thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/ruby/seed-040 2.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: HTTParty.get with user-supplied URL — SSRF to internal services
+
+require 'httparty'
+
+class WebhookController < ApplicationController
+  def trigger
+    callback_url = params[:callback]
+    payload      = { event: 'triggered', timestamp: Time.now.to_i }
+    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
+    render json: { triggered: true }
+  end
+
+  def preview_url
+    url  = params[:url]
+    resp = HTTParty.get(url, timeout: 5)
+    render plain: resp.body
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-040 3.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: HTTParty.get with user-supplied URL — SSRF to internal services
+
+require 'httparty'
+
+class WebhookController < ApplicationController
+  def trigger
+    callback_url = params[:callback]
+    payload      = { event: 'triggered', timestamp: Time.now.to_i }
+    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
+    render json: { triggered: true }
+  end
+
+  def preview_url
+    url  = params[:url]
+    resp = HTTParty.get(url, timeout: 5)
+    render plain: resp.body
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-040.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: HTTParty.get with user-supplied URL — SSRF to internal services
+
+require 'httparty'
+
+class WebhookController < ApplicationController
+  def trigger
+    callback_url = params[:callback]
+    payload      = { event: 'triggered', timestamp: Time.now.to_i }
+    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
+    render json: { triggered: true }
+  end
+
+  def preview_url
+    url  = params[:url]
+    resp = HTTParty.get(url, timeout: 5)
+    render plain: resp.body
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-041 2.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: Faraday connection built from user-controlled base URL
+
+require 'faraday'
+
+class ImportController < ApplicationController
+  def import_feed
+    source_url = params[:feed_url]
+    conn       = Faraday.new(url: source_url)
+    response   = conn.get('/')
+    data       = JSON.parse(response.body)
+    render json: { imported: data.size }
+  end
+
+  def fetch_avatar
+    avatar_url = params[:avatar_url]
+    response   = Faraday.get(avatar_url)
+    send_data response.body, type: 'image/jpeg'
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-041 3.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: Faraday connection built from user-controlled base URL
+
+require 'faraday'
+
+class ImportController < ApplicationController
+  def import_feed
+    source_url = params[:feed_url]
+    conn       = Faraday.new(url: source_url)
+    response   = conn.get('/')
+    data       = JSON.parse(response.body)
+    render json: { imported: data.size }
+  end
+
+  def fetch_avatar
+    avatar_url = params[:avatar_url]
+    response   = Faraday.get(avatar_url)
+    send_data response.body, type: 'image/jpeg'
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-041.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: Faraday connection built from user-controlled base URL
+
+require 'faraday'
+
+class ImportController < ApplicationController
+  def import_feed
+    source_url = params[:feed_url]
+    conn       = Faraday.new(url: source_url)
+    response   = conn.get('/')
+    data       = JSON.parse(response.body)
+    render json: { imported: data.size }
+  end
+
+  def fetch_avatar
+    avatar_url = params[:avatar_url]
+    response   = Faraday.get(avatar_url)
+    send_data response.body, type: 'image/jpeg'
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-042 2.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: ruby
+# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme
+
+require 'open-uri'
+
+def fetch_remote_resource(url)
+  URI.open(url).read
+end
+
+def download_image(image_url)
+  URI.open(image_url) do |f|
+    File.write('/tmp/downloaded_image', f.read)
+  end
+end
+
+class ResourceController < ApplicationController
+  def import
+    resource_url = params[:url]
+    content      = URI.open(resource_url).read
+    render plain: content
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-042 3.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: ruby
+# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme
+
+require 'open-uri'
+
+def fetch_remote_resource(url)
+  URI.open(url).read
+end
+
+def download_image(image_url)
+  URI.open(image_url) do |f|
+    File.write('/tmp/downloaded_image', f.read)
+  end
+end
+
+class ResourceController < ApplicationController
+  def import
+    resource_url = params[:url]
+    content      = URI.open(resource_url).read
+    render plain: content
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-042.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: ruby
+# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme
+
+require 'open-uri'
+
+def fetch_remote_resource(url)
+  URI.open(url).read
+end
+
+def download_image(image_url)
+  URI.open(image_url) do |f|
+    File.write('/tmp/downloaded_image', f.read)
+  end
+end
+
+class ResourceController < ApplicationController
+  def import
+    resource_url = params[:url]
+    content      = URI.open(resource_url).read
+    render plain: content
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-043 2.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: RestClient.get with user-supplied URL — SSRF
+
+require 'rest-client'
+
+class ProxyService
+  def self.relay(target_url, headers = {})
+    RestClient.get(target_url, headers)
+  rescue RestClient::Exception => e
+    e.response
+  end
+
+  def self.post_webhook(url, payload)
+    RestClient.post(url, payload.to_json, content_type: :json)
+  end
+
+  def self.check_health(host)
+    RestClient.get("http://#{host}/health")
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-043 3.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: RestClient.get with user-supplied URL — SSRF
+
+require 'rest-client'
+
+class ProxyService
+  def self.relay(target_url, headers = {})
+    RestClient.get(target_url, headers)
+  rescue RestClient::Exception => e
+    e.response
+  end
+
+  def self.post_webhook(url, payload)
+    RestClient.post(url, payload.to_json, content_type: :json)
+  end
+
+  def self.check_health(host)
+    RestClient.get("http://#{host}/health")
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-043.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: critical
+# language: ruby
+# expected: RestClient.get with user-supplied URL — SSRF
+
+require 'rest-client'
+
+class ProxyService
+  def self.relay(target_url, headers = {})
+    RestClient.get(target_url, headers)
+  rescue RestClient::Exception => e
+    e.response
+  end
+
+  def self.post_webhook(url, payload)
+    RestClient.post(url, payload.to_json, content_type: :json)
+  end
+
+  def self.check_health(host)
+    RestClient.get("http://#{host}/health")
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-044 2.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to params[:url] without validation — open redirect
+
+class SessionsController < ApplicationController
+  def create
+    if authenticated?
+      redirect_to params[:url] || root_path
+    else
+      flash[:error] = 'Invalid credentials'
+      render :new
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-044 3.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to params[:url] without validation — open redirect
+
+class SessionsController < ApplicationController
+  def create
+    if authenticated?
+      redirect_to params[:url] || root_path
+    else
+      flash[:error] = 'Invalid credentials'
+      render :new
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-044.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to params[:url] without validation — open redirect
+
+class SessionsController < ApplicationController
+  def create
+    if authenticated?
+      redirect_to params[:url] || root_path
+    else
+      flash[:error] = 'Invalid credentials'
+      render :new
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-045 2.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
+
+class AuthController < ApplicationController
+  def callback
+    next_url = params[:next] || params[:return_to] || dashboard_path
+    redirect_to next_url
+  end
+
+  def logout
+    sign_out current_user
+    redirect_to params[:redirect]
+  end
+
+  def sso_redirect
+    target = request.params['RelayState'] || root_url
+    redirect_to target, allow_other_host: true
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-045 3.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
+
+class AuthController < ApplicationController
+  def callback
+    next_url = params[:next] || params[:return_to] || dashboard_path
+    redirect_to next_url
+  end
+
+  def logout
+    sign_out current_user
+    redirect_to params[:redirect]
+  end
+
+  def sso_redirect
+    target = request.params['RelayState'] || root_url
+    redirect_to target, allow_other_host: true
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-045.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
+
+class AuthController < ApplicationController
+  def callback
+    next_url = params[:next] || params[:return_to] || dashboard_path
+    redirect_to next_url
+  end
+
+  def logout
+    sign_out current_user
+    redirect_to params[:redirect]
+  end
+
+  def sso_redirect
+    target = request.params['RelayState'] || root_url
+    redirect_to target, allow_other_host: true
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-046 2.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: medium
+# language: ruby
+# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
+
+class RedirectController < ApplicationController
+  SAFE_DOMAIN = 'example.com'
+
+  def go
+    target = params[:to]
+    if target =~ /example\.com/
+      redirect_to target, allow_other_host: true
+    else
+      redirect_to root_path
+    end
+  end
+
+  def external
+    url     = params[:url]
+    trusted = ['example.com', 'partner.com']
+    host    = URI.parse(url).host rescue ''
+    if trusted.include?(host)
+      redirect_to url, allow_other_host: true
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-046 3.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: medium
+# language: ruby
+# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
+
+class RedirectController < ApplicationController
+  SAFE_DOMAIN = 'example.com'
+
+  def go
+    target = params[:to]
+    if target =~ /example\.com/
+      redirect_to target, allow_other_host: true
+    else
+      redirect_to root_path
+    end
+  end
+
+  def external
+    url     = params[:url]
+    trusted = ['example.com', 'partner.com']
+    host    = URI.parse(url).host rescue ''
+    if trusted.include?(host)
+      redirect_to url, allow_other_host: true
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-046.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: medium
+# language: ruby
+# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
+
+class RedirectController < ApplicationController
+  SAFE_DOMAIN = 'example.com'
+
+  def go
+    target = params[:to]
+    if target =~ /example\.com/
+      redirect_to target, allow_other_host: true
+    else
+      redirect_to root_path
+    end
+  end
+
+  def external
+    url     = params[:url]
+    trusted = ['example.com', 'partner.com']
+    host    = URI.parse(url).host rescue ''
+    if trusted.include?(host)
+      redirect_to url, allow_other_host: true
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-047 2.rb

@@ -0,0 +1,26 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: send_file or redirect after download with user-controlled path
+
+class DownloadsController < ApplicationController
+  def complete
+    file      = params[:file]
+    callback  = params[:callback_url]
+    send_file Rails.root.join('public', 'downloads', file)
+    redirect_to callback
+  end
+
+  def track_and_redirect
+    destination = params[:destination]
+    track_click(destination)
+    redirect_to destination, allow_other_host: true
+  end
+
+  private
+
+  def track_click(url)
+    ClickLog.create(url: url, user_id: current_user&.id)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-047 3.rb

@@ -0,0 +1,26 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: send_file or redirect after download with user-controlled path
+
+class DownloadsController < ApplicationController
+  def complete
+    file      = params[:file]
+    callback  = params[:callback_url]
+    send_file Rails.root.join('public', 'downloads', file)
+    redirect_to callback
+  end
+
+  def track_and_redirect
+    destination = params[:destination]
+    track_click(destination)
+    redirect_to destination, allow_other_host: true
+  end
+
+  private
+
+  def track_click(url)
+    ClickLog.create(url: url, user_id: current_user&.id)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-047.rb

@@ -0,0 +1,26 @@
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: send_file or redirect after download with user-controlled path
+
+class DownloadsController < ApplicationController
+  def complete
+    file      = params[:file]
+    callback  = params[:callback_url]
+    send_file Rails.root.join('public', 'downloads', file)
+    redirect_to callback
+  end
+
+  def track_and_redirect
+    destination = params[:destination]
+    track_click(destination)
+    redirect_to destination, allow_other_host: true
+  end
+
+  private
+
+  def track_click(url)
+    ClickLog.create(url: url, user_id: current_user&.id)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-048 2.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
+
+class ConfigController < ApplicationController
+  def import
+    config_data = params[:config]
+    config      = YAML.load(config_data)
+    apply_config(config)
+    render json: { applied: true }
+  end
+
+  def load_template(template_string)
+    YAML.load(template_string)
+  end
+
+  private
+
+  def apply_config(cfg)
+    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-048 3.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
+
+class ConfigController < ApplicationController
+  def import
+    config_data = params[:config]
+    config      = YAML.load(config_data)
+    apply_config(config)
+    render json: { applied: true }
+  end
+
+  def load_template(template_string)
+    YAML.load(template_string)
+  end
+
+  private
+
+  def apply_config(cfg)
+    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-048.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
+
+class ConfigController < ApplicationController
+  def import
+    config_data = params[:config]
+    config      = YAML.load(config_data)
+    apply_config(config)
+    render json: { applied: true }
+  end
+
+  def load_template(template_string)
+    YAML.load(template_string)
+  end
+
+  private
+
+  def apply_config(cfg)
+    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-049 2.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
+
+def load_config_file(config_name)
+  path    = "/etc/app/configs/#{config_name}.yml"
+  content = File.read(path)
+  YAML.load(content)
+end
+
+def parse_pipeline(pipeline_definition)
+  YAML.load(pipeline_definition)
+end
+
+def deserialize_job(job_yaml)
+  job = YAML.load(job_yaml)
+  job.merge(loaded_at: Time.now)
+end