thuban 0.4.0 → 0.4.2

package/dist/packages/crucible/seeds/rust/seed-047 3.rs

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: crypto_misuse
-// severity: high
-// language: rust
-// expected: RC4 stream cipher implementation — broken cipher, insecure
-
-pub struct Rc4 {
-    s: [u8; 256],
-    i: usize,
-    j: usize,
-}
-
-impl Rc4 {
-    pub fn new(key: &[u8]) -> Self {
-        let mut s = [0u8; 256];
-        for i in 0..256 { s[i] = i as u8; }
-        let mut j = 0usize;
-        for i in 0..256 {
-            j = (j + s[i] as usize + key[i % key.len()] as usize) % 256;
-            s.swap(i, j);
-        }
-        Rc4 { s, i: 0, j: 0 }
-    }
-
-    pub fn apply(&mut self, data: &mut [u8]) {
-        for byte in data.iter_mut() {
-            self.i = (self.i + 1) % 256;
-            self.j = (self.j + self.s[self.i] as usize) % 256;
-            self.s.swap(self.i, self.j);
-            let k = self.s[(self.s[self.i] as usize + self.s[self.j] as usize) % 256];
-            *byte ^= k;
-        }
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-048 3.rs

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: high
-// language: rust
-// expected: Secret from env var logged to stdout/stderr — credential exposure in logs
-
-use std::env;
-
-pub fn initialize_client() {
-    let api_key = env::var("API_KEY").expect("API_KEY not set");
-    let db_password = env::var("DB_PASSWORD").expect("DB_PASSWORD not set");
-    println!("Starting client with API_KEY={}", api_key);
-    eprintln!("DB connection using password: {}", db_password);
-    log::info!("Auth token: {}", env::var("AUTH_TOKEN").unwrap_or_default());
-}
-
-pub fn debug_config() {
-    for (key, value) in env::vars() {
-        println!("{}={}", key, value);
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-049 3.rs

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: high
-// language: rust
-// expected: Environment variable values reflected in HTTP response — credential leak
-
-use axum::{response::IntoResponse, http::StatusCode};
-use std::env;
-
-pub async fn debug_handler() -> impl IntoResponse {
-    let config = serde_json::json!({
-        "database_url": env::var("DATABASE_URL").unwrap_or_default(),
-        "redis_url": env::var("REDIS_URL").unwrap_or_default(),
-        "api_key": env::var("API_KEY").unwrap_or_default(),
-        "jwt_secret": env::var("JWT_SECRET").unwrap_or_default(),
-        "aws_key": env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
-        "aws_secret": env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
-    });
-    (StatusCode::OK, config.to_string())
-}
-
-pub fn get_env_or_log(key: &str) -> String {
-    let value = env::var(key).unwrap_or_default();
-    log::debug!("Reading env {} = {}", key, value);
-    value
-}

package/dist/packages/crucible/seeds/rust/seed-050 3.rs

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: critical
-// language: rust
-// expected: User-controlled key used to read arbitrary env var — information disclosure
-
-use std::env;
-use axum::{extract::Query, response::IntoResponse};
-use std::collections::HashMap;
-
-pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
-    let key = params.get("key").cloned().unwrap_or_default();
-    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
-    format!("{}={}", key, value)
-}
-
-pub fn lookup_env(user_key: &str) -> String {
-    env::var(user_key).unwrap_or_default()
-}
-
-pub fn set_env_from_input(name: &str, value: &str) {
-    unsafe { env::set_var(name, value) }
-}

package/dist/packages/crucible/seeds/ts/seed-001 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded AWS credentials in typed config object
-
-import * as AWS from 'aws-sdk';
-
-interface AwsCredentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  region: string;
-}
-
-const credentials: AwsCredentials = {
-  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
-  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  region: 'us-east-1',
-};
-
-AWS.config.update(credentials);
-
-const s3 = new AWS.S3();
-const sqs = new AWS.SQS();
-
-export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
-  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
-}
-
-export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
-  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
-}

package/dist/packages/crucible/seeds/ts/seed-002 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded JWT secret in typed auth service
-
-import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
-
-interface TokenPayload {
-  userId: string;
-  role: 'admin' | 'user' | 'moderator';
-  email: string;
-}
-
-const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
-const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
-
-const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
-
-export function signAccessToken(payload: TokenPayload): string {
-  return jwt.sign(payload, JWT_SECRET, signOptions);
-}
-
-export function signRefreshToken(userId: string): string {
-  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
-}
-
-export function verifyAccessToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_SECRET) as JwtPayload;
-}
-
-export function verifyRefreshToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
-}

package/dist/packages/crucible/seeds/ts/seed-003 3.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded database credentials in TypeORM DataSource config
-
-import { DataSource } from 'typeorm';
-import { User } from './entities/User';
-import { Order } from './entities/Order';
-
-export const AppDataSource = new DataSource({
-  type: 'postgres',
-  host: 'prod-postgres.internal',
-  port: 5432,
-  username: 'app_user',
-  password: 'Pr0dPassw0rd!@#$',
-  database: 'production_db',
-  synchronize: false,
-  logging: false,
-  ssl: { rejectUnauthorized: false },
-  entities: [User, Order],
-  migrations: ['dist/migrations/*.js'],
-});
-
-export async function initializeDatabase(): Promise<void> {
-  await AppDataSource.initialize();
-  console.log('Database connection established');
-}

package/dist/packages/crucible/seeds/ts/seed-004 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded Stripe secret key and webhook secret in typed service
-
-import Stripe from 'stripe';
-
-const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
-const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
-
-const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
-
-export async function createPaymentIntent(
-  amount: number,
-  currency: string = 'usd',
-  customerId?: string
-): Promise<Stripe.PaymentIntent> {
-  return stripe.paymentIntents.create({
-    amount,
-    currency,
-    customer: customerId,
-    automatic_payment_methods: { enabled: true },
-  });
-}
-
-export function constructWebhookEvent(
-  payload: Buffer,
-  signature: string
-): Stripe.Event {
-  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
-}
-
-export { stripe };

package/dist/packages/crucible/seeds/ts/seed-005 3.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
-
-import sgMail from '@sendgrid/mail';
-import nodemailer from 'nodemailer';
-
-const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_KEY);
-
-interface EmailOptions {
-  to: string;
-  subject: string;
-  text?: string;
-  html?: string;
-}
-
-export async function sendTransactional(opts: EmailOptions): Promise<void> {
-  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
-}
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.myapp.com',
-  port: 587,
-  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
-});
-
-export async function sendInternal(opts: EmailOptions): Promise<void> {
-  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
-}

package/dist/packages/crucible/seeds/ts/seed-006 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
-
-import { Octokit } from '@octokit/rest';
-import axios from 'axios';
-
-interface IntegrationConfig {
-  githubToken: string;
-  slackWebhookUrl: string;
-  slackSigningSecret: string;
-}
-
-const config: IntegrationConfig = {
-  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
-  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
-  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
-};
-
-const octokit = new Octokit({ auth: config.githubToken });
-
-export async function postToSlack(text: string): Promise<void> {
-  await axios.post(config.slackWebhookUrl, { text });
-}
-
-export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
-  const { data } = await octokit.issues.create({ owner, repo, title });
-  return data.number;
-}

package/dist/packages/crucible/seeds/ts/seed-007 3.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded encryption key and static IV in typed crypto utility
-
-import * as crypto from 'crypto';
-
-const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
-const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
-
-export function encrypt(plaintext: string): string {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-}
-
-export function decrypt(ciphertext: string): string {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-export function hashToken(token: string): string {
-  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
-}

package/dist/packages/crucible/seeds/ts/seed-008 3.ts

@@ -1,40 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded OAuth2 client credentials and admin API key in typed config
-
-import { Router, Request, Response } from 'express';
-
-interface OAuthConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-interface AdminConfig {
-  apiKey: string;
-  adminPassword: string;
-}
-
-const oauthConfig: OAuthConfig = {
-  clientId: 'oauth2-client-production-id-abc123',
-  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
-  redirectUri: 'https://app.company.com/oauth/callback',
-};
-
-const adminConfig: AdminConfig = {
-  apiKey: 'admin-api-key-supersecret-prod-2024',
-  adminPassword: 'AdminP@ssw0rd!#$',
-};
-
-const router = Router();
-
-router.post('/oauth/token', (req: Request, res: Response) => {
-  if (req.body.client_secret !== oauthConfig.clientSecret) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  res.json({ access_token: 'generated', token_type: 'bearer' });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-009 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection via TypeORM query() with string concatenation
-
-import { AppDataSource } from '../data-source';
-
-export async function findUserByUsername(username: string) {
-  // Raw query with direct string interpolation — bypasses parameterization
-  const result = await AppDataSource.query(
-    `SELECT * FROM users WHERE username = '${username}'`
-  );
-  return result[0] ?? null;
-}
-
-export async function searchProducts(term: string, category: string) {
-  const sql = `
-    SELECT p.*, c.name as category_name
-    FROM products p
-    JOIN categories c ON p.category_id = c.id
-    WHERE p.name ILIKE '%` + term + `%'
-    AND c.slug = '` + category + `'
-    ORDER BY p.created_at DESC
-  `;
-  return AppDataSource.query(sql);
-}
-
-export async function deleteUserSessions(userId: string) {
-  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
-}

package/dist/packages/crucible/seeds/ts/seed-010 3.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in TypeORM repository createQueryBuilder with raw where clause
-
-import { Repository } from 'typeorm';
-import { User } from '../entities/User';
-
-export class UserRepository {
-  constructor(private repo: Repository<User>) {}
-
-  async findByEmail(email: string): Promise<User | null> {
-    return this.repo
-      .createQueryBuilder('user')
-      // Direct interpolation into where() — SQL injection
-      .where(`user.email = '${email}'`)
-      .getOne();
-  }
-
-  async searchByName(query: string, role: string): Promise<User[]> {
-    return this.repo
-      .createQueryBuilder('user')
-      .where(`user.name ILIKE '%${query}%' AND user.role = '${role}'`)
-      .orderBy('user.createdAt', 'DESC')
-      .getMany();
-  }
-
-  async getByIds(ids: string[]): Promise<User[]> {
-    const idList = ids.join(', ');
-    return this.repo.query(`SELECT * FROM users WHERE id IN (${idList})`);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-011 3.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in Prisma $queryRaw with tagged template bypassed via string concat
-
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
-export async function getUserOrders(userId: string, status: string) {
-  // $queryRawUnsafe does NOT parameterize — direct string concatenation
-  const orders = await prisma.$queryRawUnsafe(
-    `SELECT * FROM orders WHERE user_id = '${userId}' AND status = '${status}'`
-  );
-  return orders;
-}
-
-export async function searchInventory(searchTerm: string, warehouseId: string) {
-  const query = `
-    SELECT i.*, w.name as warehouse
-    FROM inventory i
-    JOIN warehouses w ON i.warehouse_id = w.id
-    WHERE i.sku ILIKE '%` + searchTerm + `%'
-    OR i.description ILIKE '%` + searchTerm + `%'
-    AND w.id = '` + warehouseId + `'
-  `;
-  return prisma.$queryRawUnsafe(query);
-}

package/dist/packages/crucible/seeds/ts/seed-012 3.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in NestJS service using raw pg query with string interpolation
-
-import { Injectable } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/typeorm';
-import { Connection } from 'typeorm';
-
-@Injectable()
-export class ReportService {
-  constructor(@InjectConnection() private connection: Connection) {}
-
-  async getRevenueReport(fromDate: string, toDate: string, groupBy: string): Promise<any[]> {
-    const sql = `
-      SELECT
-        ${groupBy} as period,
-        SUM(amount) as total_revenue,
-        COUNT(*) as transaction_count
-      FROM transactions
-      WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
-      GROUP BY ${groupBy}
-      ORDER BY period ASC
-    `;
-    return this.connection.query(sql);
-  }
-
-  async getUserActivity(userId: string, action: string): Promise<any[]> {
-    return this.connection.query(
-      `SELECT * FROM audit_log WHERE user_id = '` + userId + `' AND action = '` + action + `'`
-    );
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-013 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via dynamic ORDER BY column name from user input
-
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-interface ListOptions {
-  sortField: string;  // user-controlled
-  sortDir: 'asc' | 'desc';  // type claim but not validated
-  limit: number;
-  offset: number;
-  filter?: string;
-}
-
-export async function listProducts(opts: ListOptions) {
-  // sortField and sortDir inserted verbatim — type annotations don't prevent injection
-  const query = `
-    SELECT id, name, price, stock, created_at
-    FROM products
-    WHERE archived = false
-    ${opts.filter ? `AND name ILIKE '%${opts.filter}%'` : ''}
-    ORDER BY ${opts.sortField} ${opts.sortDir}
-    LIMIT ${opts.limit} OFFSET ${opts.offset}
-  `;
-  const { rows } = await pool.query(query);
-  return rows;
-}

package/dist/packages/crucible/seeds/ts/seed-014 3.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in authentication middleware via raw query with login credentials
-
-import { Request, Response, NextFunction } from 'express';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export async function authenticateMiddleware(
-  req: Request,
-  res: Response,
-  next: NextFunction
-): Promise<void> {
-  const { username, password } = req.body as { username: string; password: string };
-
-  // Classic auth bypass: username = "admin'--"
-  const query = `
-    SELECT id, username, role, email
-    FROM users
-    WHERE username = '${username}'
-    AND password_hash = crypt('${password}', password_hash)
-    AND active = true
-  `;
-
-  const { rows } = await pool.query(query);
-  if (!rows.length) {
-    res.status(401).json({ error: 'Invalid credentials' });
-    return;
-  }
-
-  req.user = rows[0];
-  next();
-}

package/dist/packages/crucible/seeds/ts/seed-015 3.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via Sequelize literal() with user-controlled search input
-
-import { Sequelize, QueryTypes } from 'sequelize';
-
-const sequelize = new Sequelize(process.env.DATABASE_URL!);
-
-export async function fullTextSearch(
-  query: string,
-  table: 'products' | 'articles' | 'users',
-  fields: string[]
-): Promise<Record<string, unknown>[]> {
-  const fieldList = fields.join(', ');
-  const whereClause = fields
-    .map(f => `${f} ILIKE '%${query}%'`)
-    .join(' OR ');
-
-  // Both fieldList and whereClause derived from user input — injection possible
-  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-export async function bulkUpdate(ids: number[], status: string): Promise<void> {
-  const idList = ids.join(',');
-  await sequelize.query(
-    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
-  );
-}

package/dist/packages/crucible/seeds/ts/seed-016 3.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
-
-import React from 'react';
-
-interface Comment {
-  id: string;
-  author: string;
-  body: string;
-  avatarHtml: string;
-}
-
-interface CommentCardProps {
-  comment: Comment;
-}
-
-export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
-  return (
-    <div className="comment-card">
-      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
-      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
-      <div className="author">{comment.author}</div>
-      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
-    </div>
-  );
-};
-
-interface RichTextProps {
-  content: string; // user-submitted rich text
-}
-
-export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
-  <article dangerouslySetInnerHTML={{ __html: content }} />
-);