thuban 0.4.11 → 0.4.13

package/dist/packages/crucible/seeds/ts/seed-050 2.ts

@@ -1,41 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
-
-import got from 'got';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface LinkPreviewResult {
-  title: string;
-  description: string;
-  image?: string;
-  url: string;
-}
-
-router.get('/link-preview', async (req: Request, res: Response) => {
-  const url = req.query.url as string;
-
-  // url is user-controlled — attacker can reach internal services
-  const response = await got(url, {
-    followRedirect: true,
-    timeout: { request: 8000 },
-    throwHttpErrors: false,
-  });
-
-  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
-  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
-
-  const result: LinkPreviewResult = {
-    title: titleMatch?.[1] ?? '',
-    description: descMatch?.[1] ?? '',
-    url,
-  };
-
-  res.json(result);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-051 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: typescript
-// expected: unsafe deserialization via class-transformer plainToClass with user-controlled type
-
-import { plainToClass } from 'class-transformer';
-import { IsString, IsNumber } from 'class-validator';
-import { Request, Response, Router } from 'express';
-
-class UserDto {
-  @IsString() username!: string;
-  @IsString() email!: string;
-  @IsNumber() role!: number;
-}
-
-class AdminDto extends UserDto {
-  @IsString() adminToken!: string;
-  canDeleteUsers: boolean = true;
-}
-
-const router = Router();
-
-router.post('/users/import', (req: Request, res: Response) => {
-  const { type, data } = req.body;
-
-  // User controls which class to deserialize into — can escalate to AdminDto
-  const DtoClass = type === 'admin' ? AdminDto : UserDto;
-  const instance = plainToClass(DtoClass, data);
-  // No validation step — properties set without checking constraints
-  res.json({ created: instance });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-052 2.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: typescript
-// expected: unsafe deserialization via JSON.parse used to dynamically dispatch method calls
-
-import { Request, Response, Router } from 'express';
-
-interface TaskDescriptor {
-  module: string;
-  method: string;
-  args: unknown[];
-}
-
-const allowedModules: Record<string, Record<string, (...args: unknown[]) => unknown>> = {
-  reports: require('./reports'),
-  notifications: require('./notifications'),
-};
-
-router.post('/task/run', (req: Request, res: Response) => {
-  // task is JSON-parsed from user body without schema validation
-  const task = JSON.parse(req.body.taskJson as string) as TaskDescriptor;
-
-  const mod = allowedModules[task.module];
-  if (!mod) return res.status(400).json({ error: 'Unknown module' });
-
-  const fn = mod[task.method];
-  if (typeof fn !== 'function') return res.status(400).json({ error: 'Unknown method' });
-
-  // task.args passed directly — no sanitization or type validation
-  const result = fn(...task.args);
-  res.json({ result });
-});
-
-const router2 = Router();
-export default router2;