thuban 0.4.10 → 0.4.12

package/packages/crucible/seeds/php/seed-044.php

@@ -1,25 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: file_get_contents with user-supplied URL — SSRF
-
-$url     = $_GET['url'];
-$timeout = (int) ($_GET['timeout'] ?? 10);
-
-$context = stream_context_create(['http' => ['timeout' => $timeout]]);
-$content = file_get_contents($url, false, $context);
-
-if ($content === false) {
-    http_response_code(502);
-    echo json_encode(['error' => 'Failed to fetch URL', 'url' => $url]);
-} else {
-    echo $content;
-}
-
-$imageUrl = $_POST['image_url'];
-$format   = $_POST['format'] ?? 'jpg';
-$data     = file_get_contents($imageUrl);
-file_put_contents("/tmp/image.$format", $data);
-echo json_encode(['saved' => "/tmp/image.$format", 'size' => strlen($data)]);

package/packages/crucible/seeds/php/seed-045.php

@@ -1,25 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: cURL request to user-controlled URL — SSRF enabling internal network access
-
-function fetchExternalUrl(string $url): string {
-    $ch = curl_init($url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
-    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
-    $response = curl_exec($ch);
-    curl_close($ch);
-    return $response ?: '';
-}
-
-$target   = $_POST['webhook_url'];
-$payload  = json_encode(['event' => 'test', 'data' => $_POST]);
-
-$ch = curl_init($target);
-curl_setopt($ch, CURLOPT_POST, true);
-curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
-curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-curl_exec($ch);

package/packages/crucible/seeds/php/seed-046.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: URL composed from user-supplied hostname — SSRF to internal services
-
-$host     = $_GET['host'];
-$port     = $_GET['port'] ?? '80';
-$path     = $_GET['path'] ?? '/';
-
-$url = "http://$host:$port$path";
-$ch  = curl_init($url);
-curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-curl_setopt($ch, CURLOPT_TIMEOUT, 5);
-$result = curl_exec($ch);
-$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-curl_close($ch);
-
-echo "Status: $status\n" . $result;

package/packages/crucible/seeds/php/seed-047.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: php
-// expected: Import/export feature fetches user-supplied URL with no scheme restriction
-
-function importDataFromUrl(string $sourceUrl): array {
-    $allowed_schemes = ['http', 'https'];
-    $scheme = strtolower(parse_url($sourceUrl, PHP_URL_SCHEME));
-    if (!in_array($scheme, $allowed_schemes)) {
-        return ['error' => 'Invalid scheme'];
-    }
-    // Still vulnerable: http://169.254.169.254/ or http://localhost/
-    $data = file_get_contents($sourceUrl);
-    return json_decode($data, true) ?? [];
-}
-
-$url    = $_POST['import_url'];
-$result = importDataFromUrl($url);
-echo json_encode($result);

package/packages/crucible/seeds/php/seed-048.php

@@ -1,19 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: high
-// language: php
-// expected: header('Location') with unvalidated user-supplied URL — open redirect
-
-$url     = $_GET['url'];
-$referer = $_SERVER['HTTP_REFERER'] ?? '';
-
-if (empty($url)) {
-    $url = '/';
-}
-
-// Log the redirect for analytics
-error_log("Redirecting user from $referer to: $url");
-
-header('Location: ' . $url);
-exit;

package/packages/crucible/seeds/php/seed-049.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: high
-// language: php
-// expected: Redirect after login using 'next' or 'return_to' parameter without validation
-
-function redirectAfterLogin(): void {
-    $next = $_GET['next'] ?? $_POST['return_to'] ?? '/dashboard';
-    header('Location: ' . $next);
-    exit;
-}
-
-function redirectWithMessage(string $msg): void {
-    $redirect = $_REQUEST['redirect'];
-    header("Location: $redirect?msg=" . urlencode($msg));
-    exit;
-}

package/packages/crucible/seeds/php/seed-050.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: php
-// expected: Redirect target partially validated with strpos — bypassable with subdomain trick
-
-function safeRedirect(string $url): void {
-    $allowed_host = 'example.com';
-    if (strpos($url, $allowed_host) !== false) {
-        header('Location: ' . $url);
-        exit;
-    }
-    header('Location: /error?msg=invalid_redirect');
-    exit;
-}
-
-$target = $_GET['to'];
-safeRedirect($target);
-// Attacker passes: https://evil.com?foo=example.com → strpos match!

package/packages/crucible/seeds/python/seed-001.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded AWS access key and secret key
-
-import boto3
-
-AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
-AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-AWS_REGION = "us-east-1"
-
-s3_client = boto3.client(
-    "s3",
-    aws_access_key_id=AWS_ACCESS_KEY_ID,
-    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
-    region_name=AWS_REGION,
-)
-
-
-def upload_file(file_path: str, bucket: str, key: str) -> dict:
-    with open(file_path, "rb") as f:
-        response = s3_client.put_object(Bucket=bucket, Key=key, Body=f)
-    return response
-
-
-def list_buckets() -> list:
-    response = s3_client.list_buckets()
-    return [b["Name"] for b in response.get("Buckets", [])]
-
-
-if __name__ == "__main__":
-    print(list_buckets())

package/packages/crucible/seeds/python/seed-002.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded database password in connection string
-
-import psycopg2
-from psycopg2.extras import RealDictCursor
-
-DB_HOST = "prod-db.internal.company.com"
-DB_PORT = 5432
-DB_NAME = "users_production"
-DB_USER = "db_admin"
-DB_PASSWORD = "Sup3rS3cr3tPa$$w0rd!"
-
-
-def get_connection():
-    return psycopg2.connect(
-        host=DB_HOST,
-        port=DB_PORT,
-        dbname=DB_NAME,
-        user=DB_USER,
-        password=DB_PASSWORD,
-        cursor_factory=RealDictCursor,
-    )
-
-
-def get_user(user_id: int) -> dict:
-    conn = get_connection()
-    with conn.cursor() as cur:
-        cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
-        return cur.fetchone()
-
-
-def list_users() -> list:
-    conn = get_connection()
-    with conn.cursor() as cur:
-        cur.execute("SELECT id, email, created_at FROM users")
-        return cur.fetchall()

package/packages/crucible/seeds/python/seed-003.py

@@ -1,31 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded Django SECRET_KEY and debug credentials
-
-SECRET_KEY = "django-insecure-3abc$xyz!hardcoded-secret-key-never-rotate-this-one"
-DEBUG = True
-
-DATABASES = {
-    "default": {
-        "ENGINE": "django.db.backends.postgresql",
-        "NAME": "production_db",
-        "USER": "django_app",
-        "PASSWORD": "DjangoDBPass!@#2024",
-        "HOST": "db.internal",
-        "PORT": "5432",
-    }
-}
-
-EMAIL_HOST = "smtp.company.com"
-EMAIL_HOST_USER = "noreply@company.com"
-EMAIL_HOST_PASSWORD = "SmtpPa$$w0rd#2024"
-EMAIL_PORT = 587
-EMAIL_USE_TLS = True
-
-STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRst1234567890abcdef"
-STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz12345678"
-
-REDIS_PASSWORD = "r3disPa$$w0rd"
-REDIS_URL = f"redis://:r3disPa$$w0rd@redis.internal:6379/0"

package/packages/crucible/seeds/python/seed-004.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded Stripe and PayPal API credentials
-
-import stripe
-import requests
-
-# Stripe configuration
-STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef"
-STRIPE_PUBLISHABLE_KEY = "pk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz0987654321"
-STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF"
-
-stripe.api_key = STRIPE_SECRET_KEY
-
-# PayPal configuration
-PAYPAL_CLIENT_ID = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz12345678"
-PAYPAL_CLIENT_SECRET = "EeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz123456781234"
-PAYPAL_BASE_URL = "https://api.paypal.com"
-
-
-def get_paypal_token() -> str:
-    response = requests.post(
-        f"{PAYPAL_BASE_URL}/v1/oauth2/token",
-        auth=(PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET),
-        data={"grant_type": "client_credentials"},
-    )
-    return response.json()["access_token"]
-
-
-def create_payment_intent(amount: int, currency: str = "usd") -> dict:
-    return stripe.PaymentIntent.create(amount=amount, currency=currency)

package/packages/crucible/seeds/python/seed-005.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded JWT secret and admin credentials in Flask app
-
-from flask import Flask, request, jsonify
-import jwt
-
-app = Flask(__name__)
-
-JWT_SECRET = "my-super-secret-flask-jwt-key-never-change-abc123!"
-ADMIN_USERNAME = "admin"
-ADMIN_PASSWORD = "AdminP@ssw0rd!#$2024"
-API_MASTER_KEY = "master-api-key-production-xYz9876543210"
-
-
-def generate_token(user_id: int, role: str) -> str:
-    payload = {"user_id": user_id, "role": role}
-    return jwt.encode(payload, JWT_SECRET, algorithm="HS256")
-
-
-def verify_token(token: str) -> dict:
-    return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
-
-
-@app.route("/admin/login", methods=["POST"])
-def admin_login():
-    data = request.get_json()
-    if data["username"] == ADMIN_USERNAME and data["password"] == ADMIN_PASSWORD:
-        token = generate_token(0, "admin")
-        return jsonify({"token": token})
-    return jsonify({"error": "Invalid credentials"}), 401

package/packages/crucible/seeds/python/seed-006.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded GitHub token and Slack webhook URL
-
-import requests
-
-GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"
-GITHUB_ORG = "my-company"
-
-SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
-SLACK_BOT_TOKEN = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx"
-
-GITHUB_HEADERS = {"Authorization": f"token {GITHUB_TOKEN}", "Accept": "application/vnd.github.v3+json"}
-
-
-def create_github_issue(repo: str, title: str, body: str) -> dict:
-    url = f"https://api.github.com/repos/{GITHUB_ORG}/{repo}/issues"
-    response = requests.post(url, json={"title": title, "body": body}, headers=GITHUB_HEADERS)
-    return response.json()
-
-
-def post_slack_message(text: str, channel: str = "#general") -> dict:
-    response = requests.post(
-        "https://slack.com/api/chat.postMessage",
-        headers={"Authorization": f"Bearer {SLACK_BOT_TOKEN}"},
-        json={"channel": channel, "text": text},
-    )
-    return response.json()
-
-
-def notify_slack_webhook(payload: dict) -> None:
-    requests.post(SLACK_WEBHOOK_URL, json=payload)

package/packages/crucible/seeds/python/seed-007.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded encryption key and IV in Python crypto utility
-
-from Crypto.Cipher import AES
-import base64
-
-# 32-byte AES key — hardcoded, never rotated
-ENCRYPTION_KEY = b"12345678901234567890123456789012"
-# 16-byte IV — static, reused for every encryption operation
-STATIC_IV = b"abcdef1234567890"
-
-BLOCK_SIZE = AES.block_size
-
-
-def pad(data: bytes) -> bytes:
-    pad_len = BLOCK_SIZE - len(data) % BLOCK_SIZE
-    return data + bytes([pad_len] * pad_len)
-
-
-def encrypt(plaintext: str) -> str:
-    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
-    encrypted = cipher.encrypt(pad(plaintext.encode()))
-    return base64.b64encode(encrypted).decode()
-
-
-def decrypt(ciphertext: str) -> str:
-    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()

package/packages/crucible/seeds/python/seed-008.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded OAuth2 client credentials and SMTP password in FastAPI app
-
-from fastapi import FastAPI, HTTPException
-import httpx
-
-app = FastAPI()
-
-OAUTH_CLIENT_ID = "oauth2-client-production-id-abc123"
-OAUTH_CLIENT_SECRET = "oauth2-client-secret-XyZ9876543210abcdefGHIJKL"
-OAUTH_TOKEN_URL = "https://auth.provider.com/oauth/token"
-
-SMTP_HOST = "smtp.company.com"
-SMTP_USER = "noreply@company.com"
-SMTP_PASSWORD = "Smtp$Pass#2024Production!"
-
-INTERNAL_API_KEY = "internal-service-api-key-prod-abc123xyz789"
-
-
-async def get_oauth_token() -> str:
-    async with httpx.AsyncClient() as client:
-        resp = await client.post(
-            OAUTH_TOKEN_URL,
-            data={
-                "grant_type": "client_credentials",
-                "client_id": OAUTH_CLIENT_ID,
-                "client_secret": OAUTH_CLIENT_SECRET,
-            },
-        )
-    return resp.json()["access_token"]
-
-
-@app.get("/health")
-async def health():
-    return {"status": "ok"}

package/packages/crucible/seeds/python/seed-009.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via string formatting in cursor.execute
-
-import sqlite3
-
-
-def get_user_by_name(username: str) -> dict:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    # Direct string formatting — attacker sends: "' OR '1'='1"
-    query = "SELECT * FROM users WHERE username = '%s'" % username
-    cursor.execute(query)
-    row = cursor.fetchone()
-    conn.close()
-    return row
-
-
-def search_products(term: str, category: str) -> list:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    query = (
-        "SELECT * FROM products WHERE name LIKE '%%%s%%' AND category = '%s'" % (term, category)
-    )
-    cursor.execute(query)
-    results = cursor.fetchall()
-    conn.close()
-    return results
-
-
-def delete_user(user_id: str) -> None:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    cursor.execute("DELETE FROM users WHERE id = " + user_id)
-    conn.commit()
-    conn.close()

package/packages/crucible/seeds/python/seed-010.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection in Flask route via f-string in SQL query
-
-from flask import Flask, request, jsonify
-import psycopg2
-
-app = Flask(__name__)
-
-
-def get_db():
-    return psycopg2.connect(dbname="appdb", user="app", password="app", host="localhost")
-
-
-@app.route("/users/login", methods=["POST"])
-def login():
-    data = request.get_json()
-    username = data.get("username", "")
-    password = data.get("password", "")
-
-    conn = get_db()
-    cur = conn.cursor()
-    # Classic SQL injection auth bypass
-    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
-    cur.execute(query)
-    user = cur.fetchone()
-
-    if not user:
-        return jsonify({"error": "Invalid credentials"}), 401
-    return jsonify({"user_id": user[0], "username": user[1]})
-
-
-@app.route("/products")
-def products():
-    category = request.args.get("category", "")
-    sort_by = request.args.get("sort", "name")
-    conn = get_db()
-    cur = conn.cursor()
-    cur.execute(f"SELECT * FROM products WHERE category = '{category}' ORDER BY {sort_by}")
-    return jsonify(cur.fetchall())

package/packages/crucible/seeds/python/seed-011.py

@@ -1,30 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via .format() string interpolation in Django raw query
-
-from django.db import connection
-from django.http import JsonResponse
-
-
-def search_articles(request):
-    query = request.GET.get("q", "")
-    tag = request.GET.get("tag", "")
-    author = request.GET.get("author", "")
-
-    with connection.cursor() as cursor:
-        # All three params injected via .format()
-        sql = """
-            SELECT a.id, a.title, a.summary, u.username as author
-            FROM articles a
-            JOIN users u ON a.author_id = u.id
-            WHERE a.published = true
-            AND (a.title ILIKE '%{query}%' OR a.content ILIKE '%{query}%')
-            AND a.tag = '{tag}'
-            AND u.username = '{author}'
-            ORDER BY a.created_at DESC
-        """.format(query=query, tag=tag, author=author)
-        cursor.execute(sql)
-        cols = [col[0] for col in cursor.description]
-        return JsonResponse({"results": [dict(zip(cols, row)) for row in cursor.fetchall()]})

package/packages/crucible/seeds/python/seed-012.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via SQLAlchemy text() with string concatenation
-
-from sqlalchemy import text, create_engine
-from sqlalchemy.orm import Session
-
-engine = create_engine("postgresql://user:pass@localhost/appdb")
-
-
-def find_orders(user_id: str, status: str, sort_field: str) -> list:
-    with Session(engine) as session:
-        # text() used correctly — but string concatenation defeats parameterization
-        sql = text(
-            "SELECT * FROM orders WHERE user_id = '"
-            + user_id
-            + "' AND status = '"
-            + status
-            + "' ORDER BY "
-            + sort_field
-        )
-        result = session.execute(sql)
-        return result.fetchall()
-
-
-def bulk_update_status(ids: list, new_status: str) -> int:
-    id_list = ", ".join(str(i) for i in ids)
-    with Session(engine) as session:
-        result = session.execute(
-            text(f"UPDATE orders SET status = '{new_status}' WHERE id IN ({id_list})")
-        )
-        session.commit()
-        return result.rowcount

package/packages/crucible/seeds/python/seed-013.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: high
-# language: python
-# expected: SQL injection in FastAPI route via % operator in SQL string
-
-from fastapi import FastAPI, Query
-import asyncpg
-
-app = FastAPI()
-DB_URL = "postgresql://user:pass@localhost/appdb"
-
-
-@app.get("/employees")
-async def list_employees(
-    department: str = Query(default="Engineering"),
-    sort: str = Query(default="last_name"),
-):
-    conn = await asyncpg.connect(DB_URL)
-    # Both department and sort directly interpolated
-    query = "SELECT * FROM employees WHERE department = '%s' ORDER BY %s" % (department, sort)
-    rows = await conn.fetch(query)
-    await conn.close()
-    return [dict(row) for row in rows]
-
-
-@app.get("/employees/{emp_id}/activity")
-async def get_activity(emp_id: str, action: str = Query(default="login")):
-    conn = await asyncpg.connect(DB_URL)
-    sql = f"SELECT * FROM audit_log WHERE employee_id = '{emp_id}' AND action = '{action}'"
-    rows = await conn.fetch(sql)
-    await conn.close()
-    return [dict(r) for r in rows]

package/packages/crucible/seeds/python/seed-014.py

@@ -1,40 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via string concatenation in bulk IN clause
-
-import psycopg2
-
-
-def get_db():
-    return psycopg2.connect(host="localhost", dbname="shop", user="app", password="app")
-
-
-def get_items_by_ids(item_ids: list) -> list:
-    """Fetch multiple items — ids come from user input."""
-    conn = get_db()
-    cur = conn.cursor()
-    # item_ids is user-controlled — attacker can inject into IN() clause
-    id_list = ", ".join(str(i) for i in item_ids)
-    query = f"SELECT * FROM items WHERE id IN ({id_list}) AND active = true"
-    cur.execute(query)
-    return cur.fetchall()
-
-
-def archive_items(item_ids: list, reason: str) -> int:
-    conn = get_db()
-    cur = conn.cursor()
-    id_list = ", ".join(str(i) for i in item_ids)
-    sql = f"UPDATE items SET archived = true, archive_reason = '{reason}' WHERE id IN ({id_list})"
-    cur.execute(sql)
-    conn.commit()
-    return cur.rowcount
-
-
-def get_report(from_date: str, to_date: str, group_by: str) -> list:
-    conn = get_db()
-    cur = conn.cursor()
-    sql = f"SELECT {group_by}, COUNT(*), SUM(price) FROM orders WHERE created_at BETWEEN '{from_date}' AND '{to_date}' GROUP BY {group_by}"
-    cur.execute(sql)
-    return cur.fetchall()