npm - thuban - Versions diffs - 0.3.4 → 0.4.1 - Mend

thuban 0.3.4 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (739) hide show

package/dist/packages/crucible/seeds/python/seed-015.py ADDED Viewed

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via Django extra()/RawSQL() with user input
+from django.db.models import RawSQL
+from django.http import JsonResponse
+from myapp.models import Product, Order
+def product_search(request):
+    search = request.GET.get("q", "")
+    price_filter = request.GET.get("max_price", "999999")
+    # extra() injects raw SQL directly — vulnerable to injection
+    products = Product.objects.extra(
+        where=["name ILIKE '%%%s%%'" % search, "price <= %s" % price_filter]
+    ).values("id", "name", "price")
+    return JsonResponse({"products": list(products)})
+def revenue_by_region(request):
+    group_field = request.GET.get("group_by", "region")
+    from django.db import connection
+    with connection.cursor() as cur:
+        # group_field from user — ORDER BY injection
+        cur.execute(
+            "SELECT %s, SUM(total) FROM orders GROUP BY %s" % (group_field, group_field)
+        )
+        rows = cur.fetchall()
+    return JsonResponse({"data": rows})

package/dist/packages/crucible/seeds/python/seed-016.py ADDED Viewed

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: critical
+# language: python
+# expected: XSS via Jinja2 render_template_string with user input and autoescape disabled
+from flask import Flask, request, render_template_string
+app = Flask(__name__)
+@app.route("/greet")
+def greet():
+    name = request.args.get("name", "Guest")
+    # render_template_string with user input — if autoescape is off, XSS is trivial
+    template = f"""
+    <!DOCTYPE html>
+    <html>
+      <head><title>Welcome</title></head>
+      <body>
+        <h1>Hello, {name}!</h1>
+        <p>Welcome to our platform.</p>
+      </body>
+    </html>
+    """
+    return render_template_string(template)
+@app.route("/search")
+def search():
+    query = request.args.get("q", "")
+    # Jinja2 template injection — attacker sends: {{config}} or {{''.__class__.__mro__}}
+    template = "<p>Results for: " + query + "</p><ul>{% for item in items %}<li>{{ item }}</li>{% endfor %}</ul>"
+    return render_template_string(template, items=["item1", "item2"])

package/dist/packages/crucible/seeds/python/seed-017.py ADDED Viewed

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Flask response with unsanitized user input in HTML string
+from flask import Flask, request, make_response
+app = Flask(__name__)
+@app.route("/error")
+def error_page():
+    message = request.args.get("msg", "An error occurred")
+    # User-controlled message embedded in HTML response without escaping
+    html = f"""
+    <html>
+      <head><title>Error</title></head>
+      <body>
+        <div class="error-container">
+          <h1>Error</h1>
+          <p class="message">{message}</p>
+          <a href="/">Go Home</a>
+        </div>
+      </body>
+    </html>
+    """
+    return make_response(html, 400)
+@app.route("/profile/<username>")
+def profile(username: str):
+    html = f"<html><body><h1>Profile: {username}</h1></body></html>"
+    return html

package/dist/packages/crucible/seeds/python/seed-018.py ADDED Viewed

@@ -0,0 +1,30 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: critical
+# language: python
+# expected: SSTI (Server-Side Template Injection) via Jinja2 render_template_string with user-controlled template
+from flask import Flask, request, render_template_string
+app = Flask(__name__)
+@app.route("/render")
+def render_custom():
+    # Attacker sends: ?template={{config.SECRET_KEY}} or {{''.__class__.__mro__[1].__subclasses__()}}
+    user_template = request.args.get("template", "<p>Hello World</p>")
+    context = {
+        "user": request.args.get("user", "guest"),
+        "app_name": "MyApp",
+    }
+    # render_template_string with user-controlled template = SSTI
+    return render_template_string(user_template, **context)
+@app.route("/email-preview", methods=["POST"])
+def email_preview():
+    template_body = request.form.get("template", "")
+    recipient_name = request.form.get("name", "User")
+    # Attacker injects Jinja2 expressions into the template body
+    rendered = render_template_string(template_body, name=recipient_name)
+    return rendered

package/dist/packages/crucible/seeds/python/seed-019.py ADDED Viewed

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Django HttpResponse with unsanitized user input
+from django.http import HttpResponse
+from django.views import View
+class SearchView(View):
+    def get(self, request):
+        query = request.GET.get("q", "")
+        category = request.GET.get("cat", "all")
+        # User input embedded directly in HTML without mark_safe/escape
+        html = """
+        <html>
+          <body>
+            <h1>Search Results</h1>
+            <p>Query: <b>{query}</b> | Category: {category}</p>
+            <div id="results"></div>
+          </body>
+        </html>
+        """.format(query=query, category=category)
+        return HttpResponse(html)
+class NotFoundView(View):
+    def get(self, request, path):
+        # path from URL — attacker crafts URL with XSS payload
+        return HttpResponse(f"<h1>Page not found: {path}</h1>", status=404)

package/dist/packages/crucible/seeds/python/seed-020.py ADDED Viewed

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Mako/Chameleon template rendering with user-controlled variable without escaping
+from mako.template import Template
+from flask import Flask, request
+app = Flask(__name__)
+@app.route("/dashboard")
+def dashboard():
+    username = request.args.get("user", "Guest")
+    notification = request.args.get("msg", "")
+    # Mako ${} by default does NOT HTML-escape unless | h filter is used
+    template = Template("""
+    <html>
+      <body>
+        <h1>Welcome, ${username}!</h1>
+        <div class="notification">${notification}</div>
+        <div id="content">Your dashboard content goes here.</div>
+      </body>
+    </html>
+    """)
+    return template.render(username=username, notification=notification)
+@app.route("/comment/<int:post_id>")
+def view_comment(post_id: int):
+    author = request.args.get("author", "Anonymous")
+    body = request.args.get("body", "")
+    tmpl = Template("<div><strong>${author}</strong>: ${body}</div>")
+    return tmpl.render(author=author, body=body)

package/dist/packages/crucible/seeds/python/seed-021 2.py ADDED Viewed

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Jinja2 |safe filter applied to user-controlled content
+from flask import Flask, request, render_template_string
+app = Flask(__name__)
+ARTICLE_TEMPLATE = """
+<!DOCTYPE html>
+<html>
+<head><title>{{ title }}</title></head>
+<body>
+  <article>
+    <h1>{{ title }}</h1>
+    <!-- |safe disables Jinja2 autoescaping — XSS if content is user-controlled -->
+    <div class="content">{{ content | safe }}</div>
+    <footer>By: {{ author | safe }}</footer>
+  </article>
+</body>
+</html>
+"""
+@app.route("/articles/<int:article_id>")
+def view_article(article_id: int):
+    # In practice, content and author come from DB — but users control their own author field
+    from myapp.models import Article
+    article = Article.objects.get(pk=article_id)
+    return render_template_string(
+        ARTICLE_TEMPLATE,
+        title=article.title,
+        content=article.body,    # user-submitted rich text
+        author=article.author_bio,  # user-controlled bio
+    )

package/dist/packages/crucible/seeds/python/seed-021.py ADDED Viewed

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Jinja2 |safe filter applied to user-controlled content
+from flask import Flask, request, render_template_string
+app = Flask(__name__)
+ARTICLE_TEMPLATE = """
+<!DOCTYPE html>
+<html>
+<head><title>{{ title }}</title></head>
+<body>
+  <article>
+    <h1>{{ title }}</h1>
+    <!-- |safe disables Jinja2 autoescaping — XSS if content is user-controlled -->
+    <div class="content">{{ content | safe }}</div>
+    <footer>By: {{ author | safe }}</footer>
+  </article>
+</body>
+</html>
+"""
+@app.route("/articles/<int:article_id>")
+def view_article(article_id: int):
+    # In practice, content and author come from DB — but users control their own author field
+    from myapp.models import Article
+    article = Article.objects.get(pk=article_id)
+    return render_template_string(
+        ARTICLE_TEMPLATE,
+        title=article.title,
+        content=article.body,    # user-submitted rich text
+        author=article.author_bio,  # user-controlled bio
+    )

package/dist/packages/crucible/seeds/python/seed-022 2.py ADDED Viewed

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: medium
+# language: python
+# expected: XSS via FastAPI response with HTML and user-controlled query parameter
+from fastapi import FastAPI, Query
+from fastapi.responses import HTMLResponse
+app = FastAPI()
+@app.get("/welcome", response_class=HTMLResponse)
+async def welcome(name: str = Query(default="Guest")):
+    # name injected directly into HTML — no escaping applied
+    html = f"""
+    <!DOCTYPE html>
+    <html>
+      <head><title>Welcome</title></head>
+      <body>
+        <h1>Hello, {name}!</h1>
+        <p>Thanks for visiting.</p>
+      </body>
+    </html>
+    """
+    return HTMLResponse(content=html)
+@app.get("/redirect-info", response_class=HTMLResponse)
+async def redirect_info(from_url: str = Query(default="/")):
+    # from_url reflected in response — open redirect + XSS
+    return HTMLResponse(
+        f'<p>You were redirected from: <a href="{from_url}">{from_url}</a></p>'
+    )

package/dist/packages/crucible/seeds/python/seed-022.py ADDED Viewed

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: medium
+# language: python
+# expected: XSS via FastAPI response with HTML and user-controlled query parameter
+from fastapi import FastAPI, Query
+from fastapi.responses import HTMLResponse
+app = FastAPI()
+@app.get("/welcome", response_class=HTMLResponse)
+async def welcome(name: str = Query(default="Guest")):
+    # name injected directly into HTML — no escaping applied
+    html = f"""
+    <!DOCTYPE html>
+    <html>
+      <head><title>Welcome</title></head>
+      <body>
+        <h1>Hello, {name}!</h1>
+        <p>Thanks for visiting.</p>
+      </body>
+    </html>
+    """
+    return HTMLResponse(content=html)
+@app.get("/redirect-info", response_class=HTMLResponse)
+async def redirect_info(from_url: str = Query(default="/")):
+    # from_url reflected in response — open redirect + XSS
+    return HTMLResponse(
+        f'<p>You were redirected from: <a href="{from_url}">{from_url}</a></p>'
+    )

package/dist/packages/crucible/seeds/python/seed-023 2.py ADDED Viewed

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via os.system with user-controlled input
+import os
+from flask import Flask, request, jsonify
+app = Flask(__name__)
+@app.route("/tools/ping")
+def ping():
+    host = request.args.get("host", "")
+    # Attacker: host = "8.8.8.8; cat /etc/passwd"
+    exit_code = os.system(f"ping -c 4 {host}")
+    return jsonify({"exit_code": exit_code})
+@app.route("/tools/convert", methods=["POST"])
+def convert_file():
+    data = request.get_json()
+    input_file = data.get("input", "")
+    output_format = data.get("format", "pdf")
+    # os.system executes in shell — injection via semicolons, backticks, etc.
+    os.system(f"convert {input_file} output.{output_format}")
+    return jsonify({"status": "done"})
+@app.route("/tools/compress", methods=["POST"])
+def compress():
+    data = request.get_json()
+    folder = data.get("folder", "")
+    name = data.get("archive_name", "archive")
+    os.system(f"tar -czf /tmp/{name}.tar.gz {folder}")
+    return jsonify({"archive": f"/tmp/{name}.tar.gz"})

package/dist/packages/crucible/seeds/python/seed-023.py ADDED Viewed

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via os.system with user-controlled input
+import os
+from flask import Flask, request, jsonify
+app = Flask(__name__)
+@app.route("/tools/ping")
+def ping():
+    host = request.args.get("host", "")
+    # Attacker: host = "8.8.8.8; cat /etc/passwd"
+    exit_code = os.system(f"ping -c 4 {host}")
+    return jsonify({"exit_code": exit_code})
+@app.route("/tools/convert", methods=["POST"])
+def convert_file():
+    data = request.get_json()
+    input_file = data.get("input", "")
+    output_format = data.get("format", "pdf")
+    # os.system executes in shell — injection via semicolons, backticks, etc.
+    os.system(f"convert {input_file} output.{output_format}")
+    return jsonify({"status": "done"})
+@app.route("/tools/compress", methods=["POST"])
+def compress():
+    data = request.get_json()
+    folder = data.get("folder", "")
+    name = data.get("archive_name", "archive")
+    os.system(f"tar -czf /tmp/{name}.tar.gz {folder}")
+    return jsonify({"archive": f"/tmp/{name}.tar.gz"})

package/dist/packages/crucible/seeds/python/seed-024 2.py ADDED Viewed

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.call with shell=True and user input
+import subprocess
+from flask import Flask, request, jsonify
+app = Flask(__name__)
+@app.route("/git/clone", methods=["POST"])
+def git_clone():
+    data = request.get_json()
+    repo_url = data.get("url", "")
+    target_dir = data.get("dir", "/tmp/repo")
+    # shell=True means the full string is passed to /bin/sh
+    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
+    return jsonify({"return_code": ret})
+@app.route("/nmap", methods=["POST"])
+def nmap_scan():
+    target = request.get_json().get("target", "")
+    ports = request.get_json().get("ports", "1-1000")
+    # target and ports from user — shell injection via semicolons
+    result = subprocess.check_output(
+        f"nmap -p {ports} {target}", shell=True, text=True
+    )
+    return jsonify({"output": result})
+@app.route("/whois")
+def whois():
+    domain = request.args.get("domain", "")
+    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
+    return jsonify({"result": output})

package/dist/packages/crucible/seeds/python/seed-024.py ADDED Viewed

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.call with shell=True and user input
+import subprocess
+from flask import Flask, request, jsonify
+app = Flask(__name__)
+@app.route("/git/clone", methods=["POST"])
+def git_clone():
+    data = request.get_json()
+    repo_url = data.get("url", "")
+    target_dir = data.get("dir", "/tmp/repo")
+    # shell=True means the full string is passed to /bin/sh
+    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
+    return jsonify({"return_code": ret})
+@app.route("/nmap", methods=["POST"])
+def nmap_scan():
+    target = request.get_json().get("target", "")
+    ports = request.get_json().get("ports", "1-1000")
+    # target and ports from user — shell injection via semicolons
+    result = subprocess.check_output(
+        f"nmap -p {ports} {target}", shell=True, text=True
+    )
+    return jsonify({"output": result})
+@app.route("/whois")
+def whois():
+    domain = request.args.get("domain", "")
+    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
+    return jsonify({"result": output})

package/dist/packages/crucible/seeds/python/seed-025 2.py ADDED Viewed

@@ -0,0 +1,40 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.Popen with shell=True and f-string
+import subprocess
+from fastapi import FastAPI
+from pydantic import BaseModel
+app = FastAPI()
+class ImageRequest(BaseModel):
+    image_path: str   # user-controlled
+    width: int
+    height: int
+    quality: int = 85
+class ReportRequest(BaseModel):
+    format: str       # user-controlled
+    date_range: str   # user-controlled
+@app.post("/images/thumbnail")
+def generate_thumbnail(req: ImageRequest):
+    # image_path is user-controlled — injection via shell metacharacters
+    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = proc.communicate(timeout=30)
+    return {"output": out.decode(), "errors": err.decode()}
+@app.post("/reports/generate")
+def generate_report(req: ReportRequest):
+    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
+    out, _ = proc.communicate()
+    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-025.py ADDED Viewed

@@ -0,0 +1,40 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.Popen with shell=True and f-string
+import subprocess
+from fastapi import FastAPI
+from pydantic import BaseModel
+app = FastAPI()
+class ImageRequest(BaseModel):
+    image_path: str   # user-controlled
+    width: int
+    height: int
+    quality: int = 85
+class ReportRequest(BaseModel):
+    format: str       # user-controlled
+    date_range: str   # user-controlled
+@app.post("/images/thumbnail")
+def generate_thumbnail(req: ImageRequest):
+    # image_path is user-controlled — injection via shell metacharacters
+    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = proc.communicate(timeout=30)
+    return {"output": out.decode(), "errors": err.decode()}
+@app.post("/reports/generate")
+def generate_report(req: ReportRequest):
+    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
+    out, _ = proc.communicate()
+    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-026 2.py ADDED Viewed

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via os.popen with user-controlled filename
+import os
+from flask import Flask, request, send_file
+import io
+app = Flask(__name__)
+@app.route("/export/csv")
+def export_csv():
+    table = request.args.get("table", "users")
+    date = request.args.get("date", "2024-01-01")
+    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
+    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
+    return output, 200, {"Content-Type": "text/csv"}
+@app.route("/preview/pdf")
+def preview_pdf():
+    filename = request.args.get("file", "")
+    # filename from user — injection via backticks or semicolons
+    output = os.popen(f"pdftotext uploads/{filename} -").read()
+    return {"text": output}
+@app.route("/image/metadata")
+def image_metadata():
+    path = request.args.get("path", "")
+    result = os.popen(f"exiftool {path}").read()
+    return {"metadata": result}

package/dist/packages/crucible/seeds/python/seed-026.py ADDED Viewed

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via os.popen with user-controlled filename
+import os
+from flask import Flask, request, send_file
+import io
+app = Flask(__name__)
+@app.route("/export/csv")
+def export_csv():
+    table = request.args.get("table", "users")
+    date = request.args.get("date", "2024-01-01")
+    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
+    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
+    return output, 200, {"Content-Type": "text/csv"}
+@app.route("/preview/pdf")
+def preview_pdf():
+    filename = request.args.get("file", "")
+    # filename from user — injection via backticks or semicolons
+    output = os.popen(f"pdftotext uploads/{filename} -").read()
+    return {"text": output}
+@app.route("/image/metadata")
+def image_metadata():
+    path = request.args.get("path", "")
+    result = os.popen(f"exiftool {path}").read()
+    return {"metadata": result}