+      "notes": "The code performs a DELETE without any role or ownership check. The included auth.asp only verifies that a user is logged in, not that they are an admin."
+    },
+    {
+      "finding_id": "BFLA-R-0007-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 6-18"
+      ],
+      "control_found": null,
+      "notes": "DeleteUser action lacks an admin role guard; only the class-level [Authorize] ensures authentication."
+    },
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 30-36"
+      ],
+      "control_found": null,
+      "notes": "Export action grants access based solely on a request query string parameter, with no server\u2011side role validation."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-18.json

@@ -0,0 +1,69 @@
+{
+  "batch_id": "verified-18",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AdminUserController.java",
+        "java-legacy/src/com/acme/web/AdminUserController.java lines 13-15",
+        "java-legacy/src/com/acme/web/AdminUserController.java lines 19-23"
+      ],
+      "control_found": null,
+      "notes": "No @PreAuthorize or other role check is visible on the delete method. Global security configuration is not shown."
+    },
+    {
+      "finding_id": "BFLA-R-0030-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/admin.js",
+        "node-express/routes/admin.js lines 8-9",
+        "node-express/routes/admin.js lines 5-6"
+      ],
+      "control_found": null,
+      "notes": "The delete route only uses ensureLoggedIn; no admin guard is present in the visible code."
+    },
+    {
+      "finding_id": "BFLA-R-0032-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/admin.js",
+        "node-express/routes/admin.js lines 16-18"
+      ],
+      "control_found": null,
+      "notes": "Export endpoint checks only a query parameter; no role validation is visible."
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php",
+        "php-plain/admin.php lines 6-9",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "Only a login check is performed; no admin role check is present in the visible code."
+    },
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php",
+        "php-plain/admin.php lines 10-12",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "The delete action lacks any admin role verification in the visible code."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-19.json

@@ -0,0 +1,64 @@
+{
+  "batch_id": "verified-19",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/delete_user.php:1-8",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "The file contains only a login check in auth.php and a DELETE statement that uses the supplied id. No role or ownership check is present."
+    },
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/promote.php:1-8",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "The code updates the role based solely on a POST parameter. No role verification or ownership check is performed."
+    },
+    {
+      "finding_id": "BFLA-R-0059-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/manage_users.php:1-8",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "The POST handler deletes a user by id without any role or ownership guard."
+    },
+    {
+      "finding_id": "BFLA-R-0063-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/profile.php:1-11",
+        "php-plain/inc/auth.php:1-7"
+      ],
+      "control_found": null,
+      "notes": "The script assigns any POSTed field to the user object, including role, without checking the current user's privileges."
+    },
+    {
+      "finding_id": "MASS-M-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java:1-30"
+      ],
+      "control_found": null,
+      "notes": "The controller accepts a full Account model from the request and persists it directly. No role check or property allow\u2011list is present."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-2.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-2",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0007",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 6-12"
+      ],
+      "control_found": null,
+      "notes": "The controller is marked with [Authorize] but no role or ownership check is visible in the provided code. The absence of a role check is not confirmed, so the finding is likely."
+    },
+    {
+      "finding_id": "BOLA-R-0009",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 30-36"
+      ],
+      "control_found": null,
+      "notes": "The Export action relies solely on a query\u2011string flag and lacks any role or ownership guard in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0013",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 11-15"
+      ],
+      "control_found": null,
+      "notes": "Details retrieves an invoice by id without scoping to the current user; no ownership check is shown."
+    },
+    {
+      "finding_id": "BOLA-R-0015",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 26-30"
+      ],
+      "control_found": null,
+      "notes": "The Search action builds a raw SQL query from user input and does not enforce ownership or parameter binding."
+    },
+    {
+      "finding_id": "BOLA-R-0017",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb lines 7-13"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE statement uses a hidden field value directly; no ownership verification is visible."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-20.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-20",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0004-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java:13-15"
+      ],
+      "control_found": null,
+      "notes": "The controller binds the entire Account object via @ModelAttribute and persists it without any visible ownership or role check, nor an allow\u2011list. No global filter or configuration is shown in the provided context."
+    },
+    {
+      "finding_id": "MASS-M-0005-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/ProfileServlet.java:10-13"
+      ],
+      "control_found": null,
+      "notes": "BeanUtils.populate() binds all request parameters to the Account object with no visible filtering or ownership enforcement in the snippet."
+    },
+    {
+      "finding_id": "MASS-M-0011-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/profile.php:6-8"
+      ],
+      "control_found": null,
+      "notes": "The code iterates over $_POST and assigns each field to the user object without any allow\u2011list or ownership check. The included auth.php only verifies login, not ownership."
+    },
+    {
+      "finding_id": "MASS-M-0012-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/profile.php:10"
+      ],
+      "control_found": null,
+      "notes": "The assignment of $_POST['role'] to $user->role occurs without any guard or allow\u2011list in the visible code."
+    },
+    {
+      "finding_id": "MASS-M-0001-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:12-15"
+      ],
+      "control_found": null,
+      "notes": "The Edit action accepts a Customer model and marks it Modified without any [Bind] include or ownership check in the snippet. The [Authorize] attribute only ensures authentication, not ownership."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-21.json

@@ -0,0 +1,61 @@
+{
+  "batch_id": "verified-21",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0002-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs: lines 26-31"
+      ],
+      "control_found": null,
+      "notes": "The code shows a mass assignment via TryUpdateModel(customer) but no ownership or role check, integer cast, or allow\u2011list is visible in the provided snippet."
+    },
+    {
+      "finding_id": "MASS-M-0009-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php: lines 21-24",
+        "php-laravel/app/Models/Team.php: line 8"
+      ],
+      "control_found": null,
+      "notes": "Team::create($request->all()) uses the model\u2019s $fillable which includes the privileged field owner_id, allowing an attacker to set ownership."
+    },
+    {
+      "finding_id": "MASS-M-0006-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js: lines 7-9"
+      ],
+      "control_found": null,
+      "notes": "User.findByIdAndUpdate(req.user._id, req.body, ...) performs a whole\u2011object bind with no allow\u2011list or ownership check."
+    },
+    {
+      "finding_id": "MASS-M-0007-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js: lines 16-17"
+      ],
+      "control_found": null,
+      "notes": "new User(req.body) followed by user.save() allows all fields from the request to be persisted without filtering."
+    },
+    {
+      "finding_id": "MASS-M-0008-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php: line 13"
+      ],
+      "control_found": null,
+      "notes": "The User model definition is not shown; therefore it is unclear whether privileged fields are protected by $fillable/$guarded."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-22.json

@@ -0,0 +1,50 @@
+{
+  "batch_id": "verified-22",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0010-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "AccountController.php: lines 18-23 (team creation)",
+        "AccountController.php: lines 36-37 (profile update)"
+      ],
+      "control_found": null,
+      "notes": "The controller performs whole\u2011object binding via $request->all() but the model\u2019s $fillable/$guarded definition is not shown. No visible field whitelist or ownership check is present in the provided code."
+    },
+    {
+      "finding_id": "MASS-M-0013-1",
+      "verdict": "rejected",
+      "reason_code": "evidence_mismatch",
+      "confidence": "high",
+      "checked": [
+        "register.php: lines 4-6 (extract and explicit INSERT)"
+      ],
+      "control_found": null,
+      "notes": "The code does not bind all POST values to a model; it explicitly inserts only email, name, and role columns. The evidence claiming whole\u2011object binding is incorrect."
+    },
+    {
+      "finding_id": "MASS-M-0015-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "profile.py: lines 24-29 (PATCH route with setattr loop)"
+      ],
+      "control_found": null,
+      "notes": "All JSON keys are set on the user object without any whitelist or guard. No compensating control is visible in the snippet."
+    },
+    {
+      "finding_id": "MASS-M-0014-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "profile.py: lines 8-12 (POST route creating User with **request.json)"
+      ],
+      "control_found": null,
+      "notes": "The constructor receives all JSON fields directly; no field filtering or guard is shown in the provided code."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-3.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-3",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0018",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 10-22"
+      ],
+      "control_found": null,
+      "notes": "No ownership or role check is visible in the provided code. The first query uses the raw id from the query string without scoping to the current user, and the safe query is never executed."
+    },
+    {
+      "finding_id": "BOLA-R-0019",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp lines 1-6"
+      ],
+      "control_found": null,
+      "notes": "The order number is concatenated directly into the SQL statement with no ownership check or parameter binding shown."
+    },
+    {
+      "finding_id": "BOLA-R-0001",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java lines 10-14"
+      ],
+      "control_found": null,
+      "notes": "The user_id from the request is used directly in an UPDATE statement without any ownership verification or parameter binding."
+    },
+    {
+      "finding_id": "BOLA-R-0020",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 13-15"
+      ],
+      "control_found": null,
+      "notes": "The account is saved without checking that the current session user owns the account; no ownership or role check is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0021",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 19-21"
+      ],
+      "control_found": null,
+      "notes": "The rename operation uses the id from the form without verifying ownership or applying a role check."
+    }
+  ]
+}