thuban 0.4.10 → 0.4.12

package/packages/crucible/seeds/ts/seed-030 2.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via typed file service with user-controlled subdirectory
-
-import * as fs from 'fs';
-import * as path from 'path';
-
-interface FileServiceConfig {
-  baseDir: string;
-}
-
-export class FileService {
-  private readonly baseDir: string;
-
-  constructor(config: FileServiceConfig) {
-    this.baseDir = config.baseDir;
-  }
-
-  readUserFile(userId: string, fileName: string): string {
-    // No normalization check — fileName can be "../../../etc/passwd"
-    const filePath = path.join(this.baseDir, userId, fileName);
-    return fs.readFileSync(filePath, 'utf-8');
-  }
-
-  listDirectory(userId: string, subDir: string): string[] {
-    // subDir from user — directory traversal possible
-    const dirPath = path.join(this.baseDir, userId, subDir);
-    return fs.readdirSync(dirPath);
-  }
-
-  deleteFile(userId: string, fileName: string): void {
-    const filePath = path.join(this.baseDir, userId, fileName);
-    fs.unlinkSync(filePath);
-  }
-}

package/packages/crucible/seeds/ts/seed-030.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via typed file service with user-controlled subdirectory
-
-import * as fs from 'fs';
-import * as path from 'path';
-
-interface FileServiceConfig {
-  baseDir: string;
-}
-
-export class FileService {
-  private readonly baseDir: string;
-
-  constructor(config: FileServiceConfig) {
-    this.baseDir = config.baseDir;
-  }
-
-  readUserFile(userId: string, fileName: string): string {
-    // No normalization check — fileName can be "../../../etc/passwd"
-    const filePath = path.join(this.baseDir, userId, fileName);
-    return fs.readFileSync(filePath, 'utf-8');
-  }
-
-  listDirectory(userId: string, subDir: string): string[] {
-    // subDir from user — directory traversal possible
-    const dirPath = path.join(this.baseDir, userId, subDir);
-    return fs.readdirSync(dirPath);
-  }
-
-  deleteFile(userId: string, fileName: string): void {
-    const filePath = path.join(this.baseDir, userId, fileName);
-    fs.unlinkSync(filePath);
-  }
-}

package/packages/crucible/seeds/ts/seed-031 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal in NestJS controller via user-controlled template name
-
-import { Controller, Get, Query, Res } from '@nestjs/common';
-import { Response } from 'express';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
-
-@Controller('email')
-export class EmailController {
-  @Get('preview')
-  previewTemplate(
-    @Query('name') templateName: string,
-    @Query('locale') locale: string,
-    @Res() res: Response
-  ): void {
-    // templateName from query — attacker sends "../../config/database"
-    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
-    try {
-      const html = fs.readFileSync(templatePath, 'utf-8');
-      res.type('text/html').send(html);
-    } catch {
-      res.status(404).send('Template not found');
-    }
-  }
-}

package/packages/crucible/seeds/ts/seed-031.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal in NestJS controller via user-controlled template name
-
-import { Controller, Get, Query, Res } from '@nestjs/common';
-import { Response } from 'express';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
-
-@Controller('email')
-export class EmailController {
-  @Get('preview')
-  previewTemplate(
-    @Query('name') templateName: string,
-    @Query('locale') locale: string,
-    @Res() res: Response
-  ): void {
-    // templateName from query — attacker sends "../../config/database"
-    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
-    try {
-      const html = fs.readFileSync(templatePath, 'utf-8');
-      res.type('text/html').send(html);
-    } catch {
-      res.status(404).send('Template not found');
-    }
-  }
-}

package/packages/crucible/seeds/ts/seed-032 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
-
-import AdmZip from 'adm-zip';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const EXTRACT_BASE = '/var/app/uploads/extracted';
-
-export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-  const extractedPaths: string[] = [];
-
-  for (const entry of entries) {
-    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, entry.getData());
-      extractedPaths.push(outputPath);
-    }
-  }
-
-  return extractedPaths;
-}

package/packages/crucible/seeds/ts/seed-032.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
-
-import AdmZip from 'adm-zip';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const EXTRACT_BASE = '/var/app/uploads/extracted';
-
-export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-  const extractedPaths: string[] = [];
-
-  for (const entry of entries) {
-    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, entry.getData());
-      extractedPaths.push(outputPath);
-    }
-  }
-
-  return extractedPaths;
-}

package/packages/crucible/seeds/ts/seed-033 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: typescript
-// expected: path traversal via multer upload with user-controlled destination folder
-
-import multer, { StorageEngine } from 'multer';
-import * as path from 'path';
-import * as fs from 'fs';
-import { Request } from 'express';
-
-const UPLOADS_ROOT = '/var/uploads';
-
-const storage: StorageEngine = multer.diskStorage({
-  destination: (req: Request, file, cb) => {
-    const folder = req.body.folder as string || 'default';
-    // folder from request body — allows writing to arbitrary locations
-    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
-    fs.mkdirSync(destPath, { recursive: true });
-    cb(null, destPath);
-  },
-  filename: (req: Request, file, cb) => {
-    const prefix = req.body.prefix as string || '';
-    // prefix + originalname — originalname may include path separators
-    cb(null, `${prefix}_${file.originalname}`);
-  },
-});
-
-export const upload = multer({
-  storage,
-  limits: { fileSize: 50 * 1024 * 1024 },
-});

package/packages/crucible/seeds/ts/seed-033.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: typescript
-// expected: path traversal via multer upload with user-controlled destination folder
-
-import multer, { StorageEngine } from 'multer';
-import * as path from 'path';
-import * as fs from 'fs';
-import { Request } from 'express';
-
-const UPLOADS_ROOT = '/var/uploads';
-
-const storage: StorageEngine = multer.diskStorage({
-  destination: (req: Request, file, cb) => {
-    const folder = req.body.folder as string || 'default';
-    // folder from request body — allows writing to arbitrary locations
-    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
-    fs.mkdirSync(destPath, { recursive: true });
-    cb(null, destPath);
-  },
-  filename: (req: Request, file, cb) => {
-    const prefix = req.body.prefix as string || '';
-    // prefix + originalname — originalname may include path separators
-    cb(null, `${prefix}_${file.originalname}`);
-  },
-});
-
-export const upload = multer({
-  storage,
-  limits: { fileSize: 50 * 1024 * 1024 },
-});

package/packages/crucible/seeds/ts/seed-034 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: MD5 used for password hashing in typed auth service
-
-import * as crypto from 'crypto';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export class AuthService {
-  private hashPassword(password: string): string {
-    // MD5 is cryptographically broken — should use bcrypt/argon2
-    return crypto.createHash('md5').update(password).digest('hex');
-  }
-
-  async register(email: string, password: string): Promise<void> {
-    const hash = this.hashPassword(password);
-    await pool.query(
-      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-      [email, hash]
-    );
-  }
-
-  async login(email: string, password: string): Promise<boolean> {
-    const hash = this.hashPassword(password);
-    const { rows } = await pool.query(
-      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
-      [email, hash]
-    );
-    return rows.length > 0;
-  }
-}

package/packages/crucible/seeds/ts/seed-034.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: MD5 used for password hashing in typed auth service
-
-import * as crypto from 'crypto';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export class AuthService {
-  private hashPassword(password: string): string {
-    // MD5 is cryptographically broken — should use bcrypt/argon2
-    return crypto.createHash('md5').update(password).digest('hex');
-  }
-
-  async register(email: string, password: string): Promise<void> {
-    const hash = this.hashPassword(password);
-    await pool.query(
-      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-      [email, hash]
-    );
-  }
-
-  async login(email: string, password: string): Promise<boolean> {
-    const hash = this.hashPassword(password);
-    const { rows } = await pool.query(
-      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
-      [email, hash]
-    );
-    return rows.length > 0;
-  }
-}

package/packages/crucible/seeds/ts/seed-035 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: Math.random() used for security tokens, SHA1 for HMAC
-
-import * as crypto from 'crypto';
-
-export function generateSessionId(): string {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).slice(2) + Date.now().toString(36);
-}
-
-export function generateCsrfToken(): string {
-  // Predictable timestamp-based token
-  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
-}
-
-export function generatePasswordResetToken(userId: string): string {
-  // SHA1 HMAC with weak source of randomness
-  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
-  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
-}
-
-export function generateApiKey(): string {
-  // Only 32 bits of entropy — trivially brute-forceable
-  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
-  return `key_${rand}`;
-}

package/packages/crucible/seeds/ts/seed-035.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: Math.random() used for security tokens, SHA1 for HMAC
-
-import * as crypto from 'crypto';
-
-export function generateSessionId(): string {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).slice(2) + Date.now().toString(36);
-}
-
-export function generateCsrfToken(): string {
-  // Predictable timestamp-based token
-  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
-}
-
-export function generatePasswordResetToken(userId: string): string {
-  // SHA1 HMAC with weak source of randomness
-  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
-  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
-}
-
-export function generateApiKey(): string {
-  // Only 32 bits of entropy — trivially brute-forceable
-  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
-  return `key_${rand}`;
-}

package/packages/crucible/seeds/ts/seed-036 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: AES-ECB mode with no IV and RC4 weak cipher usage
-
-import * as crypto from 'crypto';
-
-type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
-
-export class LegacyCrypto {
-  private key: Buffer;
-
-  constructor(hexKey: string) {
-    this.key = Buffer.from(hexKey, 'hex');
-  }
-
-  // ECB mode: identical plaintext blocks produce identical ciphertext
-  encryptECB(data: string): string {
-    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-
-  decryptECB(data: string): string {
-    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
-  }
-
-  // RC4 is broken — key reuse leads to plaintext recovery
-  encryptRC4(data: string): string {
-    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-}

package/packages/crucible/seeds/ts/seed-036.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: AES-ECB mode with no IV and RC4 weak cipher usage
-
-import * as crypto from 'crypto';
-
-type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
-
-export class LegacyCrypto {
-  private key: Buffer;
-
-  constructor(hexKey: string) {
-    this.key = Buffer.from(hexKey, 'hex');
-  }
-
-  // ECB mode: identical plaintext blocks produce identical ciphertext
-  encryptECB(data: string): string {
-    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-
-  decryptECB(data: string): string {
-    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
-  }
-
-  // RC4 is broken — key reuse leads to plaintext recovery
-  encryptRC4(data: string): string {
-    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-}

package/packages/crucible/seeds/ts/seed-037 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: typescript
-// expected: timing attack via string comparison of HMAC signatures
-
-import * as crypto from 'crypto';
-
-const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
-
-export function computeSignature(payload: string): string {
-  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
-}
-
-export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
-  const expectedSig = computeSignature(payload);
-  // Timing attack: early exit on first mismatch leaks signature length/prefix
-  return expectedSig === receivedSig;
-}
-
-export function verifyApiKey(providedKey: string, storedKey: string): boolean {
-  // Direct string comparison — vulnerable to timing oracle attack
-  return providedKey === storedKey;
-}
-
-export function checkTokenMatch(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  // Character-by-character comparison — timing side-channel
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}

package/packages/crucible/seeds/ts/seed-037.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: typescript
-// expected: timing attack via string comparison of HMAC signatures
-
-import * as crypto from 'crypto';
-
-const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
-
-export function computeSignature(payload: string): string {
-  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
-}
-
-export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
-  const expectedSig = computeSignature(payload);
-  // Timing attack: early exit on first mismatch leaks signature length/prefix
-  return expectedSig === receivedSig;
-}
-
-export function verifyApiKey(providedKey: string, storedKey: string): boolean {
-  // Direct string comparison — vulnerable to timing oracle attack
-  return providedKey === storedKey;
-}
-
-export function checkTokenMatch(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  // Character-by-character comparison — timing side-channel
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}

package/packages/crucible/seeds/ts/seed-038 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-
-import * as crypto from 'crypto';
-
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}

package/packages/crucible/seeds/ts/seed-038.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-
-import * as crypto from 'crypto';
-
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}

package/packages/crucible/seeds/ts/seed-039 2.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-
-interface DeepObject {
-  [key: string]: unknown;
-}
-
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-
-import { Request, Response, Router } from 'express';
-const router = Router();
-
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-039.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-
-interface DeepObject {
-  [key: string]: unknown;
-}
-
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-
-import { Request, Response, Router } from 'express';
-const router = Router();
-
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-
-export default router;