npm - thuban - Versions diffs - 0.4.0 → 0.4.2 - Mend

thuban 0.4.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (209) hide show

package/dist/packages/crucible/seeds/ts/seed-017 3.ts DELETED Viewed

@@ -1,44 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Angular [innerHTML] binding with user-controlled data
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { UserService } from '../services/user.service';
-interface UserProfile {
-  displayName: string;
-  bio: string;        // Rich HTML from user
-  signature: string;  // HTML signature from user
-}
-@Component({
-  selector: 'app-user-profile',
-  template: `
-    <div class="profile">
-      <h1>{{ user?.displayName }}</h1>
-      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
-      <div class="bio" [innerHTML]="trustedBio"></div>
-      <footer [innerHTML]="trustedSignature"></footer>
-    </div>
-  `,
-})
-export class UserProfileComponent implements OnInit {
-  user: UserProfile | null = null;
-  trustedBio: any;
-  trustedSignature: any;
-  constructor(private route: ActivatedRoute, private userService: UserService) {}
-  ngOnInit(): void {
-    const id = this.route.snapshot.paramMap.get('id')!;
-    this.userService.getProfile(id).subscribe(user => {
-      this.user = user;
-      // Bypasses Angular's built-in XSS protection
-      this.trustedBio = user.bio;
-      this.trustedSignature = user.signature;
-    });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-018 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via innerHTML in typed DOM manipulation utility
-export class DomRenderer {
-  private container: HTMLElement;
-  constructor(containerId: string) {
-    this.container = document.getElementById(containerId) as HTMLElement;
-  }
-  renderUserContent(content: string): void {
-    // Direct innerHTML assignment — content from user input
-    this.container.innerHTML = content;
-  }
-  appendItem(title: string, description: string): void {
-    // Template literal with user data written to innerHTML
-    this.container.innerHTML += `
-      <div class="item">
-        <h3>${title}</h3>
-        <p>${description}</p>
-      </div>
-    `;
-  }
-  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
-    const banner = document.querySelector('.banner') as HTMLElement;
-    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-019 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Express response with unsanitized template literal containing user input
-import { Request, Response, Router } from 'express';
-const router = Router();
-router.get('/search', (req: Request, res: Response) => {
-  const query = (req.query.q as string) || '';
-  const category = (req.query.cat as string) || 'all';
-  // Both query and category embedded directly in HTML without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html lang="en">
-      <head><title>Search - ${category}</title></head>
-      <body>
-        <h1>Results for: <em>${query}</em></h1>
-        <p>Category: ${category}</p>
-        <script>
-          const searchQuery = "${query}";
-          const searchCategory = "${category}";
-        </script>
-      </body>
-    </html>
-  `);
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-020 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: typescript
-// expected: XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
-import { GetServerSideProps, NextPage } from 'next';
-interface PageProps {
-  name: string;
-  description: string;
-}
-const ProfilePage: NextPage<PageProps> = ({ name, description }) => {
-  return (
-    <div>
-      <h1>Profile: {name}</h1>
-      {/* description from query string — dangerouslySetInnerHTML without sanitization */}
-      <div dangerouslySetInnerHTML={{ __html: description }} />
-    </div>
-  );
-};
-export const getServerSideProps: GetServerSideProps = async ({ query }) => {
-  return {
-    props: {
-      name: query.name as string ?? 'Unknown',
-      description: query.description as string ?? '',
-    },
-  };
-};
-export default ProfilePage;

package/dist/packages/crucible/seeds/ts/seed-021 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Vue.js v-html directive with user-supplied content
-import { defineComponent, ref, onMounted } from 'vue';
-import axios from 'axios';
-export default defineComponent({
-  name: 'ArticleViewer',
-  props: {
-    articleId: { type: String, required: true },
-  },
-  setup(props) {
-    const article = ref<{ title: string; content: string; authorBio: string } | null>(null);
-    onMounted(async () => {
-      const { data } = await axios.get(`/api/articles/${props.articleId}`);
-      article.value = data;
-    });
-    return { article };
-  },
-  // v-html renders raw HTML — XSS if content contains malicious script tags
-  template: `
-    <div class="article" v-if="article">
-      <h1>{{ article.title }}</h1>
-      <div class="content" v-html="article.content"></div>
-      <aside class="author-bio" v-html="article.authorBio"></aside>
-    </div>
-  `,
-});

package/dist/packages/crucible/seeds/ts/seed-022 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Marked.js rendering user markdown without sanitization
-import marked from 'marked';
-import { Request, Response, Router } from 'express';
-const router = Router();
-interface MarkdownRequest {
-  markdown: string;
-  title?: string;
-}
-router.post('/preview', (req: Request, res: Response) => {
-  const { markdown, title } = req.body as MarkdownRequest;
-  // marked() renders to HTML without XSS protection — <script> tags in markdown execute
-  const renderedHtml = marked(markdown);
-  res.send(`
-    <html>
-      <head><title>${title ?? 'Preview'}</title></head>
-      <body>
-        <h1>${title}</h1>
-        <div class="content">${renderedHtml}</div>
-      </body>
-    </html>
-  `);
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-023 3.ts DELETED Viewed

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via child_process.exec with typed but unsanitized user input
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { Request, Response, Router } from 'express';
-const execAsync = promisify(exec);
-const router = Router();
-interface PingRequest {
-  host: string;
-  count?: number;
-}
-router.post('/tools/ping', async (req: Request, res: Response) => {
-  const { host, count = 4 } = req.body as PingRequest;
-  // TypeScript types don't prevent injection — host can be "8.8.8.8; id"
-  const cmd = `ping -c ${count} ${host}`;
-  const { stdout, stderr } = await execAsync(cmd);
-  res.json({ output: stdout, errors: stderr });
-});
-router.post('/tools/traceroute', async (req: Request, res: Response) => {
-  const target: string = req.body.target;
-  const { stdout } = await execAsync(`traceroute ${target}`);
-  res.json({ hops: stdout });
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-024 3.ts DELETED Viewed

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execSync in typed file processing service
-import { execSync } from 'child_process';
-import * as path from 'path';
-interface ConversionOptions {
-  inputPath: string;  // user-controlled filename
-  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
-  quality?: number;
-}
-export class FileConverter {
-  private readonly outputDir: string;
-  constructor(outputDir: string) {
-    this.outputDir = outputDir;
-  }
-  convert(opts: ConversionOptions): string {
-    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
-    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
-    // opts.inputPath is user-controlled — no sanitization before execSync
-    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
-    execSync(cmd, { timeout: 30000 });
-    return outputPath;
-  }
-  extractText(pdfPath: string): string {
-    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-025 3.ts DELETED Viewed

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via spawn with shell:true and user-controlled arguments
-import { spawn } from 'child_process';
-import { Request, Response, Router } from 'express';
-const router = Router();
-function runCommand(cmd: string, args: string[]): Promise<string> {
-  return new Promise((resolve, reject) => {
-    // shell: true means the full command string is interpreted by /bin/sh
-    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
-    let output = '';
-    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
-    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
-    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-router.post('/scripts/run', async (req: Request, res: Response) => {
-  const { script, params }: { script: string; params: string[] } = req.body;
-  const result = await runCommand(`node scripts/${script}`, params);
-  res.json({ output: result });
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-026 3.ts DELETED Viewed

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection via git operations with user-controlled branch/tag names
-import { execSync } from 'child_process';
-interface GitOptions {
-  repoPath: string;
-  branch: string;    // user-controlled
-  remote?: string;
-}
-export class GitService {
-  clone(repoUrl: string, targetDir: string): void {
-    // repoUrl from user — can include shell metacharacters
-    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
-  }
-  checkout(opts: GitOptions): string {
-    // opts.branch may be "main; cat /etc/shadow"
-    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
-  }
-  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
-    return execSync(
-      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
-      { encoding: 'utf8' }
-    );
-  }
-  tag(repoPath: string, tagName: string, message: string): string {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-027 3.ts DELETED Viewed

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection in NestJS service using exec with user-provided report parameters
-import { Injectable } from '@nestjs/common';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-const execAsync = promisify(exec);
-interface ReportParams {
-  format: string;       // user-controlled
-  dateRange: string;    // user-controlled
-  recipient: string;    // user-controlled email
-}
-@Injectable()
-export class ReportingService {
-  async generateAndSendReport(params: ReportParams): Promise<void> {
-    const { format, dateRange, recipient } = params;
-    // All three params go directly into shell command
-    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
-    const { stdout: reportPath } = await execAsync(generateCmd);
-    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
-    await execAsync(sendCmd);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-028 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execa with shell:true and template literal from user data
-import execa from 'execa';
-import { Request, Response, Router } from 'express';
-const router = Router();
-interface ScanRequest {
-  target: string;   // IP or hostname — user-controlled
-  ports?: string;   // port range — user-controlled
-  flags?: string;   // nmap flags — user-controlled
-}
-router.post('/security/scan', async (req: Request, res: Response) => {
-  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
-  try {
-    // All fields from user body — injection via shell metacharacters
-    const { stdout } = await execa.command(
-      `nmap ${flags} -p ${ports} ${target}`,
-      { shell: true, timeout: 60000 }
-    );
-    res.json({ results: stdout });
-  } catch (err: any) {
-    res.status(500).json({ error: err.message });
-  }
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-029 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via unvalidated user path in fs.readFile
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Request, Response, Router } from 'express';
-const router = Router();
-const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
-router.get('/static/:file', async (req: Request, res: Response) => {
-  const requestedFile: string = req.params.file;
-  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
-  const filePath = path.join(PUBLIC_DIR, requestedFile);
-  try {
-    const data = await fs.readFile(filePath, 'utf-8');
-    res.type('text/plain').send(data);
-  } catch {
-    res.status(404).send('Not found');
-  }
-});
-router.get('/download', async (req: Request, res: Response) => {
-  const file = req.query.file as string;
-  // Completely unvalidated — reads arbitrary path on filesystem
-  const content = await fs.readFile(file);
-  res.send(content);
-});
-export default router;

package/dist/packages/crucible/seeds/ts/seed-030 3.ts DELETED Viewed

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via typed file service with user-controlled subdirectory
-import * as fs from 'fs';
-import * as path from 'path';
-interface FileServiceConfig {
-  baseDir: string;
-}
-export class FileService {
-  private readonly baseDir: string;
-  constructor(config: FileServiceConfig) {
-    this.baseDir = config.baseDir;
-  }
-  readUserFile(userId: string, fileName: string): string {
-    // No normalization check — fileName can be "../../../etc/passwd"
-    const filePath = path.join(this.baseDir, userId, fileName);
-    return fs.readFileSync(filePath, 'utf-8');
-  }
-  listDirectory(userId: string, subDir: string): string[] {
-    // subDir from user — directory traversal possible
-    const dirPath = path.join(this.baseDir, userId, subDir);
-    return fs.readdirSync(dirPath);
-  }
-  deleteFile(userId: string, fileName: string): void {
-    const filePath = path.join(this.baseDir, userId, fileName);
-    fs.unlinkSync(filePath);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-031 3.ts DELETED Viewed

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal in NestJS controller via user-controlled template name
-import { Controller, Get, Query, Res } from '@nestjs/common';
-import { Response } from 'express';
-import * as fs from 'fs';
-import * as path from 'path';
-const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
-@Controller('email')
-export class EmailController {
-  @Get('preview')
-  previewTemplate(
-    @Query('name') templateName: string,
-    @Query('locale') locale: string,
-    @Res() res: Response
-  ): void {
-    // templateName from query — attacker sends "../../config/database"
-    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
-    try {
-      const html = fs.readFileSync(templatePath, 'utf-8');
-      res.type('text/html').send(html);
-    } catch {
-      res.status(404).send('Template not found');
-    }
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-032 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
-import AdmZip from 'adm-zip';
-import * as fs from 'fs';
-import * as path from 'path';
-const EXTRACT_BASE = '/var/app/uploads/extracted';
-export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-  const extractedPaths: string[] = [];
-  for (const entry of entries) {
-    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, entry.getData());
-      extractedPaths.push(outputPath);
-    }
-  }
-  return extractedPaths;
-}

package/dist/packages/crucible/seeds/ts/seed-033 3.ts DELETED Viewed

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: typescript
-// expected: path traversal via multer upload with user-controlled destination folder
-import multer, { StorageEngine } from 'multer';
-import * as path from 'path';
-import * as fs from 'fs';
-import { Request } from 'express';
-const UPLOADS_ROOT = '/var/uploads';
-const storage: StorageEngine = multer.diskStorage({
-  destination: (req: Request, file, cb) => {
-    const folder = req.body.folder as string || 'default';
-    // folder from request body — allows writing to arbitrary locations
-    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
-    fs.mkdirSync(destPath, { recursive: true });
-    cb(null, destPath);
-  },
-  filename: (req: Request, file, cb) => {
-    const prefix = req.body.prefix as string || '';
-    // prefix + originalname — originalname may include path separators
-    cb(null, `${prefix}_${file.originalname}`);
-  },
-});
-export const upload = multer({
-  storage,
-  limits: { fileSize: 50 * 1024 * 1024 },
-});

package/dist/packages/crucible/seeds/ts/seed-034 3.ts DELETED Viewed

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: MD5 used for password hashing in typed auth service
-import * as crypto from 'crypto';
-import { Pool } from 'pg';
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-export class AuthService {
-  private hashPassword(password: string): string {
-    // MD5 is cryptographically broken — should use bcrypt/argon2
-    return crypto.createHash('md5').update(password).digest('hex');
-  }
-  async register(email: string, password: string): Promise<void> {
-    const hash = this.hashPassword(password);
-    await pool.query(
-      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-      [email, hash]
-    );
-  }
-  async login(email: string, password: string): Promise<boolean> {
-    const hash = this.hashPassword(password);
-    const { rows } = await pool.query(
-      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
-      [email, hash]
-    );
-    return rows.length > 0;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-035 3.ts DELETED Viewed

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: Math.random() used for security tokens, SHA1 for HMAC
-import * as crypto from 'crypto';
-export function generateSessionId(): string {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).slice(2) + Date.now().toString(36);
-}
-export function generateCsrfToken(): string {
-  // Predictable timestamp-based token
-  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
-}
-export function generatePasswordResetToken(userId: string): string {
-  // SHA1 HMAC with weak source of randomness
-  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
-  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
-}
-export function generateApiKey(): string {
-  // Only 32 bits of entropy — trivially brute-forceable
-  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
-  return `key_${rand}`;
-}