thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/ruby/seed-009 2.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: SQL injection via string interpolation in ActiveRecord where()
+
+class UserController < ApplicationController
+  def search
+    username = params[:username]
+    @users = User.where("username = '#{username}'")
+    render json: @users
+  end
+
+  def filter
+    role  = params[:role]
+    since = params[:since]
+    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
+    render json: @records
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-009 3.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: SQL injection via string interpolation in ActiveRecord where()
+
+class UserController < ApplicationController
+  def search
+    username = params[:username]
+    @users = User.where("username = '#{username}'")
+    render json: @users
+  end
+
+  def filter
+    role  = params[:role]
+    since = params[:since]
+    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
+    render json: @records
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-009.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: SQL injection via string interpolation in ActiveRecord where()
+
+class UserController < ApplicationController
+  def search
+    username = params[:username]
+    @users = User.where("username = '#{username}'")
+    render json: @users
+  end
+
+  def filter
+    role  = params[:role]
+    since = params[:since]
+    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
+    render json: @records
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-010 2.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ActiveRecord find_by_sql with string interpolation
+
+class ReportController < ApplicationController
+  def show
+    user_id = params[:user_id]
+    type    = params[:type]
+    @data = Report.find_by_sql(
+      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
+    )
+    render json: @data
+  end
+
+  def custom_query
+    condition = params[:condition]
+    @results = ActiveRecord::Base.connection.execute(
+      "SELECT * FROM events WHERE #{condition}"
+    )
+    render json: @results.to_a
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-010 3.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ActiveRecord find_by_sql with string interpolation
+
+class ReportController < ApplicationController
+  def show
+    user_id = params[:user_id]
+    type    = params[:type]
+    @data = Report.find_by_sql(
+      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
+    )
+    render json: @data
+  end
+
+  def custom_query
+    condition = params[:condition]
+    @results = ActiveRecord::Base.connection.execute(
+      "SELECT * FROM events WHERE #{condition}"
+    )
+    render json: @results.to_a
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-010.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ActiveRecord find_by_sql with string interpolation
+
+class ReportController < ApplicationController
+  def show
+    user_id = params[:user_id]
+    type    = params[:type]
+    @data = Report.find_by_sql(
+      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
+    )
+    render json: @data
+  end
+
+  def custom_query
+    condition = params[:condition]
+    @results = ActiveRecord::Base.connection.execute(
+      "SELECT * FROM events WHERE #{condition}"
+    )
+    render json: @results.to_a
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-011 2.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ORDER BY clause built from user-supplied column name without whitelist
+
+class ProductsController < ApplicationController
+  def index
+    sort_col = params[:sort_by]
+    sort_dir = params[:direction]
+    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
+    render json: @products
+  end
+
+  def search
+    term     = params[:q]
+    category = params[:category]
+    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
+    render json: @items
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-011 3.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ORDER BY clause built from user-supplied column name without whitelist
+
+class ProductsController < ApplicationController
+  def index
+    sort_col = params[:sort_by]
+    sort_dir = params[:direction]
+    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
+    render json: @products
+  end
+
+  def search
+    term     = params[:q]
+    category = params[:category]
+    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
+    render json: @items
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-011.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ORDER BY clause built from user-supplied column name without whitelist
+
+class ProductsController < ApplicationController
+  def index
+    sort_col = params[:sort_by]
+    sort_dir = params[:direction]
+    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
+    render json: @products
+  end
+
+  def search
+    term     = params[:q]
+    category = params[:category]
+    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
+    render json: @items
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-012 2.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Raw SQL executed via connection.execute with user input
+
+def run_analytics(dimension, filter_expr)
+  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
+  ActiveRecord::Base.connection.execute(sql)
+end
+
+def delete_records(table, condition)
+  ActiveRecord::Base.connection.execute(
+    "DELETE FROM #{table} WHERE #{condition}"
+  )
+end
+
+def update_field(table, field, value, id)
+  ActiveRecord::Base.connection.execute(
+    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-012 3.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Raw SQL executed via connection.execute with user input
+
+def run_analytics(dimension, filter_expr)
+  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
+  ActiveRecord::Base.connection.execute(sql)
+end
+
+def delete_records(table, condition)
+  ActiveRecord::Base.connection.execute(
+    "DELETE FROM #{table} WHERE #{condition}"
+  )
+end
+
+def update_field(table, field, value, id)
+  ActiveRecord::Base.connection.execute(
+    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-012.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Raw SQL executed via connection.execute with user input
+
+def run_analytics(dimension, filter_expr)
+  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
+  ActiveRecord::Base.connection.execute(sql)
+end
+
+def delete_records(table, condition)
+  ActiveRecord::Base.connection.execute(
+    "DELETE FROM #{table} WHERE #{condition}"
+  )
+end
+
+def update_field(table, field, value, id)
+  ActiveRecord::Base.connection.execute(
+    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-013 2.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Sequel dataset filter with string interpolation
+
+require 'sequel'
+
+DB = Sequel.connect('sqlite://db/production.sqlite3')
+
+def find_user(username, password)
+  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
+end
+
+def get_orders(status, user_id)
+  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
+end
+
+def search_items(keyword)
+  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
+end

package/dist/packages/crucible/seeds/ruby/seed-013 3.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Sequel dataset filter with string interpolation
+
+require 'sequel'
+
+DB = Sequel.connect('sqlite://db/production.sqlite3')
+
+def find_user(username, password)
+  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
+end
+
+def get_orders(status, user_id)
+  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
+end
+
+def search_items(keyword)
+  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
+end

package/dist/packages/crucible/seeds/ruby/seed-013.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Sequel dataset filter with string interpolation
+
+require 'sequel'
+
+DB = Sequel.connect('sqlite://db/production.sqlite3')
+
+def find_user(username, password)
+  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
+end
+
+def get_orders(status, user_id)
+  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
+end
+
+def search_items(keyword)
+  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
+end

package/dist/packages/crucible/seeds/ruby/seed-014 2.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: ruby
+# expected: ActiveRecord group/having clause with unparameterized user input
+
+class AnalyticsController < ApplicationController
+  def aggregate
+    group_by = params[:group_by]
+    having   = params[:having]
+    @data = Order.group(group_by)
+                 .having("COUNT(*) #{having}")
+                 .select("#{group_by}, COUNT(*) as total")
+    render json: @data
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-014 3.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: ruby
+# expected: ActiveRecord group/having clause with unparameterized user input
+
+class AnalyticsController < ApplicationController
+  def aggregate
+    group_by = params[:group_by]
+    having   = params[:having]
+    @data = Order.group(group_by)
+                 .having("COUNT(*) #{having}")
+                 .select("#{group_by}, COUNT(*) as total")
+    render json: @data
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-014.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: ruby
+# expected: ActiveRecord group/having clause with unparameterized user input
+
+class AnalyticsController < ApplicationController
+  def aggregate
+    group_by = params[:group_by]
+    having   = params[:having]
+    @data = Order.group(group_by)
+                 .having("COUNT(*) #{having}")
+                 .select("#{group_by}, COUNT(*) as total")
+    render json: @data
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-015 2.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: pg gem exec_params replaced with exec — user string in raw SQL
+
+require 'pg'
+
+conn = PG.connect(dbname: 'production')
+
+def login(conn, username, password)
+  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
+  result.first
+end
+
+def get_profile(conn, user_id)
+  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
+end

package/dist/packages/crucible/seeds/ruby/seed-015 3.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: pg gem exec_params replaced with exec — user string in raw SQL
+
+require 'pg'
+
+conn = PG.connect(dbname: 'production')
+
+def login(conn, username, password)
+  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
+  result.first
+end
+
+def get_profile(conn, user_id)
+  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
+end

package/dist/packages/crucible/seeds/ruby/seed-015.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: pg gem exec_params replaced with exec — user string in raw SQL
+
+require 'pg'
+
+conn = PG.connect(dbname: 'production')
+
+def login(conn, username, password)
+  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
+  result.first
+end
+
+def get_profile(conn, user_id)
+  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
+end

package/dist/packages/crucible/seeds/ruby/seed-016 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: render html: with user content — unescaped XSS
+
+class CommentsController < ApplicationController
+  def show
+    @comment = Comment.find(params[:id])
+    render html: @comment.body.html_safe
+  end
+
+  def preview
+    content = params[:content]
+    render html: content.html_safe
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-016 3.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: render html: with user content — unescaped XSS
+
+class CommentsController < ApplicationController
+  def show
+    @comment = Comment.find(params[:id])
+    render html: @comment.body.html_safe
+  end
+
+  def preview
+    content = params[:content]
+    render html: content.html_safe
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-016.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: render html: with user content — unescaped XSS
+
+class CommentsController < ApplicationController
+  def show
+    @comment = Comment.find(params[:id])
+    render html: @comment.body.html_safe
+  end
+
+  def preview
+    content = params[:content]
+    render html: content.html_safe
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-017 2.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: raw() helper used with user-controlled content in ERB template
+
+# In a Rails view (equivalent Ruby)
+class ArticlesController < ApplicationController
+  helper_method :render_article
+
+  def show
+    @article   = Article.find(params[:id])
+    @title     = params[:title] || @article.title
+    @body      = @article.body
+  end
+end
+
+# Equivalent ERB logic (Ruby):
+def render_article_html(title, body, author_bio)
+  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
+end
+
+def raw(str)
+  str.to_s
+end

package/dist/packages/crucible/seeds/ruby/seed-017 3.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: raw() helper used with user-controlled content in ERB template
+
+# In a Rails view (equivalent Ruby)
+class ArticlesController < ApplicationController
+  helper_method :render_article
+
+  def show
+    @article   = Article.find(params[:id])
+    @title     = params[:title] || @article.title
+    @body      = @article.body
+  end
+end
+
+# Equivalent ERB logic (Ruby):
+def render_article_html(title, body, author_bio)
+  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
+end
+
+def raw(str)
+  str.to_s
+end

package/dist/packages/crucible/seeds/ruby/seed-017.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: raw() helper used with user-controlled content in ERB template
+
+# In a Rails view (equivalent Ruby)
+class ArticlesController < ApplicationController
+  helper_method :render_article
+
+  def show
+    @article   = Article.find(params[:id])
+    @title     = params[:title] || @article.title
+    @body      = @article.body
+  end
+end
+
+# Equivalent ERB logic (Ruby):
+def render_article_html(title, body, author_bio)
+  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
+end
+
+def raw(str)
+  str.to_s
+end

package/dist/packages/crucible/seeds/ruby/seed-018 2.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: Sinatra response body includes user param without escaping
+
+require 'sinatra'
+
+get '/greet' do
+  name  = params[:name]
+  query = params[:q]
+  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
+end
+
+get '/error' do
+  msg = params[:message]
+  "<div class='error'>#{msg}</div>"
+end
+
+post '/comment' do
+  comment = params[:comment]
+  "<p>Your comment: #{comment}</p>"
+end

package/dist/packages/crucible/seeds/ruby/seed-018 3.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: Sinatra response body includes user param without escaping
+
+require 'sinatra'
+
+get '/greet' do
+  name  = params[:name]
+  query = params[:q]
+  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
+end
+
+get '/error' do
+  msg = params[:message]
+  "<div class='error'>#{msg}</div>"
+end
+
+post '/comment' do
+  comment = params[:comment]
+  "<p>Your comment: #{comment}</p>"
+end

package/dist/packages/crucible/seeds/ruby/seed-018.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: Sinatra response body includes user param without escaping
+
+require 'sinatra'
+
+get '/greet' do
+  name  = params[:name]
+  query = params[:q]
+  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
+end
+
+get '/error' do
+  msg = params[:message]
+  "<div class='error'>#{msg}</div>"
+end
+
+post '/comment' do
+  comment = params[:comment]
+  "<p>Your comment: #{comment}</p>"
+end