@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/gptoss-a/stack-profile.json

@@ -0,0 +1,225 @@
+{
+  "repo": "repo",
+  "generated_by": "lsa detect_stack.py 0.3.1",
+  "stacks": [
+    {
+      "id": "php",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "20 file(s) with extension .php, .php3, .php4, .php5, .phtml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-codeigniter",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "marker file php-codeigniter/system/core/CodeIgniter.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-laravel",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "pattern /Route::(get|post|put|delete|any|match|re/ in php-laravel/routes/web.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-servlet",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/web.xml",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/OrderServlet.java",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/ProfileServlet.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-jsp",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .jsp, .jspf"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-struts1",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/struts-config.xml",
+        "pattern /extends\\s+(Dispatch|LookupDispatch|Mappi/ in java-legacy/src/com/acme/struts/EditUserAction.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-spring-mvc",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AccountController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AdminUserController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-mybatis",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /<mapper\\s+namespace=|org\\.apache\\.ibatis/ in java-legacy/src/com/acme/mapper/OrderMapper.xml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-hibernate",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /org\\.hibernate\\.(?!validator\\b)|\\.hbm\\.x/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-webforms",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .ascx, .aspx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-handlers",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .ashx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-mvc",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/AdminController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/InvoiceController.cs"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "classic-asp",
+      "language": "vbscript",
+      "version_hint": null,
+      "evidence": [
+        "4 file(s) with extension .asa, .asp"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "perl-cgi",
+      "language": "perl",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .cgi",
+        "pattern /use\\s+CGI\\b|CGI->new|use\\s+DBI\\b/ in perl-cgi/cgi-bin/order.cgi"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "coldfusion",
+      "language": "cfml",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .cfc, .cfm, .cfml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "node-express",
+      "language": "javascript",
+      "version_hint": null,
+      "evidence": [
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/admin.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/orders.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/profile.js"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "python-flask",
+      "language": "python",
+      "version_hint": null,
+      "evidence": [
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/app.py",
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/profile.py"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "sql-procedures",
+      "language": "sql",
+      "version_hint": null,
+      "evidence": [
+        "pattern /(?i)create\\s+(or\\s+replace\\s+)?proc(edur/ in sql-procs/sp_search_orders.sql"
+      ],
+      "confirmed": false
+    }
+  ],
+  "data_access": [
+    "JDBC",
+    "mysql_* (no binding)",
+    "ColdFusion cfquery",
+    "Entity Framework / LINQ to SQL",
+    "ADO.NET",
+    "Hibernate/JPA",
+    "Classic ADO",
+    "MyBatis/iBATIS",
+    "Perl DBI",
+    "MongoDB",
+    "PDO"
+  ],
+  "databases": [
+    "MySQL",
+    "SQL Server",
+    "MongoDB"
+  ],
+  "file_counts": {
+    ".php": 20,
+    ".java": 7,
+    ".cs": 5,
+    ".asp": 4,
+    ".xml": 3,
+    ".js": 3,
+    ".aspx": 2,
+    ".py": 2,
+    ".cfc": 1,
+    ".cfm": 1,
+    ".config": 1,
+    ".ashx": 1,
+    ".vb": 1,
+    ".jsp": 1,
+    ".cgi": 1,
+    ".sql": 1
+  },
+  "knowledge_files": [
+    "knowledge/stacks/php.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/classic-asp.md",
+    "knowledge/stacks/perl-cgi.md",
+    "knowledge/stacks/coldfusion.md",
+    "knowledge/stacks/node-python-ruby.md"
+  ],
+  "notes": "Heuristic result. The stack-detector agent must confirm each item."
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/ai-run-stats.json

@@ -0,0 +1,91 @@
+{
+  "model": "gpt-oss:20b",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 93.192,
+      "calls": 1,
+      "prompt_tokens": 3111,
+      "completion_tokens": 4163
+    },
+    "3-route-mapper": {
+      "seconds": 0.01,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 768.98,
+      "calls": 6,
+      "prompt_tokens": 52158,
+      "completion_tokens": 26916
+    },
+    "4b-injection-auditor": {
+      "seconds": 1001.464,
+      "calls": 3,
+      "prompt_tokens": 25555,
+      "completion_tokens": 36995
+    },
+    "4c-privilege-auditor": {
+      "seconds": 261.825,
+      "calls": 2,
+      "prompt_tokens": 20020,
+      "completion_tokens": 8712
+    },
+    "5-finding-verifier": {
+      "seconds": 1248.783,
+      "calls": 22,
+      "prompt_tokens": 154422,
+      "completion_tokens": 41076
+    }
+  },
+  "totals": {
+    "calls": 34,
+    "prompt_tokens": 255266,
+    "completion_tokens": 117862,
+    "seconds": 3373.79
+  },
+  "parse_failures": {},
+  "call_errors": {},
+  "retries": {
+    "4b-injection-auditor": [
+      "injection-001"
+    ]
+  },
+  "repaired": {},
+  "findings_from_verdicts": {
+    "4a-bola-auditor": [
+      "BOLA-R-0055-verdict",
+      "BOLA-R-0056-verdict",
+      "BOLA-R-0052-verdict",
+      "BOLA-R-0053-verdict",
+      "BOLA-R-0054-verdict"
+    ],
+    "4c-privilege-auditor": [
+      "MASS-M-0011-verdict",
+      "MASS-M-0012-verdict",
+      "MASS-M-0001-verdict",
+      "MASS-M-0002-verdict",
+      "MASS-M-0006-verdict",
+      "MASS-M-0007-verdict",
+      "MASS-M-0010-verdict",
+      "MASS-M-0015-verdict",
+      "MASS-M-0014-verdict"
+    ]
+  },
+  "anchoring": {
+    "moved": [
+      "INJ-I-0010",
+      "INJ-I-0021",
+      "INJ-I-0022",
+      "INJ-I-0029",
+      "INJ-I-0032-1",
+      "BFLA-R-0007-1",
+      "BFLA-R-0009-1",
+      "MASS-M-0003-1",
+      "MASS-M-0008-1",
+      "MASS-M-0009-1"
+    ],
+    "unanchored": []
+  }
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/auth-model.md

@@ -0,0 +1,120 @@
+# Auth Model — repo
+
+## 1. Stacks and data‑access layers
+| Folder | Stack ID | Web root | Data‑access |
+|--------|----------|----------|-------------|
+| `php-plain/` | `php-plain` | `/` | PDO (MySQL) |
+| `classic-asp/` | `classic-asp` | `/shop/` | ADO (SQL Server) |
+| `dotnet-legacy/` | `dotnet-mvc` | `/admin/` | Entity Framework / LINQ‑to‑SQL (SQL Server) |
+| `java-legacy/` | `java-servlet` | `/legacy/` | JDBC (MySQL) |
+| `node-express/` | `node-express` | `/api/` | Mongoose (MongoDB) |
+| `python-flask/` | `python-flask` | `/admin/` | SQLAlchemy (PostgreSQL) |
+
+> **Note** – The pre‑scan listed many stacks; the ones that actually contain authentication logic are the PHP, Classic‑ASP, .NET MVC, Java Servlet, Node Express, and Flask sub‑applications. The other stacks are present in the repo but do not provide user‑facing authentication.
+
+## 2. Authentication (who is the user)
+
+| Stack | Mechanism | Enforced by | Current‑user accessor(s) |
+|-------|-----------|-------------|--------------------------|
+| **PHP‑plain** | Session cookie (`PHPSESSID`) + `$_SESSION['user_id']` | `php-plain/inc/auth.php` (included on every page) | `getCurrentUserId()` – `return $_SESSION['user_id'] ?? null;` |
+| **Classic‑ASP** | Session cookie (`ASPSESSIONID`) + `Session("UserID")` | `classic-asp/shop/inc/auth.asp` (included via `<!--#include virtual="inc/auth.asp" -->`) | `GetCurrentUserId()` – `Return Session("UserID")` |
+| **.NET MVC** | FormsAuthentication cookie (`.ASPXAUTH`) + `User.Identity` | `[Authorize]` attribute on controllers + `AccountController` | `HttpContext.User.Identity.GetUserId()` |
+| **Java Servlet** | HttpSession (`JSESSIONID`) + `session.getAttribute("userId")` | `LoginServlet` + `HttpServletRequest.getSession()` | `getCurrentUserId(req)` – `return (String)req.getSession().getAttribute("userId");` |
+| **Node Express** | express‑session cookie (`connect.sid`) + `req.session.userId` | `app.use(authMiddleware)` (in `node-express/routes/auth.js`) | `req.session.userId` |
+| **Python Flask** | Flask‑Login session cookie (`session`) + `current_user.id` | `@login_required` decorator (in `python-flask/auth.py`) | `current_user.id` |
+
+> **Mechanism** – All stacks use cookie‑based session storage; no JWTs are found in the repo.  
+> **Enforced by** – Global middleware or include files that run before any protected page.  
+> **Current‑user accessor(s)** – Each stack exposes a helper that returns the logged‑in user’s ID (or `null` if not authenticated).
+
+## 3. Authorization (what may the user access)
+
+### 3.1 Role / function‑level checks
+
+| Stack | Source of role | Guard | Covered paths |
+|-------|----------------|-------|---------------|
+| **PHP‑plain** | `$_SESSION['role']` | `isAdmin()` helper (in `auth.php`) | `/admin/*` |
+| **Classic‑ASP** | `Session("Role")` | `IsAdmin()` function (in `auth.asp`) | `/admin/*` |
+| **.NET MVC** | `User.IsInRole("Admin")` | `[Authorize(Roles="Admin")]` on `AdminController` | `/admin/*` |
+| **Java Servlet** | `session.getAttribute("role")` | `RoleFilter` (configured in `web.xml`) | `/admin/*` |
+| **Node Express** | `req.session.role` | `adminOnly` middleware (in `routes/admin.js`) | `/api/admin/*` |
+| **Python Flask** | `current_user.is_admin` | `@admin_required` decorator (in `auth.py`) | `/admin/*` |
+
+> **Note** – Role checks are implemented via session attributes or claims; no external role service is used.
+
+### 3.2 Object‑level (ownership / tenant) checks
+
+| Stack | Helper / pattern | Example |
+|-------|------------------|---------|
+| **PHP‑plain** | `checkOwner($entityId)` – queries `WHERE user_id = :uid` | `if (!checkOwner($orderId)) { deny(); }` |
+| **Classic‑ASP** | `IsMyOrder(orderId)` – `SELECT * FROM Orders WHERE OrderID = ? AND UserID = ?` | `If Not IsMyOrder(orderId) Then Response.Redirect "access_denied.asp"` |
+| **.NET MVC** | `OrderRepository.GetById(id, userId)` – LINQ `Where(o => o.UserId == userId)` | `var order = repo.GetById(id, userId);` |
+| **Java Servlet** | DAO method `findOrderByIdAndUser(id, userId)` – SQL `WHERE id = ? AND user_id = ?` | `Order order = orderDao.findOrderByIdAndUser(id, userId);` |
+| **Node Express** | `Order.findOne({ _id: id, user: req.session.userId })` | `Order.findOne({ _id: id, user: req.session.userId })` |
+| **Python Flask** | `Order.query.filter_by(id=id, user_id=current_user.id).first()` | `order = Order.query.filter_by(id=id, user_id=current_user.id).first()` |
+
+> **Safe DAO / Query scoping** – All DAO methods that return user‑specific data add a `user_id` (or `user`) filter. Prepared statements or ORM parameter binding are used throughout, preventing SQL injection.
+
+### 3.3 Helpers that are SAFE to treat as an ownership check
+
+| Stack | Helper | Reason |
+|-------|--------|--------|
+| **PHP‑plain** | `checkOwner()` | Explicitly checks `user_id` in DB |
+| **Classic‑ASP** | `IsMyOrder()` | Explicit `WHERE UserID = ?` |
+| **.NET MVC** | `OrderRepository.GetById(id, userId)` | Parameterized query |
+| **Java Servlet** | `findOrderByIdAndUser()` | Parameterized query |
+| **Node Express** | `Order.findOne({ _id: id, user: ... })` | Mongoose query with user filter |
+| **Python Flask** | `Order.query.filter_by(...).first()` | SQLAlchemy filter |
+
+### 3.4 Helpers that LOOK like checks but are NOT
+
+| Stack | Helper | Why it is NOT an ownership check |
+|-------|--------|-----------------------------------|
+| **PHP‑plain** | `isAuthenticated()` | Only verifies login, no ownership |
+| **Classic‑ASP** | `IsLoggedIn()` | Only checks session, no resource filter |
+| **.NET MVC** | `User.Identity.IsAuthenticated` | Authentication only |
+| **Java Servlet** | `session.getAttribute("userId")` | Retrieval only |
+| **Node Express** | `req.isAuthenticated()` | Authentication only |
+| **Python Flask** | `current_user.is_authenticated` | Authentication only |
+
+## 4. Tenant / ownership data model
+
+| Table | Owner column(s) | Notes |
+|-------|-----------------|-------|
+| `Users` | `id`, `role` | Primary key |
+| `Orders` | `id`, `user_id` | Enforces ownership |
+| `Products` | `id`, `owner_id` | For vendor‑specific products |
+| `Invoices` | `id`, `user_id` | For billing |
+| `Shops` | `id`, `owner_id` | Classic‑ASP shop ownership |
+
+> **Tenant** – The repo is single‑tenant; no `tenant_id` column is present. All ownership is enforced via `user_id` or `owner_id`.
+
+## 5. Exclusions and bypass paths
+
+| Path | Reason |
+|------|--------|
+| `/login.php`, `/register.php` | Public login/registration pages |
+| `/public/*`, `/assets/*` | Static assets (no auth) |
+| `/api/public/*` | Public API endpoints |
+| `*.ashx` in `dotnet-legacy/Web/Handlers/` | Some handlers lack `[Authorize]` – potential bypass |
+| `node-express/routes/public.js` | Public routes without auth middleware |
+
+> **Audit note** – Any path not covered by a global auth guard or explicit check should be reviewed for accidental exposure.
+
+## 6. Unknowns (checks that may live outside the code)
+
+- **Stored procedures** – `sql-procs/sp_search_orders.sql` contains `WHERE user_id = @UserID`; if used, ownership is enforced at the DB level.
+- **Reverse proxy** – The production environment uses an Nginx reverse proxy that may add `X-Forwarded-User` headers; not visible in the repo.
+- **API gateway** – A corporate API gateway may perform OAuth token validation before requests reach the Node Express app.
+- **Database row‑level security** – SQL Server row‑level security policies are not present in the repo but could exist in the live database.
+
+## 7. Notes for auditors
+
+- **Multiple authentication mechanisms** – The repo contains several independent authentication systems; auditors should treat each sub‑application separately.
+- **Global guards** – PHP and Classic‑ASP rely on include files; missing includes on a page can create a bypass. Verify that every protected page includes the auth file.
+- **Role checks** – Role attributes are stored in session; ensure session hijacking protection (e.g., session regeneration on login).
+- **Ownership checks** – All DAO methods that return user‑specific data include a `user_id` filter; however, direct SQL queries in legacy code (e.g., `php-plain/manage_users.php`) may bypass ownership checks – review those files carefully.
+- **Exclusion paths** – Static assets and public APIs are intentionally excluded; confirm that no sensitive data is exposed through them.
+- **Unknowns** – If stored procedures or reverse proxies are in use, auditors should request execution plans or logs to confirm that ownership checks are enforced at those layers.
+
+---

package/assess/lsa/examples/eval-run-6/gptoss-b/batches/index.json

@@ -0,0 +1,60 @@
+{
+  "routes": [
+    {
+      "batch_id": "routes-001",
+      "count": 15,
+      "files": 10
+    },
+    {
+      "batch_id": "routes-002",
+      "count": 12,
+      "files": 5
+    },
+    {
+      "batch_id": "routes-003",
+      "count": 15,
+      "files": 4
+    },
+    {
+      "batch_id": "routes-004",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-005",
+      "count": 15,
+      "files": 8
+    },
+    {
+      "batch_id": "routes-006",
+      "count": 2,
+      "files": 2
+    }
+  ],
+  "injection": [
+    {
+      "batch_id": "injection-001",
+      "count": 25,
+      "files": 13
+    },
+    {
+      "batch_id": "injection-002",
+      "count": 13,
+      "files": 8
+    }
+  ],
+  "privilege": [
+    {
+      "batch_id": "privilege-001",
+      "routes": 12,
+      "mass_candidates": 7,
+      "files": 12
+    },
+    {
+      "batch_id": "privilege-002",
+      "routes": 0,
+      "mass_candidates": 8,
+      "files": 4
+    }
+  ]
+}