@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/scripts/map_routes.py

@@ -24,6 +24,7 @@ from java_routes import (build_class_index, collect_spring_beans, entry_method_l
                          struts_modules, xml_declared)
 from lsa_common import (JAVA_WEB_ROOT, KIT_VERSION, call_args, compile_id_patterns, is_id_name,  # noqa: E402
                         iter_source_files, line_of, load_config, read_text, split_top, write_json)
+from laravel_routes import resolve_laravel_handlers, route_action  # noqa: E402
 from nextjs_routes import middleware_note, nextjs_declared  # noqa: E402
 from privilege import annotate_privilege  # noqa: E402
 
@@ -268,7 +269,7 @@ def php_declared(c: Collector, rel: str, text: str, stacks: set) -> bool:
         end = text.find(";", m.end())
         stmt = text[m.start(): end if end > 0 else m.end() + 200]
         c.add(stack="php-laravel", kind="declared_route", method=[verb.upper()], path="/" + path.lstrip("/"),
-              handler={"file": rel, "line": line, "symbol": None}, id_params=c.path_params(path),
+              handler={"file": rel, "line": line, "symbol": route_action(stmt)}, id_params=c.path_params(path),
               guard_hints=c.guards(stmt, line) + c.guards(text[:m.start()][-3000:], 1)[:2],
               data_hints=[], notes="handler is in the controller named in this route")
         found = True
@@ -744,6 +745,8 @@ def map_routes(target: Path, config: Dict, stack_ids: Optional[set] = None, work
             it["id_params"] = c.inputs("java", t)
             it["guard_hints"] = it["guard_hints"] or c.guards(t)
             it["data_hints"] = it["data_hints"] or c.data_ops(t)
+    # post-pass 1b: Laravel route declarations -> the controller method they name (#380)
+    c.items = resolve_laravel_handlers(c.items, target, enc, c, [rel for _, rel in files])
     # post-pass 2: servlet classes without @WebServlet -> take the path from web.xml
     xml_paths: Dict[str, List[str]] = {}
     for it in c.items:

package/assess/lsa/tests/EVAL-RESULTS.md

@@ -333,3 +333,129 @@ and their tests still score against them.
 Run 5 rescored against the new ground truth (for comparison only; findings unchanged): BOLA 28 / 29
 (run A) and 16 / 29 (run B), precision 0.859 and 0.826, still no false positive on SAFE markers. Every
 new marker was already reported by both runs; Tier 1 lists all of them as BOLA route candidates.
+
+---
+
+## Run 6 — 2026-11-11, platform 2.5.0, kit 0.3.1 (#323 part 4: new harness, 121-item ground truth, redaction)
+
+Issue #323. First run on the harness from #334 (no code fields in 4a / 4b templates, quote repair,
+findings from flagged verdicts), the fixtures and ground truth from #336 (121 items: 29 BOLA, 34
+SQL/NoSQL injection, 10 BFLA, 15 mass assignment, 33 SAFE), and secret redaction of code sent to the
+model (v2.4.0). Outputs are archived in [`assess/lsa/examples/eval-run-6/`](../examples/eval-run-6/).
+Runs 4–5 are not directly comparable; the Run 5 rows below are the Run 5 findings rescored against the
+new ground truth.
+
+| Item | Value |
+|---|---|
+| Pipeline | `komagu scan <repo> --no-cache --headless-ai http://localhost:11434/v1 --model <model> --ai-timeout 3600` from `main` at v2.5.0 |
+| Hosting | Ollama 0.40.16 on the same Apple M4 Pro, 24 GB RAM, 100% GPU, local only; `gpt-oss:20b` on the llama.cpp runner with 32,768 context (as in Runs 4–5) |
+| Scoring | `tests/score_findings.py --verdicts` (tolerance 3 lines) |
+| Machine | No other heavy work while measuring; up to 5.7 GB swap in use during the `gpt-oss` runs |
+
+### Results after verification (`gpt-oss:20b`)
+
+| Run | BOLA | Injection | BFLA marker | Mass marker | BFLA verdict | Mass verdict | FP on safe code | Precision | Rejected | Retries · repaired · parse fail | From verdicts | Min · calls · tokens |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| Run 5 A, rescored | 28/29 | 34/34 | 10/10 | 10/15 | 10/10 | 15/15 | 0 | 0.859 | 2 | 0 · — · 0 | — | 83 · 32 · 328K |
+| Run 5 B, rescored | 16/29 | 32/34 | 9/10 | 14/15 | 10/10 | 15/15 | 0 | 0.826 | 3 | 1 · — · 1 | — | 86 · 31 · 369K |
+| **Run 6 A** | **26/29** | **34/34** | **10/10** | **14/15** | **10/10** | **15/15** | **1** | **0.813** | 2 | 0 · 0 · 0 | 9 (5 BOLA, 4 mass) | 40 · 33 · 315K |
+| **Run 6 B** | **26/29** | **34/34** | **10/10** | **14/15** | **10/10** | **14/15** | **1** | **0.787** | 1 | 1 · 0 · 0 | 14 (5 BOLA, 9 mass) | 56 · 34 · 373K |
+
+- **The two runs now agree.** BOLA is 26 / 29 in both (Run 5: 28 and 16). No batch was lost: no parse
+  failure, no call error, no batch needed the quote repair, and the one retry (B, `injection-001`)
+  succeeded. The `routes-001` batch that failed in Run 4 B and Run 5 B now parses.
+- **Mass assignment:** 14 / 15 as located findings in both runs (Run 5: 10 and 14). Findings written from
+  flagged verdicts closed the gap: the four candidates run A of Run 5 judged `vulnerable` without a
+  finding (`profile.php` ×2, `CustomerController.cs` ×2) are findings in both runs.
+  `php-plain/register.php:4` is still missed. In A the verifier rejected it because the INSERT "only"
+  writes `email`, `name` and `role`, missing that `extract($_POST)` can overwrite `$role` (the
+  fixture change in #336); in B the auditor did not flag it.
+- **BFLA:** 10 / 10 in both runs, located and by verdict.
+- **Misses:** `perl-cgi/cgi-bin/order.cgi:19` (both runs, missed since Run 4), `node-express/routes/orders.js:29`
+  (both), `java-legacy/.../OrderServlet.java:15` (A), `python-flask/app.py:12` (B).
+- **False positives on SAFE markers: 1 per run** (Run 5: 0), both injection:
+  - A: `classic-asp/shop/member.asp:6`. The `UPDATE` starts on line 6, whose `name` value is escaped;
+    the concatenated `member_id` is on line 7, which is also reported. The finding is anchored one line
+    early rather than describing a new flaw, but it is scored as a false positive.
+  - B: `python-flask/app.py:12`. `order_id` is an `<int:...>` path parameter, so the `%` formatting
+    cannot inject. The model reported the route's missing ownership check as SQL injection, so the
+    BOLA marker on the same line was missed.
+- **Precision 0.81 / 0.79.** Five of the unmatched findings per run come from verdicts: the BOLA
+  auditor flagged the Laravel routes `/register`, `/posts`, `/teams`, `/account/rename` and
+  `/account/profile`, and the generated findings point at their declarations in `routes/web.php`
+  (lines 6–10). The triage after Run 5 found these routes act on `$request->user()` or touch no
+  record, so they are likely false positives. Without them precision would be 0.85 / 0.83.
+- **Duration:** 40 and 56 minutes (Run 5: 83 and 86). The model wrote fewer tokens (84K and 118K
+  completion tokens against about 109K and 111K); the Ollama version also changed (0.40.13 → 0.40.16).
+- **`ai-raw/`** is written only for batches that needed a repair or failed to parse. None did, so neither
+  run has an `ai-raw/` folder.
+
+### Did redaction reduce recall?
+
+No, and on this repo it cannot. Running the redaction used for model context
+(`assess/lsa/scripts/redaction.py`, `redact_lines`) over every file of the eval repo changes **0 lines**:
+the fixtures contain no secrets in the patterns it covers. The prompts sent in Run 6 are therefore the
+same code as without redaction. The BOLA difference from Run 5 A (28 → 26) is run-to-run variance (the
+same model put 16 in Run 5 B). This also means the eval repo does not test whether redaction costs
+recall on code that does contain secrets; that is covered only by the unit tests
+(`operate/tests/test_ai_redaction.py`, `test_no_planted_secret_reaches_the_model`).
+
+### `qwen3.5:9b` with a 16K context (not completed)
+
+To fit the 24 GB machine, `qwen3.5:9b` was run with `num_ctx 16384` (a local tag built
+`FROM qwen3.5:9b` with `PARAMETER num_ctx 16384`, MLX runner), same command and timeout as above. It did
+not finish: the run was stopped by hand after 3 h 14 min, while the second injection batch was still
+running and before the privilege (4c) and verifier (5) phases. The partial output is archived as
+[`eval-run-6/qwen-16k-partial/`](../examples/eval-run-6/qwen-16k-partial/) (raw batch findings, the
+per-minute memory log, and an indicative score of the unverified findings).
+
+| Phase / batch | Time | Result |
+|---|---|---|
+| Stack detection | 2 min | done |
+| BOLA `routes-001` (15 routes) | 60 min | **timed out**, empty |
+| BOLA `routes-002` … `routes-004` | 5, 3 and 2 min | 8, 7 and 9 findings |
+| BOLA `routes-005` | 60 min | **timed out**, empty |
+| BOLA `routes-006` | 1 min | 1 finding |
+| Injection `injection-001` | 11 min | 20 findings |
+| Injection `injection-002` | 49 min+ | still running when stopped |
+
+- **Memory:** the runner used 8.1 GB for the first hour, then grew to 13, 18 and finally 20 GB (from about
+  10:55, after the first timeout). Swap rose from about 4 GB (other work on the machine) to 12.4 GB of
+  13.3 GB; the run was stopped there to keep the machine usable. `gpt-oss:20b` stayed under 5.7 GB of
+  swap on the same machine.
+- **Timeouts:** a batch that hits `--ai-timeout` is not retried (only empty or unparseable replies are),
+  so two of six BOLA batches were lost outright. The quick batches suggest the model can do the task;
+  the timed-out ones look like long reasoning that does not end within the context.
+- **Indicative score** (findings before verification, from the batches that finished): BOLA 12/29,
+  injection 22/34, BFLA and mass assignment not reached, precision 0.73, no finding on a SAFE marker.
+  These numbers are not comparable with the `gpt-oss` rows: two BOLA batches, half the injection
+  candidates and the verifier are missing.
+
+Thinking looks like the cause: on this 24 GB machine a 16K context with default reasoning is **not**
+a working setting. The run below with reasoning off is.
+
+### `qwen3.5:9b` with a 16K context and reasoning off (#382)
+
+Same tag, command and timeout, plus `--ai-reasoning-effort none` (#382), which sends
+`"reasoning_effort": "none"` with every request; Ollama's `/v1` endpoint ignores `think: false` but
+honours this field. One run, archived as [`eval-run-6/qwen-16k-nothink/`](../examples/eval-run-6/qwen-16k-nothink/)
+(with `ai-raw/` for the two repaired verifier replies and the per-minute memory log).
+
+| Run | BOLA (29) | Injection (34) | BFLA (10) | Mass (15) | BFLA verdict | Mass verdict | SAFE hit | Precision | Time |
+|---|---|---|---|---|---|---|---|---|---|
+| `gpt-oss:20b` A | 26 | 34 | 10 | 14 | 10 | 15 | 1 | 0.813 | 40 min |
+| `gpt-oss:20b` B | 26 | 34 | 10 | 14 | 10 | 14 | 1 | 0.787 | 56 min |
+| `qwen3.5:9b` 16K, reasoning off | 23 | 29 | 6 | 10 | 8 | 15 | 0 | 0.734 | 35 min |
+
+- **Completed:** all phases, 33 calls, no timeout, no parse failure or call error, no retry, all findings
+  anchored. Two verifier replies were repaired (`verified-1`, `verified-9`); 11 findings were generated
+  from flagged verdicts (2 BOLA, 2 BFLA, 7 mass assignment).
+- **Recall** is lower than `gpt-oss:20b` in every category: BFLA and mass assignment are mostly found as
+  verdicts (8/10, 15/15) but placed on the right line less often (6/10, 10/15).
+- **Precision 0.73:** no finding on a SAFE marker, but 25 unmatched findings (23 BOLA, 2 BFLA), not yet triaged;
+  none is on `php-laravel/routes/web.php`.
+- **Memory and time:** the runner stayed at 14–17 GB and swap peaked at 6.0 GB (about 3.7 GB before the
+  run, from other work), against 20 GB and 12.4 GB with reasoning on. 35 minutes in all, of which the
+  verifier took 17.
+- **Minimum to run it:** a 24 GB machine is enough with `num_ctx 16384` and `--ai-reasoning-effort none`.
+  With reasoning on it needs more; on this evidence at least 32 GB RAM.

package/assess/lsa/tests/test_eval_run_6.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+"""Keeps the archived Evaluation Run 6 numbers (Issue #323) in step with the scorer and EVAL-RESULTS.md."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).resolve().parent
+LSA_ROOT = TESTS_DIR.parent
+EVAL_RUN_6_DIR = LSA_ROOT / "examples" / "eval-run-6"
+GROUND_TRUTH = EVAL_RUN_6_DIR / "ground-truth.json"
+RUNS = ("gptoss-a", "gptoss-b", "qwen-16k-nothink")
+QWEN_PARTIAL = EVAL_RUN_6_DIR / "qwen-16k-partial"
+# (BOLA, injection, BFLA, mass assignment) found by location, then BFLA / mass found by auditor verdict
+EXPECTED = {
+    "gptoss-a": {"marker": (26, 34, 10, 14), "verdict": (10, 15)},
+    "gptoss-b": {"marker": (26, 34, 10, 14), "verdict": (10, 14)},
+    "qwen-16k-nothink": {"marker": (23, 29, 6, 10), "verdict": (8, 15)},
+}
+# Findings that land on a SAFE marker, by category (see EVAL-RESULTS.md, Run 6)
+SAFE_HITS = {
+    "gptoss-a": {"injection": ["classic-asp/shop/member.asp:6"]},
+    "gptoss-b": {"injection": ["python-flask/app.py:12"]},
+    "qwen-16k-nothink": {},
+}
+
+
+def score(run: str) -> dict:
+    proc = subprocess.run(
+        [sys.executable, str(TESTS_DIR / "score_findings.py"), "--verdicts", str(GROUND_TRUTH), str(EVAL_RUN_6_DIR / run)],
+        capture_output=True, text=True, check=True,
+    )
+    return json.loads(proc.stdout)
+
+
+class TestEvaluationRun6(unittest.TestCase):
+    def test_ground_truth_is_the_121_item_set(self) -> None:
+        items = json.loads(GROUND_TRUTH.read_text(encoding="utf-8"))["items"]
+        self.assertEqual(len(items), 121)
+
+    def test_artifacts_exist(self) -> None:
+        for run in RUNS:
+            for name in ("findings.json", "coverage.json", "score.json", "ai-run-stats.json"):
+                self.assertTrue((EVAL_RUN_6_DIR / run / name).is_file(), f"{run}/{name}")
+
+    def test_archived_scores_match_the_scorer(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                archived = json.loads((EVAL_RUN_6_DIR / run / "score.json").read_text(encoding="utf-8"))
+                self.assertEqual(score(run), archived)
+
+    def test_numbers_match_eval_results(self) -> None:
+        for run, want in EXPECTED.items():
+            with self.subTest(run=run):
+                report = score(run)
+                pc, vl = report["per_category"], report["verdict_level"]
+                got = tuple(pc[c]["found"] for c in ("bola", "injection", "bfla", "mass_assignment"))
+                self.assertEqual(got, want["marker"])
+                self.assertEqual((vl["bfla"]["found"], vl["mass_assignment"]["found"]), want["verdict"])
+
+    def test_safe_marker_hits_are_the_documented_ones(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                report = score(run)
+                for cat, row in report["per_category"].items():
+                    self.assertEqual(row["false_positive_on_safe_code"], SAFE_HITS[run].get(cat, []), cat)
+                for cat, row in report["verdict_level"].items():
+                    self.assertEqual(row["flagged_safe"], [], cat)
+
+    def test_no_batch_lost_to_parse_or_call_errors(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                stats = json.loads((EVAL_RUN_6_DIR / run / "ai-run-stats.json").read_text(encoding="utf-8"))
+                self.assertEqual(stats["parse_failures"], {})
+                self.assertEqual(stats["call_errors"], {})
+                self.assertEqual(stats["anchoring"]["unanchored"], [])
+
+    def test_qwen_partial_score_matches_eval_results(self) -> None:
+        """The stopped qwen3.5:9b 16K run: indicative score of its unverified findings (EVAL-RESULTS, Run 6)."""
+        with tempfile.TemporaryDirectory() as tmp:
+            shutil.copy(QWEN_PARTIAL / "findings.partial.json", Path(tmp) / "findings.json")
+            proc = subprocess.run(
+                [sys.executable, str(TESTS_DIR / "score_findings.py"), str(GROUND_TRUTH), tmp],
+                capture_output=True, text=True, check=True,
+            )
+        report = json.loads(proc.stdout)
+        archived = json.loads((QWEN_PARTIAL / "score.partial.json").read_text(encoding="utf-8"))
+        self.assertEqual(report, archived)
+        pc = report["per_category"]
+        got = tuple(pc[c]["found"] for c in ("bola", "injection", "bfla", "mass_assignment"))
+        self.assertEqual(got, (12, 22, 0, 0))
+        self.assertEqual(report["precision"], 0.733)
+        for row in pc.values():
+            self.assertEqual(row["false_positive_on_safe_code"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_laravel_routes.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Laravel routes map to the controller method they name, not to their declaration (#380)."""
+
+from __future__ import annotations
+
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(TESTS_DIR.parent / "scripts"))
+from laravel_routes import route_action  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+from map_routes import map_routes  # noqa: E402
+
+ROUTES = """<?php
+use App\\Http\\Controllers\\OrderController;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/orders/{id}', [OrderController::class, 'show']);
+Route::post('/orders', 'OrderController@store');
+Route::get('/missing', [GoneController::class, 'index']);
+Route::get('/ping', function () { return 'ok'; });
+"""
+
+CONTROLLER = """<?php
+namespace App\\Http\\Controllers;
+
+use App\\Models\\Order;
+use Illuminate\\Http\\Request;
+
+class OrderController extends Controller
+{
+    public function show($id)
+    {
+        return Order::find($id);
+    }
+
+    public function store(Request $request)
+    {
+        return Order::create(['customer_id' => $request->input('customer_id')]);
+    }
+}
+"""
+
+
+class TestRouteAction(unittest.TestCase):
+    def test_array_and_string_actions(self) -> None:
+        self.assertEqual(route_action("Route::get('/a', [OrderController::class, 'show'])"), "OrderController@show")
+        self.assertEqual(route_action("Route::get('/a', [\\App\\Http\\Controllers\\OrderController::class, 'show'])"),
+                         "OrderController@show")
+        self.assertEqual(route_action("Route::post('/a', 'App\\Http\\Controllers\\OrderController@store')"),
+                         "OrderController@store")
+        self.assertIsNone(route_action("Route::get('/a', function () { return 1; })"))
+
+
+class TestLaravelHandlers(unittest.TestCase):
+    def setUp(self) -> None:
+        self.root = Path(tempfile.mkdtemp(prefix="lsa_laravel_"))
+        (self.root / "routes").mkdir()
+        (self.root / "app/Http/Controllers").mkdir(parents=True)
+        (self.root / "routes/web.php").write_text(ROUTES, encoding="utf-8")
+        (self.root / "app/Http/Controllers/OrderController.php").write_text(CONTROLLER, encoding="utf-8")
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def routes(self) -> dict:
+        found = map_routes(self.root, load_config(None), {"php-laravel"}, workers=1)["candidates"]
+        return {r["path"]: r for r in found if r["stack"] == "php-laravel"}
+
+    def test_route_points_at_the_controller_method(self) -> None:
+        show = self.routes()["/orders/{id}"]
+        self.assertEqual(show["handler"], {"file": "app/Http/Controllers/OrderController.php", "line": 9,
+                                           "symbol": "OrderController@show"})
+        self.assertEqual(show["notes"], "declared in routes/web.php:5")
+        self.assertIn("id", [p["name"] for p in show["id_params"]])
+
+    def test_string_action_and_body_inputs(self) -> None:
+        store = self.routes()["/orders"]
+        self.assertEqual((store["handler"]["file"], store["handler"]["line"]),
+                         ("app/Http/Controllers/OrderController.php", 14))
+        self.assertIn("customer_id", [p["name"] for p in store["id_params"]])
+
+    def test_unresolved_routes_keep_their_declaration(self) -> None:
+        routes = self.routes()
+        self.assertEqual(routes["/missing"]["handler"], {"file": "routes/web.php", "line": 7,
+                                                         "symbol": "GoneController@index"})
+        self.assertEqual(routes["/ping"]["handler"]["file"], "routes/web.php")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/examples/member-portal/backend-dotnet/Auth/DemoAuthenticationHandler.cs

@@ -0,0 +1,75 @@
+namespace MemberPortal.Backend.Auth;
+
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+
+/// <summary>
+/// Flexible authentication handler supporting mock tokens for personas as well as JWT claims.
+/// </summary>
+public class DemoAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public DemoAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        if (!Request.Headers.TryGetValue("Authorization", out var authHeaderValues))
+        {
+            // Anonymous fallback
+            return Task.FromResult(AuthenticateResult.NoResult());
+        }
+
+        var header = authHeaderValues.ToString();
+        var token = header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
+            ? header.Substring(7).Trim()
+            : header.Trim();
+
+        var claims = token switch
+        {
+            "token-user-a" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-a"),
+                new Claim("sub", "user-a"),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim("name", "Alice"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            "token-user-b" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-b"),
+                new Claim("sub", "user-b"),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim("name", "Bob"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            "token-user-c" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-c"),
+                new Claim("sub", "user-c"),
+                new Claim("tenant_id", "tenant-beta"),
+                new Claim("name", "Charlie"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            _ => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, token),
+                new Claim("sub", token),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim(ClaimTypes.Role, "member")
+            }
+        };
+
+        var identity = new ClaimsIdentity(claims, Scheme.Name);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, Scheme.Name);
+
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}

package/examples/member-portal/backend-dotnet/Program.cs

@@ -1,9 +1,7 @@
-using System.Security.Claims;
-using System.Text.Encodings.Web;
+using MemberPortal.Backend.Auth;
 using MemberPortal.Backend.Data;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Options;
 using Komagu.Security.Authorization;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -53,72 +51,3 @@ app.UseAuthorization();
 app.MapControllers();
 
 app.Run();
-
-/// <summary>
-/// Flexible authentication handler supporting mock tokens for personas as well as JWT claims.
-/// </summary>
-public class DemoAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
-{
-    public DemoAuthenticationHandler(
-        IOptionsMonitor<AuthenticationSchemeOptions> options,
-        ILoggerFactory logger,
-        UrlEncoder encoder)
-        : base(options, logger, encoder)
-    {
-    }
-
-    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
-    {
-        if (!Request.Headers.TryGetValue("Authorization", out var authHeaderValues))
-        {
-            // Anonymous fallback
-            return Task.FromResult(AuthenticateResult.NoResult());
-        }
-
-        var header = authHeaderValues.ToString();
-        var token = header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
-            ? header.Substring(7).Trim()
-            : header.Trim();
-
-        var claims = token switch
-        {
-            "token-user-a" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-a"),
-                new Claim("sub", "user-a"),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim("name", "Alice"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            "token-user-b" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-b"),
-                new Claim("sub", "user-b"),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim("name", "Bob"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            "token-user-c" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-c"),
-                new Claim("sub", "user-c"),
-                new Claim("tenant_id", "tenant-beta"),
-                new Claim("name", "Charlie"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            _ => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, token),
-                new Claim("sub", token),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim(ClaimTypes.Role, "member")
-            }
-        };
-
-        var identity = new ClaimsIdentity(claims, Scheme.Name);
-        var principal = new ClaimsPrincipal(identity);
-        var ticket = new AuthenticationTicket(principal, Scheme.Name);
-
-        return Task.FromResult(AuthenticateResult.Success(ticket));
-    }
-}

package/examples/member-portal/backend-spring/src/main/kotlin/io/komagu/portal/Application.kt

@@ -34,6 +34,8 @@ import java.time.Instant
 // so the identity module's JWT decoder, which requires komagu.security.oidc.*, is left out.
 @SpringBootApplication(exclude = [KomaguIdentityAutoConfiguration::class])
 class Application {
+    // Demo seed data: one literal per row, read as a table.
+    @Suppress("LongMethod")
     @Bean
     fun seedDataRunner(
         orderRepository: OrderRepository,
@@ -107,6 +109,8 @@ class Application {
     }
 }
 
+// Standard Spring Boot entry point; the copy of args happens once at startup.
+@Suppress("SpreadOperator")
 fun main(args: Array<String>) {
     runApplication<Application>(*args)
 }

package/examples/member-portal/backend-spring/src/main/kotlin/io/komagu/portal/controller/Controllers.kt

@@ -162,6 +162,9 @@ class DocumentController(
 }
 
 @RestController
+// Each endpoint keeps the planted vulnerable branch and the remediated branch side by side,
+// with early returns, so the demo shows the before and after in one place.
+@Suppress("ReturnCount")
 @RequestMapping("/api/v1/test")
 class LegacyTestController(
     private val orderRepository: OrderRepository,

package/examples/member-portal/backend-spring/src/main/kotlin/io/komagu/portal/model/Entities.kt

@@ -8,6 +8,8 @@ import java.math.BigDecimal
 import java.time.Instant
 import java.util.UUID
 
+// JPA entity: one constructor parameter per column.
+@Suppress("LongParameterList")
 @Entity
 @Table(name = "portal_orders")
 class OrderEntity(
@@ -21,6 +23,8 @@ class OrderEntity(
     var createdAt: Instant = Instant.now()
 ) : OwnedResource<String>
 
+// JPA entity: one constructor parameter per column.
+@Suppress("LongParameterList")
 @Entity
 @Table(name = "portal_documents")
 class DocumentEntity(

package/examples/member-portal/tests/test_d6_demo_app.py

@@ -86,7 +86,7 @@ class TestDemoAppVerification(unittest.TestCase):
         health_url = f"{cls.base_url}/api/v1/auth/personas"
         for _ in range(50):
             try:
-                with urllib.request.urlopen(health_url, timeout=1.0) as resp:
+                with urllib.request.urlopen(health_url, timeout=1.0) as resp:  # nosec B310  # http://127.0.0.1 test server
                     if resp.status == 200:
                         ready = True
                         break
@@ -124,7 +124,7 @@ class TestDemoAppVerification(unittest.TestCase):
             url,
             headers={"Authorization": "Bearer token-user-a"},
         )
-        with urllib.request.urlopen(req, timeout=5) as resp:
+        with urllib.request.urlopen(req, timeout=5) as resp:  # nosec B310  # http://127.0.0.1 test server
             self.assertEqual(resp.status, 200)
             data = json.loads(resp.read().decode("utf-8"))
             self.assertEqual(data["id"], "ord-001")
@@ -188,7 +188,7 @@ class TestDemoAppVerification(unittest.TestCase):
             headers={"Authorization": "Bearer token-user-c"},
         )
         with self.assertRaises(urllib.error.HTTPError) as ctx:
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310  # http://127.0.0.1 test server
         self.assertEqual(ctx.exception.code, 404)
 
     def test_05_safe_sort_protects_against_sqli(self) -> None:
@@ -199,7 +199,7 @@ class TestDemoAppVerification(unittest.TestCase):
             headers={"Authorization": "Bearer token-user-a"},
         )
         with self.assertRaises(urllib.error.HTTPError) as ctx:
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310  # http://127.0.0.1 test server
         # Server must reject with 400 or 500 SecurityException, not 200
         self.assertIn(ctx.exception.code, [400, 500])
 

package/examples/member-portal/tests/test_d6_remediation_verification.py

@@ -88,7 +88,7 @@ class TestRemediationVerification(unittest.TestCase):
         health_url = f"{cls.base_url}/api/v1/auth/personas"
         for _ in range(50):
             try:
-                with urllib.request.urlopen(health_url, timeout=1.0) as resp:
+                with urllib.request.urlopen(health_url, timeout=1.0) as resp:  # nosec B310  # http://127.0.0.1 test server
                     if resp.status == 200:
                         ready = True
                         break
@@ -126,7 +126,7 @@ class TestRemediationVerification(unittest.TestCase):
             url,
             headers={"Authorization": "Bearer token-user-a"},
         )
-        with urllib.request.urlopen(req, timeout=5) as resp:
+        with urllib.request.urlopen(req, timeout=5) as resp:  # nosec B310  # http://127.0.0.1 test server
             self.assertEqual(resp.status, 200)
             data = json.loads(resp.read().decode("utf-8"))
             self.assertEqual(data["id"], "ord-001")
@@ -169,7 +169,7 @@ class TestRemediationVerification(unittest.TestCase):
             headers={"Authorization": "Bearer token-user-b"},
         )
         with self.assertRaises(urllib.error.HTTPError) as ctx:
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310  # http://127.0.0.1 test server
         self.assertEqual(ctx.exception.code, 404)
 
     def test_04_attacker_direct_put_unauthorized_returns_404(self) -> None:
@@ -186,7 +186,7 @@ class TestRemediationVerification(unittest.TestCase):
             method="PUT",
         )
         with self.assertRaises(urllib.error.HTTPError) as ctx:
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310  # http://127.0.0.1 test server
         self.assertEqual(ctx.exception.code, 404)
 
     def test_05_attacker_direct_delete_unauthorized_returns_404(self) -> None:
@@ -198,7 +198,7 @@ class TestRemediationVerification(unittest.TestCase):
             method="DELETE",
         )
         with self.assertRaises(urllib.error.HTTPError) as ctx:
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310  # http://127.0.0.1 test server
         self.assertEqual(ctx.exception.code, 404)
 
     def test_06_parameterized_search_neutralizes_sqli(self) -> None:
@@ -210,7 +210,7 @@ class TestRemediationVerification(unittest.TestCase):
             url,
             headers={"Authorization": "Bearer token-user-a"},
         )
-        with urllib.request.urlopen(req, timeout=5) as resp:
+        with urllib.request.urlopen(req, timeout=5) as resp:  # nosec B310  # http://127.0.0.1 test server
             self.assertEqual(resp.status, 200)
             data = json.loads(resp.read().decode("utf-8"))
             # When safely parameterized as LIKE '%...%', it searches for the literal string and matches nothing