thuban 0.4.0 → 0.4.1

package/dist/packages/crucible/seeds/ts/seed-040 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via bracket-notation assignment with user-controlled key path
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
-  const parts = keyPath.split('.');
-  let cursor: Record<string, unknown> = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    // Allows "__proto__" or "constructor" as path segment
-    if (typeof cursor[part] !== 'object') cursor[part] = {};
-    cursor = cursor[part] as Record<string, unknown>;
-  }
-  cursor[parts[parts.length - 1]] = value;
-}
-
-router.patch('/user/preference', (req: Request, res: Response) => {
-  const { key, value } = req.body as { key: string; value: unknown };
-  const userPrefs: Record<string, unknown> = {};
-  // key = "__proto__.admin" → Object.prototype.admin = value
-  setProperty(userPrefs, key, value);
-  res.json({ updated: true });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-041 3.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const globalAppConfig: Record<string, unknown> = {};
-
-router.post('/admin/config/set', (req: Request, res: Response) => {
-  const { path, value } = req.body as { path: string; value: unknown };
-  // _.set with user-controlled path — vulnerable to prototype pollution
-  // e.g. path = "__proto__.isAdmin", value = true
-  _.set(globalAppConfig, path, value);
-  res.json({ ok: true });
-});
-
-router.post('/ui/theme', (req: Request, res: Response) => {
-  const userTheme = req.body as Record<string, unknown>;
-  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
-  // _.merge pollutes prototype when userTheme contains __proto__
-  const merged = _.merge({}, defaultTheme, userTheme);
-  res.json({ theme: merged });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-042 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: medium
-// language: typescript
-// expected: prototype pollution via constructor.prototype path in Object.assign chain
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface PluginConfig {
-  [key: string]: unknown;
-}
-
-function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
-  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
-  return Object.assign({}, baseOptions, userOptions);
-}
-
-router.post('/plugins/:id/configure', (req: Request, res: Response) => {
-  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
-  // req.body passed directly — {"__proto__": {"polluted": true}}
-  const config = applyPluginOptions(base, req.body as PluginConfig);
-  res.json({ configured: true, config });
-});
-
-router.patch('/plugins/:id/update', (req: Request, res: Response) => {
-  // Spread operator with user body — same pollution vector
-  const updated = { ...{}, ...req.body };
-  res.json({ updated });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-043 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via qs-parsed query params passed to deep clone utility
-
-import * as qs from 'qs';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function cloneDeep<T extends object>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
-}
-
-function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
-  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
-  for (const [key, val] of Object.entries(filter)) {
-    (base as Record<string, unknown>)[key] = val;
-  }
-  return base;
-}
-
-router.get('/items', (req: Request, res: Response) => {
-  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
-  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
-  const baseQuery = { page: 1, limit: 20, active: true };
-  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
-  res.json({ query: merged });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-044 3.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: eval() called with user-controlled expression in typed handler
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface CalcRequest {
-  expression: string;
-}
-
-router.post('/calc', (req: Request, res: Response) => {
-  const { expression } = req.body as CalcRequest;
-  try {
-    // TypeScript types don't prevent runtime eval injection
-    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
-    // eslint-disable-next-line no-eval
-    const result = eval(expression);
-    res.json({ result });
-  } catch (err: any) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.get('/render-tpl', (req: Request, res: Response) => {
-  const tpl = req.query.tpl as string;
-  const user = req.session?.user ?? {};
-  // eval of backtick template with user-controlled string
-  const output = eval('`' + tpl + '`');
-  res.send(output);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-045 3.ts

@@ -1,39 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: new Function() constructor with user-supplied code string in typed scripting service
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScriptRequest {
-  code: string;
-  context?: Record<string, unknown>;
-}
-
-function executeUserScript(code: string, context: Record<string, unknown>): unknown {
-  // new Function() is not sandboxed — full access to global scope
-  const fn = new Function('ctx', 'Math', 'JSON', `
-    with (ctx) {
-      ${code}
-    }
-  `);
-  return fn(context, Math, JSON);
-}
-
-router.post('/scripting/execute', (req: Request, res: Response) => {
-  const { code, context = {} } = req.body as ScriptRequest;
-  const result = executeUserScript(code, context);
-  res.json({ result });
-});
-
-router.post('/hooks/transform', (req: Request, res: Response) => {
-  const { transformCode } = req.body;
-  const transform = new Function('data', 'helpers', transformCode);
-  const output = transform(req.body.data, { JSON, Math });
-  res.json({ output });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-046 3.ts

@@ -1,41 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: typescript
-// expected: eval() inside JSON reviver executing serialized function strings from DB
-
-interface SerializedConfig {
-  [key: string]: unknown;
-}
-
-export function deserializeConfig(raw: string): SerializedConfig {
-  return JSON.parse(raw, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__function__:')) {
-      const fnBody = value.slice(13);
-      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
-      // eslint-disable-next-line no-eval
-      return eval(`(${fnBody})`);
-    }
-    return value;
-  });
-}
-
-interface PipelineStep {
-  name: string;
-  handler: ((input: unknown) => unknown) | string;
-}
-
-export function loadPipeline(configJson: string): PipelineStep[] {
-  const config = deserializeConfig(configJson);
-  return config.steps as PipelineStep[];
-}
-
-export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
-  let result = input;
-  for (const step of steps) {
-    if (typeof step.handler === 'function') {
-      result = await step.handler(result);
-    }
-  }
-  return result;
-}

package/dist/packages/crucible/seeds/ts/seed-047 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: lodash template compilation with user-controlled template string (code execution)
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface TemplateRequest {
-  template: string;
-  data: Record<string, unknown>;
-}
-
-router.post('/email/preview', async (req: Request, res: Response) => {
-  const { template, data } = req.body as TemplateRequest;
-  // _.template compiles and executes JS inside <%= %> delimiters
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const output = compiled(data);
-  res.type('text/html').send(output);
-});
-
-router.get('/report/preview', (req: Request, res: Response) => {
-  const tpl = req.query.template as string;
-  const vars = JSON.parse(req.query.vars as string ?? '{}');
-  const compiled = _.template(tpl);
-  res.send(compiled(vars));
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-048 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via fetch with unvalidated user-supplied URL
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ProxyRequest {
-  url: string;
-  method?: 'GET' | 'POST';
-  headers?: Record<string, string>;
-}
-
-router.post('/proxy', async (req: Request, res: Response) => {
-  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
-  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
-  const response = await fetch(url, { method, headers });
-  const body = await response.text();
-  res.status(response.status).send(body);
-});
-
-router.get('/preview', async (req: Request, res: Response) => {
-  const targetUrl = req.query.url as string;
-  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
-  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
-  const data = await resp.text();
-  res.json({ preview: data.slice(0, 500) });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-049 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via axios with user-controlled webhook URL and redirect following
-
-import axios from 'axios';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface WebhookConfig {
-  url: string;
-  secret?: string;
-}
-
-router.post('/webhooks/test', async (req: Request, res: Response) => {
-  const { url, secret } = req.body as WebhookConfig;
-  // url user-controlled — attacker probes internal network
-  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
-    headers: { 'X-Webhook-Secret': secret ?? '' },
-    maxRedirects: 5,  // follows redirects — can pivot to internal services
-    timeout: 10000,
-  });
-  res.json({ status: response.status, data: response.data });
-});
-
-router.get('/import', async (req: Request, res: Response) => {
-  const dataUrl = req.query.source as string;
-  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
-  res.set('Content-Type', 'application/octet-stream').send(data);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-050 3.ts

@@ -1,41 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
-
-import got from 'got';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface LinkPreviewResult {
-  title: string;
-  description: string;
-  image?: string;
-  url: string;
-}
-
-router.get('/link-preview', async (req: Request, res: Response) => {
-  const url = req.query.url as string;
-
-  // url is user-controlled — attacker can reach internal services
-  const response = await got(url, {
-    followRedirect: true,
-    timeout: { request: 8000 },
-    throwHttpErrors: false,
-  });
-
-  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
-  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
-
-  const result: LinkPreviewResult = {
-    title: titleMatch?.[1] ?? '',
-    description: descMatch?.[1] ?? '',
-    url,
-  };
-
-  res.json(result);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-051 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: typescript
-// expected: unsafe deserialization via class-transformer plainToClass with user-controlled type
-
-import { plainToClass } from 'class-transformer';
-import { IsString, IsNumber } from 'class-validator';
-import { Request, Response, Router } from 'express';
-
-class UserDto {
-  @IsString() username!: string;
-  @IsString() email!: string;
-  @IsNumber() role!: number;
-}
-
-class AdminDto extends UserDto {
-  @IsString() adminToken!: string;
-  canDeleteUsers: boolean = true;
-}
-
-const router = Router();
-
-router.post('/users/import', (req: Request, res: Response) => {
-  const { type, data } = req.body;
-
-  // User controls which class to deserialize into — can escalate to AdminDto
-  const DtoClass = type === 'admin' ? AdminDto : UserDto;
-  const instance = plainToClass(DtoClass, data);
-  // No validation step — properties set without checking constraints
-  res.json({ created: instance });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-052 3.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: typescript
-// expected: unsafe deserialization via JSON.parse used to dynamically dispatch method calls
-
-import { Request, Response, Router } from 'express';
-
-interface TaskDescriptor {
-  module: string;
-  method: string;
-  args: unknown[];
-}
-
-const allowedModules: Record<string, Record<string, (...args: unknown[]) => unknown>> = {
-  reports: require('./reports'),
-  notifications: require('./notifications'),
-};
-
-router.post('/task/run', (req: Request, res: Response) => {
-  // task is JSON-parsed from user body without schema validation
-  const task = JSON.parse(req.body.taskJson as string) as TaskDescriptor;
-
-  const mod = allowedModules[task.module];
-  if (!mod) return res.status(400).json({ error: 'Unknown module' });
-
-  const fn = mod[task.method];
-  if (typeof fn !== 'function') return res.status(400).json({ error: 'Unknown method' });
-
-  // task.args passed directly — no sanitization or type validation
-  const result = fn(...task.args);
-  res.json({ result });
-});
-
-const router2 = Router();
-export default router2;