@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-4.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-4",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0022",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 25-28"
+      ],
+      "control_found": null,
+      "notes": "No ownership or role check is visible in the update method; the account is persisted directly from the request body."
+    },
+    {
+      "finding_id": "BOLA-R-0023",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AdminUserController.java lines 13-15"
+      ],
+      "control_found": null,
+      "notes": "The delete action lacks any @PreAuthorize or explicit ownership check; the only role guard appears on a different method."
+    },
+    {
+      "finding_id": "BOLA-R-0025",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/InvoiceController.java lines 15-18"
+      ],
+      "control_found": null,
+      "notes": "The invoice is retrieved by ID without verifying that it belongs to the current user."
+    },
+    {
+      "finding_id": "BOLA-R-0027",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/InvoiceController.java lines 27-30"
+      ],
+      "control_found": null,
+      "notes": "The search query concatenates user input directly; no ownership filter or parameter binding is present."
+    },
+    {
+      "finding_id": "BOLA-R-0028",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java lines 11-15"
+      ],
+      "control_found": null,
+      "notes": "The order is fetched by ID from the request without any check that the logged\u2011in user owns it."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-5.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-5",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0030",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/admin.js:8-10"
+      ],
+      "control_found": null,
+      "notes": "The route handler only checks that a user is logged in via `ensureLoggedIn`. No role check (`requireAdmin`) or ownership verification is present in the visible code. Therefore a compensating control is not observable."
+    },
+    {
+      "finding_id": "BOLA-R-0033",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/orders.js:8-10"
+      ],
+      "control_found": null,
+      "notes": "The handler retrieves an order by ID without filtering on the authenticated user. No ownership check or role guard is visible in the provided snippet."
+    },
+    {
+      "finding_id": "BOLA-R-0043",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi:13-15"
+      ],
+      "control_found": null,
+      "notes": "The first prepared statement selects `orders` solely by `id` and is executed immediately. Although a second query later includes `user_id`, the initial query is still vulnerable. No ownership guard is present in the shown code."
+    },
+    {
+      "finding_id": "BOLA-R-0044",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php:10-12"
+      ],
+      "control_found": null,
+      "notes": "The `view` method runs a raw query against `invoices` using the supplied `id` without scoping to the current user. No ownership check is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0046",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php:23-24"
+      ],
+      "control_found": null,
+      "notes": "The `update` method updates an invoice by `id` without verifying that the invoice belongs to the authenticated user. No ownership guard is present in the snippet."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-6.json

@@ -0,0 +1,70 @@
+{
+  "batch_id": "verified-6",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0057-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php lines 5-9",
+        "php-plain/inc/auth.php lines 1-7",
+        "php-plain/inc/db.php lines 1-4"
+      ],
+      "control_found": null,
+      "notes": "The code shows a direct lookup of a user by id from the request with no ownership or role check. No global filter or other control is visible in the provided context."
+    },
+    {
+      "finding_id": "BOLA-R-0057-2",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php lines 10-13",
+        "php-plain/inc/auth.php lines 1-7",
+        "php-plain/inc/db.php lines 1-4"
+      ],
+      "control_found": null,
+      "notes": "The delete action uses the id from the request without any ownership or role verification. No compensating control is shown."
+    },
+    {
+      "finding_id": "BOLA-R-0058-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php lines 10-13",
+        "php-plain/inc/auth.php lines 1-7",
+        "php-plain/inc/db.php lines 1-4"
+      ],
+      "control_found": null,
+      "notes": "Same as BOLA-R-0057-2: no ownership or role check is present in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0066-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin/delete_user.php lines 5-7",
+        "php-plain/inc/auth.php lines 1-7",
+        "php-plain/inc/db.php lines 1-4"
+      ],
+      "control_found": null,
+      "notes": "The delete query uses a bound parameter but does not restrict by the current user. No ownership or role check is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0067-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin/promote.php lines 5-7",
+        "php-plain/inc/auth.php lines 1-7",
+        "php-plain/inc/db.php lines 1-4"
+      ],
+      "control_found": null,
+      "notes": "The promotion logic checks a request parameter but does not verify that the requester owns the target user or has an admin role. No compensating control is shown."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-7.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-7",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0059-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/manage_users.php:5-8"
+      ],
+      "control_found": null,
+      "notes": "The POST handler deletes a user by id without any role or ownership check. The only role check is in the HTML link, not in the request handling code."
+    },
+    {
+      "finding_id": "BOLA-R-0061-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php:5-6"
+      ],
+      "control_found": null,
+      "notes": "The query selects an order by id without scoping to the current user and no ownership check is present."
+    },
+    {
+      "finding_id": "BOLA-R-0069-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py:8-13"
+      ],
+      "control_found": null,
+      "notes": "The route '/orders/<int:order_id>' retrieves an order by id without filtering by user_id. The only ownership check is in the '/orders/mine/<int:order_id>' route."
+    },
+    {
+      "finding_id": "BOLA-R-0055-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php:6-9"
+      ],
+      "control_found": null,
+      "notes": "The route definition is shown, but the controller implementation is not visible in the provided context, so ownership checks cannot be confirmed or denied."
+    },
+    {
+      "finding_id": "BOLA-R-0056-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php:6-10"
+      ],
+      "control_found": null,
+      "notes": "Only the route definition is visible; the controller logic that might enforce ownership is not shown."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-8.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-8",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0052-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php line 6"
+      ],
+      "control_found": null,
+      "notes": "The route definition does not show any ownership or role check. No ownership verification is visible in the provided code context."
+    },
+    {
+      "finding_id": "BOLA-R-0053-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php line 7"
+      ],
+      "control_found": null,
+      "notes": "The route definition does not contain any ownership or role check. No ownership verification is visible in the provided code context."
+    },
+    {
+      "finding_id": "BOLA-R-0054-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php line 8"
+      ],
+      "control_found": null,
+      "notes": "The route definition does not contain any ownership or role check. No ownership verification is visible in the provided code context."
+    },
+    {
+      "finding_id": "BOLA-R-0073",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py lines 16-20"
+      ],
+      "control_found": null,
+      "notes": "The function loads a User by uid and updates the name without any ownership check or role verification. No compensating control is present in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0074",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py lines 24-30"
+      ],
+      "control_found": null,
+      "notes": "The function loads a User by uid and applies arbitrary updates without verifying that the current user owns the record. No compensating control is present in the visible code."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-a/findings/verified-9.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-9",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0010",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "Reviewed CustomerController.cs lines 11-16"
+      ],
+      "control_found": null,
+      "notes": "No ownership check, cast, or allow\u2011list is visible in the method body."
+    },
+    {
+      "finding_id": "BOLA-R-0011",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "Reviewed CustomerController.cs lines 20-23"
+      ],
+      "control_found": null,
+      "notes": "The method only calls SaveChanges(); no ownership verification is shown."
+    },
+    {
+      "finding_id": "BOLA-R-0012",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "Reviewed CustomerController.cs lines 27-32"
+      ],
+      "control_found": null,
+      "notes": "Customer is loaded by id and updated without any ownership check in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0016",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "Reviewed GetFile.ashx lines 8-10"
+      ],
+      "control_found": null,
+      "notes": "File ID is taken directly from the query string and used to transmit a file; no ownership guard is present."
+    },
+    {
+      "finding_id": "BOLA-R-0029",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "Reviewed ProfileServlet.java lines 9-13"
+      ],
+      "control_found": null,
+      "notes": "Account object is populated from request parameters without any ownership validation in the shown code."
+    }
+  ]
+}