thuban 0.4.0 → 0.4.1

package/dist/packages/crucible/seeds/rust/seed-050 3.rs

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: critical
-// language: rust
-// expected: User-controlled key used to read arbitrary env var — information disclosure
-
-use std::env;
-use axum::{extract::Query, response::IntoResponse};
-use std::collections::HashMap;
-
-pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
-    let key = params.get("key").cloned().unwrap_or_default();
-    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
-    format!("{}={}", key, value)
-}
-
-pub fn lookup_env(user_key: &str) -> String {
-    env::var(user_key).unwrap_or_default()
-}
-
-pub fn set_env_from_input(name: &str, value: &str) {
-    unsafe { env::set_var(name, value) }
-}

package/dist/packages/crucible/seeds/ts/seed-001 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded AWS credentials in typed config object
-
-import * as AWS from 'aws-sdk';
-
-interface AwsCredentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  region: string;
-}
-
-const credentials: AwsCredentials = {
-  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
-  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  region: 'us-east-1',
-};
-
-AWS.config.update(credentials);
-
-const s3 = new AWS.S3();
-const sqs = new AWS.SQS();
-
-export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
-  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
-}
-
-export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
-  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
-}

package/dist/packages/crucible/seeds/ts/seed-002 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded JWT secret in typed auth service
-
-import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
-
-interface TokenPayload {
-  userId: string;
-  role: 'admin' | 'user' | 'moderator';
-  email: string;
-}
-
-const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
-const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
-
-const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
-
-export function signAccessToken(payload: TokenPayload): string {
-  return jwt.sign(payload, JWT_SECRET, signOptions);
-}
-
-export function signRefreshToken(userId: string): string {
-  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
-}
-
-export function verifyAccessToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_SECRET) as JwtPayload;
-}
-
-export function verifyRefreshToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
-}

package/dist/packages/crucible/seeds/ts/seed-003 3.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded database credentials in TypeORM DataSource config
-
-import { DataSource } from 'typeorm';
-import { User } from './entities/User';
-import { Order } from './entities/Order';
-
-export const AppDataSource = new DataSource({
-  type: 'postgres',
-  host: 'prod-postgres.internal',
-  port: 5432,
-  username: 'app_user',
-  password: 'Pr0dPassw0rd!@#$',
-  database: 'production_db',
-  synchronize: false,
-  logging: false,
-  ssl: { rejectUnauthorized: false },
-  entities: [User, Order],
-  migrations: ['dist/migrations/*.js'],
-});
-
-export async function initializeDatabase(): Promise<void> {
-  await AppDataSource.initialize();
-  console.log('Database connection established');
-}

package/dist/packages/crucible/seeds/ts/seed-004 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded Stripe secret key and webhook secret in typed service
-
-import Stripe from 'stripe';
-
-const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
-const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
-
-const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
-
-export async function createPaymentIntent(
-  amount: number,
-  currency: string = 'usd',
-  customerId?: string
-): Promise<Stripe.PaymentIntent> {
-  return stripe.paymentIntents.create({
-    amount,
-    currency,
-    customer: customerId,
-    automatic_payment_methods: { enabled: true },
-  });
-}
-
-export function constructWebhookEvent(
-  payload: Buffer,
-  signature: string
-): Stripe.Event {
-  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
-}
-
-export { stripe };

package/dist/packages/crucible/seeds/ts/seed-005 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
-
-import sgMail from '@sendgrid/mail';
-import nodemailer from 'nodemailer';
-
-const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_KEY);
-
-interface EmailOptions {
-  to: string;
-  subject: string;
-  text?: string;
-  html?: string;
-}
-
-export async function sendTransactional(opts: EmailOptions): Promise<void> {
-  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
-}
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.myapp.com',
-  port: 587,
-  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
-});
-
-export async function sendInternal(opts: EmailOptions): Promise<void> {
-  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
-}

package/dist/packages/crucible/seeds/ts/seed-006 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
-
-import { Octokit } from '@octokit/rest';
-import axios from 'axios';
-
-interface IntegrationConfig {
-  githubToken: string;
-  slackWebhookUrl: string;
-  slackSigningSecret: string;
-}
-
-const config: IntegrationConfig = {
-  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
-  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
-  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
-};
-
-const octokit = new Octokit({ auth: config.githubToken });
-
-export async function postToSlack(text: string): Promise<void> {
-  await axios.post(config.slackWebhookUrl, { text });
-}
-
-export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
-  const { data } = await octokit.issues.create({ owner, repo, title });
-  return data.number;
-}

package/dist/packages/crucible/seeds/ts/seed-007 3.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded encryption key and static IV in typed crypto utility
-
-import * as crypto from 'crypto';
-
-const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
-const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
-
-export function encrypt(plaintext: string): string {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-}
-
-export function decrypt(ciphertext: string): string {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-export function hashToken(token: string): string {
-  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
-}

package/dist/packages/crucible/seeds/ts/seed-008 3.ts

@@ -1,40 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded OAuth2 client credentials and admin API key in typed config
-
-import { Router, Request, Response } from 'express';
-
-interface OAuthConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-interface AdminConfig {
-  apiKey: string;
-  adminPassword: string;
-}
-
-const oauthConfig: OAuthConfig = {
-  clientId: 'oauth2-client-production-id-abc123',
-  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
-  redirectUri: 'https://app.company.com/oauth/callback',
-};
-
-const adminConfig: AdminConfig = {
-  apiKey: 'admin-api-key-supersecret-prod-2024',
-  adminPassword: 'AdminP@ssw0rd!#$',
-};
-
-const router = Router();
-
-router.post('/oauth/token', (req: Request, res: Response) => {
-  if (req.body.client_secret !== oauthConfig.clientSecret) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  res.json({ access_token: 'generated', token_type: 'bearer' });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-009 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection via TypeORM query() with string concatenation
-
-import { AppDataSource } from '../data-source';
-
-export async function findUserByUsername(username: string) {
-  // Raw query with direct string interpolation — bypasses parameterization
-  const result = await AppDataSource.query(
-    `SELECT * FROM users WHERE username = '${username}'`
-  );
-  return result[0] ?? null;
-}
-
-export async function searchProducts(term: string, category: string) {
-  const sql = `
-    SELECT p.*, c.name as category_name
-    FROM products p
-    JOIN categories c ON p.category_id = c.id
-    WHERE p.name ILIKE '%` + term + `%'
-    AND c.slug = '` + category + `'
-    ORDER BY p.created_at DESC
-  `;
-  return AppDataSource.query(sql);
-}
-
-export async function deleteUserSessions(userId: string) {
-  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
-}

package/dist/packages/crucible/seeds/ts/seed-010 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in TypeORM repository createQueryBuilder with raw where clause
-
-import { Repository } from 'typeorm';
-import { User } from '../entities/User';
-
-export class UserRepository {
-  constructor(private repo: Repository<User>) {}
-
-  async findByEmail(email: string): Promise<User | null> {
-    return this.repo
-      .createQueryBuilder('user')
-      // Direct interpolation into where() — SQL injection
-      .where(`user.email = '${email}'`)
-      .getOne();
-  }
-
-  async searchByName(query: string, role: string): Promise<User[]> {
-    return this.repo
-      .createQueryBuilder('user')
-      .where(`user.name ILIKE '%${query}%' AND user.role = '${role}'`)
-      .orderBy('user.createdAt', 'DESC')
-      .getMany();
-  }
-
-  async getByIds(ids: string[]): Promise<User[]> {
-    const idList = ids.join(', ');
-    return this.repo.query(`SELECT * FROM users WHERE id IN (${idList})`);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-011 3.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in Prisma $queryRaw with tagged template bypassed via string concat
-
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
-export async function getUserOrders(userId: string, status: string) {
-  // $queryRawUnsafe does NOT parameterize — direct string concatenation
-  const orders = await prisma.$queryRawUnsafe(
-    `SELECT * FROM orders WHERE user_id = '${userId}' AND status = '${status}'`
-  );
-  return orders;
-}
-
-export async function searchInventory(searchTerm: string, warehouseId: string) {
-  const query = `
-    SELECT i.*, w.name as warehouse
-    FROM inventory i
-    JOIN warehouses w ON i.warehouse_id = w.id
-    WHERE i.sku ILIKE '%` + searchTerm + `%'
-    OR i.description ILIKE '%` + searchTerm + `%'
-    AND w.id = '` + warehouseId + `'
-  `;
-  return prisma.$queryRawUnsafe(query);
-}

package/dist/packages/crucible/seeds/ts/seed-012 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in NestJS service using raw pg query with string interpolation
-
-import { Injectable } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/typeorm';
-import { Connection } from 'typeorm';
-
-@Injectable()
-export class ReportService {
-  constructor(@InjectConnection() private connection: Connection) {}
-
-  async getRevenueReport(fromDate: string, toDate: string, groupBy: string): Promise<any[]> {
-    const sql = `
-      SELECT
-        ${groupBy} as period,
-        SUM(amount) as total_revenue,
-        COUNT(*) as transaction_count
-      FROM transactions
-      WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
-      GROUP BY ${groupBy}
-      ORDER BY period ASC
-    `;
-    return this.connection.query(sql);
-  }
-
-  async getUserActivity(userId: string, action: string): Promise<any[]> {
-    return this.connection.query(
-      `SELECT * FROM audit_log WHERE user_id = '` + userId + `' AND action = '` + action + `'`
-    );
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-013 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via dynamic ORDER BY column name from user input
-
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-interface ListOptions {
-  sortField: string;  // user-controlled
-  sortDir: 'asc' | 'desc';  // type claim but not validated
-  limit: number;
-  offset: number;
-  filter?: string;
-}
-
-export async function listProducts(opts: ListOptions) {
-  // sortField and sortDir inserted verbatim — type annotations don't prevent injection
-  const query = `
-    SELECT id, name, price, stock, created_at
-    FROM products
-    WHERE archived = false
-    ${opts.filter ? `AND name ILIKE '%${opts.filter}%'` : ''}
-    ORDER BY ${opts.sortField} ${opts.sortDir}
-    LIMIT ${opts.limit} OFFSET ${opts.offset}
-  `;
-  const { rows } = await pool.query(query);
-  return rows;
-}

package/dist/packages/crucible/seeds/ts/seed-014 3.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in authentication middleware via raw query with login credentials
-
-import { Request, Response, NextFunction } from 'express';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export async function authenticateMiddleware(
-  req: Request,
-  res: Response,
-  next: NextFunction
-): Promise<void> {
-  const { username, password } = req.body as { username: string; password: string };
-
-  // Classic auth bypass: username = "admin'--"
-  const query = `
-    SELECT id, username, role, email
-    FROM users
-    WHERE username = '${username}'
-    AND password_hash = crypt('${password}', password_hash)
-    AND active = true
-  `;
-
-  const { rows } = await pool.query(query);
-  if (!rows.length) {
-    res.status(401).json({ error: 'Invalid credentials' });
-    return;
-  }
-
-  req.user = rows[0];
-  next();
-}

package/dist/packages/crucible/seeds/ts/seed-015 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via Sequelize literal() with user-controlled search input
-
-import { Sequelize, QueryTypes } from 'sequelize';
-
-const sequelize = new Sequelize(process.env.DATABASE_URL!);
-
-export async function fullTextSearch(
-  query: string,
-  table: 'products' | 'articles' | 'users',
-  fields: string[]
-): Promise<Record<string, unknown>[]> {
-  const fieldList = fields.join(', ');
-  const whereClause = fields
-    .map(f => `${f} ILIKE '%${query}%'`)
-    .join(' OR ');
-
-  // Both fieldList and whereClause derived from user input — injection possible
-  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-export async function bulkUpdate(ids: number[], status: string): Promise<void> {
-  const idList = ids.join(',');
-  await sequelize.query(
-    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
-  );
-}

package/dist/packages/crucible/seeds/ts/seed-016 3.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
-
-import React from 'react';
-
-interface Comment {
-  id: string;
-  author: string;
-  body: string;
-  avatarHtml: string;
-}
-
-interface CommentCardProps {
-  comment: Comment;
-}
-
-export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
-  return (
-    <div className="comment-card">
-      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
-      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
-      <div className="author">{comment.author}</div>
-      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
-    </div>
-  );
-};
-
-interface RichTextProps {
-  content: string; // user-submitted rich text
-}
-
-export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
-  <article dangerouslySetInnerHTML={{ __html: content }} />
-);

package/dist/packages/crucible/seeds/ts/seed-017 3.ts

@@ -1,44 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Angular [innerHTML] binding with user-controlled data
-
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { UserService } from '../services/user.service';
-
-interface UserProfile {
-  displayName: string;
-  bio: string;        // Rich HTML from user
-  signature: string;  // HTML signature from user
-}
-
-@Component({
-  selector: 'app-user-profile',
-  template: `
-    <div class="profile">
-      <h1>{{ user?.displayName }}</h1>
-      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
-      <div class="bio" [innerHTML]="trustedBio"></div>
-      <footer [innerHTML]="trustedSignature"></footer>
-    </div>
-  `,
-})
-export class UserProfileComponent implements OnInit {
-  user: UserProfile | null = null;
-  trustedBio: any;
-  trustedSignature: any;
-
-  constructor(private route: ActivatedRoute, private userService: UserService) {}
-
-  ngOnInit(): void {
-    const id = this.route.snapshot.paramMap.get('id')!;
-    this.userService.getProfile(id).subscribe(user => {
-      this.user = user;
-      // Bypasses Angular's built-in XSS protection
-      this.trustedBio = user.bio;
-      this.trustedSignature = user.signature;
-    });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-018 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via innerHTML in typed DOM manipulation utility
-
-export class DomRenderer {
-  private container: HTMLElement;
-
-  constructor(containerId: string) {
-    this.container = document.getElementById(containerId) as HTMLElement;
-  }
-
-  renderUserContent(content: string): void {
-    // Direct innerHTML assignment — content from user input
-    this.container.innerHTML = content;
-  }
-
-  appendItem(title: string, description: string): void {
-    // Template literal with user data written to innerHTML
-    this.container.innerHTML += `
-      <div class="item">
-        <h3>${title}</h3>
-        <p>${description}</p>
-      </div>
-    `;
-  }
-
-  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
-    const banner = document.querySelector('.banner') as HTMLElement;
-    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-019 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Express response with unsanitized template literal containing user input
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-router.get('/search', (req: Request, res: Response) => {
-  const query = (req.query.q as string) || '';
-  const category = (req.query.cat as string) || 'all';
-
-  // Both query and category embedded directly in HTML without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html lang="en">
-      <head><title>Search - ${category}</title></head>
-      <body>
-        <h1>Results for: <em>${query}</em></h1>
-        <p>Category: ${category}</p>
-        <script>
-          const searchQuery = "${query}";
-          const searchCategory = "${category}";
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-export default router;