thuban 0.4.0 → 0.4.1

package/dist/packages/crucible/seeds/python/seed-025 3.py

@@ -1,40 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.Popen with shell=True and f-string
-
-import subprocess
-from fastapi import FastAPI
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class ImageRequest(BaseModel):
-    image_path: str   # user-controlled
-    width: int
-    height: int
-    quality: int = 85
-
-
-class ReportRequest(BaseModel):
-    format: str       # user-controlled
-    date_range: str   # user-controlled
-
-
-@app.post("/images/thumbnail")
-def generate_thumbnail(req: ImageRequest):
-    # image_path is user-controlled — injection via shell metacharacters
-    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    out, err = proc.communicate(timeout=30)
-    return {"output": out.decode(), "errors": err.decode()}
-
-
-@app.post("/reports/generate")
-def generate_report(req: ReportRequest):
-    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
-    out, _ = proc.communicate()
-    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-026 3.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via os.popen with user-controlled filename
-
-import os
-from flask import Flask, request, send_file
-import io
-
-app = Flask(__name__)
-
-
-@app.route("/export/csv")
-def export_csv():
-    table = request.args.get("table", "users")
-    date = request.args.get("date", "2024-01-01")
-    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
-    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
-    return output, 200, {"Content-Type": "text/csv"}
-
-
-@app.route("/preview/pdf")
-def preview_pdf():
-    filename = request.args.get("file", "")
-    # filename from user — injection via backticks or semicolons
-    output = os.popen(f"pdftotext uploads/{filename} -").read()
-    return {"text": output}
-
-
-@app.route("/image/metadata")
-def image_metadata():
-    path = request.args.get("path", "")
-    result = os.popen(f"exiftool {path}").read()
-    return {"metadata": result}

package/dist/packages/crucible/seeds/python/seed-027 3.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-028 3.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/dist/packages/crucible/seeds/python/seed-030 3.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-031 3.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()

package/dist/packages/crucible/seeds/python/seed-036 3.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-037 3.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True

package/dist/packages/crucible/seeds/python/seed-038 3.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)

package/dist/packages/crucible/seeds/python/seed-039 3.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval() called with user-controlled expression string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/calculate", methods=["POST"])
-def calculate():
-    data = request.get_json()
-    expression = data.get("expression", "")
-    try:
-        # Attacker sends: "__import__('os').system('id')"
-        result = eval(expression)
-        return jsonify({"result": result})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/filter", methods=["POST"])
-def filter_data():
-    data = request.get_json()
-    records = data.get("records", [])
-    condition = data.get("condition", "True")
-    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
-    filtered = [r for r in records if eval(condition, {"r": r})]
-    return jsonify({"results": filtered})
-
-
-@app.route("/transform", methods=["POST"])
-def transform():
-    expr = request.get_json().get("expr", "x")
-    items = request.get_json().get("items", [1, 2, 3])
-    result = list(map(lambda x: eval(expr), items))
-    return jsonify({"result": result})

package/dist/packages/crucible/seeds/python/seed-040 3.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: exec() called with user-controlled code string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/scripting/run", methods=["POST"])
-def run_script():
-    data = request.get_json()
-    code = data.get("code", "")
-    context = data.get("context", {})
-    local_vars = {"result": None, **context}
-    try:
-        # exec() executes arbitrary Python — no sandboxing
-        exec(code, {"__builtins__": __builtins__}, local_vars)
-        return jsonify({"result": local_vars.get("result")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/hooks/execute", methods=["POST"])
-def execute_hook():
-    hook_code = request.get_json().get("hook", "")
-    event = request.get_json().get("event", {})
-    # User-controlled hook code executed server-side
-    exec(hook_code, {"event": event, "print": print})
-    return jsonify({"executed": True})
-
-
-@app.route("/migration/run", methods=["POST"])
-def run_migration():
-    migration_script = request.get_json().get("script", "")
-    exec(compile(migration_script, "<migration>", "exec"))
-    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-041 3.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() used in Jinja2-like custom template rendering with user template string
-
-import re
-from flask import Flask, request
-
-app = Flask(__name__)
-
-
-def render_template(template: str, context: dict) -> str:
-    """Simple template renderer that evaluates {{ expr }} blocks."""
-    def evaluate(match):
-        expr = match.group(1).strip()
-        # eval with user-controlled expression — attacker injects arbitrary Python
-        return str(eval(expr, {"__builtins__": {}}, context))
-
-    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
-
-
-@app.route("/preview", methods=["POST"])
-def preview():
-    data = request.get_json()
-    template = data.get("template", "Hello {{ name }}!")
-    ctx = data.get("context", {"name": "World"})
-    # Attacker template: "{{ __import__('os').system('id') }}"
-    output = render_template(template, ctx)
-    return output
-
-
-@app.route("/report", methods=["POST"])
-def report():
-    tpl = request.form.get("template", "")
-    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
-    return rendered

package/dist/packages/crucible/seeds/python/seed-042 3.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() in pandas query/eval with user-controlled expression
-
-import pandas as pd
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-# Simulated data store
-DATA = pd.DataFrame({
-    "id": range(1, 101),
-    "amount": [i * 10.5 for i in range(1, 101)],
-    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
-    "active": [True] * 100,
-})
-
-
-@app.route("/data/query", methods=["POST"])
-def query_data():
-    body = request.get_json()
-    filter_expr = body.get("filter", "active == True")
-    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
-    # Attacker: "@__import__('os').system('id')"
-    try:
-        result = DATA.query(filter_expr)
-        return jsonify({"count": len(result), "data": result.to_dict("records")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/data/eval", methods=["POST"])
-def eval_expression():
-    expr = request.get_json().get("expr", "amount * 2")
-    result = DATA.eval(expr)
-    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-043 3.py

@@ -1,32 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval()/compile() used to execute user-uploaded Python module code
-
-import ast
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def safe_eval(code: str, context: dict) -> object:
-    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
-    try:
-        tree = ast.parse(code, mode="eval")
-        # compile() + eval() of user AST still allows dangerous constructs
-        compiled = compile(tree, "<user-input>", "eval")
-        return eval(compiled, {"__builtins__": __builtins__}, context)
-    except SyntaxError:
-        # Falls back to exec for multi-line code
-        exec(compile(code, "<user-input>", "exec"), context)
-        return context.get("result")
-
-
-@app.route("/plugin/evaluate", methods=["POST"])
-def evaluate_plugin():
-    payload = request.get_json()
-    code = payload.get("code", "")
-    params = payload.get("params", {})
-    result = safe_eval(code, params)
-    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-044 3.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-045 3.py

@@ -1,36 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-046 3.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})