thuban 0.3.4 → 0.4.1

package/dist/packages/crucible/seeds/python/seed-027 2.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via paramiko exec_command with user-controlled command string
+
+import paramiko
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def get_ssh_client(host: str) -> paramiko.SSHClient:
+    client = paramiko.SSHClient()
+    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
+    return client
+
+
+@app.route("/ssh/run", methods=["POST"])
+def run_remote_command():
+    data = request.get_json()
+    host = data.get("host", "")
+    # command from user — attacker appends malicious commands
+    command = data.get("command", "")
+    allowed_hosts = ["web-01.internal", "web-02.internal"]
+    if host not in allowed_hosts:
+        return jsonify({"error": "Host not allowed"}), 403
+
+    client = get_ssh_client(host)
+    # command not validated — attacker sends "ls; cat /etc/shadow"
+    stdin, stdout, stderr = client.exec_command(command)
+    output = stdout.read().decode()
+    client.close()
+    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-027.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via paramiko exec_command with user-controlled command string
+
+import paramiko
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def get_ssh_client(host: str) -> paramiko.SSHClient:
+    client = paramiko.SSHClient()
+    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
+    return client
+
+
+@app.route("/ssh/run", methods=["POST"])
+def run_remote_command():
+    data = request.get_json()
+    host = data.get("host", "")
+    # command from user — attacker appends malicious commands
+    command = data.get("command", "")
+    allowed_hosts = ["web-01.internal", "web-02.internal"]
+    if host not in allowed_hosts:
+        return jsonify({"error": "Host not allowed"}), 403
+
+    client = get_ssh_client(host)
+    # command not validated — attacker sends "ls; cat /etc/shadow"
+    stdin, stdout, stderr = client.exec_command(command)
+    output = stdout.read().decode()
+    client.close()
+    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-028 2.py

@@ -0,0 +1,42 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.run with shell=True and user-controlled git operation
+
+import subprocess
+from dataclasses import dataclass
+
+
+@dataclass
+class GitConfig:
+    repo_path: str
+    branch: str      # user-controlled
+    remote: str = "origin"
+
+
+class GitService:
+    def clone(self, repo_url: str, target: str) -> str:
+        # repo_url from user — injection possible
+        result = subprocess.run(
+            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def checkout(self, cfg: GitConfig) -> str:
+        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
+        result = subprocess.run(
+            f"git -C {cfg.repo_path} checkout {cfg.branch}",
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def tag(self, repo: str, tag_name: str, message: str) -> str:
+        result = subprocess.run(
+            f'git -C {repo} tag -a {tag_name} -m "{message}"',
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def archive(self, repo: str, branch: str, output_file: str) -> None:
+        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/dist/packages/crucible/seeds/python/seed-028.py

@@ -0,0 +1,42 @@
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.run with shell=True and user-controlled git operation
+
+import subprocess
+from dataclasses import dataclass
+
+
+@dataclass
+class GitConfig:
+    repo_path: str
+    branch: str      # user-controlled
+    remote: str = "origin"
+
+
+class GitService:
+    def clone(self, repo_url: str, target: str) -> str:
+        # repo_url from user — injection possible
+        result = subprocess.run(
+            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def checkout(self, cfg: GitConfig) -> str:
+        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
+        result = subprocess.run(
+            f"git -C {cfg.repo_path} checkout {cfg.branch}",
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def tag(self, repo: str, tag_name: str, message: str) -> str:
+        result = subprocess.run(
+            f'git -C {repo} tag -a {tag_name} -m "{message}"',
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def archive(self, repo: str, branch: str, output_file: str) -> None:
+        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/dist/packages/crucible/seeds/python/seed-029.py

@@ -0,0 +1,42 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via open() with unvalidated user-supplied file path
+
+import os
+from flask import Flask, request, send_file, abort
+
+app = Flask(__name__)
+
+BASE_DIR = "/var/app/public/files"
+
+
+@app.route("/files/<path:filename>")
+def serve_file(filename: str):
+    # path.join does NOT prevent traversal — "../../etc/passwd" resolves outside BASE_DIR
+    file_path = os.path.join(BASE_DIR, filename)
+    try:
+        with open(file_path, "rb") as f:
+            return f.read()
+    except FileNotFoundError:
+        abort(404)
+
+
+@app.route("/download")
+def download():
+    file_path = request.args.get("path", "")
+    # Completely unvalidated path — reads arbitrary files
+    try:
+        with open(file_path, "r") as f:
+            return f.read()
+    except Exception as e:
+        return str(e), 400
+
+
+@app.route("/logs/view")
+def view_log():
+    log_name = request.args.get("log", "app.log")
+    log_path = f"/var/log/app/{log_name}"
+    with open(log_path, "r") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-030 2.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal in Django view via user-controlled filename parameter
+
+import os
+from django.http import FileResponse, Http404, HttpResponse
+from django.conf import settings
+
+
+def serve_user_file(request, user_id: str):
+    filename = request.GET.get("file", "")
+    # No normalization — filename can be "../../../etc/passwd"
+    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
+    try:
+        return FileResponse(open(file_path, "rb"))
+    except FileNotFoundError:
+        raise Http404("File not found")
+
+
+def export_report(request):
+    report_name = request.GET.get("report", "monthly")
+    locale = request.GET.get("locale", "en")
+    # Both report_name and locale inserted into path — traversal possible
+    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
+    if not os.path.exists(path):
+        raise Http404
+    with open(path, "rb") as f:
+        return HttpResponse(f.read(), content_type="application/pdf")
+
+
+def read_template(request):
+    template = request.GET.get("template", "welcome")
+    path = f"{settings.TEMPLATES_DIR}/{template}.html"
+    with open(path) as f:
+        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-030.py

@@ -0,0 +1,37 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal in Django view via user-controlled filename parameter
+
+import os
+from django.http import FileResponse, Http404, HttpResponse
+from django.conf import settings
+
+
+def serve_user_file(request, user_id: str):
+    filename = request.GET.get("file", "")
+    # No normalization — filename can be "../../../etc/passwd"
+    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
+    try:
+        return FileResponse(open(file_path, "rb"))
+    except FileNotFoundError:
+        raise Http404("File not found")
+
+
+def export_report(request):
+    report_name = request.GET.get("report", "monthly")
+    locale = request.GET.get("locale", "en")
+    # Both report_name and locale inserted into path — traversal possible
+    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
+    if not os.path.exists(path):
+        raise Http404
+    with open(path, "rb") as f:
+        return HttpResponse(f.read(), content_type="application/pdf")
+
+
+def read_template(request):
+    template = request.GET.get("template", "welcome")
+    path = f"{settings.TEMPLATES_DIR}/{template}.html"
+    with open(path) as f:
+        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-031 2.py

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
+
+import os
+import zipfile
+
+
+EXTRACT_BASE = "/var/app/uploads/extracted"
+
+
+def extract_archive(zip_bytes: bytes, user_id: str) -> list:
+    import io
+    extracted = []
+    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
+        for entry in zf.infolist():
+            # entry.filename can contain "../" — writes outside EXTRACT_BASE
+            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
+            if entry.is_dir():
+                os.makedirs(output_path, exist_ok=True)
+            else:
+                os.makedirs(os.path.dirname(output_path), exist_ok=True)
+                with zf.open(entry) as src, open(output_path, "wb") as dst:
+                    dst.write(src.read())
+                extracted.append(output_path)
+    return extracted
+
+
+def get_extracted_file(user_id: str, relative_path: str) -> bytes:
+    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
+    with open(full_path, "rb") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-031.py

@@ -0,0 +1,34 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
+
+import os
+import zipfile
+
+
+EXTRACT_BASE = "/var/app/uploads/extracted"
+
+
+def extract_archive(zip_bytes: bytes, user_id: str) -> list:
+    import io
+    extracted = []
+    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
+        for entry in zf.infolist():
+            # entry.filename can contain "../" — writes outside EXTRACT_BASE
+            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
+            if entry.is_dir():
+                os.makedirs(output_path, exist_ok=True)
+            else:
+                os.makedirs(os.path.dirname(output_path), exist_ok=True)
+                with zf.open(entry) as src, open(output_path, "wb") as dst:
+                    dst.write(src.read())
+                extracted.append(output_path)
+    return extracted
+
+
+def get_extracted_file(user_id: str, relative_path: str) -> bytes:
+    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
+    with open(full_path, "rb") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-032.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: medium
+# language: python
+# expected: path traversal via Flask send_from_directory with user-controlled subdirectory
+
+import os
+from flask import Flask, request, send_from_directory, abort
+
+app = Flask(__name__)
+
+UPLOADS_ROOT = "/var/uploads"
+
+
+@app.route("/uploads/<user_id>/files")
+def list_files(user_id: str):
+    subdir = request.args.get("folder", "")
+    # user_id and subdir can include "../" to escape UPLOADS_ROOT
+    target_dir = os.path.join(UPLOADS_ROOT, user_id, subdir)
+    try:
+        files = os.listdir(target_dir)
+        return {"files": files}
+    except FileNotFoundError:
+        abort(404)
+
+
+@app.route("/uploads/<user_id>/get")
+def get_file(user_id: str):
+    filename = request.args.get("name", "")
+    directory = request.args.get("dir", "")
+    # send_from_directory with user-controlled directory + filename
+    full_dir = os.path.join(UPLOADS_ROOT, user_id, directory)
+    return send_from_directory(full_dir, filename)

package/dist/packages/crucible/seeds/python/seed-033.py

@@ -0,0 +1,32 @@
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via FastAPI file endpoint with unvalidated path parameter
+
+import os
+from fastapi import FastAPI, Query
+from fastapi.responses import FileResponse, PlainTextResponse
+
+app = FastAPI()
+
+STATIC_ROOT = "/var/app/static"
+
+
+@app.get("/static/{file_path:path}")
+async def serve_static(file_path: str):
+    # file_path can be "../../etc/passwd" — no normalization or boundary check
+    full_path = os.path.join(STATIC_ROOT, file_path)
+    if not os.path.isfile(full_path):
+        return PlainTextResponse("Not found", status_code=404)
+    return FileResponse(full_path)
+
+
+@app.get("/config/view")
+async def view_config(name: str = Query(...)):
+    config_path = f"/etc/myapp/{name}.conf"
+    try:
+        with open(config_path) as f:
+            return {"content": f.read()}
+    except FileNotFoundError:
+        return {"error": "Config not found"}, 404

package/dist/packages/crucible/seeds/python/seed-034.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for password hashing
+
+import hashlib
+import psycopg2
+
+
+def get_db():
+    return psycopg2.connect(host="localhost", dbname="app", user="app", password="app")
+
+
+def hash_password(password: str) -> str:
+    # MD5 is cryptographically broken — must not be used for passwords
+    return hashlib.md5(password.encode()).hexdigest()
+
+
+def register_user(email: str, password: str) -> None:
+    conn = get_db()
+    cur = conn.cursor()
+    pw_hash = hash_password(password)
+    cur.execute("INSERT INTO users (email, password_hash) VALUES (%s, %s)", (email, pw_hash))
+    conn.commit()
+
+
+def login_user(email: str, password: str) -> bool:
+    conn = get_db()
+    cur = conn.cursor()
+    pw_hash = hash_password(password)
+    cur.execute("SELECT id FROM users WHERE email = %s AND password_hash = %s", (email, pw_hash))
+    return cur.fetchone() is not None
+
+
+def hash_file(file_path: str) -> str:
+    with open(file_path, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()

package/dist/packages/crucible/seeds/python/seed-035.py

@@ -0,0 +1,35 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: SHA1 used for password hashing and random.random() for token generation
+
+import hashlib
+import random
+import time
+
+
+def hash_password(password: str, salt: str = "") -> str:
+    # SHA-1 is deprecated for security-sensitive hashing
+    return hashlib.sha1((salt + password).encode()).hexdigest()
+
+
+def generate_session_token() -> str:
+    # random.random() is not cryptographically secure
+    return hex(int(random.random() * 10**18))[2:]
+
+
+def generate_reset_token(user_id: int) -> str:
+    # Predictable — only uses timestamp and non-secure random
+    return hashlib.sha1(f"{user_id}-{time.time()}-{random.randint(0, 999999)}".encode()).hexdigest()
+
+
+def create_api_key(user_id: str) -> str:
+    # Weak entropy source — easily guessable
+    rand = random.getrandbits(32)
+    return hashlib.md5(f"{user_id}{rand}".encode()).hexdigest()
+
+
+def generate_otp() -> str:
+    # random.randint is predictable — use secrets.randbelow instead
+    return str(random.randint(100000, 999999))

package/dist/packages/crucible/seeds/python/seed-036 2.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: DES cipher usage and AES-ECB mode with static key
+
+from Crypto.Cipher import DES, AES
+import base64
+
+DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
+AES_KEY = b"0123456789abcdef"  # 16 bytes
+
+
+def des_encrypt(data: str) -> str:
+    # DES has only 56-bit effective key length — trivially brute-forced
+    padded = data + " " * (8 - len(data) % 8)
+    cipher = DES.new(DES_KEY, DES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
+
+
+def aes_ecb_encrypt(data: str) -> str:
+    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
+    pad_len = 16 - len(data) % 16
+    padded = (data + chr(pad_len) * pad_len).encode()
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded)).decode()
+
+
+def aes_ecb_decrypt(ciphertext: str) -> str:
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-036.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: DES cipher usage and AES-ECB mode with static key
+
+from Crypto.Cipher import DES, AES
+import base64
+
+DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
+AES_KEY = b"0123456789abcdef"  # 16 bytes
+
+
+def des_encrypt(data: str) -> str:
+    # DES has only 56-bit effective key length — trivially brute-forced
+    padded = data + " " * (8 - len(data) % 8)
+    cipher = DES.new(DES_KEY, DES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
+
+
+def aes_ecb_encrypt(data: str) -> str:
+    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
+    pad_len = 16 - len(data) % 16
+    padded = (data + chr(pad_len) * pad_len).encode()
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded)).decode()
+
+
+def aes_ecb_decrypt(ciphertext: str) -> str:
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-037 2.py

@@ -0,0 +1,41 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: medium
+# language: python
+# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
+
+import hmac
+import hashlib
+
+
+WEBHOOK_SECRET = b"static-webhook-secret-2024"
+
+
+def compute_signature(payload: bytes) -> str:
+    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
+
+
+def verify_signature(payload: bytes, received_sig: str) -> bool:
+    expected = compute_signature(payload)
+    # String comparison leaks timing info — use hmac.compare_digest instead
+    return expected == received_sig
+
+
+def verify_api_key(provided: str, stored: str) -> bool:
+    # Direct equality — timing side-channel attack possible
+    return provided == stored
+
+
+def derive_key(password: str) -> bytes:
+    # Only 1000 iterations — far below NIST recommendation of 600,000+
+    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
+
+
+def check_token(token_a: str, token_b: str) -> bool:
+    # Char-by-char comparison leaks prefix matches
+    if len(token_a) != len(token_b):
+        return False
+    for a, b in zip(token_a, token_b):
+        if a != b:
+            return False
+    return True

package/dist/packages/crucible/seeds/python/seed-037.py

@@ -0,0 +1,41 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: medium
+# language: python
+# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
+
+import hmac
+import hashlib
+
+
+WEBHOOK_SECRET = b"static-webhook-secret-2024"
+
+
+def compute_signature(payload: bytes) -> str:
+    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
+
+
+def verify_signature(payload: bytes, received_sig: str) -> bool:
+    expected = compute_signature(payload)
+    # String comparison leaks timing info — use hmac.compare_digest instead
+    return expected == received_sig
+
+
+def verify_api_key(provided: str, stored: str) -> bool:
+    # Direct equality — timing side-channel attack possible
+    return provided == stored
+
+
+def derive_key(password: str) -> bytes:
+    # Only 1000 iterations — far below NIST recommendation of 600,000+
+    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
+
+
+def check_token(token_a: str, token_b: str) -> bool:
+    # Char-by-char comparison leaks prefix matches
+    if len(token_a) != len(token_b):
+        return False
+    for a, b in zip(token_a, token_b):
+        if a != b:
+            return False
+    return True

package/dist/packages/crucible/seeds/python/seed-038 2.py

@@ -0,0 +1,33 @@
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for file integrity and RSA with insufficient key size
+
+import hashlib
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pkcs1_15
+from Crypto.Hash import MD5
+
+
+def checksum_file(filepath: str) -> str:
+    # MD5 is collision-prone — not suitable for integrity verification
+    with open(filepath, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()
+
+
+def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
+    return checksum_file(filepath) == expected_md5
+
+
+def generate_rsa_keypair():
+    # 512-bit RSA key — trivially factorable in seconds
+    key = RSA.generate(512)
+    return key.export_key().decode(), key.publickey().export_key().decode()
+
+
+def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
+    key = RSA.import_key(private_key_pem)
+    # MD5 with RSA — known-weak combination
+    h = MD5.new(message)
+    return pkcs1_15.new(key).sign(h)