npm - thuban - Versions diffs - 0.3.4 → 0.4.1 - Mend

thuban 0.3.4 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (739) hide show

package/dist/packages/crucible/seeds/kotlin/seed-014.kt ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: kotlin
+// expected: SQL injection via Room @RawQuery with user-controlled SimpleSQLiteQuery
+package com.example.db
+import androidx.room.Dao
+import androidx.room.RawQuery
+import androidx.sqlite.db.SimpleSQLiteQuery
+import androidx.sqlite.db.SupportSQLiteQuery
+@Dao
+abstract class AnalyticsDao {
+    @RawQuery
+    abstract fun runRawQuery(query: SupportSQLiteQuery): List<Map<String, Any>>
+    fun getMetrics(dimension: String, filter: String): List<Map<String, Any>> {
+        val sql = "SELECT $dimension, COUNT(*) as cnt FROM events WHERE $filter GROUP BY $dimension"
+        return runRawQuery(SimpleSQLiteQuery(sql))
+    }
+    fun customReport(whereClause: String): List<Map<String, Any>> {
+        return runRawQuery(SimpleSQLiteQuery("SELECT * FROM analytics WHERE $whereClause"))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-015.kt ADDED Viewed

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Multi-table SQL built dynamically from unvalidated user-supplied table name
+package com.example.db
+import android.database.sqlite.SQLiteDatabase
+class DynamicQueryBuilder(private val db: SQLiteDatabase) {
+    fun queryTable(tableName: String, columnFilter: String, value: String): android.database.Cursor {
+        val sql = "SELECT * FROM $tableName WHERE $columnFilter = '$value'"
+        return db.rawQuery(sql, null)
+    }
+    fun countRows(tableName: String, condition: String): Int {
+        val cursor = db.rawQuery("SELECT COUNT(*) FROM $tableName WHERE $condition", null)
+        cursor.moveToFirst()
+        val count = cursor.getInt(0)
+        cursor.close()
+        return count
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-016.kt ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadData with unsanitized user HTML content
+package com.example.ui
+import android.webkit.WebView
+import android.webkit.WebViewClient
+class HelpFragment {
+    private lateinit var webView: WebView
+    fun displayUserContent(userHtml: String) {
+        webView.settings.javaScriptEnabled = true
+        webView.loadData(userHtml, "text/html", "UTF-8")
+    }
+    fun loadUserProfile(name: String, bio: String) {
+        val html = "<html><body><h1>$name</h1><p>$bio</p></body></html>"
+        webView.loadData(html, "text/html", null)
+    }
+    fun renderTemplate(template: String, userInput: String): String {
+        return template.replace("{USER_INPUT}", userInput)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-017.kt ADDED Viewed

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: addJavascriptInterface exposes arbitrary Java object to WebView JavaScript
+package com.example.ui
+import android.webkit.JavascriptInterface
+import android.webkit.WebView
+class WebAppInterface(private val handler: AppHandler) {
+    @JavascriptInterface
+    fun executeAction(action: String, payload: String): String {
+        return handler.handle(action, payload)
+    }
+    @JavascriptInterface
+    fun getUserData(key: String): String {
+        return handler.getData(key)
+    }
+    @JavascriptInterface
+    fun runNativeCode(command: String): Boolean {
+        return handler.executeNative(command)
+    }
+}
+fun setupWebView(webView: WebView, handler: AppHandler) {
+    webView.settings.javaScriptEnabled = true
+    webView.addJavascriptInterface(WebAppInterface(handler), "Android")
+    webView.addJavascriptInterface(handler, "NativeHandler")
+}

package/dist/packages/crucible/seeds/kotlin/seed-018.kt ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadUrl with javascript: scheme from user-controlled intent data
+package com.example.deeplink
+import android.app.Activity
+import android.webkit.WebView
+class DeepLinkActivity : Activity() {
+    private lateinit var webView: WebView
+    override fun onResume() {
+        super.onResume()
+        val url = intent.getStringExtra("url") ?: intent.data?.toString() ?: ""
+        webView.settings.javaScriptEnabled = true
+        webView.loadUrl(url)
+    }
+    fun handleExternalLink(link: String) {
+        if (link.isNotEmpty()) {
+            webView.loadUrl(link)
+        }
+    }
+    fun injectScript(script: String) {
+        webView.loadUrl("javascript:$script")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-019.kt ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: kotlin
+// expected: WebView evaluateJavascript with unsanitized user string
+package com.example.ui
+import android.webkit.WebView
+class DashboardFragment {
+    private lateinit var webView: WebView
+    fun updateChart(jsonData: String) {
+        webView.settings.javaScriptEnabled = true
+        webView.evaluateJavascript("updateChart($jsonData)", null)
+    }
+    fun setUserName(name: String) {
+        webView.evaluateJavascript("document.getElementById('name').innerHTML = '$name'", null)
+    }
+    fun executeUserScript(script: String) {
+        webView.evaluateJavascript(script) { result ->
+            println("Script result: $result")
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-020.kt ADDED Viewed

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadDataWithBaseURL with user-controlled base URL and unescaped content
+package com.example.browser
+import android.webkit.WebView
+class ArticleViewer {
+    private lateinit var webView: WebView
+    fun displayArticle(baseUrl: String, content: String, title: String) {
+        val html = """
+            <html>
+            <head><title>$title</title></head>
+            <body>$content</body>
+            </html>
+        """.trimIndent()
+        webView.settings.javaScriptEnabled = true
+        webView.loadDataWithBaseURL(baseUrl, html, "text/html", "UTF-8", null)
+    }
+    fun renderMarkdown(userMarkdown: String) {
+        val html = "<html><body>${convertToHtml(userMarkdown)}</body></html>"
+        webView.loadDataWithBaseURL("https://trusted.example.com", html, "text/html", "UTF-8", null)
+    }
+    private fun convertToHtml(md: String) = md
+}

package/dist/packages/crucible/seeds/kotlin/seed-021.kt ADDED Viewed

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: Ktor server-side XSS via unescaped user parameter in HTML response
+package com.example.server
+import io.ktor.server.application.*
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+fun Application.configureRoutes() {
+    routing {
+        get("/greet") {
+            val name = call.parameters["name"] ?: "Guest"
+            val html = """
+                <html>
+                <body>
+                    <h1>Hello, $name!</h1>
+                    <p>Welcome to our portal.</p>
+                    <script>var user = "$name";</script>
+                </body>
+                </html>
+            """.trimIndent()
+            call.respondText(html, io.ktor.http.ContentType.Text.Html)
+        }
+        get("/search") {
+            val query = call.parameters["q"] ?: ""
+            call.respondText("<p>Results for: $query</p>", io.ktor.http.ContentType.Text.Html)
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-022.kt ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: kotlin
+// expected: allowUniversalAccessFromFileURLs enables cross-origin reads from file:// URLs
+package com.example.ui
+import android.webkit.WebView
+import android.webkit.WebSettings
+class DocumentViewer {
+    fun setupWebView(webView: WebView, filePath: String) {
+        webView.settings.apply {
+            javaScriptEnabled = true
+            allowFileAccess = true
+            allowContentAccess = true
+            allowFileAccessFromFileURLs = true
+            allowUniversalAccessFromFileURLs = true
+        }
+        webView.loadUrl("file://$filePath")
+    }
+    fun openLocalFile(webView: WebView, userPath: String) {
+        webView.settings.allowUniversalAccessFromFileURLs = true
+        webView.settings.javaScriptEnabled = true
+        webView.loadUrl("file:///data/user/0/com.example/$userPath")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-023.kt ADDED Viewed

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: kotlin
+// expected: Runtime.getRuntime().exec() with unsanitized user input
+package com.example.utils
+class ShellExecutor {
+    fun runCommand(userInput: String): String {
+        val process = Runtime.getRuntime().exec("ping -c 1 $userInput")
+        return process.inputStream.bufferedReader().readText()
+    }
+    fun convertFile(inputPath: String, outputPath: String): Int {
+        val cmd = "ffmpeg -i $inputPath $outputPath"
+        val proc = Runtime.getRuntime().exec(cmd)
+        return proc.waitFor()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-024.kt ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: kotlin
+// expected: ProcessBuilder with user-controlled command arguments via string split
+package com.example.utils
+class SystemUtility {
+    fun executeUserCommand(command: String): String {
+        val parts = command.split(" ")
+        val proc = ProcessBuilder(parts)
+            .redirectErrorStream(true)
+            .start()
+        return proc.inputStream.bufferedReader().readText()
+    }
+    fun runScript(scriptName: String, args: String): String {
+        val fullCmd = "/opt/scripts/$scriptName $args"
+        val process = Runtime.getRuntime().exec(arrayOf("/bin/sh", "-c", fullCmd))
+        return process.inputStream.bufferedReader().readText()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-025.kt ADDED Viewed

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: kotlin
+// expected: exec() with shell -c and user-controlled format string
+package com.example.media
+class ImageProcessor {
+    fun resizeImage(imagePath: String, width: String, height: String): Boolean {
+        val cmd = "convert $imagePath -resize ${width}x${height} output.jpg"
+        val process = Runtime.getRuntime().exec(arrayOf("/bin/sh", "-c", cmd))
+        return process.waitFor() == 0
+    }
+    fun generateThumbnail(source: String, dest: String, size: String): String {
+        val command = "ffmpeg -i \"$source\" -vf scale=$size \"$dest\""
+        val proc = Runtime.getRuntime().exec(arrayOf("sh", "-c", command))
+        val output = proc.inputStream.bufferedReader().readText()
+        val error = proc.errorStream.bufferedReader().readText()
+        return "$output\n$error"
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-026.kt ADDED Viewed

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: kotlin
+// expected: Runtime.exec() called with user-supplied filename from Intent extras
+package com.example.receiver
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+class TaskReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+        val filename = intent.getStringExtra("filename") ?: return
+        val operation = intent.getStringExtra("operation") ?: "cat"
+        try {
+            val proc = Runtime.getRuntime().exec("$operation /sdcard/$filename")
+            val output = proc.inputStream.bufferedReader().readText()
+            println("Result: $output")
+        } catch (e: Exception) {
+            e.printStackTrace()
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-027.kt ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: kotlin
+// expected: Ktor handler passes unsanitized query param to shell exec
+package com.example.server
+import io.ktor.server.application.*
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+fun Application.adminRoutes() {
+    routing {
+        get("/admin/ping") {
+            val host = call.parameters["host"] ?: "localhost"
+            val proc = Runtime.getRuntime().exec(arrayOf("/bin/sh", "-c", "ping -c 4 $host"))
+            val result = proc.inputStream.bufferedReader().readText()
+            call.respondText(result)
+        }
+        get("/admin/grep") {
+            val pattern = call.parameters["pattern"] ?: ""
+            val file = call.parameters["file"] ?: "/var/log/app.log"
+            val proc = Runtime.getRuntime().exec(arrayOf("grep", pattern, file))
+            call.respondText(proc.inputStream.bufferedReader().readText())
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-028.kt ADDED Viewed

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: kotlin
+// expected: Runtime.exec with user-controlled archive extraction path
+package com.example.archive
+import java.io.File
+class ArchiveHandler {
+    fun extractArchive(archiveName: String, destination: String): String {
+        val cmd = "tar -xzf /uploads/$archiveName -C $destination"
+        val process = Runtime.getRuntime().exec(arrayOf("/bin/sh", "-c", cmd))
+        process.waitFor()
+        return process.inputStream.bufferedReader().readText()
+    }
+    fun compressDirectory(dirPath: String, outputName: String): Boolean {
+        val command = "zip -r /tmp/$outputName $dirPath"
+        val proc = Runtime.getRuntime().exec(arrayOf("sh", "-c", command))
+        return proc.waitFor() == 0
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-029.kt ADDED Viewed

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: kotlin
+// expected: File path constructed from base + user input without normalization
+package com.example.files
+import java.io.File
+class FileService {
+    private val basePath = "/data/user/0/com.example/files/"
+    fun readUserFile(filename: String): String {
+        val file = File(basePath + filename)
+        return file.readText()
+    }
+    fun writeUserFile(filename: String, content: String) {
+        val file = File(basePath + filename)
+        file.writeText(content)
+    }
+    fun deleteUserFile(filename: String): Boolean {
+        return File(basePath + filename).delete()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-030.kt ADDED Viewed

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: kotlin
+// expected: File read from user-supplied path parameter without canonicalization
+package com.example.server
+import io.ktor.server.application.*
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+import java.io.File
+fun Application.fileRoutes() {
+    routing {
+        get("/files/{path...}") {
+            val path = call.parameters.getAll("path")?.joinToString("/") ?: ""
+            val file = File("/app/static/$path")
+            if (file.exists()) {
+                call.respondText(file.readText())
+            } else {
+                call.respondText("Not found", status = io.ktor.http.HttpStatusCode.NotFound)
+            }
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-031.kt ADDED Viewed

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: kotlin
+// expected: ZipEntry path not validated, enables zip-slip attack
+package com.example.archive
+import java.io.File
+import java.util.zip.ZipInputStream
+class ZipExtractor {
+    fun extract(zipPath: String, destDir: String) {
+        val zis = ZipInputStream(File(zipPath).inputStream())
+        var entry = zis.nextEntry
+        while (entry != null) {
+            val outputFile = File(destDir, entry.name)
+            if (entry.isDirectory) {
+                outputFile.mkdirs()
+            } else {
+                outputFile.parentFile?.mkdirs()
+                outputFile.outputStream().use { zis.copyTo(it) }
+            }
+            entry = zis.nextEntry
+        }
+        zis.close()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-032.kt ADDED Viewed

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: kotlin
+// expected: Download path constructed from user-controlled filename without sanitization
+package com.example.download
+import java.io.File
+import java.net.URL
+class DownloadManager {
+    private val downloadDir = "/sdcard/Download/"
+    fun downloadFile(url: String, filename: String) {
+        val dest = File(downloadDir + filename)
+        dest.parentFile?.mkdirs()
+        URL(url).openStream().use { input ->
+            dest.outputStream().use { output ->
+                input.copyTo(output)
+            }
+        }
+    }
+    fun saveAttachment(attachmentName: String, data: ByteArray) {
+        val file = File("/data/data/com.example/attachments/" + attachmentName)
+        file.writeBytes(data)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-033.kt ADDED Viewed

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: kotlin
+// expected: Intent-supplied file path used directly for file read without validation
+package com.example.viewer
+import android.app.Activity
+import android.os.Bundle
+import java.io.File
+class DocumentActivity : Activity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val filePath = intent.getStringExtra("file_path")
+        val subDir = intent.getStringExtra("sub_dir") ?: ""
+        if (filePath != null) {
+            val content = File(filesDir, subDir + filePath).readText()
+            displayContent(content)
+        }
+    }
+    fun serveFile(relativePath: String): ByteArray {
+        val resolved = File("/app/resources/" + relativePath)
+        return resolved.readBytes()
+    }
+    private fun displayContent(content: String) = println(content)
+}

package/dist/packages/crucible/seeds/kotlin/seed-034.kt ADDED Viewed

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: MD5 used for password hashing
+package com.example.auth
+import java.security.MessageDigest
+class PasswordService {
+    fun hashPassword(password: String): String {
+        val md = MessageDigest.getInstance("MD5")
+        val digest = md.digest(password.toByteArray())
+        return digest.joinToString("") { "%02x".format(it) }
+    }
+    fun verifyPassword(password: String, hash: String): Boolean {
+        return hashPassword(password) == hash
+    }
+    fun hashWithSalt(password: String, username: String): String {
+        val md = MessageDigest.getInstance("MD5")
+        return md.digest("$username:$password".toByteArray()).toString()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-035.kt ADDED Viewed

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: DES cipher used for encryption — weak key size (56-bit)
+package com.example.crypto
+import javax.crypto.Cipher
+import javax.crypto.SecretKeyFactory
+import javax.crypto.spec.DESKeySpec
+class LegacyEncryptor {
+    private val key = "AbCdEfGh"
+    fun encrypt(data: String): ByteArray {
+        val keySpec = DESKeySpec(key.toByteArray())
+        val keyFactory = SecretKeyFactory.getInstance("DES")
+        val secretKey = keyFactory.generateSecret(keySpec)
+        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
+        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
+        return cipher.doFinal(data.toByteArray())
+    }
+    fun decrypt(data: ByteArray): String {
+        val keySpec = DESKeySpec(key.toByteArray())
+        val keyFactory = SecretKeyFactory.getInstance("DES")
+        val secretKey = keyFactory.generateSecret(keySpec)
+        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
+        cipher.init(Cipher.DECRYPT_MODE, secretKey)
+        return String(cipher.doFinal(data))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-036.kt ADDED Viewed

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: Math.random() used for security-sensitive token generation
+package com.example.auth
+import kotlin.math.abs
+class TokenGenerator {
+    fun generateSessionToken(): String {
+        val chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+        return (1..32).map { chars[abs(Math.random() * chars.length).toInt()] }.joinToString("")
+    }
+    fun generateOtp(): String {
+        return String.format("%06d", (Math.random() * 1000000).toInt())
+    }
+    fun generateResetToken(): String {
+        val rand = (Math.random() * Long.MAX_VALUE).toLong()
+        return java.lang.Long.toHexString(rand)
+    }
+}