npm - thuban - Versions diffs - 0.3.4 → 0.4.0 - Mend

thuban 0.3.4 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (918) hide show

package/dist/packages/crucible/seeds/csharp/seed-019.cs ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via HtmlHelper.Raw embedding user-supplied comment content
+using Microsoft.AspNetCore.Html;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Rendering;
+namespace App.Controllers
+{
+    public class CommentController : Controller
+    {
+        [HttpGet("comments")]
+        public IActionResult Index(string comment, string author)
+        {
+            // Vulnerable: Html.Raw allows unsanitized input to render as HTML
+            var rawComment = new HtmlString(
+                $"<div class=\"comment\"><b>{author}</b>: {comment}</div>");
+            ViewBag.Comment = rawComment;
+            return View();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-020.cs ADDED Viewed

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via Razor @Html.Raw with user-controlled error message parameter
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+namespace App.Pages
+{
+    public class ErrorModel : PageModel
+    {
+        public string ErrorMessage { get; private set; }
+        public void OnGet(string message, string code)
+        {
+            // Vulnerable: message stored as raw HTML to be rendered with @Html.Raw
+            ErrorMessage = $"<b>Error {code}:</b> {message}";
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-021.cs ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: csharp
+// expected: XSS via Response.Write injecting user input into JavaScript variable
+using System.Web;
+namespace App.Handlers
+{
+    public class UserDataHandler : IHttpHandler
+    {
+        public bool IsReusable => false;
+        public void ProcessRequest(HttpContext context)
+        {
+            string userId   = context.Request.QueryString["uid"];
+            string redirect = context.Request.QueryString["next"];
+            context.Response.ContentType = "text/html";
+            // Vulnerable: userId and redirect injected into inline JS
+            context.Response.Write("<script>");
+            context.Response.Write("var userId = \"" + userId + "\";");
+            context.Response.Write("var nextUrl = \"" + redirect + "\";");
+            context.Response.Write("window.location = nextUrl;");
+            context.Response.Write("</script>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-022.cs ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS bypass via HtmlEncode applied to already-composed HTML string instead of individual inputs
+using System.Web;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    public class MessageController : Controller
+    {
+        [HttpGet("message")]
+        public ContentResult Show(string template, string value)
+        {
+            // Vulnerable: HtmlEncode is applied to the fully composed string,
+            // so the attacker can inject into 'template' before encoding occurs.
+            // The final response uses the unencoded 'composed' variable.
+            string composed = $"<div class='{template}'>{value}</div>";
+            string encoded  = HttpUtility.HtmlEncode(composed); // too late — not used below
+            return Content("<html><body>" + composed + "</body></html>", "text/html");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-023.cs ADDED Viewed

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled argument string
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class PingController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult Ping([FromQuery] string host)
+        {
+            // Vulnerable: host injected directly into shell command arguments
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "/bin/bash",
+                Arguments              = $"-c \"ping -c 4 {host}\"",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string output = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return Ok(output);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-024.cs ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-supplied filename in ffmpeg command
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ConvertController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Convert([FromQuery] string inputFile, [FromQuery] string outputFile)
+        {
+            // Vulnerable: inputFile and outputFile not sanitized before shell execution
+            string cmd = $"ffmpeg -i /uploads/{inputFile} /output/{outputFile}";
+            var psi = new ProcessStartInfo("/bin/sh", $"-c \"{cmd}\"")
+            {
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            proc.WaitForExit();
+            return Ok($"Exit code: {proc.ExitCode}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-025.cs ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start executing user-supplied script name
+using System.Diagnostics;
+namespace App.Services
+{
+    public class ScriptRunner
+    {
+        private const string ScriptDir = "/opt/app/scripts/";
+        public string RunScript(string scriptName, string args)
+        {
+            // Vulnerable: scriptName and args appended without escaping
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "/bin/bash",
+                Arguments              = $"{ScriptDir}{scriptName} {args}",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string result = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return result;
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-026.cs ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled zip archive path
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ArchiveController : ControllerBase
+    {
+        [HttpPost("extract")]
+        public IActionResult Extract([FromQuery] string archiveName, [FromQuery] string destDir)
+        {
+            // Vulnerable: both params injected into shell command
+            string command = $"unzip /uploads/{archiveName} -d /output/{destDir}";
+            Process.Start("/bin/sh", $"-c \"{command}\"")?.WaitForExit();
+            return Ok("Extraction started");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-027.cs ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via cmd.exe with user-supplied network path
+using System.Diagnostics;
+namespace App.Services
+{
+    public class NetworkScanner
+    {
+        public string ScanHost(string ipAddress)
+        {
+            // Vulnerable: ipAddress passed to cmd.exe without validation
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "cmd.exe",
+                Arguments              = $"/c nslookup {ipAddress}",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string output = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return output;
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-028.cs ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled email and report path
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ReportMailerController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Send([FromQuery] string email, [FromQuery] string reportPath)
+        {
+            // Vulnerable: email and reportPath injected into sendmail command
+            string cmd = $"sendmail {email} < {reportPath}";
+            Process.Start("/bin/sh", $"-c \"{cmd}\"")?.WaitForExit();
+            return Ok("Report sent");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-029.cs ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via File.ReadAllText with unvalidated user-supplied filename
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class FileController : ControllerBase
+    {
+        private const string BaseDir = @"C:\App\Files\";
+        [HttpGet]
+        public IActionResult Download([FromQuery] string filename)
+        {
+            // Vulnerable: no normalization or containment check
+            string fullPath = BaseDir + filename;
+            string content  = File.ReadAllText(fullPath);
+            return Ok(content);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-030.cs ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via Path.Combine without verifying result stays within base directory
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class TemplateController : ControllerBase
+    {
+        private const string TemplateRoot = "/var/app/templates/";
+        [HttpGet]
+        public IActionResult GetTemplate([FromQuery] string name)
+        {
+            // Vulnerable: Path.Combine does not prevent traversal if name starts with /
+            string path    = Path.Combine(TemplateRoot, name);
+            byte[] content = File.ReadAllBytes(path);
+            return File(content, "text/html");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-031.cs ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via FileStream opened from user-supplied config name
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ConfigController : ControllerBase
+    {
+        private const string ConfigDir = "/etc/appservice/configs/";
+        [HttpGet("{configName}")]
+        public IActionResult GetConfig(string configName)
+        {
+            // Vulnerable: configName not validated; ../../etc/shadow possible
+            string filePath = ConfigDir + configName + ".json";
+            using var fs     = new FileStream(filePath, FileMode.Open, FileAccess.Read);
+            using var reader = new StreamReader(fs);
+            return Ok(reader.ReadToEnd());
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-032.cs ADDED Viewed

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal in file delete via Directory.Delete with user-controlled path
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class CleanupController : ControllerBase
+    {
+        private const string UploadRoot = "/var/uploads/";
+        [HttpDelete]
+        public IActionResult DeleteFile([FromQuery] string relativePath)
+        {
+            // Vulnerable: relativePath with ../ can delete files outside UploadRoot
+            string fullPath = Path.Combine(UploadRoot, relativePath);
+            if (Directory.Exists(fullPath))
+                Directory.Delete(fullPath, recursive: true);
+            else if (File.Exists(fullPath))
+                File.Delete(fullPath);
+            return Ok("Deleted");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-033.cs ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ReportController : ControllerBase
+    {
+        private const string ReportBase = "/var/reports/";
+        [HttpPost]
+        public IActionResult SaveReport([FromQuery] string reportName, [FromBody] string content)
+        {
+            // Vulnerable: reportName can traverse directory (../../etc/cron.d/evil)
+            string outputPath = ReportBase + reportName + ".txt";
+            File.WriteAllText(outputPath, content);
+            return Ok($"Saved to {outputPath}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-034.cs ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: MD5 used for password hashing via MD5.Create()
+using System.Security.Cryptography;
+using System.Text;
+namespace App.Security
+{
+    public class PasswordHasher
+    {
+        // Vulnerable: MD5 is cryptographically broken and unsalted
+        public static string HashPassword(string password)
+        {
+            using var md5  = MD5.Create();
+            byte[] hash    = md5.ComputeHash(Encoding.UTF8.GetBytes(password));
+            return BitConverter.ToString(hash).Replace("-", "").ToLower();
+        }
+        public static bool Verify(string password, string storedHash)
+            => HashPassword(password) == storedHash;
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-035.cs ADDED Viewed

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: csharp
+// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+namespace App.Security
+{
+    public class LegacyEncryptor
+    {
+        private static readonly byte[] Key = Encoding.ASCII.GetBytes("8ByteKey");
+        private static readonly byte[] IV  = Encoding.ASCII.GetBytes("InitVec!");
+        // Vulnerable: DES is broken — 56-bit key susceptible to brute force
+        public static byte[] Encrypt(string plaintext)
+        {
+            using var des    = DES.Create();
+            des.Key          = Key;
+            des.IV           = IV;
+            using var ms     = new MemoryStream();
+            using var cs     = new CryptoStream(ms, des.CreateEncryptor(), CryptoStreamMode.Write);
+            byte[] data      = Encoding.UTF8.GetBytes(plaintext);
+            cs.Write(data, 0, data.Length);
+            cs.FlushFinalBlock();
+            return ms.ToArray();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-036.cs ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: System.Random used instead of RNGCryptoServiceProvider for token generation
+using System;
+namespace App.Security
+{
+    public class TokenService
+    {
+        // Vulnerable: System.Random is not cryptographically secure
+        private static readonly Random Rng = new Random();
+        private const string Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        public static string GenerateToken(int length = 32)
+        {
+            var sb = new System.Text.StringBuilder(length);
+            for (int i = 0; i < length; i++)
+                sb.Append(Alphabet[Rng.Next(Alphabet.Length)]);
+            return sb.ToString();
+        }
+        public static string GenerateCsrfToken() => GenerateToken(24);
+        public static string GeneratePasswordReset() => GenerateToken(40);
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-037.cs ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: SHA1 used for HMAC signing instead of SHA256 or higher
+using System.Security.Cryptography;
+using System.Text;
+namespace App.Security
+{
+    public class SignatureService
+    {
+        // Vulnerable: HMACSHA1 is weak for new applications
+        public static string Sign(string data, string key)
+        {
+            using var hmac = new HMACSHA1(Encoding.UTF8.GetBytes(key));
+            byte[] hash    = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
+            return Convert.ToBase64String(hash);
+        }
+        // Vulnerable: MD5 used for payload integrity
+        public static string ComputeMd5(byte[] data)
+        {
+            using var md5 = MD5.Create();
+            return BitConverter.ToString(md5.ComputeHash(data)).Replace("-", "");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-038.cs ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: AES-ECB mode used for encryption (no IV, leaks data patterns)
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+namespace App.Security
+{
+    public class AesEcbEncryptor
+    {
+        private static readonly byte[] Key = Encoding.ASCII.GetBytes("1234567890abcdef");
+        // Vulnerable: AES in ECB mode — identical plaintext blocks produce identical ciphertext
+        public static byte[] Encrypt(byte[] data)
+        {
+            using var aes = Aes.Create();
+            aes.Key       = Key;
+            aes.Mode      = CipherMode.ECB;
+            aes.Padding   = PaddingMode.PKCS7;
+            using var encryptor = aes.CreateEncryptor();
+            return encryptor.TransformFinalBlock(data, 0, data.Length);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-039.cs ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via BinaryFormatter.Deserialize on untrusted stream
+using System.IO;
+using System.Runtime.Serialization.Formatters.Binary;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class SessionController : ControllerBase
+    {
+        [HttpPost("restore")]
+        public IActionResult RestoreSession()
+        {
+            // Vulnerable: BinaryFormatter can execute arbitrary code via gadget chains
+            var formatter = new BinaryFormatter();
+#pragma warning disable SYSLIB0011
+            object data = formatter.Deserialize(Request.Body);
+#pragma warning restore SYSLIB0011
+            HttpContext.Session.SetString("data", data.ToString());
+            return Ok("Session restored");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-040.cs ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via JsonConvert with TypeNameHandling.All on user input
+using Newtonsoft.Json;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class DataController : ControllerBase
+    {
+        [HttpPost("load")]
+        public IActionResult Load([FromBody] string json)
+        {
+            // Vulnerable: TypeNameHandling.All allows attacker to specify arbitrary type
+            var settings = new JsonSerializerSettings
+            {
+                TypeNameHandling = TypeNameHandling.All
+            };
+            object result = JsonConvert.DeserializeObject(json, settings);
+            return Ok(result?.GetType().Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-041.cs ADDED Viewed

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via BinaryFormatter on Base64-decoded cookie value
+using System;
+using System.IO;
+using System.Runtime.Serialization.Formatters.Binary;
+using Microsoft.AspNetCore.Mvc;
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AuthController : ControllerBase
+    {
+        [HttpGet("me")]
+        public IActionResult GetCurrentUser()
+        {
+            string cookie = Request.Cookies["session"];
+            if (cookie == null) return Unauthorized();
+            byte[] data = Convert.FromBase64String(cookie);
+            // Vulnerable: attacker-crafted cookie triggers gadget chain
+            var formatter = new BinaryFormatter();
+#pragma warning disable SYSLIB0011
+            object principal = formatter.Deserialize(new MemoryStream(data));
+#pragma warning restore SYSLIB0011
+            return Ok(principal.ToString());
+        }
+    }
+}