thuban 0.3.4 → 0.4.1

package/dist/packages/crucible/seeds/ruby/seed-005.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: ruby
+# expected: Hardcoded JWT secret and admin API token
+
+JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
+ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
+
+def generate_jwt(payload)
+  JWT.encode(payload, JWT_SECRET, 'HS256')
+end
+
+def verify_admin(token)
+  token == ADMIN_TOKEN
+end
+
+def sign_request(body)
+  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
+end

package/dist/packages/crucible/seeds/ruby/seed-006 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded OAuth client secret and social login credentials
+
+GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
+GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
+GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
+
+OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
+end

package/dist/packages/crucible/seeds/ruby/seed-006.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded OAuth client secret and social login credentials
+
+GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
+GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
+GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
+
+OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
+end

package/dist/packages/crucible/seeds/ruby/seed-007 2.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Twilio credentials and SendGrid API key
+
+TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
+TWILIO_PHONE       = '+15005550006'
+SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
+
+def send_sms(to, message)
+  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
+  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
+  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
+end

package/dist/packages/crucible/seeds/ruby/seed-007.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Twilio credentials and SendGrid API key
+
+TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
+TWILIO_PHONE       = '+15005550006'
+SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
+
+def send_sms(to, message)
+  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
+  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
+  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
+end

package/dist/packages/crucible/seeds/ruby/seed-008 2.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Slack webhook URL and signing secret
+
+SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
+SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
+SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
+
+def post_to_slack(message)
+  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
+  Net::HTTP.post(
+    URI(SLACK_WEBHOOK_URL),
+    { text: message }.to_json,
+    'Content-Type' => 'application/json'
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-008.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Slack webhook URL and signing secret
+
+SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
+SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
+SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
+
+def post_to_slack(message)
+  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
+  Net::HTTP.post(
+    URI(SLACK_WEBHOOK_URL),
+    { text: message }.to_json,
+    'Content-Type' => 'application/json'
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-009 2.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: SQL injection via string interpolation in ActiveRecord where()
+
+class UserController < ApplicationController
+  def search
+    username = params[:username]
+    @users = User.where("username = '#{username}'")
+    render json: @users
+  end
+
+  def filter
+    role  = params[:role]
+    since = params[:since]
+    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
+    render json: @records
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-009.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: SQL injection via string interpolation in ActiveRecord where()
+
+class UserController < ApplicationController
+  def search
+    username = params[:username]
+    @users = User.where("username = '#{username}'")
+    render json: @users
+  end
+
+  def filter
+    role  = params[:role]
+    since = params[:since]
+    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
+    render json: @records
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-010 2.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ActiveRecord find_by_sql with string interpolation
+
+class ReportController < ApplicationController
+  def show
+    user_id = params[:user_id]
+    type    = params[:type]
+    @data = Report.find_by_sql(
+      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
+    )
+    render json: @data
+  end
+
+  def custom_query
+    condition = params[:condition]
+    @results = ActiveRecord::Base.connection.execute(
+      "SELECT * FROM events WHERE #{condition}"
+    )
+    render json: @results.to_a
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-010.rb

@@ -0,0 +1,24 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ActiveRecord find_by_sql with string interpolation
+
+class ReportController < ApplicationController
+  def show
+    user_id = params[:user_id]
+    type    = params[:type]
+    @data = Report.find_by_sql(
+      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
+    )
+    render json: @data
+  end
+
+  def custom_query
+    condition = params[:condition]
+    @results = ActiveRecord::Base.connection.execute(
+      "SELECT * FROM events WHERE #{condition}"
+    )
+    render json: @results.to_a
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-011 2.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ORDER BY clause built from user-supplied column name without whitelist
+
+class ProductsController < ApplicationController
+  def index
+    sort_col = params[:sort_by]
+    sort_dir = params[:direction]
+    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
+    render json: @products
+  end
+
+  def search
+    term     = params[:q]
+    category = params[:category]
+    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
+    render json: @items
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-011.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: ORDER BY clause built from user-supplied column name without whitelist
+
+class ProductsController < ApplicationController
+  def index
+    sort_col = params[:sort_by]
+    sort_dir = params[:direction]
+    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
+    render json: @products
+  end
+
+  def search
+    term     = params[:q]
+    category = params[:category]
+    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
+    render json: @items
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-012 2.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Raw SQL executed via connection.execute with user input
+
+def run_analytics(dimension, filter_expr)
+  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
+  ActiveRecord::Base.connection.execute(sql)
+end
+
+def delete_records(table, condition)
+  ActiveRecord::Base.connection.execute(
+    "DELETE FROM #{table} WHERE #{condition}"
+  )
+end
+
+def update_field(table, field, value, id)
+  ActiveRecord::Base.connection.execute(
+    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-012.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Raw SQL executed via connection.execute with user input
+
+def run_analytics(dimension, filter_expr)
+  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
+  ActiveRecord::Base.connection.execute(sql)
+end
+
+def delete_records(table, condition)
+  ActiveRecord::Base.connection.execute(
+    "DELETE FROM #{table} WHERE #{condition}"
+  )
+end
+
+def update_field(table, field, value, id)
+  ActiveRecord::Base.connection.execute(
+    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-013 2.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Sequel dataset filter with string interpolation
+
+require 'sequel'
+
+DB = Sequel.connect('sqlite://db/production.sqlite3')
+
+def find_user(username, password)
+  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
+end
+
+def get_orders(status, user_id)
+  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
+end
+
+def search_items(keyword)
+  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
+end

package/dist/packages/crucible/seeds/ruby/seed-013.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: Sequel dataset filter with string interpolation
+
+require 'sequel'
+
+DB = Sequel.connect('sqlite://db/production.sqlite3')
+
+def find_user(username, password)
+  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
+end
+
+def get_orders(status, user_id)
+  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
+end
+
+def search_items(keyword)
+  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
+end

package/dist/packages/crucible/seeds/ruby/seed-014 2.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: ruby
+# expected: ActiveRecord group/having clause with unparameterized user input
+
+class AnalyticsController < ApplicationController
+  def aggregate
+    group_by = params[:group_by]
+    having   = params[:having]
+    @data = Order.group(group_by)
+                 .having("COUNT(*) #{having}")
+                 .select("#{group_by}, COUNT(*) as total")
+    render json: @data
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-014.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: ruby
+# expected: ActiveRecord group/having clause with unparameterized user input
+
+class AnalyticsController < ApplicationController
+  def aggregate
+    group_by = params[:group_by]
+    having   = params[:having]
+    @data = Order.group(group_by)
+                 .having("COUNT(*) #{having}")
+                 .select("#{group_by}, COUNT(*) as total")
+    render json: @data
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-015 2.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: pg gem exec_params replaced with exec — user string in raw SQL
+
+require 'pg'
+
+conn = PG.connect(dbname: 'production')
+
+def login(conn, username, password)
+  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
+  result.first
+end
+
+def get_profile(conn, user_id)
+  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
+end

package/dist/packages/crucible/seeds/ruby/seed-015.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: ruby
+# expected: pg gem exec_params replaced with exec — user string in raw SQL
+
+require 'pg'
+
+conn = PG.connect(dbname: 'production')
+
+def login(conn, username, password)
+  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
+  result.first
+end
+
+def get_profile(conn, user_id)
+  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
+end

package/dist/packages/crucible/seeds/ruby/seed-016 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: render html: with user content — unescaped XSS
+
+class CommentsController < ApplicationController
+  def show
+    @comment = Comment.find(params[:id])
+    render html: @comment.body.html_safe
+  end
+
+  def preview
+    content = params[:content]
+    render html: content.html_safe
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-016.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: render html: with user content — unescaped XSS
+
+class CommentsController < ApplicationController
+  def show
+    @comment = Comment.find(params[:id])
+    render html: @comment.body.html_safe
+  end
+
+  def preview
+    content = params[:content]
+    render html: content.html_safe
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-017 2.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: raw() helper used with user-controlled content in ERB template
+
+# In a Rails view (equivalent Ruby)
+class ArticlesController < ApplicationController
+  helper_method :render_article
+
+  def show
+    @article   = Article.find(params[:id])
+    @title     = params[:title] || @article.title
+    @body      = @article.body
+  end
+end
+
+# Equivalent ERB logic (Ruby):
+def render_article_html(title, body, author_bio)
+  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
+end
+
+def raw(str)
+  str.to_s
+end

package/dist/packages/crucible/seeds/ruby/seed-017.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: raw() helper used with user-controlled content in ERB template
+
+# In a Rails view (equivalent Ruby)
+class ArticlesController < ApplicationController
+  helper_method :render_article
+
+  def show
+    @article   = Article.find(params[:id])
+    @title     = params[:title] || @article.title
+    @body      = @article.body
+  end
+end
+
+# Equivalent ERB logic (Ruby):
+def render_article_html(title, body, author_bio)
+  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
+end
+
+def raw(str)
+  str.to_s
+end

package/dist/packages/crucible/seeds/ruby/seed-018 2.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: Sinatra response body includes user param without escaping
+
+require 'sinatra'
+
+get '/greet' do
+  name  = params[:name]
+  query = params[:q]
+  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
+end
+
+get '/error' do
+  msg = params[:message]
+  "<div class='error'>#{msg}</div>"
+end
+
+post '/comment' do
+  comment = params[:comment]
+  "<p>Your comment: #{comment}</p>"
+end

package/dist/packages/crucible/seeds/ruby/seed-018.rb

@@ -0,0 +1,23 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: Sinatra response body includes user param without escaping
+
+require 'sinatra'
+
+get '/greet' do
+  name  = params[:name]
+  query = params[:q]
+  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
+end
+
+get '/error' do
+  msg = params[:message]
+  "<div class='error'>#{msg}</div>"
+end
+
+post '/comment' do
+  comment = params[:comment]
+  "<p>Your comment: #{comment}</p>"
+end

package/dist/packages/crucible/seeds/ruby/seed-019 2.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: medium
+# language: ruby
+# expected: User content embedded in JSON output that is then eval()d client-side
+
+class ApiController < ApplicationController
+  def user_data
+    user  = User.find(params[:id])
+    bio   = params[:bio] || user.bio
+    @json = { name: user.name, bio: bio, role: params[:role] }
+    render json: @json
+  end
+
+  def config
+    callback = params[:callback]
+    data     = { status: 'ok', user: current_user&.name }
+    render plain: "#{callback}(#{data.to_json})"
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-019.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: medium
+# language: ruby
+# expected: User content embedded in JSON output that is then eval()d client-side
+
+class ApiController < ApplicationController
+  def user_data
+    user  = User.find(params[:id])
+    bio   = params[:bio] || user.bio
+    @json = { name: user.name, bio: bio, role: params[:role] }
+    render json: @json
+  end
+
+  def config
+    callback = params[:callback]
+    data     = { status: 'ok', user: current_user&.name }
+    render plain: "#{callback}(#{data.to_json})"
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-020 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: content_tag or link_to with unescaped user attribute
+
+def build_link(url, label, css_class)
+  "<a href='#{url}' class='#{css_class}'>#{label}</a>"
+end
+
+def build_input(name, value, placeholder)
+  "<input name='#{name}' value='#{value}' placeholder='#{placeholder}'>"
+end
+
+def build_script_tag(variable_name, data)
+  "<script>var #{variable_name} = #{data.to_json};</script>"
+end

package/dist/packages/crucible/seeds/ruby/seed-020.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: ruby
+# expected: content_tag or link_to with unescaped user attribute
+
+def build_link(url, label, css_class)
+  "<a href='#{url}' class='#{css_class}'>#{label}</a>"
+end
+
+def build_input(name, value, placeholder)
+  "<input name='#{name}' value='#{value}' placeholder='#{placeholder}'>"
+end
+
+def build_script_tag(variable_name, data)
+  "<script>var #{variable_name} = #{data.to_json};</script>"
+end