thuban 0.4.0 → 0.4.1

package/dist/packages/crucible/seeds/python/seed-047 3.py

@@ -1,44 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
-
-import aiohttp
-from fastapi import FastAPI, Body
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class NotificationConfig(BaseModel):
-    webhook_url: str    # user-controlled
-    event_type: str
-    secret: str = ""
-
-
-class ImportRequest(BaseModel):
-    data_url: str       # user-controlled source URL
-    format: str = "json"
-
-
-@app.post("/notifications/send")
-async def send_notification(config: NotificationConfig):
-    async with aiohttp.ClientSession() as session:
-        # webhook_url from user — attacker targets http://10.0.0.1/admin
-        async with session.post(
-            config.webhook_url,
-            json={"event": config.event_type},
-            headers={"X-Secret": config.secret},
-            timeout=aiohttp.ClientTimeout(total=10),
-            allow_redirects=True,  # follows redirects — pivot to internal
-        ) as resp:
-            return {"status": resp.status}
-
-
-@app.post("/data/import")
-async def import_data(req: ImportRequest):
-    async with aiohttp.ClientSession() as session:
-        async with session.get(req.data_url) as resp:
-            data = await resp.text()
-    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-048 3.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.loads used with untrusted data — arbitrary code execution
-
-import pickle
-import base64
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/session/restore", methods=["POST"])
-def restore_session():
-    session_data = request.cookies.get("session", "")
-    if not session_data:
-        return jsonify({"error": "No session"}), 401
-
-    try:
-        # pickle.loads executes arbitrary Python code embedded in the payload
-        # Attacker payload: object with __reduce__ returning os.system('id')
-        decoded = base64.b64decode(session_data)
-        session = pickle.loads(decoded)
-        return jsonify({"user": session.get("user"), "role": session.get("role")})
-    except Exception as e:
-        return jsonify({"error": "Invalid session"}), 400
-
-
-@app.route("/cache/get", methods=["POST"])
-def get_cached():
-    raw = request.get_json().get("data", "")
-    # Data from Redis — but Redis can be poisoned by attacker
-    obj = pickle.loads(base64.b64decode(raw))
-    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-049 3.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
-
-import pickle
-import shelve
-from fastapi import FastAPI, UploadFile, File, HTTPException
-
-app = FastAPI()
-
-
-@app.post("/models/load")
-async def load_model(file: UploadFile = File(...)):
-    contents = await file.read()
-    try:
-        # User-uploaded .pkl file deserialized without any validation
-        model = pickle.loads(contents)
-        return {"model_type": type(model).__name__}
-    except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-
-@app.get("/cache/{key}")
-def get_from_cache(key: str):
-    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
-    with shelve.open("/var/cache/app_cache") as db:
-        if key not in db:
-            raise HTTPException(status_code=404, detail="Not found")
-        value = db[key]  # deserialized via pickle
-    return {"value": value}
-
-
-@app.post("/tasks/restore")
-async def restore_task_state(file: UploadFile = File(...)):
-    data = await file.read()
-    state = pickle.loads(data)  # untrusted task state from client
-    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-050 3.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: high
-# language: python
-# expected: marshal.loads and jsonpickle.decode used with untrusted data
-
-import marshal
-import jsonpickle
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.post("/code/load")
-def load_code():
-    """Load a compiled Python code object from client."""
-    data = request.get_data()
-    # marshal.loads with user data can reconstruct code objects — arbitrary execution
-    code_obj = marshal.loads(data)
-    result = eval(code_obj)
-    return jsonify({"result": str(result)})
-
-
-@app.post("/object/restore")
-def restore_object():
-    payload = request.get_json()
-    serialized = payload.get("object", "")
-    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
-    obj = jsonpickle.decode(serialized)
-    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
-
-
-@app.post("/state/import")
-def import_state():
-    body = request.get_json()
-    state_json = body.get("state", "null")
-    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
-    state = jsonpickle.decode(state_json, classes=None)
-    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-051 3.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_injection
-# severity: critical
-# language: python
-# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
-
-import yaml
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/config/upload", methods=["POST"])
-def upload_config():
-    raw_yaml = request.data.decode("utf-8")
-    # yaml.load without Loader= defaults to full deserialization — RCE possible
-    # Attacker payload: "!!python/object/apply:os.system ['id']"
-    config = yaml.load(raw_yaml)
-    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
-
-
-@app.route("/workflow/import", methods=["POST"])
-def import_workflow():
-    yaml_content = request.get_json().get("yaml", "")
-    # yaml.load with untrusted string
-    workflow = yaml.load(yaml_content)
-    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
-    return jsonify({"steps": steps})
-
-
-@app.route("/settings/restore", methods=["POST"])
-def restore_settings():
-    uploaded = request.files.get("settings")
-    if not uploaded:
-        return jsonify({"error": "No file"}), 400
-    content = uploaded.read().decode("utf-8")
-    settings = yaml.load(content)  # unsafe loader
-    return jsonify({"restored": True, "settings": settings})

package/dist/packages/crucible/seeds/python/seed-052 3.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_injection
-# severity: critical
-# language: python
-# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML
-
-import yaml
-import os
-from pathlib import Path
-
-
-def load_pipeline_config(config_path: str) -> dict:
-    """Load a pipeline configuration from a YAML file."""
-    with open(config_path, "r") as f:
-        # yaml.load() without Loader allows arbitrary Python object instantiation
-        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
-        return yaml.load(f)
-
-
-def load_user_preferences(user_id: str) -> dict:
-    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
-    if not prefs_path.exists():
-        return {}
-    with prefs_path.open() as f:
-        # User controls their own preference file — YAML injection if file content is user-controlled
-        return yaml.load(f.read())
-
-
-def merge_configs(*config_paths: str) -> dict:
-    merged = {}
-    for path in config_paths:
-        with open(path) as f:
-            data = yaml.load(f)  # unsafe
-            if isinstance(data, dict):
-                merged.update(data)
-    return merged
-
-
-def parse_webhook_payload(yaml_str: str) -> dict:
-    # Webhook body parsed as YAML without safe_load
-    return yaml.load(yaml_str)

package/dist/packages/crucible/seeds/ruby/seed-001 3.rb

@@ -1,15 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Rails secret_key_base in source code
-
-module MyApp
-  class Application < Rails::Application
-    config.secret_key_base = "b3f6d9e2a1c4f7a8b9d0e1f2a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
-
-    config.active_record.encryption.primary_key   = "my_primary_encryption_key_not_secret"
-    config.active_record.encryption.deterministic_key = "my_deterministic_key_not_secret_too"
-    config.active_record.encryption.key_derivation_salt = "my_key_derivation_salt_hardcoded"
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-002 3.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded database password in database.yml equivalent or initializer
-
-DB_CONFIG = {
-  adapter:  'postgresql',
-  host:     'prod-db.example.com',
-  database: 'production_db',
-  username: 'app_user',
-  password: 'Sup3rS3cr3tP@ssw0rd!2024',
-  port:     5432
-}.freeze
-
-REDIS_URL = 'redis://:myR3d1sS3cret@redis.prod.example.com:6379/0'
-MONGO_URI = 'mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb'
-
-def establish_db_connection
-  puts "Connecting with password: #{DB_CONFIG[:password]}"
-  ActiveRecord::Base.establish_connection(DB_CONFIG)
-end

package/dist/packages/crucible/seeds/ruby/seed-003 3.rb

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded AWS credentials in Ruby initializer
-
-require 'aws-sdk-s3'
-
-AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1'
-AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
-AWS_REGION     = 'us-east-1'
-S3_BUCKET      = 'my-production-bucket'
-
-Aws.config.update(
-  region:      AWS_REGION,
-  credentials: Aws::Credentials.new(AWS_ACCESS_KEY, AWS_SECRET_KEY)
-)
-
-def s3_client
-  Aws::S3::Client.new(
-    access_key_id:     AWS_ACCESS_KEY,
-    secret_access_key: AWS_SECRET_KEY,
-    region:            AWS_REGION
-  )
-end

package/dist/packages/crucible/seeds/ruby/seed-004 3.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Stripe API keys in Rails initializer
-
-Stripe.api_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
-
-STRIPE_CONFIG = {
-  publishable_key: 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu',
-  webhook_secret:  'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ',
-  api_key:         'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
-}.freeze
-
-def charge_customer(amount, token)
-  Stripe::Charge.create(amount: amount, currency: 'usd', source: token)
-end

package/dist/packages/crucible/seeds/ruby/seed-005 3.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: ruby
-# expected: Hardcoded JWT secret and admin API token
-
-JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
-ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
-
-def generate_jwt(payload)
-  JWT.encode(payload, JWT_SECRET, 'HS256')
-end
-
-def verify_admin(token)
-  token == ADMIN_TOKEN
-end
-
-def sign_request(body)
-  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
-end

package/dist/packages/crucible/seeds/ruby/seed-006 3.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded OAuth client secret and social login credentials
-
-GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
-GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
-GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
-
-OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
-
-Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
-  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
-end

package/dist/packages/crucible/seeds/ruby/seed-007 3.rb

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Twilio credentials and SendGrid API key
-
-TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
-TWILIO_PHONE       = '+15005550006'
-SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
-
-def send_sms(to, message)
-  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
-  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
-  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
-end

package/dist/packages/crucible/seeds/ruby/seed-008 3.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Slack webhook URL and signing secret
-
-SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
-SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
-SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
-
-def post_to_slack(message)
-  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
-  Net::HTTP.post(
-    URI(SLACK_WEBHOOK_URL),
-    { text: message }.to_json,
-    'Content-Type' => 'application/json'
-  )
-end

package/dist/packages/crucible/seeds/ruby/seed-009 3.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: SQL injection via string interpolation in ActiveRecord where()
-
-class UserController < ApplicationController
-  def search
-    username = params[:username]
-    @users = User.where("username = '#{username}'")
-    render json: @users
-  end
-
-  def filter
-    role  = params[:role]
-    since = params[:since]
-    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
-    render json: @records
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-010 3.rb

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: ActiveRecord find_by_sql with string interpolation
-
-class ReportController < ApplicationController
-  def show
-    user_id = params[:user_id]
-    type    = params[:type]
-    @data = Report.find_by_sql(
-      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
-    )
-    render json: @data
-  end
-
-  def custom_query
-    condition = params[:condition]
-    @results = ActiveRecord::Base.connection.execute(
-      "SELECT * FROM events WHERE #{condition}"
-    )
-    render json: @results.to_a
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-011 3.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: ORDER BY clause built from user-supplied column name without whitelist
-
-class ProductsController < ApplicationController
-  def index
-    sort_col = params[:sort_by]
-    sort_dir = params[:direction]
-    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
-    render json: @products
-  end
-
-  def search
-    term     = params[:q]
-    category = params[:category]
-    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
-    render json: @items
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-012 3.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: Raw SQL executed via connection.execute with user input
-
-def run_analytics(dimension, filter_expr)
-  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
-  ActiveRecord::Base.connection.execute(sql)
-end
-
-def delete_records(table, condition)
-  ActiveRecord::Base.connection.execute(
-    "DELETE FROM #{table} WHERE #{condition}"
-  )
-end
-
-def update_field(table, field, value, id)
-  ActiveRecord::Base.connection.execute(
-    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
-  )
-end

package/dist/packages/crucible/seeds/ruby/seed-013 3.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: Sequel dataset filter with string interpolation
-
-require 'sequel'
-
-DB = Sequel.connect('sqlite://db/production.sqlite3')
-
-def find_user(username, password)
-  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
-end
-
-def get_orders(status, user_id)
-  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
-end
-
-def search_items(keyword)
-  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
-end

package/dist/packages/crucible/seeds/ruby/seed-014 3.rb

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: high
-# language: ruby
-# expected: ActiveRecord group/having clause with unparameterized user input
-
-class AnalyticsController < ApplicationController
-  def aggregate
-    group_by = params[:group_by]
-    having   = params[:having]
-    @data = Order.group(group_by)
-                 .having("COUNT(*) #{having}")
-                 .select("#{group_by}, COUNT(*) as total")
-    render json: @data
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-015 3.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: pg gem exec_params replaced with exec — user string in raw SQL
-
-require 'pg'
-
-conn = PG.connect(dbname: 'production')
-
-def login(conn, username, password)
-  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
-  result.first
-end
-
-def get_profile(conn, user_id)
-  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
-end

package/dist/packages/crucible/seeds/ruby/seed-016 3.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: render html: with user content — unescaped XSS
-
-class CommentsController < ApplicationController
-  def show
-    @comment = Comment.find(params[:id])
-    render html: @comment.body.html_safe
-  end
-
-  def preview
-    content = params[:content]
-    render html: content.html_safe
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-017 3.rb

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: raw() helper used with user-controlled content in ERB template
-
-# In a Rails view (equivalent Ruby)
-class ArticlesController < ApplicationController
-  helper_method :render_article
-
-  def show
-    @article   = Article.find(params[:id])
-    @title     = params[:title] || @article.title
-    @body      = @article.body
-  end
-end
-
-# Equivalent ERB logic (Ruby):
-def render_article_html(title, body, author_bio)
-  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
-end
-
-def raw(str)
-  str.to_s
-end

package/dist/packages/crucible/seeds/ruby/seed-018 3.rb

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: Sinatra response body includes user param without escaping
-
-require 'sinatra'
-
-get '/greet' do
-  name  = params[:name]
-  query = params[:q]
-  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
-end
-
-get '/error' do
-  msg = params[:message]
-  "<div class='error'>#{msg}</div>"
-end
-
-post '/comment' do
-  comment = params[:comment]
-  "<p>Your comment: #{comment}</p>"
-end

package/dist/packages/crucible/seeds/ruby/seed-019 3.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: ruby
-# expected: User content embedded in JSON output that is then eval()d client-side
-
-class ApiController < ApplicationController
-  def user_data
-    user  = User.find(params[:id])
-    bio   = params[:bio] || user.bio
-    @json = { name: user.name, bio: bio, role: params[:role] }
-    render json: @json
-  end
-
-  def config
-    callback = params[:callback]
-    data     = { status: 'ok', user: current_user&.name }
-    render plain: "#{callback}(#{data.to_json})"
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-020 3.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: content_tag or link_to with unescaped user attribute
-
-def build_link(url, label, css_class)
-  "<a href='#{url}' class='#{css_class}'>#{label}</a>"
-end
-
-def build_input(name, value, placeholder)
-  "<input name='#{name}' value='#{value}' placeholder='#{placeholder}'>"
-end
-
-def build_script_tag(variable_name, data)
-  "<script>var #{variable_name} = #{data.to_json};</script>"
-end