thuban 0.4.11 → 0.4.13

package/dist/packages/crucible/seeds/ruby/seed-009 2.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: SQL injection via string interpolation in ActiveRecord where()
-
-class UserController < ApplicationController
-  def search
-    username = params[:username]
-    @users = User.where("username = '#{username}'")
-    render json: @users
-  end
-
-  def filter
-    role  = params[:role]
-    since = params[:since]
-    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
-    render json: @records
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-010 2.rb

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: ActiveRecord find_by_sql with string interpolation
-
-class ReportController < ApplicationController
-  def show
-    user_id = params[:user_id]
-    type    = params[:type]
-    @data = Report.find_by_sql(
-      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
-    )
-    render json: @data
-  end
-
-  def custom_query
-    condition = params[:condition]
-    @results = ActiveRecord::Base.connection.execute(
-      "SELECT * FROM events WHERE #{condition}"
-    )
-    render json: @results.to_a
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-011 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: ORDER BY clause built from user-supplied column name without whitelist
-
-class ProductsController < ApplicationController
-  def index
-    sort_col = params[:sort_by]
-    sort_dir = params[:direction]
-    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
-    render json: @products
-  end
-
-  def search
-    term     = params[:q]
-    category = params[:category]
-    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
-    render json: @items
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-012 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: Raw SQL executed via connection.execute with user input
-
-def run_analytics(dimension, filter_expr)
-  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
-  ActiveRecord::Base.connection.execute(sql)
-end
-
-def delete_records(table, condition)
-  ActiveRecord::Base.connection.execute(
-    "DELETE FROM #{table} WHERE #{condition}"
-  )
-end
-
-def update_field(table, field, value, id)
-  ActiveRecord::Base.connection.execute(
-    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
-  )
-end

package/dist/packages/crucible/seeds/ruby/seed-013 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: Sequel dataset filter with string interpolation
-
-require 'sequel'
-
-DB = Sequel.connect('sqlite://db/production.sqlite3')
-
-def find_user(username, password)
-  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
-end
-
-def get_orders(status, user_id)
-  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
-end
-
-def search_items(keyword)
-  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
-end

package/dist/packages/crucible/seeds/ruby/seed-014 2.rb

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: high
-# language: ruby
-# expected: ActiveRecord group/having clause with unparameterized user input
-
-class AnalyticsController < ApplicationController
-  def aggregate
-    group_by = params[:group_by]
-    having   = params[:having]
-    @data = Order.group(group_by)
-                 .having("COUNT(*) #{having}")
-                 .select("#{group_by}, COUNT(*) as total")
-    render json: @data
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-015 2.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: ruby
-# expected: pg gem exec_params replaced with exec — user string in raw SQL
-
-require 'pg'
-
-conn = PG.connect(dbname: 'production')
-
-def login(conn, username, password)
-  result = conn.exec("SELECT * FROM users WHERE username = '#{username}' AND password_hash = '#{password}'")
-  result.first
-end
-
-def get_profile(conn, user_id)
-  conn.exec("SELECT * FROM profiles WHERE user_id = #{user_id}").first
-end

package/dist/packages/crucible/seeds/ruby/seed-016 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: render html: with user content — unescaped XSS
-
-class CommentsController < ApplicationController
-  def show
-    @comment = Comment.find(params[:id])
-    render html: @comment.body.html_safe
-  end
-
-  def preview
-    content = params[:content]
-    render html: content.html_safe
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-017 2.rb

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: raw() helper used with user-controlled content in ERB template
-
-# In a Rails view (equivalent Ruby)
-class ArticlesController < ApplicationController
-  helper_method :render_article
-
-  def show
-    @article   = Article.find(params[:id])
-    @title     = params[:title] || @article.title
-    @body      = @article.body
-  end
-end
-
-# Equivalent ERB logic (Ruby):
-def render_article_html(title, body, author_bio)
-  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
-end
-
-def raw(str)
-  str.to_s
-end

package/dist/packages/crucible/seeds/ruby/seed-018 2.rb

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: Sinatra response body includes user param without escaping
-
-require 'sinatra'
-
-get '/greet' do
-  name  = params[:name]
-  query = params[:q]
-  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
-end
-
-get '/error' do
-  msg = params[:message]
-  "<div class='error'>#{msg}</div>"
-end
-
-post '/comment' do
-  comment = params[:comment]
-  "<p>Your comment: #{comment}</p>"
-end

package/dist/packages/crucible/seeds/ruby/seed-019 2.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: ruby
-# expected: User content embedded in JSON output that is then eval()d client-side
-
-class ApiController < ApplicationController
-  def user_data
-    user  = User.find(params[:id])
-    bio   = params[:bio] || user.bio
-    @json = { name: user.name, bio: bio, role: params[:role] }
-    render json: @json
-  end
-
-  def config
-    callback = params[:callback]
-    data     = { status: 'ok', user: current_user&.name }
-    render plain: "#{callback}(#{data.to_json})"
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-020 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: content_tag or link_to with unescaped user attribute
-
-def build_link(url, label, css_class)
-  "<a href='#{url}' class='#{css_class}'>#{label}</a>"
-end
-
-def build_input(name, value, placeholder)
-  "<input name='#{name}' value='#{value}' placeholder='#{placeholder}'>"
-end
-
-def build_script_tag(variable_name, data)
-  "<script>var #{variable_name} = #{data.to_json};</script>"
-end

package/dist/packages/crucible/seeds/ruby/seed-021 2.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: ruby
-# expected: ActionMailer HTML email built with unescaped user content
-
-class NotificationMailer < ApplicationMailer
-  def welcome_email(user, custom_message)
-    @user    = user
-    @message = custom_message
-    @subject = params[:subject] || "Welcome!"
-
-    mail(
-      to:      @user.email,
-      subject: @subject
-    ) do |format|
-      format.html { render html: "<h1>#{@user.name}</h1><p>#{@message}</p>".html_safe }
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-022 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: medium
-# language: ruby
-# expected: ERB template rendered with user string directly substituted
-
-require 'erb'
-
-def render_template(template_string, user_data)
-  ERB.new(template_string).result(binding)
-end
-
-def personalize_email(user_name, promo_code)
-  template = "Hello <%= user_name %>, your promo code is: <%= promo_code %>"
-  ERB.new(template).result(binding)
-end
-
-def build_page(title, body, footer)
-  tmpl = "<html><head><title><%= title %></title></head><body><%= body %><footer><%= footer %></footer></body></html>"
-  ERB.new(tmpl).result(binding)
-end

package/dist/packages/crucible/seeds/ruby/seed-023 2.rb

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: Backtick operator with user-supplied input — command injection
-
-class SystemController < ApplicationController
-  def ping
-    host   = params[:host]
-    result = `ping -c 4 #{host}`
-    render plain: result
-  end
-
-  def dns_lookup
-    domain = params[:domain]
-    output = `nslookup #{domain}`
-    render plain: output
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-024 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: system() with user-controlled arguments — command injection
-
-def convert_image(src, dest, width, height)
-  system("convert #{src} -resize #{width}x#{height} #{dest}")
-end
-
-def compress_archive(dir_path, output_name)
-  system("tar -czf /tmp/#{output_name} #{dir_path}")
-end
-
-def run_script(script_name, args)
-  system("/opt/scripts/#{script_name} #{args}")
-end

package/dist/packages/crucible/seeds/ruby/seed-025 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: exec() with user-controlled command — replaces process, no return
-
-def execute_task(command)
-  exec(command)
-end
-
-def run_user_script(script_path, user_arg)
-  exec("ruby #{script_path} #{user_arg}")
-end
-
-def start_service(service_name, config_file)
-  exec("#{service_name} --config #{config_file}")
-end

package/dist/packages/crucible/seeds/ruby/seed-026 2.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: Open3.capture2 with shell string — user input in format string
-
-require 'open3'
-
-def run_ffmpeg(input_file, output_file, codec)
-  cmd    = "ffmpeg -i '#{input_file}' -c:v #{codec} '#{output_file}'"
-  stdout, stderr, status = Open3.capture2(cmd)
-  { output: stdout, error: stderr, success: status.success? }
-end
-
-def grep_logs(pattern, log_file)
-  stdout, _ = Open3.capture2("grep -n '#{pattern}' /var/log/#{log_file}")
-  stdout
-end

package/dist/packages/crucible/seeds/ruby/seed-027 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: ruby
-# expected: IO.popen with user-controlled shell string
-
-def tail_log(log_name, lines)
-  IO.popen("tail -n #{lines} /var/log/#{log_name}") do |f|
-    f.read
-  end
-end
-
-def search_file(filename, keyword)
-  IO.popen("grep '#{keyword}' /data/#{filename}") do |io|
-    io.read
-  end
-end
-
-def pipe_command(cmd)
-  IO.popen(cmd) { |f| f.read }
-end

package/dist/packages/crucible/seeds/ruby/seed-028 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: ruby
-# expected: Kernel.system called with interpolated hostname for network diagnostics
-
-class DiagnosticsController < ApplicationController
-  def check_connectivity
-    host    = params[:host]
-    port    = params[:port]
-    timeout = params[:timeout] || '5'
-
-    result = `nc -zv -w #{timeout} #{host} #{port} 2>&1`
-    render json: { output: result, host: host, port: port }
-  end
-
-  def whois_lookup
-    domain = params[:domain]
-    output = `whois #{domain}`
-    render plain: output
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-029 2.rb

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: File.read with unvalidated user-supplied path
-
-class FilesController < ApplicationController
-  def show
-    filename = params[:filename]
-    content  = File.read("/var/app/uploads/#{filename}")
-    render plain: content
-  end
-
-  def download
-    path = params[:path]
-    data = File.read(path)
-    send_data data, filename: File.basename(path)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-030 2.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: send_file with user-controlled path — arbitrary file download
-
-class DownloadsController < ApplicationController
-  def get_file
-    filename = params[:file]
-    base_dir = Rails.root.join('public', 'downloads')
-    file_path = File.join(base_dir, filename)
-    send_file file_path
-  end
-
-  def export
-    name = params[:name]
-    path = "/var/reports/#{name}"
-    send_file path, type: 'application/octet-stream'
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-031 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Zip extraction writes files using entry name without sanitization — zip slip
-
-require 'zip'
-
-def extract_zip(zip_path, dest_dir)
-  Zip::File.open(zip_path) do |zip|
-    zip.each do |entry|
-      output_path = File.join(dest_dir, entry.name)
-      FileUtils.mkdir_p(File.dirname(output_path))
-      entry.extract(output_path) { true }
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-032 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: ruby
-# expected: File.write to user-controlled destination path
-
-def save_export(filename, data)
-  path = "/var/app/exports/#{filename}"
-  File.write(path, data)
-  path
-end
-
-def cache_response(cache_key, content)
-  cache_path = "/tmp/cache/#{cache_key}"
-  FileUtils.mkdir_p(File.dirname(cache_path))
-  File.write(cache_path, content)
-end
-
-def write_template(template_name, subdir, content)
-  full_path = "/app/templates/#{subdir}/#{template_name}"
-  File.write(full_path, content)
-end

package/dist/packages/crucible/seeds/ruby/seed-033 2.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Dir.glob and File.open with user-controlled subdirectory
-
-def list_files(base_dir, subdir)
-  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
-end
-
-def read_config(config_name)
-  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
-end
-
-def load_plugin(plugin_id)
-  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
-  JSON.parse(manifest)
-end

package/dist/packages/crucible/seeds/ruby/seed-034 2.rb

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: params.permit(:all) or ActionController::Parameters without strong params
-
-class UsersController < ApplicationController
-  def update
-    @user = User.find(params[:id])
-    @user.update(params[:user])
-    redirect_to @user
-  end
-
-  def create
-    @user = User.new(params[:user].permit!)
-    @user.save
-    render json: @user
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-035 2.rb

@@ -1,19 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: ActiveRecord.new(params) without strong parameters — mass assignment
-
-class ProfilesController < ApplicationController
-  def update
-    profile = Profile.find(params[:id])
-    profile.update_attributes(params[:profile])
-    render json: profile
-  end
-
-  def create
-    profile = Profile.new(params)
-    profile.save!
-    render json: profile, status: :created
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-036 2.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: critical
-# language: ruby
-# expected: attr_accessible :all or missing attr_protected — mass assignment in model
-
-class User < ActiveRecord::Base
-  # No attr_protected or attr_accessible defined
-  # Allows setting admin, role, confirmed fields via mass assignment
-
-  def self.create_from_params(params)
-    create(params)
-  end
-
-  def self.register(registration_params)
-    new(registration_params).tap(&:save)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-037 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
-
-class OrdersController < ApplicationController
-  def create
-    permitted = params.require(:order).permit!
-    @order    = Order.create(permitted)
-    render json: @order
-  end
-
-  def bulk_update
-    params[:records].each do |record_params|
-      item = Item.find(record_params[:id])
-      item.update(record_params.except(:id))
-    end
-    render json: { updated: params[:records].count }
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-038 2.rb

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: Mongoid or other ODM with unfiltered hash assignment
-
-require 'mongoid'
-
-class Document
-  include Mongoid::Document
-
-  field :title,   type: String
-  field :content, type: String
-  field :admin,   type: Boolean, default: false
-  field :role,    type: String,  default: 'user'
-
-  def self.create_from_hash(attrs)
-    create!(attrs)
-  end
-
-  def update_from_request(request_params)
-    update_attributes!(request_params)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-039 2.rb

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: Net::HTTP.get_response with user-controlled URL — SSRF
-
-require 'net/http'
-require 'uri'
-
-class ProxyController < ApplicationController
-  def fetch
-    url      = params[:url]
-    uri      = URI.parse(url)
-    response = Net::HTTP.get_response(uri)
-    render plain: response.body
-  end
-
-  def check_endpoint
-    target = params[:endpoint]
-    uri    = URI(target)
-    res    = Net::HTTP.get_response(uri)
-    render json: { status: res.code, body: res.body[0..200] }
-  end
-end