thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/python/seed-040 2.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: exec() called with user-controlled code string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/scripting/run", methods=["POST"])
+def run_script():
+    data = request.get_json()
+    code = data.get("code", "")
+    context = data.get("context", {})
+    local_vars = {"result": None, **context}
+    try:
+        # exec() executes arbitrary Python — no sandboxing
+        exec(code, {"__builtins__": __builtins__}, local_vars)
+        return jsonify({"result": local_vars.get("result")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/hooks/execute", methods=["POST"])
+def execute_hook():
+    hook_code = request.get_json().get("hook", "")
+    event = request.get_json().get("event", {})
+    # User-controlled hook code executed server-side
+    exec(hook_code, {"event": event, "print": print})
+    return jsonify({"executed": True})
+
+
+@app.route("/migration/run", methods=["POST"])
+def run_migration():
+    migration_script = request.get_json().get("script", "")
+    exec(compile(migration_script, "<migration>", "exec"))
+    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-040 3.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: exec() called with user-controlled code string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/scripting/run", methods=["POST"])
+def run_script():
+    data = request.get_json()
+    code = data.get("code", "")
+    context = data.get("context", {})
+    local_vars = {"result": None, **context}
+    try:
+        # exec() executes arbitrary Python — no sandboxing
+        exec(code, {"__builtins__": __builtins__}, local_vars)
+        return jsonify({"result": local_vars.get("result")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/hooks/execute", methods=["POST"])
+def execute_hook():
+    hook_code = request.get_json().get("hook", "")
+    event = request.get_json().get("event", {})
+    # User-controlled hook code executed server-side
+    exec(hook_code, {"event": event, "print": print})
+    return jsonify({"executed": True})
+
+
+@app.route("/migration/run", methods=["POST"])
+def run_migration():
+    migration_script = request.get_json().get("script", "")
+    exec(compile(migration_script, "<migration>", "exec"))
+    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-040.py

@@ -0,0 +1,39 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: exec() called with user-controlled code string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/scripting/run", methods=["POST"])
+def run_script():
+    data = request.get_json()
+    code = data.get("code", "")
+    context = data.get("context", {})
+    local_vars = {"result": None, **context}
+    try:
+        # exec() executes arbitrary Python — no sandboxing
+        exec(code, {"__builtins__": __builtins__}, local_vars)
+        return jsonify({"result": local_vars.get("result")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/hooks/execute", methods=["POST"])
+def execute_hook():
+    hook_code = request.get_json().get("hook", "")
+    event = request.get_json().get("event", {})
+    # User-controlled hook code executed server-side
+    exec(hook_code, {"event": event, "print": print})
+    return jsonify({"executed": True})
+
+
+@app.route("/migration/run", methods=["POST"])
+def run_migration():
+    migration_script = request.get_json().get("script", "")
+    exec(compile(migration_script, "<migration>", "exec"))
+    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-041 2.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() used in Jinja2-like custom template rendering with user template string
+
+import re
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+def render_template(template: str, context: dict) -> str:
+    """Simple template renderer that evaluates {{ expr }} blocks."""
+    def evaluate(match):
+        expr = match.group(1).strip()
+        # eval with user-controlled expression — attacker injects arbitrary Python
+        return str(eval(expr, {"__builtins__": {}}, context))
+
+    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
+
+
+@app.route("/preview", methods=["POST"])
+def preview():
+    data = request.get_json()
+    template = data.get("template", "Hello {{ name }}!")
+    ctx = data.get("context", {"name": "World"})
+    # Attacker template: "{{ __import__('os').system('id') }}"
+    output = render_template(template, ctx)
+    return output
+
+
+@app.route("/report", methods=["POST"])
+def report():
+    tpl = request.form.get("template", "")
+    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
+    return rendered

package/dist/packages/crucible/seeds/python/seed-041 3.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() used in Jinja2-like custom template rendering with user template string
+
+import re
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+def render_template(template: str, context: dict) -> str:
+    """Simple template renderer that evaluates {{ expr }} blocks."""
+    def evaluate(match):
+        expr = match.group(1).strip()
+        # eval with user-controlled expression — attacker injects arbitrary Python
+        return str(eval(expr, {"__builtins__": {}}, context))
+
+    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
+
+
+@app.route("/preview", methods=["POST"])
+def preview():
+    data = request.get_json()
+    template = data.get("template", "Hello {{ name }}!")
+    ctx = data.get("context", {"name": "World"})
+    # Attacker template: "{{ __import__('os').system('id') }}"
+    output = render_template(template, ctx)
+    return output
+
+
+@app.route("/report", methods=["POST"])
+def report():
+    tpl = request.form.get("template", "")
+    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
+    return rendered

package/dist/packages/crucible/seeds/python/seed-041.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() used in Jinja2-like custom template rendering with user template string
+
+import re
+from flask import Flask, request
+
+app = Flask(__name__)
+
+
+def render_template(template: str, context: dict) -> str:
+    """Simple template renderer that evaluates {{ expr }} blocks."""
+    def evaluate(match):
+        expr = match.group(1).strip()
+        # eval with user-controlled expression — attacker injects arbitrary Python
+        return str(eval(expr, {"__builtins__": {}}, context))
+
+    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
+
+
+@app.route("/preview", methods=["POST"])
+def preview():
+    data = request.get_json()
+    template = data.get("template", "Hello {{ name }}!")
+    ctx = data.get("context", {"name": "World"})
+    # Attacker template: "{{ __import__('os').system('id') }}"
+    output = render_template(template, ctx)
+    return output
+
+
+@app.route("/report", methods=["POST"])
+def report():
+    tpl = request.form.get("template", "")
+    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
+    return rendered

package/dist/packages/crucible/seeds/python/seed-042 2.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() in pandas query/eval with user-controlled expression
+
+import pandas as pd
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+# Simulated data store
+DATA = pd.DataFrame({
+    "id": range(1, 101),
+    "amount": [i * 10.5 for i in range(1, 101)],
+    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
+    "active": [True] * 100,
+})
+
+
+@app.route("/data/query", methods=["POST"])
+def query_data():
+    body = request.get_json()
+    filter_expr = body.get("filter", "active == True")
+    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
+    # Attacker: "@__import__('os').system('id')"
+    try:
+        result = DATA.query(filter_expr)
+        return jsonify({"count": len(result), "data": result.to_dict("records")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/data/eval", methods=["POST"])
+def eval_expression():
+    expr = request.get_json().get("expr", "amount * 2")
+    result = DATA.eval(expr)
+    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-042 3.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() in pandas query/eval with user-controlled expression
+
+import pandas as pd
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+# Simulated data store
+DATA = pd.DataFrame({
+    "id": range(1, 101),
+    "amount": [i * 10.5 for i in range(1, 101)],
+    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
+    "active": [True] * 100,
+})
+
+
+@app.route("/data/query", methods=["POST"])
+def query_data():
+    body = request.get_json()
+    filter_expr = body.get("filter", "active == True")
+    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
+    # Attacker: "@__import__('os').system('id')"
+    try:
+        result = DATA.query(filter_expr)
+        return jsonify({"count": len(result), "data": result.to_dict("records")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/data/eval", methods=["POST"])
+def eval_expression():
+    expr = request.get_json().get("expr", "amount * 2")
+    result = DATA.eval(expr)
+    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-042.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: high
+# language: python
+# expected: eval() in pandas query/eval with user-controlled expression
+
+import pandas as pd
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+# Simulated data store
+DATA = pd.DataFrame({
+    "id": range(1, 101),
+    "amount": [i * 10.5 for i in range(1, 101)],
+    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
+    "active": [True] * 100,
+})
+
+
+@app.route("/data/query", methods=["POST"])
+def query_data():
+    body = request.get_json()
+    filter_expr = body.get("filter", "active == True")
+    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
+    # Attacker: "@__import__('os').system('id')"
+    try:
+        result = DATA.query(filter_expr)
+        return jsonify({"count": len(result), "data": result.to_dict("records")})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/data/eval", methods=["POST"])
+def eval_expression():
+    expr = request.get_json().get("expr", "amount * 2")
+    result = DATA.eval(expr)
+    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-043 2.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-043 3.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-043.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-044 2.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-044 3.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-044.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-045 2.py

@@ -0,0 +1,36 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-045 3.py

@@ -0,0 +1,36 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-045.py

@@ -0,0 +1,36 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}