@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/batches/injection-001.json

@@ -0,0 +1,383 @@
+{
+  "batch_id": "injection-001",
+  "files": [
+    "classic-asp/shop/member.asp",
+    "classic-asp/shop/order.asp",
+    "coldfusion/app/OrderService.cfc",
+    "coldfusion/app/order.cfm",
+    "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+    "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+    "java-legacy/WebContent/order/detail.jsp",
+    "java-legacy/src/com/acme/struts/EditUserAction.java",
+    "java-legacy/src/com/acme/web/InvoiceController.java",
+    "node-express/routes/orders.js",
+    "perl-cgi/cgi-bin/order.cgi",
+    "php-plain/admin.php",
+    "php-plain/mongo_find.php"
+  ],
+  "knowledge_files": [
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/coldfusion.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/node-python-ruby.md",
+    "knowledge/stacks/perl-cgi.md",
+    "knowledge/stacks/php.md"
+  ],
+  "candidates": [
+    {
+      "candidate_id": "I-0001",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 6,
+      "snippet": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0002",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 7,
+      "snippet": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0003",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/member.asp",
+      "line": 10,
+      "snippet": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0004",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/order.asp",
+      "line": 6,
+      "snippet": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+      "sql_var": "rs",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0005",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "classic-asp/shop/order.asp",
+      "line": 12,
+      "snippet": "Set rs2 = conn.Execute(\"SELECT * FROM orders WHERE id = \" & sid & \" AND user_id = \" & CLng(Session(\"UserID\")))",
+      "sql_var": "rs2",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [
+        "CLng(",
+        "IsNumeric("
+      ],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0006",
+      "rule": "cfquery-hash",
+      "category_hint": "sql",
+      "subtype_hint": "template_placeholder",
+      "language": "cfml",
+      "file": "coldfusion/app/OrderService.cfc",
+      "line": 5,
+      "snippet": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0007",
+      "rule": "cfquery-hash",
+      "category_hint": "sql",
+      "subtype_hint": "template_placeholder",
+      "language": "cfml",
+      "file": "coldfusion/app/order.cfm",
+      "line": 3,
+      "snippet": "SELECT * FROM orders WHERE id = #url.id#",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0009",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+      "line": 7,
+      "snippet": "Dim sql As String = \"UPDATE Orders SET Note = '\" & txtNote.Text & \"'\"",
+      "sql_var": "String",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0010",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "vb",
+      "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+      "line": 8,
+      "snippet": "sql &= \" WHERE OrderId = \" & hfOrderId.Value",
+      "sql_var": "sql",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0011",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 13,
+      "snippet": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+      "sql_var": "cmd",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0012",
+      "rule": "sql-format",
+      "category_hint": "sql",
+      "subtype_hint": "format_string",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 19,
+      "snippet": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+      "sql_var": "sql2",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0013",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+      "line": 20,
+      "snippet": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+      "sql_var": "sql3",
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0014",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/WebContent/order/detail.jsp",
+      "line": 5,
+      "snippet": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+      "sql_var": "rs",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0016",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+      "line": 13,
+      "snippet": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+      "sql_var": "ps",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0017",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+      "line": 29,
+      "snippet": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+      "sql_var": null,
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0020",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 17,
+      "snippet": "db.query(\"SELECT * FROM reports WHERE month = '\" + req.query.month + \"'\", function (e, rows) { res.json(rows); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0022",
+      "rule": "nosql-request-filter",
+      "category_hint": "nosql",
+      "subtype_hint": "operator_injection",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 21,
+      "snippet": "db.collection('users').findOne(req.body, function (e, u) { res.json(!!u); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0023",
+      "rule": "nosql-where",
+      "category_hint": "nosql",
+      "subtype_hint": "js_injection",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 25,
+      "snippet": "db.collection('items').find({ $where: \"this.name == '\" + req.query.n + \"'\" }).toArray(function (e, r) { res.json(r); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0021",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "js",
+      "file": "node-express/routes/orders.js",
+      "line": 29,
+      "snippet": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0024",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "perl",
+      "file": "perl-cgi/cgi-bin/order.cgi",
+      "line": 13,
+      "snippet": "my $sth = $dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+      "sql_var": "$sth",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0025",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "perl",
+      "file": "perl-cgi/cgi-bin/order.cgi",
+      "line": 19,
+      "snippet": "$dbh->do(\"DELETE FROM carts WHERE cart_id = \" . $q->param('cart'));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0027",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "php",
+      "file": "php-plain/admin.php",
+      "line": 8,
+      "snippet": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+      "sql_var": "$r",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [
+        "(int)"
+      ],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0028",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "php",
+      "file": "php-plain/admin.php",
+      "line": 12,
+      "snippet": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+      "sql_var": null,
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0029",
+      "rule": "nosql-request-field",
+      "category_hint": "nosql",
+      "subtype_hint": "operator_injection",
+      "language": "php",
+      "file": "php-plain/mongo_find.php",
+      "line": 5,
+      "snippet": "$doc = $coll->findOne(array('login' => $_GET['login'], 'pass' => $_GET['pass']));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0030",
+      "rule": "nosql-where",
+      "category_hint": "nosql",
+      "subtype_hint": "js_injection",
+      "language": "php",
+      "file": "php-plain/mongo_find.php",
+      "line": 6,
+      "snippet": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/batches/injection-002.json

@@ -0,0 +1,205 @@
+{
+  "batch_id": "injection-002",
+  "files": [
+    "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+    "java-legacy/src/com/acme/mapper/OrderMapper.xml",
+    "java-legacy/src/com/acme/web/OrderServlet.java",
+    "php-codeigniter/application/controllers/Invoice.php",
+    "php-plain/order_detail.php",
+    "php-plain/search.php",
+    "python-flask/app.py",
+    "sql-procs/sp_search_orders.sql"
+  ],
+  "knowledge_files": [
+    "knowledge/stacks/php.md",
+    "knowledge/stacks/node-python-ruby.md",
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/java.md"
+  ],
+  "candidates": [
+    {
+      "candidate_id": "I-0031",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "php",
+      "file": "php-plain/order_detail.php",
+      "line": 6,
+      "snippet": "$res = mysql_query(\"SELECT * FROM orders WHERE id = \" . $id);",
+      "sql_var": "$res",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0032",
+      "rule": "sql-append",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "php",
+      "file": "php-plain/search.php",
+      "line": 8,
+      "snippet": "$sql .= \" AND name LIKE '%\" . $kw . \"%'\";",
+      "sql_var": "$sql",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [
+        "addslashes"
+      ],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0033",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation|dynamic_identifier",
+      "language": "php",
+      "file": "php-plain/search.php",
+      "line": 9,
+      "snippet": "$sql .= \" ORDER BY \" . $sort;",
+      "sql_var": "$sql",
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0034",
+      "rule": "heredoc-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "php",
+      "file": "php-plain/search.php",
+      "line": 14,
+      "snippet": "WHERE category = '{$_GET['cat']}'",
+      "sql_var": null,
+      "input_hint": "request_input_on_line",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0036",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "python",
+      "file": "python-flask/app.py",
+      "line": 29,
+      "snippet": "cur.execute(f\"SELECT * FROM products WHERE name LIKE '%{q}%'\")",
+      "sql_var": null,
+      "input_hint": "request_input_nearby",
+      "sanitizer_hints": [],
+      "priority": "high"
+    },
+    {
+      "candidate_id": "I-0035",
+      "rule": "sql-format",
+      "category_hint": "sql",
+      "subtype_hint": "format_string",
+      "language": "python",
+      "file": "python-flask/app.py",
+      "line": 12,
+      "snippet": "cur.execute(\"SELECT * FROM orders WHERE id = %s\" % order_id)",
+      "sql_var": null,
+      "input_hint": "request_input_in_file",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0008",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "cs",
+      "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+      "line": 28,
+      "snippet": "var list = db.Database.SqlQuery<Invoice>(\"SELECT * FROM Invoices WHERE Customer = '\" + customer + \"'\").ToList();",
+      "sql_var": "list",
+      "input_hint": "none",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0015",
+      "rule": "mybatis-dollar",
+      "category_hint": "sql",
+      "subtype_hint": "template_placeholder",
+      "language": "xml",
+      "file": "java-legacy/src/com/acme/mapper/OrderMapper.xml",
+      "line": 9,
+      "snippet": "ORDER BY ${orderBy}",
+      "sql_var": null,
+      "input_hint": "none",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0018",
+      "rule": "sql-concat",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+      "line": 15,
+      "snippet": "ResultSet rs = stmt.executeQuery(\"SELECT * FROM orders WHERE id = '\" + id + \"'\");",
+      "sql_var": "rs",
+      "input_hint": "request_input_in_file",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0019",
+      "rule": "sql-append",
+      "category_hint": "sql",
+      "subtype_hint": "string_concatenation",
+      "language": "java",
+      "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+      "line": 17,
+      "snippet": "sb.append(\" AND order_id = \").append(id);",
+      "sql_var": "sb",
+      "input_hint": "request_input_in_file",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0026",
+      "rule": "sql-interpolation",
+      "category_hint": "sql",
+      "subtype_hint": "string_interpolation",
+      "language": "php",
+      "file": "php-codeigniter/application/controllers/Invoice.php",
+      "line": 10,
+      "snippet": "$q = $this->db->query(\"SELECT * FROM invoices WHERE id = $id\");",
+      "sql_var": "$q",
+      "input_hint": "request_input_in_file",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0037",
+      "rule": "proc-dynamic-sql",
+      "category_hint": "sql",
+      "subtype_hint": "stored_procedure_dynamic_sql",
+      "language": "sql",
+      "file": "sql-procs/sp_search_orders.sql",
+      "line": 5,
+      "snippet": "SET @sql = 'SELECT * FROM Orders WHERE Customer = ''' + @Customer + ''' ORDER BY ' + @Sort",
+      "sql_var": null,
+      "input_hint": "none",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    },
+    {
+      "candidate_id": "I-0038",
+      "rule": "proc-dynamic-sql",
+      "category_hint": "sql",
+      "subtype_hint": "stored_procedure_dynamic_sql",
+      "language": "sql",
+      "file": "sql-procs/sp_search_orders.sql",
+      "line": 6,
+      "snippet": "EXEC(@sql)",
+      "sql_var": null,
+      "input_hint": "none",
+      "sanitizer_hints": [],
+      "priority": "normal"
+    }
+  ]
+}