thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/ts/seed-024.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via execSync in typed file processing service
+
+import { execSync } from 'child_process';
+import * as path from 'path';
+
+interface ConversionOptions {
+  inputPath: string;  // user-controlled filename
+  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
+  quality?: number;
+}
+
+export class FileConverter {
+  private readonly outputDir: string;
+
+  constructor(outputDir: string) {
+    this.outputDir = outputDir;
+  }
+
+  convert(opts: ConversionOptions): string {
+    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
+    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
+    // opts.inputPath is user-controlled — no sanitization before execSync
+    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
+    execSync(cmd, { timeout: 30000 });
+    return outputPath;
+  }
+
+  extractText(pdfPath: string): string {
+    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-025 2.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via spawn with shell:true and user-controlled arguments
+
+import { spawn } from 'child_process';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function runCommand(cmd: string, args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    // shell: true means the full command string is interpreted by /bin/sh
+    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
+    let output = '';
+    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
+    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
+    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
+  });
+}
+
+router.post('/scripts/run', async (req: Request, res: Response) => {
+  const { script, params }: { script: string; params: string[] } = req.body;
+  const result = await runCommand(`node scripts/${script}`, params);
+  res.json({ output: result });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-025 3.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via spawn with shell:true and user-controlled arguments
+
+import { spawn } from 'child_process';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function runCommand(cmd: string, args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    // shell: true means the full command string is interpreted by /bin/sh
+    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
+    let output = '';
+    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
+    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
+    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
+  });
+}
+
+router.post('/scripts/run', async (req: Request, res: Response) => {
+  const { script, params }: { script: string; params: string[] } = req.body;
+  const result = await runCommand(`node scripts/${script}`, params);
+  res.json({ output: result });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-025.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via spawn with shell:true and user-controlled arguments
+
+import { spawn } from 'child_process';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function runCommand(cmd: string, args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    // shell: true means the full command string is interpreted by /bin/sh
+    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
+    let output = '';
+    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
+    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
+    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
+  });
+}
+
+router.post('/scripts/run', async (req: Request, res: Response) => {
+  const { script, params }: { script: string; params: string[] } = req.body;
+  const result = await runCommand(`node scripts/${script}`, params);
+  res.json({ output: result });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-026 2.ts

@@ -0,0 +1,36 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection via git operations with user-controlled branch/tag names
+
+import { execSync } from 'child_process';
+
+interface GitOptions {
+  repoPath: string;
+  branch: string;    // user-controlled
+  remote?: string;
+}
+
+export class GitService {
+  clone(repoUrl: string, targetDir: string): void {
+    // repoUrl from user — can include shell metacharacters
+    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
+  }
+
+  checkout(opts: GitOptions): string {
+    // opts.branch may be "main; cat /etc/shadow"
+    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
+  }
+
+  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
+    return execSync(
+      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
+      { encoding: 'utf8' }
+    );
+  }
+
+  tag(repoPath: string, tagName: string, message: string): string {
+    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-026 3.ts

@@ -0,0 +1,36 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection via git operations with user-controlled branch/tag names
+
+import { execSync } from 'child_process';
+
+interface GitOptions {
+  repoPath: string;
+  branch: string;    // user-controlled
+  remote?: string;
+}
+
+export class GitService {
+  clone(repoUrl: string, targetDir: string): void {
+    // repoUrl from user — can include shell metacharacters
+    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
+  }
+
+  checkout(opts: GitOptions): string {
+    // opts.branch may be "main; cat /etc/shadow"
+    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
+  }
+
+  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
+    return execSync(
+      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
+      { encoding: 'utf8' }
+    );
+  }
+
+  tag(repoPath: string, tagName: string, message: string): string {
+    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-026.ts

@@ -0,0 +1,36 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection via git operations with user-controlled branch/tag names
+
+import { execSync } from 'child_process';
+
+interface GitOptions {
+  repoPath: string;
+  branch: string;    // user-controlled
+  remote?: string;
+}
+
+export class GitService {
+  clone(repoUrl: string, targetDir: string): void {
+    // repoUrl from user — can include shell metacharacters
+    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
+  }
+
+  checkout(opts: GitOptions): string {
+    // opts.branch may be "main; cat /etc/shadow"
+    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
+  }
+
+  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
+    return execSync(
+      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
+      { encoding: 'utf8' }
+    );
+  }
+
+  tag(repoPath: string, tagName: string, message: string): string {
+    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-027 2.ts

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection in NestJS service using exec with user-provided report parameters
+
+import { Injectable } from '@nestjs/common';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
+
+interface ReportParams {
+  format: string;       // user-controlled
+  dateRange: string;    // user-controlled
+  recipient: string;    // user-controlled email
+}
+
+@Injectable()
+export class ReportingService {
+  async generateAndSendReport(params: ReportParams): Promise<void> {
+    const { format, dateRange, recipient } = params;
+    // All three params go directly into shell command
+    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
+    const { stdout: reportPath } = await execAsync(generateCmd);
+
+    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
+    await execAsync(sendCmd);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-027 3.ts

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection in NestJS service using exec with user-provided report parameters
+
+import { Injectable } from '@nestjs/common';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
+
+interface ReportParams {
+  format: string;       // user-controlled
+  dateRange: string;    // user-controlled
+  recipient: string;    // user-controlled email
+}
+
+@Injectable()
+export class ReportingService {
+  async generateAndSendReport(params: ReportParams): Promise<void> {
+    const { format, dateRange, recipient } = params;
+    // All three params go directly into shell command
+    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
+    const { stdout: reportPath } = await execAsync(generateCmd);
+
+    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
+    await execAsync(sendCmd);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-027.ts

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: typescript
+// expected: command injection in NestJS service using exec with user-provided report parameters
+
+import { Injectable } from '@nestjs/common';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
+
+interface ReportParams {
+  format: string;       // user-controlled
+  dateRange: string;    // user-controlled
+  recipient: string;    // user-controlled email
+}
+
+@Injectable()
+export class ReportingService {
+  async generateAndSendReport(params: ReportParams): Promise<void> {
+    const { format, dateRange, recipient } = params;
+    // All three params go directly into shell command
+    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
+    const { stdout: reportPath } = await execAsync(generateCmd);
+
+    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
+    await execAsync(sendCmd);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-028 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via execa with shell:true and template literal from user data
+
+import execa from 'execa';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ScanRequest {
+  target: string;   // IP or hostname — user-controlled
+  ports?: string;   // port range — user-controlled
+  flags?: string;   // nmap flags — user-controlled
+}
+
+router.post('/security/scan', async (req: Request, res: Response) => {
+  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
+  try {
+    // All fields from user body — injection via shell metacharacters
+    const { stdout } = await execa.command(
+      `nmap ${flags} -p ${ports} ${target}`,
+      { shell: true, timeout: 60000 }
+    );
+    res.json({ results: stdout });
+  } catch (err: any) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-028 3.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via execa with shell:true and template literal from user data
+
+import execa from 'execa';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ScanRequest {
+  target: string;   // IP or hostname — user-controlled
+  ports?: string;   // port range — user-controlled
+  flags?: string;   // nmap flags — user-controlled
+}
+
+router.post('/security/scan', async (req: Request, res: Response) => {
+  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
+  try {
+    // All fields from user body — injection via shell metacharacters
+    const { stdout } = await execa.command(
+      `nmap ${flags} -p ${ports} ${target}`,
+      { shell: true, timeout: 60000 }
+    );
+    res.json({ results: stdout });
+  } catch (err: any) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-028.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: typescript
+// expected: command injection via execa with shell:true and template literal from user data
+
+import execa from 'execa';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ScanRequest {
+  target: string;   // IP or hostname — user-controlled
+  ports?: string;   // port range — user-controlled
+  flags?: string;   // nmap flags — user-controlled
+}
+
+router.post('/security/scan', async (req: Request, res: Response) => {
+  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
+  try {
+    // All fields from user body — injection via shell metacharacters
+    const { stdout } = await execa.command(
+      `nmap ${flags} -p ${ports} ${target}`,
+      { shell: true, timeout: 60000 }
+    );
+    res.json({ results: stdout });
+  } catch (err: any) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-029 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via unvalidated user path in fs.readFile
+
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
+
+router.get('/static/:file', async (req: Request, res: Response) => {
+  const requestedFile: string = req.params.file;
+  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
+  const filePath = path.join(PUBLIC_DIR, requestedFile);
+
+  try {
+    const data = await fs.readFile(filePath, 'utf-8');
+    res.type('text/plain').send(data);
+  } catch {
+    res.status(404).send('Not found');
+  }
+});
+
+router.get('/download', async (req: Request, res: Response) => {
+  const file = req.query.file as string;
+  // Completely unvalidated — reads arbitrary path on filesystem
+  const content = await fs.readFile(file);
+  res.send(content);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-029 3.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via unvalidated user path in fs.readFile
+
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
+
+router.get('/static/:file', async (req: Request, res: Response) => {
+  const requestedFile: string = req.params.file;
+  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
+  const filePath = path.join(PUBLIC_DIR, requestedFile);
+
+  try {
+    const data = await fs.readFile(filePath, 'utf-8');
+    res.type('text/plain').send(data);
+  } catch {
+    res.status(404).send('Not found');
+  }
+});
+
+router.get('/download', async (req: Request, res: Response) => {
+  const file = req.query.file as string;
+  // Completely unvalidated — reads arbitrary path on filesystem
+  const content = await fs.readFile(file);
+  res.send(content);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-029.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via unvalidated user path in fs.readFile
+
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
+
+router.get('/static/:file', async (req: Request, res: Response) => {
+  const requestedFile: string = req.params.file;
+  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
+  const filePath = path.join(PUBLIC_DIR, requestedFile);
+
+  try {
+    const data = await fs.readFile(filePath, 'utf-8');
+    res.type('text/plain').send(data);
+  } catch {
+    res.status(404).send('Not found');
+  }
+});
+
+router.get('/download', async (req: Request, res: Response) => {
+  const file = req.query.file as string;
+  // Completely unvalidated — reads arbitrary path on filesystem
+  const content = await fs.readFile(file);
+  res.send(content);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-030 2.ts

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via typed file service with user-controlled subdirectory
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface FileServiceConfig {
+  baseDir: string;
+}
+
+export class FileService {
+  private readonly baseDir: string;
+
+  constructor(config: FileServiceConfig) {
+    this.baseDir = config.baseDir;
+  }
+
+  readUserFile(userId: string, fileName: string): string {
+    // No normalization check — fileName can be "../../../etc/passwd"
+    const filePath = path.join(this.baseDir, userId, fileName);
+    return fs.readFileSync(filePath, 'utf-8');
+  }
+
+  listDirectory(userId: string, subDir: string): string[] {
+    // subDir from user — directory traversal possible
+    const dirPath = path.join(this.baseDir, userId, subDir);
+    return fs.readdirSync(dirPath);
+  }
+
+  deleteFile(userId: string, fileName: string): void {
+    const filePath = path.join(this.baseDir, userId, fileName);
+    fs.unlinkSync(filePath);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-030 3.ts

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via typed file service with user-controlled subdirectory
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface FileServiceConfig {
+  baseDir: string;
+}
+
+export class FileService {
+  private readonly baseDir: string;
+
+  constructor(config: FileServiceConfig) {
+    this.baseDir = config.baseDir;
+  }
+
+  readUserFile(userId: string, fileName: string): string {
+    // No normalization check — fileName can be "../../../etc/passwd"
+    const filePath = path.join(this.baseDir, userId, fileName);
+    return fs.readFileSync(filePath, 'utf-8');
+  }
+
+  listDirectory(userId: string, subDir: string): string[] {
+    // subDir from user — directory traversal possible
+    const dirPath = path.join(this.baseDir, userId, subDir);
+    return fs.readdirSync(dirPath);
+  }
+
+  deleteFile(userId: string, fileName: string): void {
+    const filePath = path.join(this.baseDir, userId, fileName);
+    fs.unlinkSync(filePath);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-030.ts

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via typed file service with user-controlled subdirectory
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface FileServiceConfig {
+  baseDir: string;
+}
+
+export class FileService {
+  private readonly baseDir: string;
+
+  constructor(config: FileServiceConfig) {
+    this.baseDir = config.baseDir;
+  }
+
+  readUserFile(userId: string, fileName: string): string {
+    // No normalization check — fileName can be "../../../etc/passwd"
+    const filePath = path.join(this.baseDir, userId, fileName);
+    return fs.readFileSync(filePath, 'utf-8');
+  }
+
+  listDirectory(userId: string, subDir: string): string[] {
+    // subDir from user — directory traversal possible
+    const dirPath = path.join(this.baseDir, userId, subDir);
+    return fs.readdirSync(dirPath);
+  }
+
+  deleteFile(userId: string, fileName: string): void {
+    const filePath = path.join(this.baseDir, userId, fileName);
+    fs.unlinkSync(filePath);
+  }
+}