thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/seeds/php/seed-044.php

@@ -0,0 +1,25 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: file_get_contents with user-supplied URL — SSRF
+
+$url     = $_GET['url'];
+$timeout = (int) ($_GET['timeout'] ?? 10);
+
+$context = stream_context_create(['http' => ['timeout' => $timeout]]);
+$content = file_get_contents($url, false, $context);
+
+if ($content === false) {
+    http_response_code(502);
+    echo json_encode(['error' => 'Failed to fetch URL', 'url' => $url]);
+} else {
+    echo $content;
+}
+
+$imageUrl = $_POST['image_url'];
+$format   = $_POST['format'] ?? 'jpg';
+$data     = file_get_contents($imageUrl);
+file_put_contents("/tmp/image.$format", $data);
+echo json_encode(['saved' => "/tmp/image.$format", 'size' => strlen($data)]);

package/dist/packages/crucible/seeds/php/seed-045.php

@@ -0,0 +1,25 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: cURL request to user-controlled URL — SSRF enabling internal network access
+
+function fetchExternalUrl(string $url): string {
+    $ch = curl_init($url);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+    $response = curl_exec($ch);
+    curl_close($ch);
+    return $response ?: '';
+}
+
+$target   = $_POST['webhook_url'];
+$payload  = json_encode(['event' => 'test', 'data' => $_POST]);
+
+$ch = curl_init($target);
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_exec($ch);

package/dist/packages/crucible/seeds/php/seed-046.php

@@ -0,0 +1,20 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: URL composed from user-supplied hostname — SSRF to internal services
+
+$host     = $_GET['host'];
+$port     = $_GET['port'] ?? '80';
+$path     = $_GET['path'] ?? '/';
+
+$url = "http://$host:$port$path";
+$ch  = curl_init($url);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_setopt($ch, CURLOPT_TIMEOUT, 5);
+$result = curl_exec($ch);
+$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+
+echo "Status: $status\n" . $result;

package/dist/packages/crucible/seeds/php/seed-047.php

@@ -0,0 +1,21 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: php
+// expected: Import/export feature fetches user-supplied URL with no scheme restriction
+
+function importDataFromUrl(string $sourceUrl): array {
+    $allowed_schemes = ['http', 'https'];
+    $scheme = strtolower(parse_url($sourceUrl, PHP_URL_SCHEME));
+    if (!in_array($scheme, $allowed_schemes)) {
+        return ['error' => 'Invalid scheme'];
+    }
+    // Still vulnerable: http://169.254.169.254/ or http://localhost/
+    $data = file_get_contents($sourceUrl);
+    return json_decode($data, true) ?? [];
+}
+
+$url    = $_POST['import_url'];
+$result = importDataFromUrl($url);
+echo json_encode($result);

package/dist/packages/crucible/seeds/php/seed-048.php

@@ -0,0 +1,19 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: high
+// language: php
+// expected: header('Location') with unvalidated user-supplied URL — open redirect
+
+$url     = $_GET['url'];
+$referer = $_SERVER['HTTP_REFERER'] ?? '';
+
+if (empty($url)) {
+    $url = '/';
+}
+
+// Log the redirect for analytics
+error_log("Redirecting user from $referer to: $url");
+
+header('Location: ' . $url);
+exit;

package/dist/packages/crucible/seeds/php/seed-049.php

@@ -0,0 +1,18 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: high
+// language: php
+// expected: Redirect after login using 'next' or 'return_to' parameter without validation
+
+function redirectAfterLogin(): void {
+    $next = $_GET['next'] ?? $_POST['return_to'] ?? '/dashboard';
+    header('Location: ' . $next);
+    exit;
+}
+
+function redirectWithMessage(string $msg): void {
+    $redirect = $_REQUEST['redirect'];
+    header("Location: $redirect?msg=" . urlencode($msg));
+    exit;
+}

package/dist/packages/crucible/seeds/php/seed-050.php

@@ -0,0 +1,20 @@
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: php
+// expected: Redirect target partially validated with strpos — bypassable with subdomain trick
+
+function safeRedirect(string $url): void {
+    $allowed_host = 'example.com';
+    if (strpos($url, $allowed_host) !== false) {
+        header('Location: ' . $url);
+        exit;
+    }
+    header('Location: /error?msg=invalid_redirect');
+    exit;
+}
+
+$target = $_GET['to'];
+safeRedirect($target);
+// Attacker passes: https://evil.com?foo=example.com → strpos match!

package/dist/packages/crucible/seeds/python/seed-001.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded AWS access key and secret key
+
+import boto3
+
+AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
+AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+AWS_REGION = "us-east-1"
+
+s3_client = boto3.client(
+    "s3",
+    aws_access_key_id=AWS_ACCESS_KEY_ID,
+    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
+    region_name=AWS_REGION,
+)
+
+
+def upload_file(file_path: str, bucket: str, key: str) -> dict:
+    with open(file_path, "rb") as f:
+        response = s3_client.put_object(Bucket=bucket, Key=key, Body=f)
+    return response
+
+
+def list_buckets() -> list:
+    response = s3_client.list_buckets()
+    return [b["Name"] for b in response.get("Buckets", [])]
+
+
+if __name__ == "__main__":
+    print(list_buckets())

package/dist/packages/crucible/seeds/python/seed-002.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded database password in connection string
+
+import psycopg2
+from psycopg2.extras import RealDictCursor
+
+DB_HOST = "prod-db.internal.company.com"
+DB_PORT = 5432
+DB_NAME = "users_production"
+DB_USER = "db_admin"
+DB_PASSWORD = "Sup3rS3cr3tPa$$w0rd!"
+
+
+def get_connection():
+    return psycopg2.connect(
+        host=DB_HOST,
+        port=DB_PORT,
+        dbname=DB_NAME,
+        user=DB_USER,
+        password=DB_PASSWORD,
+        cursor_factory=RealDictCursor,
+    )
+
+
+def get_user(user_id: int) -> dict:
+    conn = get_connection()
+    with conn.cursor() as cur:
+        cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
+        return cur.fetchone()
+
+
+def list_users() -> list:
+    conn = get_connection()
+    with conn.cursor() as cur:
+        cur.execute("SELECT id, email, created_at FROM users")
+        return cur.fetchall()

package/dist/packages/crucible/seeds/python/seed-003.py

@@ -0,0 +1,31 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded Django SECRET_KEY and debug credentials
+
+SECRET_KEY = "django-insecure-3abc$xyz!hardcoded-secret-key-never-rotate-this-one"
+DEBUG = True
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": "production_db",
+        "USER": "django_app",
+        "PASSWORD": "DjangoDBPass!@#2024",
+        "HOST": "db.internal",
+        "PORT": "5432",
+    }
+}
+
+EMAIL_HOST = "smtp.company.com"
+EMAIL_HOST_USER = "noreply@company.com"
+EMAIL_HOST_PASSWORD = "SmtpPa$$w0rd#2024"
+EMAIL_PORT = 587
+EMAIL_USE_TLS = True
+
+STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRst1234567890abcdef"
+STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz12345678"
+
+REDIS_PASSWORD = "r3disPa$$w0rd"
+REDIS_URL = f"redis://:r3disPa$$w0rd@redis.internal:6379/0"

package/dist/packages/crucible/seeds/python/seed-004.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded Stripe and PayPal API credentials
+
+import stripe
+import requests
+
+# Stripe configuration
+STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef"
+STRIPE_PUBLISHABLE_KEY = "pk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz0987654321"
+STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF"
+
+stripe.api_key = STRIPE_SECRET_KEY
+
+# PayPal configuration
+PAYPAL_CLIENT_ID = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz12345678"
+PAYPAL_CLIENT_SECRET = "EeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz123456781234"
+PAYPAL_BASE_URL = "https://api.paypal.com"
+
+
+def get_paypal_token() -> str:
+    response = requests.post(
+        f"{PAYPAL_BASE_URL}/v1/oauth2/token",
+        auth=(PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET),
+        data={"grant_type": "client_credentials"},
+    )
+    return response.json()["access_token"]
+
+
+def create_payment_intent(amount: int, currency: str = "usd") -> dict:
+    return stripe.PaymentIntent.create(amount=amount, currency=currency)

package/dist/packages/crucible/seeds/python/seed-005.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded JWT secret and admin credentials in Flask app
+
+from flask import Flask, request, jsonify
+import jwt
+
+app = Flask(__name__)
+
+JWT_SECRET = "my-super-secret-flask-jwt-key-never-change-abc123!"
+ADMIN_USERNAME = "admin"
+ADMIN_PASSWORD = "AdminP@ssw0rd!#$2024"
+API_MASTER_KEY = "master-api-key-production-xYz9876543210"
+
+
+def generate_token(user_id: int, role: str) -> str:
+    payload = {"user_id": user_id, "role": role}
+    return jwt.encode(payload, JWT_SECRET, algorithm="HS256")
+
+
+def verify_token(token: str) -> dict:
+    return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+
+
+@app.route("/admin/login", methods=["POST"])
+def admin_login():
+    data = request.get_json()
+    if data["username"] == ADMIN_USERNAME and data["password"] == ADMIN_PASSWORD:
+        token = generate_token(0, "admin")
+        return jsonify({"token": token})
+    return jsonify({"error": "Invalid credentials"}), 401

package/dist/packages/crucible/seeds/python/seed-006.py

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded GitHub token and Slack webhook URL
+
+import requests
+
+GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"
+GITHUB_ORG = "my-company"
+
+SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
+SLACK_BOT_TOKEN = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx"
+
+GITHUB_HEADERS = {"Authorization": f"token {GITHUB_TOKEN}", "Accept": "application/vnd.github.v3+json"}
+
+
+def create_github_issue(repo: str, title: str, body: str) -> dict:
+    url = f"https://api.github.com/repos/{GITHUB_ORG}/{repo}/issues"
+    response = requests.post(url, json={"title": title, "body": body}, headers=GITHUB_HEADERS)
+    return response.json()
+
+
+def post_slack_message(text: str, channel: str = "#general") -> dict:
+    response = requests.post(
+        "https://slack.com/api/chat.postMessage",
+        headers={"Authorization": f"Bearer {SLACK_BOT_TOKEN}"},
+        json={"channel": channel, "text": text},
+    )
+    return response.json()
+
+
+def notify_slack_webhook(payload: dict) -> None:
+    requests.post(SLACK_WEBHOOK_URL, json=payload)

package/dist/packages/crucible/seeds/python/seed-007.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded encryption key and IV in Python crypto utility
+
+from Crypto.Cipher import AES
+import base64
+
+# 32-byte AES key — hardcoded, never rotated
+ENCRYPTION_KEY = b"12345678901234567890123456789012"
+# 16-byte IV — static, reused for every encryption operation
+STATIC_IV = b"abcdef1234567890"
+
+BLOCK_SIZE = AES.block_size
+
+
+def pad(data: bytes) -> bytes:
+    pad_len = BLOCK_SIZE - len(data) % BLOCK_SIZE
+    return data + bytes([pad_len] * pad_len)
+
+
+def encrypt(plaintext: str) -> str:
+    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
+    encrypted = cipher.encrypt(pad(plaintext.encode()))
+    return base64.b64encode(encrypted).decode()
+
+
+def decrypt(ciphertext: str) -> str:
+    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-008.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded OAuth2 client credentials and SMTP password in FastAPI app
+
+from fastapi import FastAPI, HTTPException
+import httpx
+
+app = FastAPI()
+
+OAUTH_CLIENT_ID = "oauth2-client-production-id-abc123"
+OAUTH_CLIENT_SECRET = "oauth2-client-secret-XyZ9876543210abcdefGHIJKL"
+OAUTH_TOKEN_URL = "https://auth.provider.com/oauth/token"
+
+SMTP_HOST = "smtp.company.com"
+SMTP_USER = "noreply@company.com"
+SMTP_PASSWORD = "Smtp$Pass#2024Production!"
+
+INTERNAL_API_KEY = "internal-service-api-key-prod-abc123xyz789"
+
+
+async def get_oauth_token() -> str:
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            OAUTH_TOKEN_URL,
+            data={
+                "grant_type": "client_credentials",
+                "client_id": OAUTH_CLIENT_ID,
+                "client_secret": OAUTH_CLIENT_SECRET,
+            },
+        )
+    return resp.json()["access_token"]
+
+
+@app.get("/health")
+async def health():
+    return {"status": "ok"}

package/dist/packages/crucible/seeds/python/seed-009.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via string formatting in cursor.execute
+
+import sqlite3
+
+
+def get_user_by_name(username: str) -> dict:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    # Direct string formatting — attacker sends: "' OR '1'='1"
+    query = "SELECT * FROM users WHERE username = '%s'" % username
+    cursor.execute(query)
+    row = cursor.fetchone()
+    conn.close()
+    return row
+
+
+def search_products(term: str, category: str) -> list:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    query = (
+        "SELECT * FROM products WHERE name LIKE '%%%s%%' AND category = '%s'" % (term, category)
+    )
+    cursor.execute(query)
+    results = cursor.fetchall()
+    conn.close()
+    return results
+
+
+def delete_user(user_id: str) -> None:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    cursor.execute("DELETE FROM users WHERE id = " + user_id)
+    conn.commit()
+    conn.close()

package/dist/packages/crucible/seeds/python/seed-010.py

@@ -0,0 +1,42 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection in Flask route via f-string in SQL query
+
+from flask import Flask, request, jsonify
+import psycopg2
+
+app = Flask(__name__)
+
+
+def get_db():
+    return psycopg2.connect(dbname="appdb", user="app", password="app", host="localhost")
+
+
+@app.route("/users/login", methods=["POST"])
+def login():
+    data = request.get_json()
+    username = data.get("username", "")
+    password = data.get("password", "")
+
+    conn = get_db()
+    cur = conn.cursor()
+    # Classic SQL injection auth bypass
+    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
+    cur.execute(query)
+    user = cur.fetchone()
+
+    if not user:
+        return jsonify({"error": "Invalid credentials"}), 401
+    return jsonify({"user_id": user[0], "username": user[1]})
+
+
+@app.route("/products")
+def products():
+    category = request.args.get("category", "")
+    sort_by = request.args.get("sort", "name")
+    conn = get_db()
+    cur = conn.cursor()
+    cur.execute(f"SELECT * FROM products WHERE category = '{category}' ORDER BY {sort_by}")
+    return jsonify(cur.fetchall())

package/dist/packages/crucible/seeds/python/seed-011.py

@@ -0,0 +1,30 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via .format() string interpolation in Django raw query
+
+from django.db import connection
+from django.http import JsonResponse
+
+
+def search_articles(request):
+    query = request.GET.get("q", "")
+    tag = request.GET.get("tag", "")
+    author = request.GET.get("author", "")
+
+    with connection.cursor() as cursor:
+        # All three params injected via .format()
+        sql = """
+            SELECT a.id, a.title, a.summary, u.username as author
+            FROM articles a
+            JOIN users u ON a.author_id = u.id
+            WHERE a.published = true
+            AND (a.title ILIKE '%{query}%' OR a.content ILIKE '%{query}%')
+            AND a.tag = '{tag}'
+            AND u.username = '{author}'
+            ORDER BY a.created_at DESC
+        """.format(query=query, tag=tag, author=author)
+        cursor.execute(sql)
+        cols = [col[0] for col in cursor.description]
+        return JsonResponse({"results": [dict(zip(cols, row)) for row in cursor.fetchall()]})

package/dist/packages/crucible/seeds/python/seed-012.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via SQLAlchemy text() with string concatenation
+
+from sqlalchemy import text, create_engine
+from sqlalchemy.orm import Session
+
+engine = create_engine("postgresql://user:pass@localhost/appdb")
+
+
+def find_orders(user_id: str, status: str, sort_field: str) -> list:
+    with Session(engine) as session:
+        # text() used correctly — but string concatenation defeats parameterization
+        sql = text(
+            "SELECT * FROM orders WHERE user_id = '"
+            + user_id
+            + "' AND status = '"
+            + status
+            + "' ORDER BY "
+            + sort_field
+        )
+        result = session.execute(sql)
+        return result.fetchall()
+
+
+def bulk_update_status(ids: list, new_status: str) -> int:
+    id_list = ", ".join(str(i) for i in ids)
+    with Session(engine) as session:
+        result = session.execute(
+            text(f"UPDATE orders SET status = '{new_status}' WHERE id IN ({id_list})")
+        )
+        session.commit()
+        return result.rowcount

package/dist/packages/crucible/seeds/python/seed-013.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: python
+# expected: SQL injection in FastAPI route via % operator in SQL string
+
+from fastapi import FastAPI, Query
+import asyncpg
+
+app = FastAPI()
+DB_URL = "postgresql://user:pass@localhost/appdb"
+
+
+@app.get("/employees")
+async def list_employees(
+    department: str = Query(default="Engineering"),
+    sort: str = Query(default="last_name"),
+):
+    conn = await asyncpg.connect(DB_URL)
+    # Both department and sort directly interpolated
+    query = "SELECT * FROM employees WHERE department = '%s' ORDER BY %s" % (department, sort)
+    rows = await conn.fetch(query)
+    await conn.close()
+    return [dict(row) for row in rows]
+
+
+@app.get("/employees/{emp_id}/activity")
+async def get_activity(emp_id: str, action: str = Query(default="login")):
+    conn = await asyncpg.connect(DB_URL)
+    sql = f"SELECT * FROM audit_log WHERE employee_id = '{emp_id}' AND action = '{action}'"
+    rows = await conn.fetch(sql)
+    await conn.close()
+    return [dict(r) for r in rows]

package/dist/packages/crucible/seeds/python/seed-014.py

@@ -0,0 +1,40 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via string concatenation in bulk IN clause
+
+import psycopg2
+
+
+def get_db():
+    return psycopg2.connect(host="localhost", dbname="shop", user="app", password="app")
+
+
+def get_items_by_ids(item_ids: list) -> list:
+    """Fetch multiple items — ids come from user input."""
+    conn = get_db()
+    cur = conn.cursor()
+    # item_ids is user-controlled — attacker can inject into IN() clause
+    id_list = ", ".join(str(i) for i in item_ids)
+    query = f"SELECT * FROM items WHERE id IN ({id_list}) AND active = true"
+    cur.execute(query)
+    return cur.fetchall()
+
+
+def archive_items(item_ids: list, reason: str) -> int:
+    conn = get_db()
+    cur = conn.cursor()
+    id_list = ", ".join(str(i) for i in item_ids)
+    sql = f"UPDATE items SET archived = true, archive_reason = '{reason}' WHERE id IN ({id_list})"
+    cur.execute(sql)
+    conn.commit()
+    return cur.rowcount
+
+
+def get_report(from_date: str, to_date: str, group_by: str) -> list:
+    conn = get_db()
+    cur = conn.cursor()
+    sql = f"SELECT {group_by}, COUNT(*), SUM(price) FROM orders WHERE created_at BETWEEN '{from_date}' AND '{to_date}' GROUP BY {group_by}"
+    cur.execute(sql)
+    return cur.fetchall()