npm - thuban - Versions diffs - 0.3.4 → 0.4.0 - Mend

thuban 0.3.4 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (918) hide show

package/dist/packages/crucible/seeds/go/seed-013.go ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection in IN clause via string join of user-supplied IDs
+package repository
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+)
+type OrderRepository struct {
+	DB *sql.DB
+}
+func (r *OrderRepository) GetOrdersByIDs(rawIDs string) (*sql.Rows, error) {
+	// Vulnerable: rawIDs (e.g. "1,2,3") injected directly into IN clause
+	query := fmt.Sprintf("SELECT * FROM orders WHERE id IN (%s)", rawIDs)
+	return r.DB.Query(query)
+}
+func (r *OrderRepository) BulkUpdateStatus(ids []string, status string) error {
+	// Vulnerable: ids joined and injected without parameterization
+	query := fmt.Sprintf("UPDATE orders SET status='%s' WHERE id IN (%s)",
+		status, strings.Join(ids, ","))
+	_, err := r.DB.Exec(query)
+	return err
+}

package/dist/packages/crucible/seeds/go/seed-014.go ADDED Viewed

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection via fmt.Sprintf in multi-column search query
+package handlers
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+)
+type SearchHandler struct {
+	DB *sql.DB
+}
+func (h *SearchHandler) Search(w http.ResponseWriter, r *http.Request) {
+	name  := r.URL.Query().Get("name")
+	email := r.URL.Query().Get("email")
+	dept  := r.URL.Query().Get("dept")
+	// Vulnerable: three URL query params injected via fmt.Sprintf
+	query := fmt.Sprintf(
+		"SELECT * FROM employees WHERE name LIKE '%%%s%%' AND email='%s' AND dept='%s'",
+		name, email, dept)
+	rows, err := h.DB.Query(query)
+	if err != nil {
+		http.Error(w, "Query error", 500)
+		return
+	}
+	defer rows.Close()
+	fmt.Fprintf(w, "Results fetched: %v", rows)
+}

package/dist/packages/crucible/seeds/go/seed-015.go ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: go
+// expected: SQL injection via string concatenation building INSERT statement with user data
+package repository
+import (
+	"database/sql"
+	"fmt"
+)
+type CommentRepository struct {
+	DB *sql.DB
+}
+func (r *CommentRepository) InsertComment(author, body, postID string) error {
+	// Vulnerable: all three values concatenated into INSERT statement
+	query := fmt.Sprintf(
+		"INSERT INTO comments (author, body, post_id) VALUES ('%s', '%s', %s)",
+		author, body, postID)
+	_, err := r.DB.Exec(query)
+	return err
+}

package/dist/packages/crucible/seeds/go/seed-016.go ADDED Viewed

@@ -0,0 +1,19 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: XSS via fmt.Fprintf to http.ResponseWriter with unescaped query parameter
+package handlers
+import (
+	"fmt"
+	"net/http"
+)
+func GreetHandler(w http.ResponseWriter, r *http.Request) {
+	name := r.URL.Query().Get("name")
+	w.Header().Set("Content-Type", "text/html")
+	// Vulnerable: name reflected directly into HTML without html.EscapeString
+	fmt.Fprintf(w, "<html><body><h1>Hello, %s!</h1><p>Welcome back.</p></body></html>", name)
+}

package/dist/packages/crucible/seeds/go/seed-017.go ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: XSS via fmt.Fprintf reflecting search query into HTML page
+package handlers
+import (
+	"fmt"
+	"net/http"
+)
+func SearchResultsHandler(w http.ResponseWriter, r *http.Request) {
+	query := r.URL.Query().Get("q")
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	// Vulnerable: query injected into both meta tag and page body
+	fmt.Fprintf(w, `<!DOCTYPE html><html><head>
+<meta name="description" content="Results for: %s">
+</head><body>
+<h2>Search results for: <em>%s</em></h2>
+</body></html>`, query, query)
+}

package/dist/packages/crucible/seeds/go/seed-018.go ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: XSS via io.WriteString writing raw user input into HTTP response
+package handlers
+import (
+	"io"
+	"net/http"
+)
+func ErrorHandler(w http.ResponseWriter, r *http.Request) {
+	msg  := r.URL.Query().Get("message")
+	code := r.URL.Query().Get("code")
+	w.Header().Set("Content-Type", "text/html")
+	w.WriteHeader(http.StatusBadRequest)
+	// Vulnerable: both params written raw to response
+	io.WriteString(w, `<div class="alert alert-danger">`)
+	io.WriteString(w, "Error "+code+": "+msg)
+	io.WriteString(w, `</div><a href="/">Return home</a>`)
+}

package/dist/packages/crucible/seeds/go/seed-019.go ADDED Viewed

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: XSS via w.Write injecting user input into inline JavaScript variable
+package handlers
+import (
+	"fmt"
+	"net/http"
+)
+func ProfileHandler(w http.ResponseWriter, r *http.Request) {
+	username := r.URL.Query().Get("user")
+	nextURL  := r.URL.Query().Get("next")
+	w.Header().Set("Content-Type", "text/html")
+	// Vulnerable: both values injected into inline JS without escaping
+	script := fmt.Sprintf("<script>var user = \"%s\"; var nextUrl = \"%s\"; window.location = nextUrl;</script>",
+		username, nextURL)
+	fmt.Fprint(w, "<html><head>"+script+"</head><body></body></html>")
+}

package/dist/packages/crucible/seeds/go/seed-020.go ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: Stored XSS — comment body stored and reflected without HTML escaping
+package handlers
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+)
+type CommentHandler struct {
+	DB *sql.DB
+}
+func (h *CommentHandler) ListComments(w http.ResponseWriter, r *http.Request) {
+	rows, _ := h.DB.Query("SELECT author, body FROM comments ORDER BY id DESC LIMIT 20")
+	defer rows.Close()
+	w.Header().Set("Content-Type", "text/html")
+	fmt.Fprint(w, "<html><body>")
+	for rows.Next() {
+		var author, body string
+		rows.Scan(&author, &body)
+		// Vulnerable: stored comment body reflected without html.EscapeString
+		fmt.Fprintf(w, "<div><b>%s</b>: %s</div>", author, body)
+	}
+	fmt.Fprint(w, "</body></html>")
+}

package/dist/packages/crucible/seeds/go/seed-021.go ADDED Viewed

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: go
+// expected: XSS via fmt.Fprintf embedding Referer header into HTML response
+package handlers
+import (
+	"fmt"
+	"net/http"
+)
+func ThankYouHandler(w http.ResponseWriter, r *http.Request) {
+	// Vulnerable: Referer header reflected directly into page without encoding
+	referer := r.Header.Get("Referer")
+	w.Header().Set("Content-Type", "text/html")
+	fmt.Fprintf(w, `<!DOCTYPE html><html><body>
+<p>You came from: %s</p>
+<p>Thank you for visiting!</p>
+</body></html>`, referer)
+}

package/dist/packages/crucible/seeds/go/seed-022.go ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: go
+// expected: XSS via template.HTML conversion bypassing Go's html/template auto-escaping
+package handlers
+import (
+	"html/template"
+	"net/http"
+)
+var badTmpl = template.Must(template.New("badge").Parse(
+	`<html><body>{{.Content}}</body></html>`))
+type BadgeData struct {
+	Content template.HTML
+}
+func BadgeHandler(w http.ResponseWriter, r *http.Request) {
+	label := r.URL.Query().Get("label")
+	color := r.URL.Query().Get("color")
+	// Vulnerable: casting to template.HTML bypasses auto-escaping
+	composed := template.HTML(
+		"<span style=\"background:" + color + "\">" + label + "</span>")
+	w.Header().Set("Content-Type", "text/html")
+	badTmpl.Execute(w, BadgeData{Content: composed})
+}

package/dist/packages/crucible/seeds/go/seed-023.go ADDED Viewed

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command with user-controlled string passed to shell
+package handlers
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+func PingHandler(w http.ResponseWriter, r *http.Request) {
+	host := r.URL.Query().Get("host")
+	// Vulnerable: host injected into shell command via /bin/sh -c
+	cmd := exec.Command("/bin/sh", "-c", "ping -c 4 "+host)
+	out, err := cmd.Output()
+	if err != nil {
+		http.Error(w, "Error: "+err.Error(), 500)
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain")
+	fmt.Fprintf(w, "%s", out)
+}

package/dist/packages/crucible/seeds/go/seed-024.go ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command with user-controlled filename in ffmpeg call
+package handlers
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+func ConvertHandler(w http.ResponseWriter, r *http.Request) {
+	input  := r.URL.Query().Get("input")
+	output := r.URL.Query().Get("output")
+	// Vulnerable: both params injected into shell command string
+	cmdStr := fmt.Sprintf("ffmpeg -i /uploads/%s /output/%s", input, output)
+	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		http.Error(w, string(out), 500)
+		return
+	}
+	fmt.Fprintf(w, "Done: %s", out)
+}

package/dist/packages/crucible/seeds/go/seed-025.go ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via strings.Split on user input passed to exec.Command
+package services
+import (
+	"os/exec"
+	"strings"
+)
+type ScriptRunner struct {
+	ScriptDir string
+}
+func (s *ScriptRunner) Run(userCommand string) ([]byte, error) {
+	// Vulnerable: splitting user input and passing as command + args
+	parts := strings.Split(userCommand, " ")
+	cmd   := exec.Command(s.ScriptDir+"/"+parts[0], parts[1:]...)
+	return cmd.Output()
+}

package/dist/packages/crucible/seeds/go/seed-026.go ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command passing user-supplied archive name to unzip
+package handlers
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+const archiveDir = "/var/archives/"
+const outputDir  = "/var/output/"
+func ExtractHandler(w http.ResponseWriter, r *http.Request) {
+	archive := r.URL.Query().Get("archive")
+	dest    := r.URL.Query().Get("dest")
+	// Vulnerable: archive and dest injected into unzip shell command
+	cmdStr  := fmt.Sprintf("unzip %s%s -d %s%s", archiveDir, archive, outputDir, dest)
+	cmd     := exec.Command("/bin/bash", "-c", cmdStr)
+	if err   := cmd.Run(); err != nil {
+		http.Error(w, "Extraction failed", 500)
+		return
+	}
+	fmt.Fprint(w, "Extracted successfully")
+}

package/dist/packages/crucible/seeds/go/seed-027.go ADDED Viewed

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command running nslookup with unsanitized domain
+package handlers
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+func DnsLookupHandler(w http.ResponseWriter, r *http.Request) {
+	domain := r.URL.Query().Get("domain")
+	// Vulnerable: domain passed via shell -c enables injection
+	cmd    := exec.Command("/bin/sh", "-c", "nslookup "+domain)
+	out, err := cmd.Output()
+	if err != nil {
+		http.Error(w, "Lookup failed", 500)
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain")
+	fmt.Fprintf(w, "%s", out)
+}

package/dist/packages/crucible/seeds/go/seed-028.go ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command with user-supplied email in sendmail call
+package services
+import (
+	"fmt"
+	"os/exec"
+)
+type Mailer struct {
+	ReportBasePath string
+}
+func (m *Mailer) SendReport(email, reportName string) error {
+	// Vulnerable: email not sanitized before shell injection via sendmail
+	cmdStr := fmt.Sprintf("sendmail %s < %s/%s", email, m.ReportBasePath, reportName)
+	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
+	return cmd.Run()
+}

package/dist/packages/crucible/seeds/go/seed-029.go ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via os.Open with user-supplied filename concatenated to base path
+package handlers
+import (
+	"io"
+	"net/http"
+	"os"
+)
+const uploadDir = "/var/app/uploads/"
+func DownloadHandler(w http.ResponseWriter, r *http.Request) {
+	filename := r.URL.Query().Get("file")
+	// Vulnerable: filename not normalized; ../../etc/passwd traversal possible
+	f, err := os.Open(uploadDir + filename)
+	if err != nil {
+		http.Error(w, "File not found", 404)
+		return
+	}
+	defer f.Close()
+	w.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
+	io.Copy(w, f)
+}

package/dist/packages/crucible/seeds/go/seed-030.go ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via ioutil.ReadFile with unvalidated user path component
+package handlers
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+const configRoot = "/etc/appservice/configs/"
+func ConfigHandler(w http.ResponseWriter, r *http.Request) {
+	name := r.URL.Query().Get("name")
+	// Vulnerable: name allows traversal (e.g. ../../etc/shadow)
+	data, err := ioutil.ReadFile(configRoot + name + ".json")
+	if err != nil {
+		http.Error(w, "Config not found", 404)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	fmt.Fprintf(w, "%s", data)
+}

package/dist/packages/crucible/seeds/go/seed-031.go ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via filepath.Join without verifying result is within base directory
+package handlers
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+)
+const templateRoot = "/opt/app/templates"
+func TemplateHandler(w http.ResponseWriter, r *http.Request) {
+	tmpl := r.URL.Query().Get("template")
+	// Vulnerable: filepath.Join does not prevent traversal if tmpl starts with /
+	fullPath := filepath.Join(templateRoot, tmpl)
+	data, err := os.ReadFile(fullPath)
+	if err != nil {
+		http.Error(w, "Template not found", 404)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html")
+	w.Write(data)
+}

package/dist/packages/crucible/seeds/go/seed-032.go ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal in file delete endpoint with user-controlled relative path
+package handlers
+import (
+	"fmt"
+	"net/http"
+	"os"
+)
+const uploadRoot = "/var/uploads/"
+func DeleteHandler(w http.ResponseWriter, r *http.Request) {
+	rel := r.URL.Query().Get("path")
+	// Vulnerable: rel can traverse outside uploadRoot via ../
+	target := uploadRoot + rel
+	err := os.Remove(target)
+	if err != nil {
+		http.Error(w, "Delete failed: "+err.Error(), 500)
+		return
+	}
+	fmt.Fprintf(w, `{"deleted":true,"path":"%s"}`, target)
+}

package/dist/packages/crucible/seeds/go/seed-033.go ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal in file write with user-supplied output filename
+package handlers
+import (
+	"io"
+	"net/http"
+	"os"
+)
+const reportBase = "/var/reports/"
+func SaveReportHandler(w http.ResponseWriter, r *http.Request) {
+	reportName := r.URL.Query().Get("name")
+	// Vulnerable: reportName can escape reportBase (e.g. ../../etc/cron.d/backdoor)
+	outPath := reportBase + reportName + ".txt"
+	f, err  := os.Create(outPath)
+	if err != nil {
+		http.Error(w, "Cannot create file", 500)
+		return
+	}
+	defer f.Close()
+	io.Copy(f, r.Body)
+	io.WriteString(w, "Saved: "+outPath)
+}

package/dist/packages/crucible/seeds/go/seed-034.go ADDED Viewed

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: MD5 used for password hashing via crypto/md5
+package security
+import (
+	"crypto/md5"
+	"fmt"
+)
+// Vulnerable: MD5 is cryptographically broken and unsalted
+func HashPassword(password string) string {
+	hash := md5.Sum([]byte(password))
+	return fmt.Sprintf("%x", hash)
+}
+func VerifyPassword(password, storedHash string) bool {
+	return HashPassword(password) == storedHash
+}

package/dist/packages/crucible/seeds/go/seed-035.go ADDED Viewed

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: math/rand used instead of crypto/rand for security token generation
+package security
+import (
+	"math/rand"
+	"time"
+)
+const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+func init() {
+	// Vulnerable: seeding math/rand with time is predictable
+	rand.Seed(time.Now().UnixNano())
+}
+// Vulnerable: math/rand is not cryptographically secure
+func GenerateToken(length int) string {
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = alphabet[rand.Intn(len(alphabet))]
+	}
+	return string(b)
+}
+func GenerateSessionID() string  { return GenerateToken(32) }
+func GenerateCSRFToken() string  { return GenerateToken(24) }
+func GenerateResetToken() string { return GenerateToken(40) }

package/dist/packages/crucible/seeds/go/seed-036.go ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: SHA1 used for HMAC signing and MD5 for file integrity verification
+package security
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/sha1"
+	"encoding/hex"
+)
+// Vulnerable: HMAC-SHA1 is weak for new applications
+func SignHMAC(data, key string) string {
+	mac := hmac.New(sha1.New, []byte(key))
+	mac.Write([]byte(data))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+// Vulnerable: MD5 for file integrity — susceptible to collision attacks
+func FileChecksum(data []byte) string {
+	hash := md5.Sum(data)
+	return hex.EncodeToString(hash[:])
+}