thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/java/seed-008.java

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded OAuth2 client secret in Spring Security configuration
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.core.AuthorizationGrantType;
+
+@Configuration
+public class OAuth2Config {
+    private static final String CLIENT_ID     = "my-app-client-id-prod";
+    private static final String CLIENT_SECRET = "oauth2-client-secret-xK9mP2qR7wZ4";
+
+    @Bean
+    public ClientRegistration googleClientRegistration() {
+        return ClientRegistration.withRegistrationId("google")
+            .clientId(CLIENT_ID)
+            .clientSecret(CLIENT_SECRET)
+            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
+            .scope("openid", "profile", "email")
+            .authorizationUri("https://accounts.google.com/o/oauth2/auth")
+            .tokenUri("https://oauth2.googleapis.com/token")
+            .build();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-009.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection via string concatenation in executeQuery
+
+import java.sql.*;
+
+public class UserRepository {
+    private Connection conn;
+
+    public ResultSet findByUsername(String username) throws SQLException {
+        // Vulnerable: direct string concatenation into SQL
+        String query = "SELECT * FROM users WHERE username = '" + username + "'";
+        Statement stmt = conn.createStatement();
+        return stmt.executeQuery(query);
+    }
+
+    public boolean deleteUser(String userId) throws SQLException {
+        String sql = "DELETE FROM users WHERE id = " + userId;
+        Statement stmt = conn.createStatement();
+        return stmt.executeUpdate(sql) > 0;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-010.java

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection via string concatenation in login query
+
+import java.sql.*;
+import javax.servlet.http.*;
+
+public class LoginServlet extends HttpServlet {
+    private Connection conn;
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        String user = req.getParameter("username");
+        String pass = req.getParameter("password");
+
+        // Vulnerable: both parameters concatenated directly
+        String sql = "SELECT id FROM accounts WHERE username='" + user +
+                     "' AND password='" + pass + "'";
+        Statement st = conn.createStatement();
+        ResultSet rs = st.executeQuery(sql);
+        if (rs.next()) {
+            req.getSession().setAttribute("userId", rs.getInt("id"));
+            resp.sendRedirect("/dashboard");
+        } else {
+            resp.sendRedirect("/login?error=1");
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-011.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection via String.format building ORDER BY clause
+
+import java.sql.*;
+import java.util.ArrayList;
+import java.util.List;
+
+public class ProductSearch {
+    private Connection conn;
+
+    public List<String> searchProducts(String keyword, String sortColumn) throws SQLException {
+        // Vulnerable: sortColumn injected into ORDER BY without validation
+        String sql = String.format(
+            "SELECT name FROM products WHERE name LIKE '%%%s%%' ORDER BY %s",
+            keyword, sortColumn);
+        Statement stmt = conn.createStatement();
+        ResultSet rs = stmt.executeQuery(sql);
+        List<String> results = new ArrayList<>();
+        while (rs.next()) results.add(rs.getString("name"));
+        return results;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-012.java

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection through dynamic table name construction
+
+import java.sql.*;
+
+public class ReportGenerator {
+    private Connection conn;
+
+    public ResultSet generateReport(String reportType, String startDate, String endDate)
+            throws SQLException {
+        // Vulnerable: reportType used as table name without sanitization
+        String query = "SELECT * FROM " + reportType +
+                       " WHERE created_at BETWEEN '" + startDate + "' AND '" + endDate + "'";
+        Statement stmt = conn.createStatement();
+        return stmt.executeQuery(query);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-013.java

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection in search with multiple concatenated parameters
+
+import java.sql.*;
+import javax.servlet.http.*;
+
+public class SearchServlet extends HttpServlet {
+    private Connection conn;
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        String name  = req.getParameter("name");
+        String email = req.getParameter("email");
+        String role  = req.getParameter("role");
+
+        // Vulnerable: three user params concatenated
+        String query = "SELECT * FROM employees WHERE name LIKE '%" + name +
+                       "%' AND email = '" + email + "' AND role = '" + role + "'";
+        Statement stmt = conn.createStatement();
+        ResultSet rs = stmt.executeQuery(query);
+        // ... render results
+    }
+}

package/dist/packages/crucible/seeds/java/seed-014.java

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection via stored procedure call with string concatenation
+
+import java.sql.*;
+
+public class AuditLogger {
+    private Connection conn;
+
+    public void logEvent(String userId, String action, String detail) throws SQLException {
+        // Vulnerable: detail field concatenated into EXEC call
+        String sql = "EXEC sp_log_audit '" + userId + "', '" + action + "', '" + detail + "'";
+        Statement stmt = conn.createStatement();
+        stmt.execute(sql);
+    }
+
+    public ResultSet getAuditTrail(String fromDate) throws SQLException {
+        String query = "SELECT * FROM audit_log WHERE event_time >= '" + fromDate + "'";
+        return conn.createStatement().executeQuery(query);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-015.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: java
+// expected: SQL injection via IN clause built with user-supplied comma-separated IDs
+
+import java.sql.*;
+import java.util.List;
+
+public class BatchProcessor {
+    private Connection conn;
+
+    public ResultSet getOrdersByIds(String rawIds) throws SQLException {
+        // Vulnerable: rawIds (e.g. "1,2,3") injected directly into IN clause
+        String sql = "SELECT * FROM orders WHERE id IN (" + rawIds + ")";
+        Statement stmt = conn.createStatement();
+        return stmt.executeQuery(sql);
+    }
+
+    public int bulkUpdateStatus(String idList, String status) throws SQLException {
+        String sql = "UPDATE orders SET status='" + status +
+                     "' WHERE id IN (" + idList + ")";
+        return conn.createStatement().executeUpdate(sql);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-016.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via PrintWriter writing unescaped request parameter to response
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class GreetingServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        String name = req.getParameter("name");
+        // Vulnerable: name reflected directly into HTML without encoding
+        out.println("<html><body>");
+        out.println("<h1>Hello, " + name + "!</h1>");
+        out.println("<p>Welcome back to our portal.</p>");
+        out.println("</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-017.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via response.getWriter writing unescaped search query into page
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class SearchResultsServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String query = req.getParameter("q");
+        PrintWriter pw = resp.getWriter();
+        resp.setContentType("text/html; charset=UTF-8");
+        // Vulnerable: raw query injected into meta and visible output
+        pw.write("<!DOCTYPE html><html><head>");
+        pw.write("<meta name=\"description\" content=\"Results for: " + query + "\">");
+        pw.write("</head><body>");
+        pw.write("<h2>Search results for: <em>" + query + "</em></h2>");
+        pw.write("<div id=\"results\"><!-- results here --></div>");
+        pw.write("</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-018.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via JSP-style out.print with unescaped error message from request
+
+import java.io.*;
+import javax.servlet.http.*;
+import javax.servlet.*;
+
+public class ErrorPageServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, ServletException {
+        String errorMsg = req.getParameter("message");
+        String code     = req.getParameter("code");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        // Vulnerable: both parameters written without sanitization
+        out.print("<div class=\"alert alert-danger\">");
+        out.print("Error " + code + ": " + errorMsg);
+        out.print("</div>");
+        out.print("<a href=\"/\">Return home</a>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-019.java

@@ -0,0 +1,38 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: Stored XSS — user-supplied comment written to DB then reflected without escaping
+
+import java.io.*;
+import java.sql.*;
+import javax.servlet.http.*;
+
+public class CommentServlet extends HttpServlet {
+    private Connection conn;
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, SQLException {
+        String comment  = req.getParameter("comment");
+        String username = req.getParameter("username");
+        // Store raw (vulnerable: no sanitization before storage)
+        PreparedStatement ps = conn.prepareStatement(
+            "INSERT INTO comments(username, body) VALUES (?, ?)");
+        ps.setString(1, username);
+        ps.setString(2, comment);
+        ps.executeUpdate();
+        resp.sendRedirect("/comments");
+    }
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, SQLException {
+        PrintWriter out = resp.getWriter();
+        ResultSet rs = conn.createStatement().executeQuery(
+            "SELECT username, body FROM comments ORDER BY id DESC LIMIT 20");
+        while (rs.next()) {
+            // Vulnerable: stored comment reflected without escaping
+            out.println("<div><b>" + rs.getString("username") + "</b>: "
+                + rs.getString("body") + "</div>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-020.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via JSON response that directly embeds user input in HTML script block
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ProfileServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String username    = req.getParameter("user");
+        String redirectUrl = req.getParameter("next");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        // Vulnerable: user input injected into inline JS
+        out.println("<script>");
+        out.println("var currentUser = \"" + username + "\";");
+        out.println("var nextUrl = \"" + redirectUrl + "\";");
+        out.println("window.location = nextUrl;");
+        out.println("</script>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-021.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: java
+// expected: XSS via setAttribute building HTML string with user input
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class BadgeServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String label = req.getParameter("label");
+        String color = req.getParameter("color");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        // Vulnerable: color and label injected into style/text attributes
+        String html = "<span style=\"background-color:" + color +
+                      "; padding:4px; border-radius:3px;\">" + label + "</span>";
+        out.println("<html><body>" + html + "</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-022.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via HttpServletResponse writer echoing HTTP Referer header
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ReferrerLogServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: Referer header reflected directly into HTML
+        String referer = req.getHeader("Referer");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        out.println("<!DOCTYPE html><html><body>");
+        out.println("<p>You came from: " + referer + "</p>");
+        out.println("<p>Thank you for visiting us!</p>");
+        out.println("</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-023.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-supplied filename
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileProcessorServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("filename");
+        // Vulnerable: filename injected into shell command via Runtime.exec
+        String cmd = "convert /uploads/" + filename + " /processed/" + filename + ".pdf";
+        Process proc = Runtime.getRuntime().exec(cmd);
+        int exitCode;
+        try { exitCode = proc.waitFor(); } catch (InterruptedException e) { exitCode = -1; }
+        PrintWriter out = resp.getWriter();
+        out.println("Exit: " + exitCode);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-024.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec array form with unsanitized user argument
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class PingServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String host = req.getParameter("host");
+        // Vulnerable: passing through shell with -c allows injection
+        String[] cmd = {"/bin/sh", "-c", "ping -c 4 " + host};
+        Process proc = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(
+            new InputStreamReader(proc.getInputStream()));
+        PrintWriter out = resp.getWriter();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.println(line + "<br>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-025.java

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via ProcessBuilder with user-controlled arguments
+
+import java.io.*;
+import java.util.Arrays;
+import javax.servlet.http.*;
+
+public class ImageResizerServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String inputFile  = req.getParameter("input");
+        String width      = req.getParameter("width");
+        String height     = req.getParameter("height");
+        // Vulnerable: width/height not validated, passed to shell via ProcessBuilder
+        ProcessBuilder pb = new ProcessBuilder(
+            "/bin/sh", "-c",
+            "ffmpeg -i " + inputFile + " -vf scale=" + width + ":" + height + " out.mp4");
+        pb.redirectErrorStream(true);
+        Process p = pb.start();
+        PrintWriter out = resp.getWriter();
+        new BufferedReader(new InputStreamReader(p.getInputStream()))
+            .lines().forEach(l -> out.println(l));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-026.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-supplied email address
+
+import java.io.*;
+
+public class MailSender {
+    public void sendReport(String email, String reportPath) throws IOException {
+        // Vulnerable: email address concatenated directly into sendmail command
+        String command = "sendmail -v " + email + " < " + reportPath;
+        Process proc = Runtime.getRuntime().exec(
+            new String[]{"/bin/sh", "-c", command});
+        try {
+            proc.waitFor();
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    public static void main(String[] args) throws IOException {
+        new MailSender().sendReport(args[0], "/reports/monthly.txt");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-027.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-controlled zip archive name
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ArchiveServlet extends HttpServlet {
+    private static final String ARCHIVE_DIR = "/var/archives/";
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String archiveName = req.getParameter("name");
+        String targetDir   = req.getParameter("dir");
+        // Vulnerable: both parameters injected into unzip command
+        String cmd = "unzip " + ARCHIVE_DIR + archiveName + " -d " + targetDir;
+        Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
+        resp.getWriter().println("Extracting archive...");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-028.java

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec nslookup with user-supplied domain
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class DnsLookupServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String domain = req.getParameter("domain");
+        // Vulnerable: domain not sanitized before exec
+        Process proc = Runtime.getRuntime().exec("nslookup " + domain);
+        InputStream is = proc.getInputStream();
+        byte[] buf = is.readAllBytes();
+        resp.setContentType("text/plain");
+        resp.getWriter().write(new String(buf));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-029.java

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via new File(basePath + userInput) without normalization
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileDownloadServlet extends HttpServlet {
+    private static final String BASE_DIR = "/var/app/uploads/";
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("file");
+        // Vulnerable: no normalization or containment check
+        File file = new File(BASE_DIR + filename);
+        resp.setContentType("application/octet-stream");
+        resp.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");
+        try (FileInputStream fis = new FileInputStream(file)) {
+            byte[] buf = new byte[4096];
+            int n;
+            while ((n = fis.read(buf)) != -1) {
+                resp.getOutputStream().write(buf, 0, n);
+            }
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-030.java

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via FileInputStream constructed from user-supplied path
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ConfigViewerServlet extends HttpServlet {
+    private static final String CONFIG_ROOT = "/etc/app/configs/";
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String configName = req.getParameter("config");
+        // Vulnerable: traversal allows reading arbitrary files (e.g. ../../etc/passwd)
+        FileInputStream fis = new FileInputStream(CONFIG_ROOT + configName);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(fis));
+        PrintWriter out = resp.getWriter();
+        resp.setContentType("text/plain");
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.println(line);
+        }
+        fis.close();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-031.java

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via Paths.get with user input enabling directory escape
+
+import java.io.*;
+import java.nio.file.*;
+import javax.servlet.http.*;
+
+public class TemplateServlet extends HttpServlet {
+    private static final Path TEMPLATE_DIR = Paths.get("/opt/app/templates");
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String templateName = req.getParameter("template");
+        // Vulnerable: resolve without startsWith check allows traversal
+        Path templatePath = TEMPLATE_DIR.resolve(templateName);
+        byte[] content = Files.readAllBytes(templatePath);
+        resp.setContentType("text/html");
+        resp.getOutputStream().write(content);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-032.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal in file delete endpoint with user-controlled filename
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileManagerServlet extends HttpServlet {
+    private static final String UPLOAD_DIR = "/var/uploads/";
+
+    protected void doDelete(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("name");
+        // Vulnerable: attacker can delete arbitrary files via ../
+        File target = new File(UPLOAD_DIR + filename);
+        boolean deleted = target.delete();
+        resp.setContentType("application/json");
+        resp.getWriter().println("{\"deleted\":" + deleted + "}");
+    }
+}