thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/csharp/seed-042.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via DataContractSerializer reading from request body
+
+using System.Runtime.Serialization;
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class OrderController : ControllerBase
+    {
+        [HttpPost("import")]
+        public IActionResult Import()
+        {
+            // Vulnerable: DataContractSerializer resolves types from XML — SSRF/RCE risk
+            var serializer = new DataContractSerializer(typeof(object));
+            using var reader = XmlReader.Create(Request.Body);
+            object order = serializer.ReadObject(reader);
+            return Ok("Imported: " + order?.GetType().Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-043.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via LosFormatter (ViewState) with user-controlled input
+
+using System.IO;
+using System.Web.UI;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ViewStateController : ControllerBase
+    {
+        [HttpPost("restore")]
+        public IActionResult Restore([FromQuery] string viewState)
+        {
+            // Vulnerable: LosFormatter deserializes attacker-controlled ViewState bytes
+            var formatter = new LosFormatter();
+            byte[] data   = Convert.FromBase64String(viewState);
+            object result = formatter.Deserialize(Convert.ToBase64String(data));
+            return Ok(result?.ToString());
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-044.cs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via WebClient.DownloadString with user-supplied URL
+
+using System.Net;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ProxyController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult Fetch([FromQuery] string url)
+        {
+            // Vulnerable: fetches arbitrary URL including internal services
+            using var client = new WebClient();
+            string content   = client.DownloadString(url);
+            return Content(content, "text/plain");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-045.cs

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via HttpClient.GetAsync with user-controlled endpoint URL
+
+using System.Net.Http;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class WebhookTestController : ControllerBase
+    {
+        private static readonly HttpClient _httpClient = new HttpClient();
+
+        [HttpPost]
+        public async Task<IActionResult> Test([FromQuery] string webhookUrl, [FromBody] string payload)
+        {
+            // Vulnerable: attacker can target internal metadata endpoints
+            var response = await _httpClient.PostAsync(
+                webhookUrl,
+                new StringContent(payload, System.Text.Encoding.UTF8, "application/json"));
+            string body = await response.Content.ReadAsStringAsync();
+            return Ok(body);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-046.cs

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via WebRequest.Create with user-supplied URL for avatar fetching
+
+using System.IO;
+using System.Net;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AvatarController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult FetchAvatar([FromQuery] string avatarUrl)
+        {
+            // Vulnerable: server fetches any URL, allowing SSRF to internal services
+            WebRequest request  = WebRequest.Create(avatarUrl);
+            WebResponse response = request.GetResponse();
+            using var stream    = response.GetResponseStream();
+            using var ms        = new MemoryStream();
+            stream.CopyTo(ms);
+            return File(ms.ToArray(), response.ContentType);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-047.cs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via HttpClient built from base URL query parameter for API aggregation
+
+using System.Net.Http;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AggregatorController : ControllerBase
+    {
+        [HttpGet]
+        public async Task<IActionResult> Aggregate([FromQuery] string serviceUrl, [FromQuery] string path)
+        {
+            // Vulnerable: combines user-controlled base URL and path — can reach internal services
+            using var client = new HttpClient { BaseAddress = new System.Uri(serviceUrl) };
+            string response  = await client.GetStringAsync(path);
+            return Ok(response);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-048.cs

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)
+
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class XmlImportController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Import()
+        {
+            // Vulnerable: default XmlReaderSettings allows DTD and external entities
+            var settings = new XmlReaderSettings
+            {
+                DtdProcessing = DtdProcessing.Parse,   // allows DOCTYPE
+                XmlResolver   = new XmlUrlResolver()    // resolves external entities
+            };
+            using var reader = XmlReader.Create(Request.Body, settings);
+            var doc = new XmlDocument();
+            doc.Load(reader);
+            return Ok("Imported " + doc.DocumentElement?.Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-049.cs

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XmlDocument.LoadXml with default XmlResolver allowing entity expansion
+
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class FeedController : ControllerBase
+    {
+        [HttpPost("parse")]
+        public IActionResult ParseFeed([FromBody] string xmlContent)
+        {
+            // Vulnerable: XmlDocument with default resolver processes external entities
+            var doc = new XmlDocument();
+            doc.XmlResolver = new XmlUrlResolver(); // allows file:// and http:// entities
+            doc.LoadXml(xmlContent);
+            string rootName = doc.DocumentElement?.Name ?? "none";
+            return Ok($"Root element: {rootName}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-050.cs

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XPathDocument loaded from request body without disabling DTD processing
+
+using System.IO;
+using System.Xml;
+using System.Xml.XPath;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class XPathQueryController : ControllerBase
+    {
+        [HttpPost("query")]
+        public IActionResult Query([FromQuery] string xpath)
+        {
+            // Vulnerable: XPathDocument with XmlUrlResolver resolves external entities
+            using var reader = new StreamReader(Request.Body);
+            string xml       = reader.ReadToEnd();
+            var doc          = new XPathDocument(new StringReader(xml));
+            var nav          = doc.CreateNavigator();
+            string result    = nav.SelectSingleNode(xpath)?.Value ?? "";
+            return Ok(result);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-051.cs

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: csharp
+// expected: Open redirect via Response.Redirect with unvalidated user-supplied URL
+
+using System.Web;
+
+namespace App.Handlers
+{
+    public class LoginHandler : IHttpHandler
+    {
+        public bool IsReusable => false;
+
+        public void ProcessRequest(HttpContext context)
+        {
+            string username = context.Request.Form["username"];
+            string password = context.Request.Form["password"];
+            string next     = context.Request.QueryString["next"];
+
+            if (Authenticate(username, password))
+            {
+                // Vulnerable: 'next' not validated — can redirect to external malicious site
+                context.Response.Redirect(next ?? "/dashboard");
+            }
+            else
+            {
+                context.Response.Redirect("/login?error=1");
+            }
+        }
+
+        private bool Authenticate(string u, string p) => u == "admin" && p == "password";
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-052.cs

@@ -0,0 +1,36 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: csharp
+// expected: Open redirect via LocalRedirect with user-controlled URL bypassing local check
+
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    public class AccountController : Controller
+    {
+        [HttpPost("logout")]
+        public IActionResult Logout(string returnUrl)
+        {
+            // Clear session
+            HttpContext.Session.Clear();
+
+            // Vulnerable: returnUrl not properly validated;
+            // attacker can supply //evil.com or /\evil.com to bypass IsLocalUrl
+            if (!string.IsNullOrEmpty(returnUrl))
+                return Redirect(returnUrl);
+
+            return RedirectToAction("Index", "Home");
+        }
+
+        [HttpGet("oauth-callback")]
+        public IActionResult OAuthCallback(string state, string code)
+        {
+            // Vulnerable: state used as redirect target without validation
+            string destination = System.Text.Encoding.UTF8.GetString(
+                Convert.FromBase64String(state));
+            return Redirect(destination);
+        }
+    }
+}

package/dist/packages/crucible/seeds/go/seed-001.go

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded AWS access key and secret key in Go constants
+
+package config
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/s3"
+)
+
+const (
+	awsAccessKeyID     = "AKIAIOSFODNN7EXAMPLE"
+	awsSecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+	awsRegion          = "us-east-1"
+)
+
+func NewS3Client() *s3.S3 {
+	creds := credentials.NewStaticCredentials(awsAccessKeyID, awsSecretAccessKey, "")
+	sess := session.Must(session.NewSession(&aws.Config{
+		Region:      aws.String(awsRegion),
+		Credentials: creds,
+	}))
+	return s3.New(sess)
+}

package/dist/packages/crucible/seeds/go/seed-002.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded database password in Go variable used for connection string
+
+package database
+
+import (
+	"database/sql"
+	"fmt"
+	_ "github.com/lib/pq"
+)
+
+const (
+	dbHost     = "prod-postgres.internal"
+	dbPort     = 5432
+	dbUser     = "app_user"
+	dbPassword = "Pr0dDB$uper$ecret2024!"
+	dbName     = "appdb"
+)
+
+func Connect() (*sql.DB, error) {
+	dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=require",
+		dbHost, dbPort, dbUser, dbPassword, dbName)
+	return sql.Open("postgres", dsn)
+}

package/dist/packages/crucible/seeds/go/seed-003.go

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded JWT signing secret stored as package-level variable
+
+package auth
+
+import (
+	"time"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+// Vulnerable: signing secret hardcoded — should come from environment/vault
+var jwtSigningKey = []byte("my-super-secret-jwt-key-do-not-share")
+
+func GenerateToken(userID string) (string, error) {
+	claims := jwt.MapClaims{
+		"sub": userID,
+		"iat": time.Now().Unix(),
+		"exp": time.Now().Add(24 * time.Hour).Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(jwtSigningKey)
+}
+
+func ValidateToken(tokenStr string) (*jwt.Token, error) {
+	return jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
+		return jwtSigningKey, nil
+	})
+}

package/dist/packages/crucible/seeds/go/seed-004.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: go
+// expected: Hardcoded Stripe secret key in payment service package variable
+
+package payments
+
+import (
+	"github.com/stripe/stripe-go/v74"
+	"github.com/stripe/stripe-go/v74/charge"
+)
+
+const stripeSecretKey = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD"
+
+func init() {
+	stripe.Key = stripeSecretKey
+}
+
+func CreateCharge(token string, amountCents int64) (*stripe.Charge, error) {
+	params := &stripe.ChargeParams{
+		Amount:   stripe.Int64(amountCents),
+		Currency: stripe.String(string(stripe.CurrencyUSD)),
+		Source:   &stripe.SourceParams{Token: stripe.String(token)},
+	}
+	return charge.New(params)
+}

package/dist/packages/crucible/seeds/go/seed-005.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded Redis password and encryption key in configuration struct literal
+
+package config
+
+type CacheConfig struct {
+	Host     string
+	Port     int
+	Password string
+	EncKey   string
+}
+
+// Vulnerable: both secrets hardcoded in source
+var DefaultCacheConfig = CacheConfig{
+	Host:     "redis.internal.prod",
+	Port:     6379,
+	Password: "RedisP@$$w0rd#Prod2024",
+	EncKey:   "AES256KeyForCache!Encrypt#9876XY",
+}
+
+func GetRedisURL() string {
+	return "redis://:" + DefaultCacheConfig.Password +
+		"@" + DefaultCacheConfig.Host + ":6379"
+}

package/dist/packages/crucible/seeds/go/seed-006.go

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: go
+// expected: Hardcoded GitHub personal access token in REST client
+
+package github
+
+import (
+	"net/http"
+)
+
+const githubToken = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345"
+
+func NewClient() *http.Client {
+	return &http.Client{}
+}
+
+func GetRepository(owner, repo string) (*http.Response, error) {
+	req, err := http.NewRequest("GET",
+		"https://api.github.com/repos/"+owner+"/"+repo, nil)
+	if err != nil {
+		return nil, err
+	}
+	// Vulnerable: hardcoded token added to every request
+	req.Header.Set("Authorization", "token "+githubToken)
+	req.Header.Set("Accept", "application/vnd.github.v3+json")
+	return http.DefaultClient.Do(req)
+}

package/dist/packages/crucible/seeds/go/seed-007.go

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded SMTP password and SendGrid API key in notification package
+
+package notifications
+
+const (
+	smtpHost     = "smtp.company.com"
+	smtpPort     = 587
+	smtpUser     = "alerts@company.com"
+	smtpPassword = "SmtpP@$$w0rd!Prod"
+
+	sendGridAPIKey = "SG.aBcDeFgHiJkLmNoPqRsTuVwXyZ.0123456789abcdefghijklmno"
+)
+
+func SMTPConnectionString() string {
+	return smtpUser + ":" + smtpPassword + "@" + smtpHost
+}
+
+func SendGridKey() string {
+	return sendGridAPIKey
+}

package/dist/packages/crucible/seeds/go/seed-008.go

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: go
+// expected: Hardcoded OAuth2 client secret in Go OAuth configuration
+
+package oauth
+
+import (
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google"
+)
+
+const (
+	oauthClientID     = "my-app-client-id-prod.apps.googleusercontent.com"
+	oauthClientSecret = "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R7wZ4"
+)
+
+var GoogleOAuthConfig = &oauth2.Config{
+	ClientID:     oauthClientID,
+	ClientSecret: oauthClientSecret,
+	RedirectURL:  "https://myapp.com/auth/callback",
+	Scopes:       []string{"openid", "profile", "email"},
+	Endpoint:     google.Endpoint,
+}

package/dist/packages/crucible/seeds/go/seed-009.go

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection via fmt.Sprintf in db.Query building WHERE clause
+
+package repository
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+type UserRepository struct {
+	db *sql.DB
+}
+
+func (r *UserRepository) FindByUsername(username string) (*sql.Row, error) {
+	// Vulnerable: fmt.Sprintf injects username directly into query string
+	query := fmt.Sprintf("SELECT id, email FROM users WHERE username = '%s'", username)
+	row := r.db.QueryRow(query)
+	return row, nil
+}
+
+func (r *UserRepository) DeleteUser(userID string) error {
+	// Vulnerable: userID concatenated without parameterization
+	query := fmt.Sprintf("DELETE FROM users WHERE id = %s", userID)
+	_, err := r.db.Exec(query)
+	return err
+}

package/dist/packages/crucible/seeds/go/seed-010.go

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection in login handler via fmt.Sprintf with username and password
+
+package handlers
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+)
+
+type AuthHandler struct {
+	DB *sql.DB
+}
+
+func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+
+	// Vulnerable: both form values injected into SQL via fmt.Sprintf
+	query := fmt.Sprintf(
+		"SELECT id FROM users WHERE username='%s' AND password='%s'",
+		username, password)
+	row := h.DB.QueryRow(query)
+
+	var id int
+	if err := row.Scan(&id); err == nil {
+		http.Redirect(w, r, "/dashboard", http.StatusFound)
+	} else {
+		http.Redirect(w, r, "/login?error=1", http.StatusFound)
+	}
+}

package/dist/packages/crucible/seeds/go/seed-011.go

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection via string concatenation in ORDER BY clause with user sort param
+
+package repository
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+type ProductRepository struct {
+	DB *sql.DB
+}
+
+func (r *ProductRepository) SearchProducts(keyword, sortCol, sortDir string) (*sql.Rows, error) {
+	// Vulnerable: sortCol and sortDir injected without allowlist validation
+	query := fmt.Sprintf(
+		"SELECT name, price FROM products WHERE name LIKE '%%%s%%' ORDER BY %s %s",
+		keyword, sortCol, sortDir)
+	return r.DB.Query(query)
+}

package/dist/packages/crucible/seeds/go/seed-012.go

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection via fmt.Sprintf with dynamic table name from user input
+
+package repository
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+type ReportRepository struct {
+	DB *sql.DB
+}
+
+func (r *ReportRepository) GetReport(reportType, startDate, endDate string) (*sql.Rows, error) {
+	// Vulnerable: reportType used as table name; cannot use placeholder for identifiers
+	query := fmt.Sprintf(
+		"SELECT * FROM %s WHERE created_at BETWEEN '%s' AND '%s'",
+		reportType, startDate, endDate)
+	return r.DB.Query(query)
+}