@hoanghainh/komagu 2.6.0 → 2.7.0

package/operate/tests/test_ai_remediation.py

@@ -0,0 +1,288 @@
+#!/usr/bin/env python3
+"""Tests for Tier 2 AI-assisted multi-line remediation and verification gate (#394)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(REPO_ROOT))
+
+from operate.ai.mock_server import MockLLMHandler, start_mock_llm_server
+from operate.cli.main import main as cli_main
+from operate.remediator.ai_fixer import AITier2Fixer
+from operate.remediator.runner import RemediationRunner
+
+
+class TestAITier2Fixer(unittest.TestCase):
+    """Verify AI multi-line patching, redaction, and mandatory verification gates."""
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.server, cls.thread, cls.base_url = start_mock_llm_server()
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        cls.server.shutdown()
+        cls.server.server_close()
+
+    def setUp(self) -> None:
+        self.temp_dir = Path(tempfile.mkdtemp(prefix="komagu_ai_fix_test_")).resolve()
+        MockLLMHandler.response_generator = None
+        MockLLMHandler.received_requests = []
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.temp_dir, ignore_errors=True)
+
+    def test_java_legacy_multiline_sqli_fix_and_secret_redaction(self) -> None:
+        java_file = self.temp_dir / "OrderDao.java"
+        java_file.write_text(
+            "import java.sql.*;\n"
+            "public class OrderDao {\n"
+            '    private String dbPassword = "SuperSecretPassword99";\n'
+            "    public ResultSet find(Connection conn, String id) throws SQLException {\n"
+            "        Statement st = conn.createStatement();\n"
+            '        return st.executeQuery("SELECT * FROM orders WHERE id = \'" + id + "\'");\n'
+            "    }\n"
+            "}\n",
+            encoding="utf-8",
+        )
+
+        def reply(messages, model):
+            return json.dumps(
+                {
+                    "start_line": 5,
+                    "end_line": 6,
+                    "patched_snippet": (
+                        '        PreparedStatement ps = conn.prepareStatement("SELECT * FROM orders WHERE id = ?");\n'
+                        "        ps.setString(1, id);\n"
+                        "        return ps.executeQuery();\n"
+                    ),
+                    "explanation": "Replaced Statement concatenation with PreparedStatement.",
+                }
+            )
+
+        MockLLMHandler.response_generator = reply
+
+        findings_path = self.temp_dir / "findings.json"
+        findings_path.write_text(
+            json.dumps(
+                {
+                    "findings": [
+                        {
+                            "finding_id": "INJ-JAVA-01",
+                            "category": "sql_injection",
+                            "cwe": "CWE-89",
+                            "title": "Dynamic SQL in OrderDao",
+                            "location": {"file": "OrderDao.java", "start_line": 6},
+                        }
+                    ]
+                }
+            ),
+            encoding="utf-8",
+        )
+
+        fixer = AITier2Fixer(endpoint=self.base_url, model="mock-model")
+        runner = RemediationRunner(
+            target_dir=self.temp_dir,
+            findings_path=findings_path,
+            dry_run=True,
+            ai_fixer=fixer,
+        )
+        report = runner.run()
+
+        self.assertEqual(report.planned_count, 1)
+        plan = report.plans[0]
+        self.assertIn("[AI-GENERATED — REQUIRES PERSON B REVIEW]", plan.reason)
+        self.assertIn("PreparedStatement ps = conn.prepareStatement", plan.patched_content)
+
+        # Ensure secret was redacted before leaving the host
+        sent_user_msg = MockLLMHandler.received_requests[-1]["messages"][1]["content"]
+        self.assertNotIn("SuperSecretPassword99", sent_user_msg)
+        self.assertIn("[REDACTED]", sent_user_msg)
+
+    def test_php_legacy_multiline_sqli_fix(self) -> None:
+        php_file = self.temp_dir / "orders.php"
+        php_file.write_text(
+            "<?php\n"
+            "$id = $_GET['id'];\n"
+            '$res = mysql_query("SELECT * FROM orders WHERE id = " . $id);\n',
+            encoding="utf-8",
+        )
+
+        def reply(messages, model):
+            return json.dumps(
+                {
+                    "start_line": 3,
+                    "end_line": 3,
+                    "patched_snippet": (
+                        '$stmt = $pdo->prepare("SELECT * FROM orders WHERE id = ?");\n'
+                        "$stmt->execute([$id]);\n"
+                        "$res = $stmt->fetchAll();\n"
+                    ),
+                    "explanation": "Migrated mysql_query concatenation to PDO prepared statement.",
+                }
+            )
+
+        MockLLMHandler.response_generator = reply
+        fixer = AITier2Fixer(endpoint=self.base_url, model="mock-model")
+        res = fixer.generate_verified_patch(
+            php_file,
+            php_file.read_text(encoding="utf-8"),
+            {"category": "sql_injection", "cwe": "CWE-89", "location": {"start_line": 3}},
+        )
+        self.assertTrue(res.changed)
+        self.assertTrue(res.verified)
+        self.assertIn("$pdo->prepare", res.patched_content)
+
+    def test_rejects_comment_only_patch(self) -> None:
+        java_file = self.temp_dir / "Legacy.java"
+        content = (
+            "public class Legacy {\n"
+            '    String q = "SELECT * FROM users WHERE name = \'" + name + "\'";\n'
+            "}\n"
+        )
+        java_file.write_text(content, encoding="utf-8")
+
+        MockLLMHandler.response_generator = lambda m, mdl: json.dumps(
+            {
+                "start_line": 2,
+                "end_line": 2,
+                "patched_snippet": (
+                    "    // TODO: parameterize query\n"
+                    '    String q = "SELECT * FROM users WHERE name = \'" + name + "\'";\n'
+                ),
+                "explanation": "Added comment.",
+            }
+        )
+
+        fixer = AITier2Fixer(endpoint=self.base_url, model="mock-model")
+        res = fixer.generate_verified_patch(
+            java_file,
+            content,
+            {"category": "sql_injection", "location": {"start_line": 2}},
+        )
+        self.assertFalse(res.changed)
+        self.assertIn("comment-only", res.explanation)
+
+    def test_rejects_python_syntax_error_patch(self) -> None:
+        py_file = self.temp_dir / "bad.py"
+        content = "def get_user(cur, uid):\n    cur.execute(f'SELECT * FROM users WHERE id = {uid}')\n"
+        py_file.write_text(content, encoding="utf-8")
+
+        MockLLMHandler.response_generator = lambda m, mdl: json.dumps(
+            {
+                "start_line": 2,
+                "end_line": 2,
+                "patched_snippet": "    cur.execute('SELECT * FROM users WHERE id = %s', (uid,)\n",  # missing ')'
+                "explanation": "Broken syntax.",
+            }
+        )
+
+        fixer = AITier2Fixer(endpoint=self.base_url, model="mock-model")
+        res = fixer.generate_verified_patch(
+            py_file,
+            content,
+            {"category": "sql_injection", "location": {"start_line": 2}},
+        )
+        self.assertFalse(res.changed)
+        self.assertIn("py_compile failed", res.explanation)
+
+    def test_rejects_patch_that_leaves_injection_sink_intact(self) -> None:
+        java_file = self.temp_dir / "StillBad.java"
+        content = (
+            "public class StillBad {\n"
+            "    void run(Statement st, String id) {\n"
+            '        st.executeQuery("SELECT * FROM t WHERE id = " + id);\n'
+            "    }\n"
+            "}\n"
+        )
+        java_file.write_text(content, encoding="utf-8")
+
+        MockLLMHandler.response_generator = lambda m, mdl: json.dumps(
+            {
+                "start_line": 3,
+                "end_line": 3,
+                "patched_snippet": '        st.executeQuery("SELECT * FROM t WHERE id = " + id.trim());\n',
+                "explanation": "Trimmed input but still concatenated.",
+            }
+        )
+
+        fixer = AITier2Fixer(endpoint=self.base_url, model="mock-model")
+        res = fixer.generate_verified_patch(
+            java_file,
+            content,
+            {"category": "sql_injection", "location": {"start_line": 3}},
+        )
+        self.assertFalse(res.changed)
+        self.assertIn("Tier 1 re-scan still flags", res.explanation)
+
+    def test_cli_fix_with_ai_flag_end_to_end(self) -> None:
+        java_file = self.temp_dir / "App.java"
+        java_file.write_text(
+            "import java.sql.*;\n"
+            "public class App {\n"
+            "    void run(Connection c, String id) throws SQLException {\n"
+            "        Statement st = c.createStatement();\n"
+            '        st.executeQuery("SELECT * FROM items WHERE id = " + id);\n'
+            "    }\n"
+            "}\n",
+            encoding="utf-8",
+        )
+        findings_path = self.temp_dir / "findings.json"
+        findings_path.write_text(
+            json.dumps(
+                {
+                    "findings": [
+                        {
+                            "finding_id": "INJ-01",
+                            "category": "sql_injection",
+                            "cwe": "CWE-89",
+                            "location": {"file": "App.java", "start_line": 5},
+                        }
+                    ]
+                }
+            ),
+            encoding="utf-8",
+        )
+
+        MockLLMHandler.response_generator = lambda m, mdl: json.dumps(
+            {
+                "start_line": 4,
+                "end_line": 5,
+                "patched_snippet": (
+                    '        PreparedStatement ps = c.prepareStatement("SELECT * FROM items WHERE id = ?");\n'
+                    "        ps.setString(1, id);\n"
+                    "        ps.executeQuery();\n"
+                ),
+                "explanation": "Use PreparedStatement.",
+            }
+        )
+
+        exit_code = cli_main(
+            [
+                "--no-banner",
+                "fix",
+                str(self.temp_dir),
+                "--findings",
+                str(findings_path),
+                "--dry-run",
+                "--ai",
+                "--ai-endpoint",
+                self.base_url,
+                "--ai-model",
+                "mock-model",
+                "--format",
+                "json",
+            ]
+        )
+        self.assertEqual(exit_code, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_audit_minimum_versions.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""`.github/scripts/audit_minimum_versions.py`: audits the lowest version each requirement allows (#390)."""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+SCRIPT = Path(__file__).resolve().parents[2] / ".github" / "scripts" / "audit_minimum_versions.py"
+_spec = importlib.util.spec_from_file_location("audit_minimum_versions", SCRIPT)
+amv = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(amv)
+
+
+def _report(*vulns: tuple) -> dict:
+    deps = {}
+    for name, version, vuln_id, fixes in vulns:
+        deps.setdefault((name, version), []).append({"id": vuln_id, "fix_versions": fixes})
+    return {"dependencies": [{"name": n, "version": v, "vulns": vs} for (n, v), vs in deps.items()]}
+
+
+class TestMinimumPins(unittest.TestCase):
+    def test_lower_bounds_and_exact_pins_become_pins(self) -> None:
+        text = "# comment\npyjwt>=2.15.0\ncryptography[ssh] >= 50.0.0  # note\nrequests==2.32.3\n"
+        self.assertEqual(amv.minimum_pins(text), ["pyjwt==2.15.0", "cryptography==50.0.0", "requests==2.32.3"])
+
+    def test_unversioned_and_upper_bounds_are_ignored(self) -> None:
+        self.assertEqual(amv.minimum_pins("flask\nurllib3<3\n-r other.txt\n"), [])
+
+
+class TestClassify(unittest.TestCase):
+    def test_fixable_and_unfixable_are_split_and_deduplicated(self) -> None:
+        report = _report(
+            ("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]),
+            ("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]),
+            ("pyjwt", "2.8.0", "PYSEC-2", []),
+        )
+        fixable, unfixable = amv.classify(report)
+        self.assertEqual(fixable, ["pyjwt 2.8.0: PYSEC-1 (fixed in 2.12.0)"])
+        self.assertEqual(unfixable, ["pyjwt 2.8.0: PYSEC-2 (no fixed version)"])
+
+
+class TestMain(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.mkdtemp(prefix="komagu_amv_")
+        self.req = os.path.join(self.tmp, "requirements.txt")
+        self.summary = os.path.join(self.tmp, "summary.md")
+        with open(self.req, "w", encoding="utf-8") as handle:
+            handle.write("pyjwt>=2.8.0\n")
+
+    def _run(self, report: dict) -> int:
+        with mock.patch.object(amv, "audit", return_value=report) as audit, \
+                mock.patch("builtins.print"):
+            code = amv.main(["--summary", self.summary, self.req])
+        audit.assert_called_once_with(["pyjwt==2.8.0"])
+        return code
+
+    def test_fixable_vulnerability_at_the_minimum_fails(self) -> None:
+        self.assertEqual(self._run(_report(("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]))), 1)
+        with open(self.summary, encoding="utf-8") as handle:
+            self.assertIn("FAIL pyjwt 2.8.0: PYSEC-1", handle.read())
+
+    def test_vulnerability_without_a_fix_is_only_reported(self) -> None:
+        self.assertEqual(self._run(_report(("pyjwt", "2.8.0", "PYSEC-2", []))), 0)
+        with open(self.summary, encoding="utf-8") as handle:
+            self.assertIn("note pyjwt 2.8.0: PYSEC-2", handle.read())
+
+    def test_clean_minimum_passes(self) -> None:
+        self.assertEqual(self._run({"dependencies": [{"name": "pyjwt", "version": "2.8.0", "vulns": []}]}), 0)
+
+
+class TestRepositoryMinimums(unittest.TestCase):
+    """Minimums raised in #390: these versions had fixable advisories."""
+
+    def test_raised_minimums(self) -> None:
+        root = SCRIPT.parents[2]
+        ekyc = amv.minimum_pins((root / "remediate/ekyc/requirements.txt").read_text(encoding="utf-8"))
+        identity = amv.minimum_pins((root / "remediate/identity/python/requirements.txt").read_text(encoding="utf-8"))
+        self.assertIn("cryptography==50.0.0", ekyc)
+        self.assertIn("cryptography==50.0.0", identity)
+        self.assertIn("pyjwt==2.15.0", identity)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_cli.py

@@ -61,7 +61,7 @@ class TestKomaguCLI(unittest.TestCase):
     def test_subcommand_parser_builds_cleanly(self) -> None:
         """In-process parser must parse subcommands without throwing."""
         parser = build_parser()
-        args_scan = parser.parse_args(["scan", "/tmp", "--format", "html"])
+        args_scan = parser.parse_args(["scan", "./src", "--format", "html"])
         self.assertEqual(args_scan.subcommand, "scan")
         self.assertEqual(args_scan.format, "html")