thuban 0.4.0 → 0.4.2

package/dist/packages/crucible/rules/deserialization.json

@@ -0,0 +1,152 @@
+[
+  {
+    "id": "DESER001",
+    "pattern": "pickle\\.loads|ObjectInputStream|BinaryFormatter|unserialize\\s*\\(",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER002",
+    "pattern": "DataContractSerializer|JavaScriptSerializer|JsonConvert\\.DeserializeObject\\s*<(?!string)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER003",
+    "pattern": "ObjectMessage|message\\.getObject\\s*\\(\\)|readObject\\s*\\(\\)",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER004",
+    "pattern": "new BinaryFormatter\\s*\\(\\)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER005",
+    "pattern": "TypeNameHandling\\.(?:All|Objects|Auto)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER006",
+    "pattern": "new LosFormatter\\s*\\(\\)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER007",
+    "pattern": "unserialize\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|data)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "PHP deserialization",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER008",
+    "pattern": "Class\\.forName\\s*\\(",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER009",
+    "pattern": "kryo\\.readClassAndObject\\s*\\(|isRegistrationRequired\\s*=\\s*false",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER010",
+    "pattern": "\\[\\s*\\w+\\.(?:action|method|nextStep|type)\\s*\\]",
+    "flags": "",
+    "category": "deserialization",
+    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER011",
+    "pattern": "plainToClass\\s*\\(\\s*\\w+\\s*,",
+    "flags": "",
+    "category": "deserialization",
+    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/env-injection.json

@@ -0,0 +1,46 @@
+[
+  {
+    "id": "ENV001",
+    "pattern": "(?:println!|eprintln!)\\s*\\(\\s*\"[^\"]*(?:API_KEY|password|secret|token)[^\"]*\"",
+    "flags": "i",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV002",
+    "pattern": "env::vars\\s*\\(\\s*\\)",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV003",
+    "pattern": "env::var\\s*\\(\\s*key\\s*\\)",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV004",
+    "pattern": "json!\\s*\\(\\s*\\{[\\s\\S]*?env::var",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/eval-abuse.json

@@ -0,0 +1,104 @@
+[
+  {
+    "id": "EVAL001",
+    "pattern": "\\beval\\s*\\(|new\\s+Function\\s*\\(",
+    "flags": "",
+    "category": "eval_abuse",
+    "description": "eval abuse (direct and indirect)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "EVAL002",
+    "pattern": "const\\s+\\w+\\s*=\\s*eval\\b|let\\s+\\w+\\s*=\\s*eval\\b|var\\s+\\w+\\s*=\\s*eval\\b",
+    "flags": "",
+    "category": "eval_abuse",
+    "description": "eval abuse (direct and indirect)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "EVAL003",
+    "pattern": "eval\\s*\\(\\s*atob\\s*\\(|eval\\s*\\(\\s*Buffer\\.from\\s*\\([^)]*base64",
+    "flags": "i",
+    "category": "eval_abuse",
+    "description": "eval() fed an encoded/decoded payload (base64 atob/Buffer.from, hex, etc.)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "EVAL004",
+    "pattern": "eval\\s*\\(\\s*\\w+\\.from\\s*\\(.*['\"]hex['\"]\\)",
+    "flags": "i",
+    "category": "eval_abuse",
+    "description": "eval() fed an encoded/decoded payload (base64 atob/Buffer.from, hex, etc.)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "EVAL005",
+    "pattern": "\\bexec\\s*\\(\\s*(?:code\\b|hook_code\\b|compile\\s*\\()",
+    "flags": "",
+    "category": "eval_abuse",
+    "description": "Python: exec() with user-controlled code string",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "EVAL006",
+    "pattern": "_\\.template\\s*\\(\\s*(?:template|tpl)\\b",
+    "flags": "",
+    "category": "eval_abuse",
+    "description": "TypeScript: lodash template compilation (code execution)",
+    "language": [
+      "typescript"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/file-upload.json

@@ -0,0 +1,46 @@
+[
+  {
+    "id": "UPLOAD001",
+    "pattern": "move_uploaded_file\\s*\\([^,]+,\\s*\\$[^)]*['\"]\\s*\\.\\s*\\$_FILES",
+    "flags": "i",
+    "category": "file_upload",
+    "description": "PHP file upload: move_uploaded_file with original filename (no extension check)",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "UPLOAD002",
+    "pattern": "move_uploaded_file\\s*\\(\\s*\\$_FILES\\[",
+    "flags": "i",
+    "category": "file_upload",
+    "description": "PHP file upload: move_uploaded_file with original filename (no extension check)",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "UPLOAD003",
+    "pattern": "move_uploaded_file\\s*\\([^)]*\\$(?:destination|target_file|dest|path)",
+    "flags": "i",
+    "category": "file_upload",
+    "description": "PHP file upload: move_uploaded_file with original filename (no extension check)",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "UPLOAD004",
+    "pattern": "\\$_FILES\\[['\"]\\w+['\"]\\]\\[['\"](?:name|tmp_name)['\"]\\]",
+    "flags": "i",
+    "category": "file_upload",
+    "description": "PHP file upload: move_uploaded_file with original filename (no extension check)",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/hallucination.json

@@ -0,0 +1,22 @@
+[
+  {
+    "id": "HALL001",
+    "pattern": "fs\\.readFileAsync\\s*\\(|fs\\.writeFileAsync\\s*\\(|http\\.getAsync\\s*\\(",
+    "flags": "",
+    "category": "hallucination",
+    "description": "Hallucination",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  }
+]