@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-12.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-12",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0003",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 10, 8, 6, 7"
+      ],
+      "control_found": null,
+      "notes": "Direct string concatenation of Request.QueryString('member_id') into SQL DELETE statement without any integer casting, parameter binding, or ownership check. The code explicitly constructs the query using user input directly.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Unprotected string concatenation of user input into a destructive SQL query."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/member.asp?mode=delete&member_id={id}",
+        "target_param": "member_id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0004",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/order.asp lines 6, 12"
+      ],
+      "control_found": null,
+      "notes": "Line 6 directly concatenates `id` (from Request) into SQL. Line 12 uses `CLng` on the session user ID but NOT on the `sid` parameter derived from Request. An attacker can bypass the ownership check by manipulating `sid` to match a different user's order ID or inject logic.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "User input `id` and `sid` are concatenated directly into SQL without type casting or parameterization."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order.asp?id={id}",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0005",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/order.asp lines 12, 6"
+      ],
+      "control_found": null,
+      "notes": "Duplicate of INJ-I-0004. The code at line 12 concatenates `sid` (derived from Request) directly into SQL. Although `user_id` is cast via CLng, the `sid` parameter itself is not validated or cast before insertion, allowing injection to bypass the ownership filter.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Same vulnerability as INJ-I-0004; user-controlled `sid` is concatenated into SQL."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order.asp?sid={sid}",
+        "target_param": "sid"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0006",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "coldfusion/app/OrderService.cfc lines 5, 3"
+      ],
+      "control_found": null,
+      "notes": "ColdFusion template interpolation `#arguments.orderId#` is used directly in the SQL query. The argument type is defined as 'string' (line 3), which does not enforce integer casting. Without `cfqueryparam`, this allows injection.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "String-typed argument passed directly to template interpolation without type enforcement."
+      },
+      "attack_vector": {
+        "method": "POST/GET",
+        "path": "/OrderService.cfc?orderId={id}",
+        "target_param": "orderId"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0007",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "coldfusion/app/order.cfm lines 3, 6"
+      ],
+      "control_found": null,
+      "notes": "Line 3 uses `#url.id#` directly in SQL. While line 7 shows a safe version using `cfqueryparam`, the finding specifically targets line 3 which lacks protection. The code at line 3 is reachable and vulnerable.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Unprotected template interpolation at line 3; the existence of a safe query later does not mitigate the vulnerability at line 3."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order.cfm?id={id}",
+        "target_param": "id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-13.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-13",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0009",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 10, 13"
+      ],
+      "control_found": null,
+      "notes": "User input 'id' from Request.QueryString is directly concatenated into the SQL string without any sanitization, casting, or parameter binding. The subsequent creation of a 'safe' command with parameters does not mitigate the risk of the first query.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation of unvalidated user input into SQL command."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/Orders/OrderDetail.aspx?id=<payload>",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0010",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 19"
+      ],
+      "control_found": null,
+      "notes": "User input 'ref' from Request is directly interpolated into a SQL string using string.Format. No validation or parameterization is applied.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string formatting of unvalidated user input into SQL command."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/Orders/OrderDetail.aspx?ref=<payload>",
+        "target_param": "ref"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0011",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 20"
+      ],
+      "control_found": null,
+      "notes": "User input 'cart' from Request.Form is directly interpolated into a SQL string using raw interpolation. No validation or parameterization is applied.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string interpolation of unvalidated user input into SQL command."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Orders/OrderDetail.aspx",
+        "target_param": "cart"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0012",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp lines 3, 5"
+      ],
+      "control_found": null,
+      "notes": "User input 'no' from request.getParameter is directly concatenated into a SQL string. No validation or parameterization is applied.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation of unvalidated user input into SQL command."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order/detail.jsp?no=<payload>",
+        "target_param": "no"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0016",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java lines 10, 13"
+      ],
+      "control_found": null,
+      "notes": "User input 'email' and 'user_id' from request.getParameter are directly concatenated into a SQL string. No validation or parameterization is applied.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation of unvalidated user input into SQL command."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/EditUserAction.action",
+        "target_param": "email"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-14.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-14",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0017",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "InvoiceController.java line 29"
+      ],
+      "control_found": null,
+      "notes": "User input 'customer' is directly concatenated into a Hibernate HQL string without parameter binding or allow-listing. The method signature accepts a String, and the query uses string concatenation.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation into HQL query with user-supplied input."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/invoices?customer={payload}",
+        "target_param": "customer"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0020",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "orders.js line 17"
+      ],
+      "control_found": null,
+      "notes": "User input 'req.query.month' is directly concatenated into a SQL string. No sanitization or parameter binding is visible in the provided context.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation into SQL query with user-supplied input."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/reports?month={payload}",
+        "target_param": "month"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0021",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "orders.js line 29"
+      ],
+      "control_found": null,
+      "notes": "User input 'req.query.shop' is interpolated directly into a template literal SQL string. No sanitization or parameter binding is visible.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct template literal interpolation into SQL query with user-supplied input."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/stats?shop={payload}",
+        "target_param": "shop"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0022",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "orders.js line 21"
+      ],
+      "control_found": null,
+      "notes": "The entire 'req.body' object is passed directly as the filter argument to `findOne`. This allows injection of arbitrary MongoDB operators (e.g., `$ne`, `$gt`) or field names. No schema validation or whitelisting is visible in the context.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct object passing to NoSQL query without schema validation or operator whitelisting."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/login",
+        "target_param": "body"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0023",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "orders.js line 25"
+      ],
+      "control_found": null,
+      "notes": "User input 'req.query.n' is concatenated into a JavaScript string inside the `$where` clause. This executes arbitrary JavaScript logic on the server side against the database document, allowing bypass of standard query filters.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct string concatenation into MongoDB $where clause with user-supplied input."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/search?n={payload}",
+        "target_param": "n"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-15.json

@@ -0,0 +1,110 @@
+{
+  "batch_id": "verified-15",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0024",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:29"
+      ],
+      "control_found": null,
+      "notes": "User input `req.query.shop` is interpolated directly into a MongoDB query string without any sanitization, casting, or allow-listing. The code uses backticks for template literals which bypasses standard escaping mechanisms.",
+      "suggested_subtype": "operator_injection",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/api/orders/stats",
+        "target_param": "shop"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0025",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi:13"
+      ],
+      "control_found": null,
+      "notes": "User input `$id` from `$_GET` is concatenated directly into a SQL string using double quotes. No integer casting or parameterized query is used for this specific statement.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/cgi-bin/order.cgi",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0027",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php:8"
+      ],
+      "control_found": null,
+      "notes": "Input is cast to integer on line 6 (`$uid = (int)$_GET['uid']`). This mitigates standard numeric SQL injection vectors. While concatenation exists, the explicit type coercion significantly reduces the attack surface. Severity should be lowered from critical.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/admin.php?action=view",
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0028",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php:12"
+      ],
+      "control_found": null,
+      "notes": "User input `$id` from `$_POST` is concatenated directly into a SQL DELETE statement without any sanitization or parameterization. This allows arbitrary deletion of records.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "POST",
+        "path": "/admin.php?action=delete",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0029",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php:5"
+      ],
+      "control_found": null,
+      "notes": "User input `$_GET['login']` and `$_GET['pass']` are passed directly as keys in a MongoDB query object. This allows attackers to inject arbitrary fields or operators (e.g., `$where`, `$regex`) into the query structure.",
+      "suggested_subtype": "operator_injection",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/mongo_find.php",
+        "target_param": "login"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-16.json

@@ -0,0 +1,116 @@
+{
+  "batch_id": "verified-16",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0030",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php:6",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "User input $_GET['n'] is directly concatenated into the MongoDB $where clause string. No allow-list, integer cast, or parameter binding is visible in the provided code context.",
+      "suggested_subtype": "operator_injection",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/mongo_find.php",
+        "target_param": "n"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0031",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php:6",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "User input $_GET['id'] is directly concatenated into the SQL query string. No integer cast or parameter binding is visible in the provided code context.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/order_detail.php",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0032",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:8",
+        "php-plain/search.php:9",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "User input $_GET['q'] is concatenated into the SQL query. User input $_GET['sort'] is also concatenated directly into the ORDER BY clause without any allow-list validation or integer casting visible in the code context.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/search.php",
+        "target_param": "q"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0033",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:9",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "User input $_GET['sort'] is directly concatenated into the ORDER BY clause. No allow-list or validation logic is visible in the provided code context.",
+      "suggested_subtype": "string_concatenation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/search.php",
+        "target_param": "sort"
+      }
+    },
+    {
+      "finding_id": "INJ-I-0034",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "critical",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:14",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "User input $_GET['cat'] is interpolated directly into the SQL string using heredoc syntax. No allow-list or validation is visible in the provided code context.",
+      "suggested_subtype": "string_interpolation",
+      "suggested_cwe": [
+        "CWE-89"
+      ],
+      "attack_vector": {
+        "method": "GET",
+        "path": "/search.php",
+        "target_param": "cat"
+      }
+    }
+  ]
+}