thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/seeds/js/seed-026.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: javascript
+// expected: command injection via child_process.exec in scheduled job
+
+const { exec } = require('child_process');
+const cron = require('node-cron');
+
+class ReportGenerator {
+  constructor(config) {
+    this.outputDir = config.outputDir;
+    this.reportFormat = config.reportFormat; // user-controlled
+    this.emailRecipient = config.emailRecipient; // user-controlled
+  }
+
+  generateReport(startDate, endDate) {
+    // reportFormat and emailRecipient from user config — not sanitized
+    const cmd = `python3 scripts/report.py --start ${startDate} --end ${endDate} --format ${this.reportFormat}`;
+    exec(cmd, (err, stdout) => {
+      if (err) { console.error('Report failed:', err); return; }
+      exec(`mail -s "Report" ${this.emailRecipient} < ${stdout.trim()}`);
+    });
+  }
+
+  schedule(cronExpr, startDate, endDate) {
+    cron.schedule(cronExpr, () => this.generateReport(startDate, endDate));
+  }
+}
+
+module.exports = ReportGenerator;

package/dist/packages/crucible/seeds/js/seed-027.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via execa with unsanitized filename
+
+const execa = require('execa');
+const express = require('express');
+const router = express.Router();
+
+router.post('/upload/process', async (req, res) => {
+  const { filename, operation } = req.body;
+
+  try {
+    // filename is user-supplied — shell metacharacters not stripped
+    const { stdout } = await execa.command(`file-processor --op ${operation} --file uploads/${filename}`, {
+      shell: true,
+    });
+    res.json({ result: stdout });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.post('/tools/whois', async (req, res) => {
+  const domain = req.body.domain;
+  const { stdout } = await execa.command(`whois ${domain}`, { shell: true });
+  res.send(stdout);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-028.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: javascript
+// expected: command injection via shell metacharacters in git operations
+
+const { execSync } = require('child_process');
+
+class GitService {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+  }
+
+  cloneRepo(repoUrl, targetDir) {
+    // repoUrl from user input — could contain shell metacharacters
+    return execSync(`git clone ${repoUrl} ${this.baseDir}/${targetDir}`, { encoding: 'utf8' });
+  }
+
+  checkoutBranch(repoPath, branchName) {
+    // branchName could be "main; cat /etc/shadow > /tmp/shadow"
+    return execSync(`git -C ${repoPath} checkout ${branchName}`, { encoding: 'utf8' });
+  }
+
+  createTag(repoPath, tagName, message) {
+    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
+  }
+
+  diffBranches(repo, branch1, branch2) {
+    return execSync(`git -C ${repo} diff ${branch1}..${branch2} --stat`, { encoding: 'utf8' });
+  }
+}
+
+module.exports = GitService;

package/dist/packages/crucible/seeds/js/seed-029.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via unvalidated user-supplied file path in fs.readFile
+
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const router = express.Router();
+
+const BASE_DIR = path.join(__dirname, 'public', 'files');
+
+router.get('/files/:filename', (req, res) => {
+  // No path normalization — attacker can request "../../etc/passwd"
+  const filePath = path.join(BASE_DIR, req.params.filename);
+
+  fs.readFile(filePath, 'utf8', (err, data) => {
+    if (err) return res.status(404).send('File not found');
+    res.type('text/plain').send(data);
+  });
+});
+
+router.get('/download', (req, res) => {
+  const file = req.query.path;
+  // Completely unvalidated path from query string
+  fs.readFile(file, (err, data) => {
+    if (err) return res.status(404).send('Not found');
+    res.send(data);
+  });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-030.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via user-controlled directory in readdir and readFileSync
+
+const fs = require('fs');
+const path = require('path');
+
+const UPLOADS_ROOT = '/var/app/uploads';
+
+function listUserFiles(userId, subdir) {
+  // subdir can be "../../../../etc" — escapes UPLOADS_ROOT
+  const userDir = path.join(UPLOADS_ROOT, userId, subdir);
+  return fs.readdirSync(userDir);
+}
+
+function readUserFile(userId, fileName) {
+  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
+  // Missing check that filePath starts with UPLOADS_ROOT
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function deleteUserFile(userId, fileName) {
+  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
+  fs.unlinkSync(filePath);
+  return true;
+}
+
+module.exports = { listUserFiles, readUserFile, deleteUserFile };

package/dist/packages/crucible/seeds/js/seed-031.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via require() with user-controlled module path
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/plugin/:name', (req, res) => {
+  const pluginName = req.params.name;
+  try {
+    // Attacker can request "../../config/secrets" or "../../../etc/passwd"
+    const plugin = require(`./plugins/${pluginName}`);
+    const result = plugin.run(req.query);
+    res.json({ result });
+  } catch (err) {
+    res.status(404).json({ error: `Plugin '${pluginName}' not found` });
+  }
+});
+
+router.get('/template', (req, res) => {
+  const templateName = req.query.template;
+  const fs = require('fs');
+  // Reads arbitrary files under templates/ — but no validation of templateName
+  const templatePath = `./templates/${templateName}.html`;
+  const content = fs.readFileSync(templatePath, 'utf8');
+  res.type('text/html').send(content);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-032.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via ZIP extraction without path validation
+
+const AdmZip = require('adm-zip');
+const path = require('path');
+const fs = require('fs');
+
+const EXTRACT_BASE = '/var/app/extracted';
+
+function extractUserArchive(zipBuffer, userId) {
+  const zip = new AdmZip(zipBuffer);
+  const entries = zip.getEntries();
+
+  entries.forEach(entry => {
+    // entry.entryName can contain "../" sequences (zip-slip vulnerability)
+    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
+    if (entry.isDirectory) {
+      fs.mkdirSync(outputPath, { recursive: true });
+    } else {
+      // Writing to outputPath without verifying it's within EXTRACT_BASE
+      fs.writeFileSync(outputPath, entry.getData());
+    }
+  });
+}
+
+function getExtractedFile(userId, relativePath) {
+  const fullPath = path.join(EXTRACT_BASE, userId, relativePath);
+  return fs.readFileSync(fullPath);
+}
+
+module.exports = { extractUserArchive, getExtractedFile };

package/dist/packages/crucible/seeds/js/seed-033.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: medium
+// language: javascript
+// expected: path traversal via multer upload destination with user-controlled subfolder
+
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs');
+
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    // req.body.folder is user-controlled — allows writing to arbitrary directories
+    const uploadPath = path.join('/var/uploads', req.body.folder || 'default');
+    fs.mkdirSync(uploadPath, { recursive: true });
+    cb(null, uploadPath);
+  },
+  filename: (req, file, cb) => {
+    // originalname preserved — could include path separators on some OS
+    cb(null, req.body.prefix + '_' + file.originalname);
+  },
+});
+
+const upload = multer({ storage });
+
+const express = require('express');
+const router = express.Router();
+
+router.post('/upload', upload.single('file'), (req, res) => {
+  res.json({ path: req.file.path, size: req.file.size });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-034.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: MD5 used for password hashing
+
+const crypto = require('crypto');
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+function hashPassword(password) {
+  // MD5 is cryptographically broken and must not be used for passwords
+  return crypto.createHash('md5').update(password).digest('hex');
+}
+
+async function registerUser(email, password) {
+  const hashedPw = hashPassword(password);
+  await pool.query(
+    'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
+    [email, hashedPw]
+  );
+}
+
+async function loginUser(email, password) {
+  const hash = hashPassword(password);
+  const result = await pool.query(
+    'SELECT * FROM users WHERE email = $1 AND password_hash = $2',
+    [email, hash]
+  );
+  return result.rows[0] || null;
+}
+
+module.exports = { hashPassword, registerUser, loginUser };

package/dist/packages/crucible/seeds/js/seed-035.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: SHA1 used for password hashing and weak random for token generation
+
+const crypto = require('crypto');
+
+function hashPassword(password, salt) {
+  // SHA-1 is deprecated for security-sensitive operations
+  return crypto.createHash('sha1').update(salt + password).digest('hex');
+}
+
+function generateSessionToken() {
+  // Math.random() is not cryptographically secure
+  return Math.random().toString(36).substring(2) + Date.now().toString(36);
+}
+
+function generateResetToken() {
+  // Predictable: only uses current timestamp
+  return Buffer.from(Date.now().toString()).toString('base64');
+}
+
+function createApiKey(userId) {
+  // Weak entropy source
+  const rand = Math.floor(Math.random() * 999999999).toString();
+  return crypto.createHash('sha1').update(userId + rand).digest('hex');
+}
+
+module.exports = { hashPassword, generateSessionToken, generateResetToken, createApiKey };

package/dist/packages/crucible/seeds/js/seed-036.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: DES/RC4 weak cipher and static IV reuse in AES-ECB mode
+
+const crypto = require('crypto');
+
+// ECB mode has no semantic security — identical plaintexts produce identical ciphertext
+function encryptWithECB(data, key) {
+  const cipher = crypto.createCipheriv('aes-128-ecb', Buffer.from(key), null);
+  let enc = cipher.update(data, 'utf8', 'hex');
+  enc += cipher.final('hex');
+  return enc;
+}
+
+function decryptWithECB(data, key) {
+  const decipher = crypto.createDecipheriv('aes-128-ecb', Buffer.from(key), null);
+  let dec = decipher.update(data, 'hex', 'utf8');
+  dec += decipher.final('utf8');
+  return dec;
+}
+
+// RC4 is a broken stream cipher
+function encryptRC4(data, key) {
+  const cipher = crypto.createCipheriv('rc4', Buffer.from(key), null);
+  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+}
+
+module.exports = { encryptWithECB, decryptWithECB, encryptRC4 };

package/dist/packages/crucible/seeds/js/seed-037.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: javascript
+// expected: insufficient key length and no salt in PBKDF2, MD5 for data integrity
+
+const crypto = require('crypto');
+
+function deriveKey(password) {
+  // Insufficient iterations (1000 — NIST recommends 600,000+) and no salt
+  return crypto.pbkdf2Sync(password, 'static-salt-value', 1000, 16, 'sha1');
+}
+
+function signData(data) {
+  // MD5 HMAC is collision-prone
+  return crypto.createHmac('md5', 'hardcoded-hmac-key').update(data).digest('hex');
+}
+
+function verifySignature(data, expectedSig) {
+  const sig = signData(data);
+  // Timing attack: string comparison instead of timingSafeEqual
+  return sig === expectedSig;
+}
+
+function checksumFile(buffer) {
+  return crypto.createHash('md5').update(buffer).digest('hex');
+}
+
+module.exports = { deriveKey, signData, verifySignature, checksumFile };

package/dist/packages/crucible/seeds/js/seed-038.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: hardcoded RSA private key and weak key size (512-bit)
+
+const crypto = require('crypto');
+const { createSign, createVerify } = crypto;
+
+// 512-bit RSA key — trivially factorable
+const PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----
+MIIBOgIBAAJBALRiMLAHudeSA/xKl1oMEBKFOeOPIQbQEsZHMPMIqVQXaFFC
+9m0YG8dMdgoKGDHb9FMtSGQm/fB8CtMmBwsN4mECAwEAAQJAcLMSZ5XwJKGQ
+nL7VlKl9M4kzGaIDM7l0x7G/zE+7n8fGOJxHj3pzfH0fQRaDVzfZuAXXl/jP
+cxjk1u1Y+sJBAQIhANSXB5jRfMv2VpUBsGAeTR/3a5pEPP5DlMqVVLfZqLkB
+AiEA3pB4GOdMNL7Z0cqVUvWNrRHuHu2+6P7NXZZ1yM2sM9kCIBY6ovRdJKGS
+-----END RSA PRIVATE KEY-----`;
+
+function signPayload(data) {
+  const sign = createSign('SHA256');
+  sign.update(data);
+  return sign.sign(PRIVATE_KEY, 'base64');
+}
+
+function verifyPayload(data, signature, publicKey) {
+  const verify = createVerify('SHA256');
+  verify.update(data);
+  return verify.verify(publicKey, signature, 'base64');
+}
+
+module.exports = { signPayload, verifyPayload };

package/dist/packages/crucible/seeds/js/seed-039.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via recursive merge of user-controlled object
+
+function deepMerge(target, source) {
+  for (const key of Object.keys(source)) {
+    // Allows "__proto__" or "constructor" as a key — pollutes Object.prototype
+    if (typeof source[key] === 'object' && source[key] !== null) {
+      if (!target[key]) target[key] = {};
+      deepMerge(target[key], source[key]);
+    } else {
+      target[key] = source[key];
+    }
+  }
+  return target;
+}
+
+function applyUserSettings(defaultConfig, userConfig) {
+  // userConfig comes directly from request body — not validated
+  return deepMerge({ ...defaultConfig }, userConfig);
+}
+
+// Attacker sends: { "__proto__": { "isAdmin": true } }
+// After merge, ({}).isAdmin === true for ALL objects
+const express = require('express');
+const router = express.Router();
+router.post('/settings', (req, res) => {
+  const config = applyUserSettings({ theme: 'light', lang: 'en' }, req.body);
+  res.json({ config });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-040.js

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via bracket-notation property assignment with user key
+
+const express = require('express');
+const router = express.Router();
+
+function setNestedProperty(obj, path, value) {
+  const parts = path.split('.');
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    // Unguarded bracket notation — path can include "__proto__"
+    if (!current[parts[i]]) current[parts[i]] = {};
+    current = current[parts[i]];
+  }
+  current[parts[parts.length - 1]] = value;
+}
+
+router.post('/preferences', (req, res) => {
+  const userPrefs = {};
+  const { key, value } = req.body;
+  // key = "__proto__.admin" poisons Object.prototype
+  setNestedProperty(userPrefs, key, value);
+  res.json({ saved: true, prefs: userPrefs });
+});
+
+router.patch('/config', (req, res) => {
+  const { path: propPath, val } = req.body;
+  setNestedProperty(global.appConfig, propPath, val);
+  res.json({ updated: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-041.js

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via Object.assign with user-controlled source
+
+const express = require('express');
+const router = express.Router();
+
+const defaultOptions = { timeout: 5000, retries: 3, debug: false };
+
+router.post('/api/options', (req, res) => {
+  // Object.assign does NOT deep copy — assigning user object containing __proto__ pollutes
+  const options = Object.assign({}, defaultOptions, req.body.options);
+  // Attacker: { "options": { "__proto__": { "polluted": true } } }
+  res.json({ applied: options });
+});
+
+function createUserContext(baseCtx, overrides) {
+  // Spread of user-controlled overrides — shallow, but __proto__ key is still dangerous
+  return Object.assign(Object.create(null), baseCtx, overrides);
+}
+
+router.post('/context', (req, res) => {
+  const ctx = createUserContext(
+    { userId: req.session.userId, role: 'user' },
+    req.body // direct spread of request body
+  );
+  res.json(ctx);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-042.js

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: javascript
+// expected: prototype pollution via JSON.parse result passed to merge function
+
+const express = require('express');
+const router = express.Router();
+
+function mergeObjects(base, extension) {
+  for (const [key, value] of Object.entries(extension)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      // Attempted guard — but Object.entries still iterates inherited keys on some engines
+      continue;
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      mergeObjects(base[key] || (base[key] = {}), value);
+    } else {
+      base[key] = value;
+    }
+  }
+  return base;
+}
+
+router.post('/merge', (req, res) => {
+  // The raw JSON body may contain {"__proto__":{"isAdmin":true}} before parsing
+  const payload = JSON.parse(req.body.raw);
+  const result = mergeObjects({}, payload); // Still pollutable via constructor.prototype
+  res.json(result);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-043.js

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via lodash _.set or _.merge with user-controlled path
+
+const _ = require('lodash');
+const express = require('express');
+const router = express.Router();
+
+const globalConfig = {};
+
+router.post('/admin/config', (req, res) => {
+  const { path, value } = req.body;
+  // _.set with user-controlled path — pollutes prototype when path includes __proto__
+  _.set(globalConfig, path, value);
+  res.json({ ok: true, config: globalConfig });
+});
+
+router.post('/theme', (req, res) => {
+  const theme = req.body.theme;
+  // _.merge is vulnerable to prototype pollution
+  const merged = _.merge({}, { colors: { primary: '#333', secondary: '#666' } }, theme);
+  res.json({ applied: merged });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-044.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: eval() called with user-controlled expression string
+
+const express = require('express');
+const router = express.Router();
+
+router.post('/calculate', (req, res) => {
+  const { formula } = req.body;
+  try {
+    // Attacker sends: "process.mainModule.require('child_process').execSync('id')"
+    const result = eval(formula);
+    res.json({ result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.get('/template', (req, res) => {
+  const template = req.query.tpl;
+  const data = { user: req.session.user, ts: Date.now() };
+  // eval to render a "template" string from query params
+  const rendered = eval('`' + template + '`');
+  res.send(rendered);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-045.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: new Function() constructor used with user-supplied code string
+
+const express = require('express');
+const router = express.Router();
+
+function runSandboxedCode(code, context) {
+  // new Function() is NOT sandboxed — has full access to global scope
+  const fn = new Function('ctx', `with(ctx) { ${code} }`);
+  return fn(context);
+}
+
+router.post('/scripting/run', (req, res) => {
+  const { script, params } = req.body;
+  try {
+    const result = runSandboxedCode(script, { params, Math, JSON });
+    res.json({ output: result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.post('/hooks/evaluate', (req, res) => {
+  const { hookCode } = req.body;
+  const hook = new Function('event', 'context', hookCode);
+  const result = hook({ type: 'user.created' }, { req });
+  res.json({ result });
+});
+
+module.exports = router;