npm - thuban - Versions diffs - 0.4.0 → 0.4.1 - Mend

thuban 0.4.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (183) hide show

package/dist/packages/crucible/seeds/ts/seed-020 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: typescript
-// expected: XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
-import { GetServerSideProps, NextPage } from 'next';
-interface PageProps {
-  name: string;
-  description: string;
-}
-const ProfilePage: NextPage<PageProps> = ({ name, description }) => {
-  return (
-    <div>
-      <h1>Profile: {name}</h1>
-      {/* description from query string — dangerouslySetInnerHTML without sanitization */}
-      <div dangerouslySetInnerHTML={{ __html: description }} />
-    </div>
-  );
-};
-export const getServerSideProps: GetServerSideProps = async ({ query }) => {
-  return {
-    props: {
-      name: query.name as string ?? 'Unknown',
-      description: query.description as string ?? '',
-    },
-  };
-};
-export default ProfilePage;

package/dist/packages/crucible/seeds/ts/seed-021 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Vue.js v-html directive with user-supplied content
-import { defineComponent, ref, onMounted } from 'vue';
-import axios from 'axios';
-export default defineComponent({
-  name: 'ArticleViewer',
-  props: {
-    articleId: { type: String, required: true },
-  },
-  setup(props) {
-    const article = ref<{ title: string; content: string; authorBio: string } | null>(null);
-    onMounted(async () => {
-      const { data } = await axios.get(`/api/articles/${props.articleId}`);
-      article.value = data;
-    });
-    return { article };
-  },
-  // v-html renders raw HTML — XSS if content contains malicious script tags
-  template: `
-    <div class="article" v-if="article">
-      <h1>{{ article.title }}</h1>
-      <div class="content" v-html="article.content"></div>
-      <aside class="author-bio" v-html="article.authorBio"></aside>
-    </div>
-  `,
-});

package/dist/packages/crucible/seeds/ts/seed-022 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Marked.js rendering user markdown without sanitization
-import marked from 'marked';
-import { Request, Response, Router } from 'express';
-const router = Router();
-interface MarkdownRequest {
-  markdown: string;
-  title?: string;
-}
-router.post('/preview', (req: Request, res: Response) => {
-  const { markdown, title } = req.body as MarkdownRequest;
-  // marked() renders to HTML without XSS protection — <script> tags in markdown execute
-  const renderedHtml = marked(markdown);
-  res.send(`
-    <html>
-      <head><title>${title ?? 'Preview'}</title></head>
-      <body>
-        <h1>${title}</h1>
-        <div class="content">${renderedHtml}</div>
-      </body>
-    </html>
-  `);
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-023 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via child_process.exec with typed but unsanitized user input
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { Request, Response, Router } from 'express';
-const execAsync = promisify(exec);
-const router = Router();
-interface PingRequest {
-  host: string;
-  count?: number;
-}
-router.post('/tools/ping', async (req: Request, res: Response) => {
-  const { host, count = 4 } = req.body as PingRequest;
-  // TypeScript types don't prevent injection — host can be "8.8.8.8; id"
-  const cmd = `ping -c ${count} ${host}`;
-  const { stdout, stderr } = await execAsync(cmd);
-  res.json({ output: stdout, errors: stderr });
-});
-router.post('/tools/traceroute', async (req: Request, res: Response) => {
-  const target: string = req.body.target;
-  const { stdout } = await execAsync(`traceroute ${target}`);
-  res.json({ hops: stdout });
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-024 3.ts DELETED Viewed

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execSync in typed file processing service
-import { execSync } from 'child_process';
-import * as path from 'path';
-interface ConversionOptions {
-  inputPath: string;  // user-controlled filename
-  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
-  quality?: number;
-}
-export class FileConverter {
-  private readonly outputDir: string;
-  constructor(outputDir: string) {
-    this.outputDir = outputDir;
-  }
-  convert(opts: ConversionOptions): string {
-    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
-    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
-    // opts.inputPath is user-controlled — no sanitization before execSync
-    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
-    execSync(cmd, { timeout: 30000 });
-    return outputPath;
-  }
-  extractText(pdfPath: string): string {
-    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-025 3.ts DELETED Viewed

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via spawn with shell:true and user-controlled arguments
-import { spawn } from 'child_process';
-import { Request, Response, Router } from 'express';
-const router = Router();
-function runCommand(cmd: string, args: string[]): Promise<string> {
-  return new Promise((resolve, reject) => {
-    // shell: true means the full command string is interpreted by /bin/sh
-    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
-    let output = '';
-    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
-    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
-    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-router.post('/scripts/run', async (req: Request, res: Response) => {
-  const { script, params }: { script: string; params: string[] } = req.body;
-  const result = await runCommand(`node scripts/${script}`, params);
-  res.json({ output: result });
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-026 3.ts DELETED Viewed

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection via git operations with user-controlled branch/tag names
-import { execSync } from 'child_process';
-interface GitOptions {
-  repoPath: string;
-  branch: string;    // user-controlled
-  remote?: string;
-}
-export class GitService {
-  clone(repoUrl: string, targetDir: string): void {
-    // repoUrl from user — can include shell metacharacters
-    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
-  }
-  checkout(opts: GitOptions): string {
-    // opts.branch may be "main; cat /etc/shadow"
-    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
-  }
-  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
-    return execSync(
-      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
-      { encoding: 'utf8' }
-    );
-  }
-  tag(repoPath: string, tagName: string, message: string): string {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-027 3.ts DELETED Viewed

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection in NestJS service using exec with user-provided report parameters
-import { Injectable } from '@nestjs/common';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-const execAsync = promisify(exec);
-interface ReportParams {
-  format: string;       // user-controlled
-  dateRange: string;    // user-controlled
-  recipient: string;    // user-controlled email
-}
-@Injectable()
-export class ReportingService {
-  async generateAndSendReport(params: ReportParams): Promise<void> {
-    const { format, dateRange, recipient } = params;
-    // All three params go directly into shell command
-    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
-    const { stdout: reportPath } = await execAsync(generateCmd);
-    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
-    await execAsync(sendCmd);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-028 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execa with shell:true and template literal from user data
-import execa from 'execa';
-import { Request, Response, Router } from 'express';
-const router = Router();
-interface ScanRequest {
-  target: string;   // IP or hostname — user-controlled
-  ports?: string;   // port range — user-controlled
-  flags?: string;   // nmap flags — user-controlled
-}
-router.post('/security/scan', async (req: Request, res: Response) => {
-  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
-  try {
-    // All fields from user body — injection via shell metacharacters
-    const { stdout } = await execa.command(
-      `nmap ${flags} -p ${ports} ${target}`,
-      { shell: true, timeout: 60000 }
-    );
-    res.json({ results: stdout });
-  } catch (err: any) {
-    res.status(500).json({ error: err.message });
-  }
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-029 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via unvalidated user path in fs.readFile
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Request, Response, Router } from 'express';
-const router = Router();
-const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
-router.get('/static/:file', async (req: Request, res: Response) => {
-  const requestedFile: string = req.params.file;
-  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
-  const filePath = path.join(PUBLIC_DIR, requestedFile);
-  try {
-    const data = await fs.readFile(filePath, 'utf-8');
-    res.type('text/plain').send(data);
-  } catch {
-    res.status(404).send('Not found');
-  }
-});
-router.get('/download', async (req: Request, res: Response) => {
-  const file = req.query.file as string;
-  // Completely unvalidated — reads arbitrary path on filesystem
-  const content = await fs.readFile(file);
-  res.send(content);
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-030 3.ts DELETED Viewed

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via typed file service with user-controlled subdirectory
-import * as fs from 'fs';
-import * as path from 'path';
-interface FileServiceConfig {
-  baseDir: string;
-}
-export class FileService {
-  private readonly baseDir: string;
-  constructor(config: FileServiceConfig) {
-    this.baseDir = config.baseDir;
-  }
-  readUserFile(userId: string, fileName: string): string {
-    // No normalization check — fileName can be "../../../etc/passwd"
-    const filePath = path.join(this.baseDir, userId, fileName);
-    return fs.readFileSync(filePath, 'utf-8');
-  }
-  listDirectory(userId: string, subDir: string): string[] {
-    // subDir from user — directory traversal possible
-    const dirPath = path.join(this.baseDir, userId, subDir);
-    return fs.readdirSync(dirPath);
-  }
-  deleteFile(userId: string, fileName: string): void {
-    const filePath = path.join(this.baseDir, userId, fileName);
-    fs.unlinkSync(filePath);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-031 3.ts DELETED Viewed

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal in NestJS controller via user-controlled template name
-import { Controller, Get, Query, Res } from '@nestjs/common';
-import { Response } from 'express';
-import * as fs from 'fs';
-import * as path from 'path';
-const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
-@Controller('email')
-export class EmailController {
-  @Get('preview')
-  previewTemplate(
-    @Query('name') templateName: string,
-    @Query('locale') locale: string,
-    @Res() res: Response
-  ): void {
-    // templateName from query — attacker sends "../../config/database"
-    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
-    try {
-      const html = fs.readFileSync(templatePath, 'utf-8');
-      res.type('text/html').send(html);
-    } catch {
-      res.status(404).send('Template not found');
-    }
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-032 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
-import AdmZip from 'adm-zip';
-import * as fs from 'fs';
-import * as path from 'path';
-const EXTRACT_BASE = '/var/app/uploads/extracted';
-export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-  const extractedPaths: string[] = [];
-  for (const entry of entries) {
-    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, entry.getData());
-      extractedPaths.push(outputPath);
-    }
-  }
-  return extractedPaths;
-}

package/dist/packages/crucible/seeds/ts/seed-033 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: typescript
-// expected: path traversal via multer upload with user-controlled destination folder
-import multer, { StorageEngine } from 'multer';
-import * as path from 'path';
-import * as fs from 'fs';
-import { Request } from 'express';
-const UPLOADS_ROOT = '/var/uploads';
-const storage: StorageEngine = multer.diskStorage({
-  destination: (req: Request, file, cb) => {
-    const folder = req.body.folder as string || 'default';
-    // folder from request body — allows writing to arbitrary locations
-    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
-    fs.mkdirSync(destPath, { recursive: true });
-    cb(null, destPath);
-  },
-  filename: (req: Request, file, cb) => {
-    const prefix = req.body.prefix as string || '';
-    // prefix + originalname — originalname may include path separators
-    cb(null, `${prefix}_${file.originalname}`);
-  },
-});
-export const upload = multer({
-  storage,
-  limits: { fileSize: 50 * 1024 * 1024 },
-});

package/dist/packages/crucible/seeds/ts/seed-034 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: MD5 used for password hashing in typed auth service
-import * as crypto from 'crypto';
-import { Pool } from 'pg';
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-export class AuthService {
-  private hashPassword(password: string): string {
-    // MD5 is cryptographically broken — should use bcrypt/argon2
-    return crypto.createHash('md5').update(password).digest('hex');
-  }
-  async register(email: string, password: string): Promise<void> {
-    const hash = this.hashPassword(password);
-    await pool.query(
-      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-      [email, hash]
-    );
-  }
-  async login(email: string, password: string): Promise<boolean> {
-    const hash = this.hashPassword(password);
-    const { rows } = await pool.query(
-      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
-      [email, hash]
-    );
-    return rows.length > 0;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-035 3.ts DELETED Viewed

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: Math.random() used for security tokens, SHA1 for HMAC
-import * as crypto from 'crypto';
-export function generateSessionId(): string {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).slice(2) + Date.now().toString(36);
-}
-export function generateCsrfToken(): string {
-  // Predictable timestamp-based token
-  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
-}
-export function generatePasswordResetToken(userId: string): string {
-  // SHA1 HMAC with weak source of randomness
-  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
-  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
-}
-export function generateApiKey(): string {
-  // Only 32 bits of entropy — trivially brute-forceable
-  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
-  return `key_${rand}`;
-}

package/dist/packages/crucible/seeds/ts/seed-036 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: AES-ECB mode with no IV and RC4 weak cipher usage
-import * as crypto from 'crypto';
-type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
-export class LegacyCrypto {
-  private key: Buffer;
-  constructor(hexKey: string) {
-    this.key = Buffer.from(hexKey, 'hex');
-  }
-  // ECB mode: identical plaintext blocks produce identical ciphertext
-  encryptECB(data: string): string {
-    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-  decryptECB(data: string): string {
-    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
-  }
-  // RC4 is broken — key reuse leads to plaintext recovery
-  encryptRC4(data: string): string {
-    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-037 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: typescript
-// expected: timing attack via string comparison of HMAC signatures
-import * as crypto from 'crypto';
-const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
-export function computeSignature(payload: string): string {
-  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
-}
-export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
-  const expectedSig = computeSignature(payload);
-  // Timing attack: early exit on first mismatch leaks signature length/prefix
-  return expectedSig === receivedSig;
-}
-export function verifyApiKey(providedKey: string, storedKey: string): boolean {
-  // Direct string comparison — vulnerable to timing oracle attack
-  return providedKey === storedKey;
-}
-export function checkTokenMatch(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  // Character-by-character comparison — timing side-channel
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}

package/dist/packages/crucible/seeds/ts/seed-038 3.ts DELETED Viewed

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-import * as crypto from 'crypto';
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}

package/dist/packages/crucible/seeds/ts/seed-039 3.ts DELETED Viewed

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-interface DeepObject {
-  [key: string]: unknown;
-}
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-import { Request, Response, Router } from 'express';
-const router = Router();
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-export default router;