thuban 0.3.4 → 0.4.1

package/dist/packages/crucible/seeds/ts/seed-030 2.ts

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via typed file service with user-controlled subdirectory
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface FileServiceConfig {
+  baseDir: string;
+}
+
+export class FileService {
+  private readonly baseDir: string;
+
+  constructor(config: FileServiceConfig) {
+    this.baseDir = config.baseDir;
+  }
+
+  readUserFile(userId: string, fileName: string): string {
+    // No normalization check — fileName can be "../../../etc/passwd"
+    const filePath = path.join(this.baseDir, userId, fileName);
+    return fs.readFileSync(filePath, 'utf-8');
+  }
+
+  listDirectory(userId: string, subDir: string): string[] {
+    // subDir from user — directory traversal possible
+    const dirPath = path.join(this.baseDir, userId, subDir);
+    return fs.readdirSync(dirPath);
+  }
+
+  deleteFile(userId: string, fileName: string): void {
+    const filePath = path.join(this.baseDir, userId, fileName);
+    fs.unlinkSync(filePath);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-030.ts

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal via typed file service with user-controlled subdirectory
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface FileServiceConfig {
+  baseDir: string;
+}
+
+export class FileService {
+  private readonly baseDir: string;
+
+  constructor(config: FileServiceConfig) {
+    this.baseDir = config.baseDir;
+  }
+
+  readUserFile(userId: string, fileName: string): string {
+    // No normalization check — fileName can be "../../../etc/passwd"
+    const filePath = path.join(this.baseDir, userId, fileName);
+    return fs.readFileSync(filePath, 'utf-8');
+  }
+
+  listDirectory(userId: string, subDir: string): string[] {
+    // subDir from user — directory traversal possible
+    const dirPath = path.join(this.baseDir, userId, subDir);
+    return fs.readdirSync(dirPath);
+  }
+
+  deleteFile(userId: string, fileName: string): void {
+    const filePath = path.join(this.baseDir, userId, fileName);
+    fs.unlinkSync(filePath);
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-031 2.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal in NestJS controller via user-controlled template name
+
+import { Controller, Get, Query, Res } from '@nestjs/common';
+import { Response } from 'express';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
+
+@Controller('email')
+export class EmailController {
+  @Get('preview')
+  previewTemplate(
+    @Query('name') templateName: string,
+    @Query('locale') locale: string,
+    @Res() res: Response
+  ): void {
+    // templateName from query — attacker sends "../../config/database"
+    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
+    try {
+      const html = fs.readFileSync(templatePath, 'utf-8');
+      res.type('text/html').send(html);
+    } catch {
+      res.status(404).send('Template not found');
+    }
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-031.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: path traversal in NestJS controller via user-controlled template name
+
+import { Controller, Get, Query, Res } from '@nestjs/common';
+import { Response } from 'express';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
+
+@Controller('email')
+export class EmailController {
+  @Get('preview')
+  previewTemplate(
+    @Query('name') templateName: string,
+    @Query('locale') locale: string,
+    @Res() res: Response
+  ): void {
+    // templateName from query — attacker sends "../../config/database"
+    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
+    try {
+      const html = fs.readFileSync(templatePath, 'utf-8');
+      res.type('text/html').send(html);
+    } catch {
+      res.status(404).send('Template not found');
+    }
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-032 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
+
+import AdmZip from 'adm-zip';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const EXTRACT_BASE = '/var/app/uploads/extracted';
+
+export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
+  const zip = new AdmZip(zipBuffer);
+  const entries = zip.getEntries();
+  const extractedPaths: string[] = [];
+
+  for (const entry of entries) {
+    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
+    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
+
+    if (entry.isDirectory) {
+      fs.mkdirSync(outputPath, { recursive: true });
+    } else {
+      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+      fs.writeFileSync(outputPath, entry.getData());
+      extractedPaths.push(outputPath);
+    }
+  }
+
+  return extractedPaths;
+}

package/dist/packages/crucible/seeds/ts/seed-032.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: typescript
+// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
+
+import AdmZip from 'adm-zip';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const EXTRACT_BASE = '/var/app/uploads/extracted';
+
+export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
+  const zip = new AdmZip(zipBuffer);
+  const entries = zip.getEntries();
+  const extractedPaths: string[] = [];
+
+  for (const entry of entries) {
+    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
+    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
+
+    if (entry.isDirectory) {
+      fs.mkdirSync(outputPath, { recursive: true });
+    } else {
+      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+      fs.writeFileSync(outputPath, entry.getData());
+      extractedPaths.push(outputPath);
+    }
+  }
+
+  return extractedPaths;
+}

package/dist/packages/crucible/seeds/ts/seed-033 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: medium
+// language: typescript
+// expected: path traversal via multer upload with user-controlled destination folder
+
+import multer, { StorageEngine } from 'multer';
+import * as path from 'path';
+import * as fs from 'fs';
+import { Request } from 'express';
+
+const UPLOADS_ROOT = '/var/uploads';
+
+const storage: StorageEngine = multer.diskStorage({
+  destination: (req: Request, file, cb) => {
+    const folder = req.body.folder as string || 'default';
+    // folder from request body — allows writing to arbitrary locations
+    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
+    fs.mkdirSync(destPath, { recursive: true });
+    cb(null, destPath);
+  },
+  filename: (req: Request, file, cb) => {
+    const prefix = req.body.prefix as string || '';
+    // prefix + originalname — originalname may include path separators
+    cb(null, `${prefix}_${file.originalname}`);
+  },
+});
+
+export const upload = multer({
+  storage,
+  limits: { fileSize: 50 * 1024 * 1024 },
+});

package/dist/packages/crucible/seeds/ts/seed-033.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: medium
+// language: typescript
+// expected: path traversal via multer upload with user-controlled destination folder
+
+import multer, { StorageEngine } from 'multer';
+import * as path from 'path';
+import * as fs from 'fs';
+import { Request } from 'express';
+
+const UPLOADS_ROOT = '/var/uploads';
+
+const storage: StorageEngine = multer.diskStorage({
+  destination: (req: Request, file, cb) => {
+    const folder = req.body.folder as string || 'default';
+    // folder from request body — allows writing to arbitrary locations
+    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
+    fs.mkdirSync(destPath, { recursive: true });
+    cb(null, destPath);
+  },
+  filename: (req: Request, file, cb) => {
+    const prefix = req.body.prefix as string || '';
+    // prefix + originalname — originalname may include path separators
+    cb(null, `${prefix}_${file.originalname}`);
+  },
+});
+
+export const upload = multer({
+  storage,
+  limits: { fileSize: 50 * 1024 * 1024 },
+});

package/dist/packages/crucible/seeds/ts/seed-034 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: MD5 used for password hashing in typed auth service
+
+import * as crypto from 'crypto';
+import { Pool } from 'pg';
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+export class AuthService {
+  private hashPassword(password: string): string {
+    // MD5 is cryptographically broken — should use bcrypt/argon2
+    return crypto.createHash('md5').update(password).digest('hex');
+  }
+
+  async register(email: string, password: string): Promise<void> {
+    const hash = this.hashPassword(password);
+    await pool.query(
+      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
+      [email, hash]
+    );
+  }
+
+  async login(email: string, password: string): Promise<boolean> {
+    const hash = this.hashPassword(password);
+    const { rows } = await pool.query(
+      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
+      [email, hash]
+    );
+    return rows.length > 0;
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-034.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: MD5 used for password hashing in typed auth service
+
+import * as crypto from 'crypto';
+import { Pool } from 'pg';
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+export class AuthService {
+  private hashPassword(password: string): string {
+    // MD5 is cryptographically broken — should use bcrypt/argon2
+    return crypto.createHash('md5').update(password).digest('hex');
+  }
+
+  async register(email: string, password: string): Promise<void> {
+    const hash = this.hashPassword(password);
+    await pool.query(
+      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
+      [email, hash]
+    );
+  }
+
+  async login(email: string, password: string): Promise<boolean> {
+    const hash = this.hashPassword(password);
+    const { rows } = await pool.query(
+      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
+      [email, hash]
+    );
+    return rows.length > 0;
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-035 2.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: Math.random() used for security tokens, SHA1 for HMAC
+
+import * as crypto from 'crypto';
+
+export function generateSessionId(): string {
+  // Math.random() is not cryptographically secure
+  return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+
+export function generateCsrfToken(): string {
+  // Predictable timestamp-based token
+  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
+}
+
+export function generatePasswordResetToken(userId: string): string {
+  // SHA1 HMAC with weak source of randomness
+  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
+  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
+}
+
+export function generateApiKey(): string {
+  // Only 32 bits of entropy — trivially brute-forceable
+  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
+  return `key_${rand}`;
+}

package/dist/packages/crucible/seeds/ts/seed-035.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: Math.random() used for security tokens, SHA1 for HMAC
+
+import * as crypto from 'crypto';
+
+export function generateSessionId(): string {
+  // Math.random() is not cryptographically secure
+  return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+
+export function generateCsrfToken(): string {
+  // Predictable timestamp-based token
+  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
+}
+
+export function generatePasswordResetToken(userId: string): string {
+  // SHA1 HMAC with weak source of randomness
+  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
+  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
+}
+
+export function generateApiKey(): string {
+  // Only 32 bits of entropy — trivially brute-forceable
+  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
+  return `key_${rand}`;
+}

package/dist/packages/crucible/seeds/ts/seed-036 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: AES-ECB mode with no IV and RC4 weak cipher usage
+
+import * as crypto from 'crypto';
+
+type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
+
+export class LegacyCrypto {
+  private key: Buffer;
+
+  constructor(hexKey: string) {
+    this.key = Buffer.from(hexKey, 'hex');
+  }
+
+  // ECB mode: identical plaintext blocks produce identical ciphertext
+  encryptECB(data: string): string {
+    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
+    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+  }
+
+  decryptECB(data: string): string {
+    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
+    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
+  }
+
+  // RC4 is broken — key reuse leads to plaintext recovery
+  encryptRC4(data: string): string {
+    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
+    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-036.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: AES-ECB mode with no IV and RC4 weak cipher usage
+
+import * as crypto from 'crypto';
+
+type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
+
+export class LegacyCrypto {
+  private key: Buffer;
+
+  constructor(hexKey: string) {
+    this.key = Buffer.from(hexKey, 'hex');
+  }
+
+  // ECB mode: identical plaintext blocks produce identical ciphertext
+  encryptECB(data: string): string {
+    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
+    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+  }
+
+  decryptECB(data: string): string {
+    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
+    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
+  }
+
+  // RC4 is broken — key reuse leads to plaintext recovery
+  encryptRC4(data: string): string {
+    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
+    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-037 2.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: typescript
+// expected: timing attack via string comparison of HMAC signatures
+
+import * as crypto from 'crypto';
+
+const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
+
+export function computeSignature(payload: string): string {
+  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
+}
+
+export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
+  const expectedSig = computeSignature(payload);
+  // Timing attack: early exit on first mismatch leaks signature length/prefix
+  return expectedSig === receivedSig;
+}
+
+export function verifyApiKey(providedKey: string, storedKey: string): boolean {
+  // Direct string comparison — vulnerable to timing oracle attack
+  return providedKey === storedKey;
+}
+
+export function checkTokenMatch(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  // Character-by-character comparison — timing side-channel
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}

package/dist/packages/crucible/seeds/ts/seed-037.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: typescript
+// expected: timing attack via string comparison of HMAC signatures
+
+import * as crypto from 'crypto';
+
+const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
+
+export function computeSignature(payload: string): string {
+  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
+}
+
+export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
+  const expectedSig = computeSignature(payload);
+  // Timing attack: early exit on first mismatch leaks signature length/prefix
+  return expectedSig === receivedSig;
+}
+
+export function verifyApiKey(providedKey: string, storedKey: string): boolean {
+  // Direct string comparison — vulnerable to timing oracle attack
+  return providedKey === storedKey;
+}
+
+export function checkTokenMatch(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  // Character-by-character comparison — timing side-channel
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}

package/dist/packages/crucible/seeds/ts/seed-038 2.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-038.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-039 2.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-039.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;