@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/mass-assignment.candidates.json

@@ -0,0 +1,232 @@
+{
+  "generated_by": "lsa find_mass_assignment.py 0.3.1",
+  "target": "repo",
+  "summary": {
+    "total": 15,
+    "high_priority": 11,
+    "by_rule": {
+      "cs-entity-binding": 1,
+      "cs-update-model": 1,
+      "java-entity-binding": 2,
+      "java-beanutils-populate": 1,
+      "js-model-call": 2,
+      "php-eloquent-static": 2,
+      "php-eloquent-fill": 1,
+      "php-foreach-input": 1,
+      "php-privileged-field": 1,
+      "php-extract": 1,
+      "py-kwargs-request": 1,
+      "py-items-loop": 1
+    },
+    "by_subtype": {
+      "whole_object_binding": 13,
+      "privileged_field_writable": 2
+    },
+    "models": {
+      "jpa_entities": 1,
+      "ef_dbsets": 2,
+      "laravel_models": 3
+    }
+  },
+  "candidates": [
+    {
+      "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+      "line": 12,
+      "language": "cs",
+      "rule": "cs-entity-binding",
+      "subtype": "whole_object_binding",
+      "target": "Customer",
+      "allowlist": "none",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "public ActionResult Edit(Customer customer)",
+      "candidate_id": "M-0001"
+    },
+    {
+      "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+      "line": 30,
+      "language": "cs",
+      "rule": "cs-update-model",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "TryUpdateModel(customer);",
+      "candidate_id": "M-0002"
+    },
+    {
+      "file": "java-legacy/src/com/acme/web/AccountController.java",
+      "line": 14,
+      "language": "java",
+      "rule": "java-entity-binding",
+      "subtype": "whole_object_binding",
+      "target": "Account",
+      "allowlist": "none",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "public String save(@ModelAttribute Account account) {",
+      "candidate_id": "M-0003"
+    },
+    {
+      "file": "java-legacy/src/com/acme/web/AccountController.java",
+      "line": 27,
+      "language": "java",
+      "rule": "java-entity-binding",
+      "subtype": "whole_object_binding",
+      "target": "Account",
+      "allowlist": "none",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "public Account update(@RequestBody Account account) {",
+      "candidate_id": "M-0004"
+    },
+    {
+      "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+      "line": 12,
+      "language": "java",
+      "rule": "java-beanutils-populate",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "BeanUtils.populate(account, request.getParameterMap());",
+      "candidate_id": "M-0005"
+    },
+    {
+      "file": "node-express/routes/profile.js",
+      "line": 8,
+      "language": "js",
+      "rule": "js-model-call",
+      "subtype": "whole_object_binding",
+      "target": "User",
+      "allowlist": "unknown",
+      "priority": "medium",
+      "sensitive_fields": [],
+      "code": "User.findByIdAndUpdate(req.user._id, req.body, function (e, u) { res.json(u); });",
+      "candidate_id": "M-0006"
+    },
+    {
+      "file": "node-express/routes/profile.js",
+      "line": 16,
+      "language": "js",
+      "rule": "js-model-call",
+      "subtype": "whole_object_binding",
+      "target": "User",
+      "allowlist": "unknown",
+      "priority": "medium",
+      "sensitive_fields": [],
+      "code": "var user = new User(req.body);",
+      "candidate_id": "M-0007"
+    },
+    {
+      "file": "php-laravel/app/Http/Controllers/AccountController.php",
+      "line": 13,
+      "language": "php",
+      "rule": "php-eloquent-static",
+      "subtype": "whole_object_binding",
+      "target": "User",
+      "allowlist": "none",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "return User::create($request->all());",
+      "candidate_id": "M-0008"
+    },
+    {
+      "file": "php-laravel/app/Http/Controllers/AccountController.php",
+      "line": 23,
+      "language": "php",
+      "rule": "php-eloquent-static",
+      "subtype": "privileged_field_writable",
+      "target": "Team",
+      "allowlist": "seen",
+      "priority": "high",
+      "sensitive_fields": [
+        "owner_id"
+      ],
+      "code": "return Team::create($request->all());",
+      "candidate_id": "M-0009"
+    },
+    {
+      "file": "php-laravel/app/Http/Controllers/AccountController.php",
+      "line": 36,
+      "language": "php",
+      "rule": "php-eloquent-fill",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "medium",
+      "sensitive_fields": [],
+      "code": "$user->fill($request->all())->save();",
+      "candidate_id": "M-0010"
+    },
+    {
+      "file": "php-plain/profile.php",
+      "line": 6,
+      "language": "php",
+      "rule": "php-foreach-input",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "foreach ($_POST as $field => $value) {",
+      "candidate_id": "M-0011"
+    },
+    {
+      "file": "php-plain/profile.php",
+      "line": 10,
+      "language": "php",
+      "rule": "php-privileged-field",
+      "subtype": "privileged_field_writable",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [
+        "role"
+      ],
+      "code": "$user->role = $_POST['role'];",
+      "candidate_id": "M-0012"
+    },
+    {
+      "file": "php-plain/register.php",
+      "line": 4,
+      "language": "php",
+      "rule": "php-extract",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "extract($_POST);",
+      "candidate_id": "M-0013"
+    },
+    {
+      "file": "python-flask/profile.py",
+      "line": 10,
+      "language": "python",
+      "rule": "py-kwargs-request",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "medium",
+      "sensitive_fields": [],
+      "code": "user = User(**request.json)",
+      "candidate_id": "M-0014"
+    },
+    {
+      "file": "python-flask/profile.py",
+      "line": 27,
+      "language": "python",
+      "rule": "py-items-loop",
+      "subtype": "whole_object_binding",
+      "target": null,
+      "allowlist": "unknown",
+      "priority": "high",
+      "sensitive_fields": [],
+      "code": "for key, value in request.json.items():",
+      "candidate_id": "M-0015"
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/memory.log

@@ -0,0 +1,36 @@
+13:38:18 swap=3675.81M compr_pages=42433.
+13:39:18 swap=3675.81M compr_pages=57738. qwen3.5:9b-16k df9cabffde69 7.9 GB 100% GPU 16384 mlx 4 minutes from now
+13:40:18 swap=3675.81M compr_pages=57412. qwen3.5:9b-16k df9cabffde69 7.9 GB 100% GPU 16384 mlx 3 minutes from now
+13:41:18 swap=3675.81M compr_pages=56420. qwen3.5:9b-16k df9cabffde69 8.7 GB 100% GPU 16384 mlx 4 minutes from now
+13:42:18 swap=3659.81M compr_pages=54938. qwen3.5:9b-16k df9cabffde69 8.7 GB 100% GPU 16384 mlx 3 minutes from now
+13:43:18 swap=3651.81M compr_pages=54619. qwen3.5:9b-16k df9cabffde69 9.4 GB 100% GPU 16384 mlx 4 minutes from now
+13:44:19 swap=3651.81M compr_pages=54461. qwen3.5:9b-16k df9cabffde69 9.4 GB 100% GPU 16384 mlx 3 minutes from now
+13:45:19 swap=3651.81M compr_pages=53870. qwen3.5:9b-16k df9cabffde69 10.0 GB 100% GPU 16384 mlx 4 minutes from now
+13:46:19 swap=3651.81M compr_pages=53783. qwen3.5:9b-16k df9cabffde69 10 GB 100% GPU 16384 mlx 4 minutes from now
+13:47:19 swap=3651.81M compr_pages=53086. qwen3.5:9b-16k df9cabffde69 10 GB 100% GPU 16384 mlx 3 minutes from now
+13:48:19 swap=3651.81M compr_pages=52997. qwen3.5:9b-16k df9cabffde69 11 GB 100% GPU 16384 mlx 4 minutes from now
+13:49:19 swap=3651.81M compr_pages=104902. qwen3.5:9b-16k df9cabffde69 11 GB 100% GPU 16384 mlx 3 minutes from now
+13:50:19 swap=3651.81M compr_pages=104596. qwen3.5:9b-16k df9cabffde69 11 GB 100% GPU 16384 mlx 2 minutes from now
+13:51:19 swap=3651.81M compr_pages=104476. qwen3.5:9b-16k df9cabffde69 11 GB 100% GPU 16384 mlx About a minute from now
+13:52:19 swap=3651.81M compr_pages=111680. qwen3.5:9b-16k df9cabffde69 11 GB 100% GPU 16384 mlx 4 minutes from now
+13:53:19 swap=3651.81M compr_pages=110438. qwen3.5:9b-16k df9cabffde69 12 GB 100% GPU 16384 mlx 4 minutes from now
+13:54:19 swap=3779.56M compr_pages=378423. qwen3.5:9b-16k df9cabffde69 12 GB 100% GPU 16384 mlx 3 minutes from now
+13:55:20 swap=3763.56M compr_pages=362192. qwen3.5:9b-16k df9cabffde69 12 GB 100% GPU 16384 mlx 2 minutes from now
+13:56:20 swap=3739.56M compr_pages=381713. qwen3.5:9b-16k df9cabffde69 13 GB 100% GPU 16384 mlx 4 minutes from now
+13:57:20 swap=4470.50M compr_pages=383437. qwen3.5:9b-16k df9cabffde69 13 GB 100% GPU 16384 mlx 4 minutes from now
+13:58:20 swap=4454.50M compr_pages=381367. qwen3.5:9b-16k df9cabffde69 14 GB 100% GPU 16384 mlx 4 minutes from now
+13:59:20 swap=4685.94M compr_pages=401842. qwen3.5:9b-16k df9cabffde69 14 GB 100% GPU 16384 mlx 4 minutes from now
+14:00:20 swap=4669.94M compr_pages=424209. qwen3.5:9b-16k df9cabffde69 15 GB 100% GPU 16384 mlx 4 minutes from now
+14:01:20 swap=5394.81M compr_pages=433790. qwen3.5:9b-16k df9cabffde69 15 GB 100% GPU 16384 mlx 4 minutes from now
+14:02:20 swap=5394.81M compr_pages=435286. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:03:20 swap=5394.81M compr_pages=484879. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:04:20 swap=5410.69M compr_pages=465188. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:05:20 swap=5336.88M compr_pages=516055. qwen3.5:9b-16k df9cabffde69 17 GB 100% GPU 16384 mlx 4 minutes from now
+14:06:21 swap=5882.25M compr_pages=494168. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:07:21 swap=5074.75M compr_pages=469292. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:08:21 swap=5296.75M compr_pages=480656. qwen3.5:9b-16k df9cabffde69 17 GB 100% GPU 16384 mlx 4 minutes from now
+14:09:21 swap=5281.19M compr_pages=494084. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:10:21 swap=4827.81M compr_pages=510889. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:11:21 swap=5509.25M compr_pages=504096. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now
+14:12:21 swap=5950.88M compr_pages=468699. qwen3.5:9b-16k df9cabffde69 17 GB 100% GPU 16384 mlx 4 minutes from now
+14:13:21 swap=5670.88M compr_pages=461384. qwen3.5:9b-16k df9cabffde69 16 GB 100% GPU 16384 mlx 4 minutes from now

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/routes/routes-001.json

@@ -0,0 +1,425 @@
+{
+  "routes": [
+    {
+      "route_id": "R-0002",
+      "method": [
+        "ANY"
+      ],
+      "path": "/classic-asp/shop/member.asp?mode=edit",
+      "path_source": "declared",
+      "handler": {
+        "file": "classic-asp/shop/member.asp",
+        "line": 5
+      },
+      "id_inputs": [
+        {
+          "name": "mode",
+          "source": "any"
+        },
+        {
+          "name": "name",
+          "source": "form"
+        },
+        {
+          "name": "member_id",
+          "source": "form"
+        },
+        {
+          "name": "member_id",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0003",
+      "method": [
+        "ANY"
+      ],
+      "path": "/classic-asp/shop/member.asp?mode=delete",
+      "path_source": "declared",
+      "handler": {
+        "file": "classic-asp/shop/member.asp",
+        "line": 9
+      },
+      "id_inputs": [
+        {
+          "name": "mode",
+          "source": "any"
+        },
+        {
+          "name": "name",
+          "source": "form"
+        },
+        {
+          "name": "member_id",
+          "source": "form"
+        },
+        {
+          "name": "member_id",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0004",
+      "method": [
+        "ANY"
+      ],
+      "path": "/classic-asp/shop/order.asp",
+      "path_source": "declared",
+      "handler": {
+        "file": "classic-asp/shop/order.asp",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        },
+        {
+          "name": "sid",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0005",
+      "method": [
+        "ANY"
+      ],
+      "path": "/coldfusion/app/OrderService.cfc?method=getOrder",
+      "path_source": "declared",
+      "handler": {
+        "file": "coldfusion/app/OrderService.cfc",
+        "line": 2
+      },
+      "id_inputs": [
+        {
+          "name": "orderId",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0006",
+      "method": [
+        "ANY"
+      ],
+      "path": "/coldfusion/app/order.cfm",
+      "path_source": "declared",
+      "handler": {
+        "file": "coldfusion/app/order.cfm",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0007",
+      "method": [
+        "POST"
+      ],
+      "path": "/Admin/DeleteUser",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "line": 12
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0008",
+      "method": [
+        "POST",
+        "POST"
+      ],
+      "path": "/Admin/ResetPassword",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "line": 22
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0009",
+      "method": [
+        "POST"
+      ],
+      "path": "/Admin/Export",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "line": 30
+      },
+      "id_inputs": [
+        {
+          "name": "isAdmin",
+          "source": "query"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0013",
+      "method": [
+        "ANY"
+      ],
+      "path": "/Invoice/Details",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "line": 11
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0014",
+      "method": [
+        "ANY"
+      ],
+      "path": "/Invoice/Mine",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "line": 17
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0015",
+      "method": [
+        "POST"
+      ],
+      "path": "/Invoice/Search",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "line": 26
+      },
+      "id_inputs": [
+        {
+          "name": "customer",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0017",
+      "method": [
+        "ANY"
+      ],
+      "path": "/dotnet-legacy/Web/Orders/EditOrder.aspx",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "hfOrderId",
+          "source": "hidden_field"
+        },
+        {
+          "name": "txtNote",
+          "source": "form"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0018",
+      "method": [
+        "ANY"
+      ],
+      "path": "/dotnet-legacy/Web/Orders/OrderDetail.aspx",
+      "path_source": "declared",
+      "handler": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "id",
+          "source": "query"
+        },
+        {
+          "name": "cart",
+          "source": "form"
+        },
+        {
+          "name": "ref",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0019",
+      "method": [
+        "ANY"
+      ],
+      "path": "/order/detail.jsp",
+      "path_source": "declared",
+      "handler": {
+        "file": "java-legacy/WebContent/order/detail.jsp",
+        "line": 1
+      },
+      "id_inputs": [
+        {
+          "name": "no",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    },
+    {
+      "route_id": "R-0001",
+      "method": [
+        "ANY"
+      ],
+      "path": "/user/edit.do",
+      "path_source": "declared",
+      "handler": {
+        "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+        "line": 8
+      },
+      "id_inputs": [
+        {
+          "name": "user_id",
+          "source": "any"
+        },
+        {
+          "name": "email",
+          "source": "any"
+        }
+      ],
+      "guards": [],
+      "data_ops": [
+        {
+          "op": "read"
+        }
+      ],
+      "needs_bola_audit": true
+    }
+  ],
+  "rejected": []
+}