@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-6.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-6",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0046",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php line 23"
+      ],
+      "control_found": null,
+      "notes": "The update query updates an invoice by id without filtering on the authenticated user\u2019s id, and no role or ownership check is present in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0057",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php line 7"
+      ],
+      "control_found": null,
+      "notes": "The view action selects a user by id from the request without any ownership or role guard; the included auth file only verifies login."
+    },
+    {
+      "finding_id": "BOLA-R-0058",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php line 11"
+      ],
+      "control_found": null,
+      "notes": "The delete action deletes a user by id from the request without any ownership or role guard; the included auth file only verifies login."
+    },
+    {
+      "finding_id": "BOLA-R-0066",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/delete_user.php line 5"
+      ],
+      "control_found": null,
+      "notes": "The delete_user script deletes a user by id from the request without any ownership or role guard; the included auth file only verifies login."
+    },
+    {
+      "finding_id": "BOLA-R-0067",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/promote.php line 5"
+      ],
+      "control_found": null,
+      "notes": "The promote script updates a user\u2019s role based on an id from the request without any ownership or role guard; the included auth file only verifies login."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-7.json

@@ -0,0 +1,64 @@
+{
+  "batch_id": "verified-7",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0059",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/manage_users.php lines 5-7",
+        "php-plain/inc/auth.php lines 2-6",
+        "php-plain/inc/db.php lines 2-4"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement uses the id from the request without any ownership or role check. The only role check is in the UI, not enforced on the server."
+    },
+    {
+      "finding_id": "BOLA-R-0061",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php lines 5-7",
+        "php-plain/inc/auth.php lines 2-6",
+        "php-plain/inc/db.php lines 2-4"
+      ],
+      "control_found": null,
+      "notes": "The SELECT query retrieves an order by id from the request without filtering by the current user. No ownership check is present."
+    },
+    {
+      "finding_id": "BOLA-R-0069",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py lines 8-13"
+      ],
+      "control_found": null,
+      "notes": "The route /orders/<int:order_id> returns any order by id. Only authentication is enforced; no ownership or tenant check is performed."
+    },
+    {
+      "finding_id": "BOLA-R-0055-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php line 9"
+      ],
+      "control_found": null,
+      "notes": "The route definition is shown, but the controller implementation is not visible in the provided context. Therefore it is unclear whether an ownership check exists."
+    },
+    {
+      "finding_id": "BOLA-R-0056-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php line 10"
+      ],
+      "control_found": null,
+      "notes": "Only the route definition is visible; the controller code that might perform an ownership check is not shown."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-8.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-8",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0052-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php:6"
+      ],
+      "control_found": null,
+      "notes": "The route maps POST /register to AccountController::register, but the controller code is not shown. Registration typically does not require an ownership check, so the evidence is insufficient to confirm a missing check."
+    },
+    {
+      "finding_id": "BOLA-R-0053-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php:7"
+      ],
+      "control_found": null,
+      "notes": "The route maps POST /posts to AccountController::post. The controller implementation is not visible; creating a post usually does not involve an ownership check on the target resource, so the evidence is insufficient."
+    },
+    {
+      "finding_id": "BOLA-R-0054-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/routes/web.php:8"
+      ],
+      "control_found": null,
+      "notes": "The route maps POST /teams to AccountController::team. The controller code is not shown; team creation typically does not require an ownership check on an existing resource, so the evidence is insufficient."
+    },
+    {
+      "finding_id": "BOLA-R-0073",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py:16-20"
+      ],
+      "control_found": null,
+      "notes": "The rename endpoint loads a User by the uid from the URL and updates the name without verifying that uid matches the authenticated user. No ownership check is present."
+    },
+    {
+      "finding_id": "BOLA-R-0074",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py:24-30"
+      ],
+      "control_found": null,
+      "notes": "The patch endpoint loads a User by uid from the URL and applies arbitrary updates without checking ownership. No ownership verification is present."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-9.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-9",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0010",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "lines 12-15 of dotnet-legacy/Web/Controllers/CustomerController.cs"
+      ],
+      "control_found": null,
+      "notes": "The Edit action accepts a Customer object and directly marks it as Modified and saves it without any ownership or role check. No compensating control is visible in the provided code."
+    },
+    {
+      "finding_id": "BOLA-R-0011",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "lines 20-23 of dotnet-legacy/Web/Controllers/CustomerController.cs"
+      ],
+      "control_found": null,
+      "notes": "EditName accepts a Customer with only Id and Name bound, then calls SaveChanges without verifying that the Id belongs to the current user. No ownership check is present in the code."
+    },
+    {
+      "finding_id": "BOLA-R-0012",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "lines 27-32 of dotnet-legacy/Web/Controllers/CustomerController.cs"
+      ],
+      "control_found": null,
+      "notes": "Refresh loads a Customer by id from the request, updates it via TryUpdateModel, and saves it without any ownership validation. No compensating control is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0016",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "lines 8-10 of dotnet-legacy/Web/Handlers/GetFile.ashx"
+      ],
+      "control_found": null,
+      "notes": "GetFile retrieves a file path based on a query string parameter and transmits it without checking that the requesting user owns the file. No ownership or role check is present."
+    },
+    {
+      "finding_id": "BOLA-R-0029",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "lines 9-15 of java-legacy/src/com/acme/web/ProfileServlet.java"
+      ],
+      "control_found": null,
+      "notes": "ProfileServlet populates an Account object directly from request parameters and does not verify that the account belongs to the authenticated user. No ownership check is visible."
+    }
+  ]
+}