npm - thuban - Versions diffs - 0.4.0 → 0.4.2 - Mend

thuban 0.4.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (209) hide show

package/dist/packages/crucible/seeds/ruby/seed-018 3.rb DELETED Viewed

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: Sinatra response body includes user param without escaping
-require 'sinatra'
-get '/greet' do
-  name  = params[:name]
-  query = params[:q]
-  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
-end
-get '/error' do
-  msg = params[:message]
-  "<div class='error'>#{msg}</div>"
-end
-post '/comment' do
-  comment = params[:comment]
-  "<p>Your comment: #{comment}</p>"
-end

package/dist/packages/crucible/seeds/ruby/seed-019 3.rb DELETED Viewed

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: ruby
-# expected: User content embedded in JSON output that is then eval()d client-side
-class ApiController < ApplicationController
-  def user_data
-    user  = User.find(params[:id])
-    bio   = params[:bio] || user.bio
-    @json = { name: user.name, bio: bio, role: params[:role] }
-    render json: @json
-  end
-  def config
-    callback = params[:callback]
-    data     = { status: 'ok', user: current_user&.name }
-    render plain: "#{callback}(#{data.to_json})"
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-020 3.rb DELETED Viewed

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: content_tag or link_to with unescaped user attribute
-def build_link(url, label, css_class)
-  "<a href='#{url}' class='#{css_class}'>#{label}</a>"
-end
-def build_input(name, value, placeholder)
-  "<input name='#{name}' value='#{value}' placeholder='#{placeholder}'>"
-end
-def build_script_tag(variable_name, data)
-  "<script>var #{variable_name} = #{data.to_json};</script>"
-end

package/dist/packages/crucible/seeds/ruby/seed-021 3.rb DELETED Viewed

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: ActionMailer HTML email built with unescaped user content
-class NotificationMailer < ApplicationMailer
-  def welcome_email(user, custom_message)
-    @user    = user
-    @message = custom_message
-    @subject = params[:subject] || "Welcome!"
-    mail(
-      to:      @user.email,
-      subject: @subject
-    ) do |format|
-      format.html { render html: "<h1>#{@user.name}</h1><p>#{@message}</p>".html_safe }
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-022 3.rb DELETED Viewed

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: ruby
-# expected: ERB template rendered with user string directly substituted
-require 'erb'
-def render_template(template_string, user_data)
-  ERB.new(template_string).result(binding)
-end
-def personalize_email(user_name, promo_code)
-  template = "Hello <%= user_name %>, your promo code is: <%= promo_code %>"
-  ERB.new(template).result(binding)
-end
-def build_page(title, body, footer)
-  tmpl = "<html><head><title><%= title %></title></head><body><%= body %><footer><%= footer %></footer></body></html>"
-  ERB.new(tmpl).result(binding)
-end

package/dist/packages/crucible/seeds/ruby/seed-023 3.rb DELETED Viewed

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: Backtick operator with user-supplied input — command injection
-class SystemController < ApplicationController
-  def ping
-    host   = params[:host]
-    result = `ping -c 4 #{host}`
-    render plain: result
-  end
-  def dns_lookup
-    domain = params[:domain]
-    output = `nslookup #{domain}`
-    render plain: output
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-024 3.rb DELETED Viewed

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: system() with user-controlled arguments — command injection
-def convert_image(src, dest, width, height)
-  system("convert #{src} -resize #{width}x#{height} #{dest}")
-end
-def compress_archive(dir_path, output_name)
-  system("tar -czf /tmp/#{output_name} #{dir_path}")
-end
-def run_script(script_name, args)
-  system("/opt/scripts/#{script_name} #{args}")
-end

package/dist/packages/crucible/seeds/ruby/seed-025 3.rb DELETED Viewed

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: exec() with user-controlled command — replaces process, no return
-def execute_task(command)
-  exec(command)
-end
-def run_user_script(script_path, user_arg)
-  exec("ruby #{script_path} #{user_arg}")
-end
-def start_service(service_name, config_file)
-  exec("#{service_name} --config #{config_file}")
-end

package/dist/packages/crucible/seeds/ruby/seed-026 3.rb DELETED Viewed

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: Open3.capture2 with shell string — user input in format string
-require 'open3'
-def run_ffmpeg(input_file, output_file, codec)
-  cmd    = "ffmpeg -i '#{input_file}' -c:v #{codec} '#{output_file}'"
-  stdout, stderr, status = Open3.capture2(cmd)
-  { output: stdout, error: stderr, success: status.success? }
-end
-def grep_logs(pattern, log_file)
-  stdout, _ = Open3.capture2("grep -n '#{pattern}' /var/log/#{log_file}")
-  stdout
-end

package/dist/packages/crucible/seeds/ruby/seed-027 3.rb DELETED Viewed

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: IO.popen with user-controlled shell string
-def tail_log(log_name, lines)
-  IO.popen("tail -n #{lines} /var/log/#{log_name}") do |f|
-    f.read
-  end
-end
-def search_file(filename, keyword)
-  IO.popen("grep '#{keyword}' /data/#{filename}") do |io|
-    io.read
-  end
-end
-def pipe_command(cmd)
-  IO.popen(cmd) { |f| f.read }
-end

package/dist/packages/crucible/seeds/ruby/seed-028 3.rb DELETED Viewed

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: ruby
-# expected: Kernel.system called with interpolated hostname for network diagnostics
-class DiagnosticsController < ApplicationController
-  def check_connectivity
-    host    = params[:host]
-    port    = params[:port]
-    timeout = params[:timeout] || '5'
-    result = `nc -zv -w #{timeout} #{host} #{port} 2>&1`
-    render json: { output: result, host: host, port: port }
-  end
-  def whois_lookup
-    domain = params[:domain]
-    output = `whois #{domain}`
-    render plain: output
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-029 3.rb DELETED Viewed

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: File.read with unvalidated user-supplied path
-class FilesController < ApplicationController
-  def show
-    filename = params[:filename]
-    content  = File.read("/var/app/uploads/#{filename}")
-    render plain: content
-  end
-  def download
-    path = params[:path]
-    data = File.read(path)
-    send_data data, filename: File.basename(path)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-030 3.rb DELETED Viewed

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: send_file with user-controlled path — arbitrary file download
-class DownloadsController < ApplicationController
-  def get_file
-    filename = params[:file]
-    base_dir = Rails.root.join('public', 'downloads')
-    file_path = File.join(base_dir, filename)
-    send_file file_path
-  end
-  def export
-    name = params[:name]
-    path = "/var/reports/#{name}"
-    send_file path, type: 'application/octet-stream'
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-031 3.rb DELETED Viewed

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Zip extraction writes files using entry name without sanitization — zip slip
-require 'zip'
-def extract_zip(zip_path, dest_dir)
-  Zip::File.open(zip_path) do |zip|
-    zip.each do |entry|
-      output_path = File.join(dest_dir, entry.name)
-      FileUtils.mkdir_p(File.dirname(output_path))
-      entry.extract(output_path) { true }
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-032 3.rb DELETED Viewed

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: ruby
-# expected: File.write to user-controlled destination path
-def save_export(filename, data)
-  path = "/var/app/exports/#{filename}"
-  File.write(path, data)
-  path
-end
-def cache_response(cache_key, content)
-  cache_path = "/tmp/cache/#{cache_key}"
-  FileUtils.mkdir_p(File.dirname(cache_path))
-  File.write(cache_path, content)
-end
-def write_template(template_name, subdir, content)
-  full_path = "/app/templates/#{subdir}/#{template_name}"
-  File.write(full_path, content)
-end

package/dist/packages/crucible/seeds/ruby/seed-033 3.rb DELETED Viewed

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Dir.glob and File.open with user-controlled subdirectory
-def list_files(base_dir, subdir)
-  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
-end
-def read_config(config_name)
-  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
-end
-def load_plugin(plugin_id)
-  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
-  JSON.parse(manifest)
-end

package/dist/packages/crucible/seeds/ruby/seed-034 3.rb DELETED Viewed

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: params.permit(:all) or ActionController::Parameters without strong params
-class UsersController < ApplicationController
-  def update
-    @user = User.find(params[:id])
-    @user.update(params[:user])
-    redirect_to @user
-  end
-  def create
-    @user = User.new(params[:user].permit!)
-    @user.save
-    render json: @user
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-035 3.rb DELETED Viewed

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: ActiveRecord.new(params) without strong parameters — mass assignment
-class ProfilesController < ApplicationController
-  def update
-    profile = Profile.find(params[:id])
-    profile.update_attributes(params[:profile])
-    render json: profile
-  end
-  def create
-    profile = Profile.new(params)
-    profile.save!
-    render json: profile, status: :created
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-036 3.rb DELETED Viewed

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: critical
-# language: ruby
-# expected: attr_accessible :all or missing attr_protected — mass assignment in model
-class User < ActiveRecord::Base
-  # No attr_protected or attr_accessible defined
-  # Allows setting admin, role, confirmed fields via mass assignment
-  def self.create_from_params(params)
-    create(params)
-  end
-  def self.register(registration_params)
-    new(registration_params).tap(&:save)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-037 3.rb DELETED Viewed

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
-class OrdersController < ApplicationController
-  def create
-    permitted = params.require(:order).permit!
-    @order    = Order.create(permitted)
-    render json: @order
-  end
-  def bulk_update
-    params[:records].each do |record_params|
-      item = Item.find(record_params[:id])
-      item.update(record_params.except(:id))
-    end
-    render json: { updated: params[:records].count }
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-038 3.rb DELETED Viewed

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: Mongoid or other ODM with unfiltered hash assignment
-require 'mongoid'
-class Document
-  include Mongoid::Document
-  field :title,   type: String
-  field :content, type: String
-  field :admin,   type: Boolean, default: false
-  field :role,    type: String,  default: 'user'
-  def self.create_from_hash(attrs)
-    create!(attrs)
-  end
-  def update_from_request(request_params)
-    update_attributes!(request_params)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-039 3.rb DELETED Viewed

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: Net::HTTP.get_response with user-controlled URL — SSRF
-require 'net/http'
-require 'uri'
-class ProxyController < ApplicationController
-  def fetch
-    url      = params[:url]
-    uri      = URI.parse(url)
-    response = Net::HTTP.get_response(uri)
-    render plain: response.body
-  end
-  def check_endpoint
-    target = params[:endpoint]
-    uri    = URI(target)
-    res    = Net::HTTP.get_response(uri)
-    render json: { status: res.code, body: res.body[0..200] }
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-040 3.rb DELETED Viewed

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: HTTParty.get with user-supplied URL — SSRF to internal services
-require 'httparty'
-class WebhookController < ApplicationController
-  def trigger
-    callback_url = params[:callback]
-    payload      = { event: 'triggered', timestamp: Time.now.to_i }
-    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
-    render json: { triggered: true }
-  end
-  def preview_url
-    url  = params[:url]
-    resp = HTTParty.get(url, timeout: 5)
-    render plain: resp.body
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-041 3.rb DELETED Viewed

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: Faraday connection built from user-controlled base URL
-require 'faraday'
-class ImportController < ApplicationController
-  def import_feed
-    source_url = params[:feed_url]
-    conn       = Faraday.new(url: source_url)
-    response   = conn.get('/')
-    data       = JSON.parse(response.body)
-    render json: { imported: data.size }
-  end
-  def fetch_avatar
-    avatar_url = params[:avatar_url]
-    response   = Faraday.get(avatar_url)
-    send_data response.body, type: 'image/jpeg'
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-042 3.rb DELETED Viewed

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: ruby
-# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme
-require 'open-uri'
-def fetch_remote_resource(url)
-  URI.open(url).read
-end
-def download_image(image_url)
-  URI.open(image_url) do |f|
-    File.write('/tmp/downloaded_image', f.read)
-  end
-end
-class ResourceController < ApplicationController
-  def import
-    resource_url = params[:url]
-    content      = URI.open(resource_url).read
-    render plain: content
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-043 3.rb DELETED Viewed

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: RestClient.get with user-supplied URL — SSRF
-require 'rest-client'
-class ProxyService
-  def self.relay(target_url, headers = {})
-    RestClient.get(target_url, headers)
-  rescue RestClient::Exception => e
-    e.response
-  end
-  def self.post_webhook(url, payload)
-    RestClient.post(url, payload.to_json, content_type: :json)
-  end
-  def self.check_health(host)
-    RestClient.get("http://#{host}/health")
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-044 3.rb DELETED Viewed

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to params[:url] without validation — open redirect
-class SessionsController < ApplicationController
-  def create
-    if authenticated?
-      redirect_to params[:url] || root_path
-    else
-      flash[:error] = 'Invalid credentials'
-      render :new
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-045 3.rb DELETED Viewed

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
-class AuthController < ApplicationController
-  def callback
-    next_url = params[:next] || params[:return_to] || dashboard_path
-    redirect_to next_url
-  end
-  def logout
-    sign_out current_user
-    redirect_to params[:redirect]
-  end
-  def sso_redirect
-    target = request.params['RelayState'] || root_url
-    redirect_to target, allow_other_host: true
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-046 3.rb DELETED Viewed

@@ -1,27 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: medium
-# language: ruby
-# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
-class RedirectController < ApplicationController
-  SAFE_DOMAIN = 'example.com'
-  def go
-    target = params[:to]
-    if target =~ /example\.com/
-      redirect_to target, allow_other_host: true
-    else
-      redirect_to root_path
-    end
-  end
-  def external
-    url     = params[:url]
-    trusted = ['example.com', 'partner.com']
-    host    = URI.parse(url).host rescue ''
-    if trusted.include?(host)
-      redirect_to url, allow_other_host: true
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-047 3.rb DELETED Viewed

@@ -1,26 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: send_file or redirect after download with user-controlled path
-class DownloadsController < ApplicationController
-  def complete
-    file      = params[:file]
-    callback  = params[:callback_url]
-    send_file Rails.root.join('public', 'downloads', file)
-    redirect_to callback
-  end
-  def track_and_redirect
-    destination = params[:destination]
-    track_click(destination)
-    redirect_to destination, allow_other_host: true
-  end
-  private
-  def track_click(url)
-    ClickLog.create(url: url, user_id: current_user&.id)
-  end
-end