thuban 0.4.11 → 0.4.13

package/dist/packages/crucible/seeds/rust/seed-041 2.rs

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: race_condition
-// severity: critical
-// language: rust
-// expected: Unsafe impl Send for type containing raw pointer — data race
-
-use std::ptr;
-
-pub struct RawBuffer {
-    ptr: *mut u8,
-    len: usize,
-}
-
-unsafe impl Send for RawBuffer {}
-unsafe impl Sync for RawBuffer {}
-
-impl RawBuffer {
-    pub fn new(size: usize) -> Self {
-        let mut data = vec![0u8; size];
-        let ptr = data.as_mut_ptr();
-        std::mem::forget(data);
-        RawBuffer { ptr, len: size }
-    }
-
-    pub fn write_at(&self, offset: usize, value: u8) {
-        unsafe { ptr::write(self.ptr.add(offset), value) }
-    }
-
-    pub fn read_at(&self, offset: usize) -> u8 {
-        unsafe { ptr::read(self.ptr.add(offset)) }
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-042 2.rs

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: race_condition
-// severity: high
-// language: rust
-// expected: Multiple threads access static mut without synchronization
-
-static mut GLOBAL_COUNTER: u64 = 0;
-static mut INITIALIZED: bool = false;
-
-pub fn increment_global() {
-    unsafe {
-        GLOBAL_COUNTER += 1;
-    }
-}
-
-pub fn get_global() -> u64 {
-    unsafe { GLOBAL_COUNTER }
-}
-
-pub fn initialize_once(value: u64) {
-    unsafe {
-        if !INITIALIZED {
-            GLOBAL_COUNTER = value;
-            INITIALIZED = true;
-        }
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-043 2.rs

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: race_condition
-// severity: high
-// language: rust
-// expected: Mutex poisoning ignored with unwrap — may expose partial state
-
-use std::sync::{Arc, Mutex};
-use std::thread;
-
-pub fn parallel_updates(shared: Arc<Mutex<Vec<i32>>>, items: Vec<i32>) {
-    let handles: Vec<_> = items.into_iter().map(|item| {
-        let shared = Arc::clone(&shared);
-        thread::spawn(move || {
-            let mut guard = shared.lock().unwrap();
-            guard.push(item);
-            if item == 42 {
-                panic!("Special case panic — poisons the Mutex");
-            }
-        })
-    }).collect();
-
-    for h in handles {
-        let _ = h.join();
-    }
-}
-
-pub fn read_poisoned(shared: Arc<Mutex<Vec<i32>>>) -> Vec<i32> {
-    shared.lock().unwrap().clone()
-}

package/dist/packages/crucible/seeds/rust/seed-044 2.rs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: crypto_misuse
-// severity: high
-// language: rust
-// expected: MD5 crate used for password or data integrity hashing
-
-use md5;
-
-pub fn hash_password(password: &str) -> String {
-    let digest = md5::compute(password.as_bytes());
-    format!("{:x}", digest)
-}
-
-pub fn hash_with_salt(password: &str, username: &str) -> String {
-    let input = format!("{}:{}", username, password);
-    format!("{:x}", md5::compute(input.as_bytes()))
-}
-
-pub fn verify_password(password: &str, stored_hash: &str) -> bool {
-    hash_password(password) == stored_hash
-}
-
-pub fn generate_cache_key(data: &str) -> String {
-    format!("{:x}", md5::compute(data))
-}

package/dist/packages/crucible/seeds/rust/seed-045 2.rs

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: crypto_misuse
-// severity: critical
-// language: rust
-// expected: Custom XOR cipher implementation — homegrown crypto
-
-pub fn xor_encrypt(data: &[u8], key: &[u8]) -> Vec<u8> {
-    data.iter()
-        .zip(key.iter().cycle())
-        .map(|(d, k)| d ^ k)
-        .collect()
-}
-
-pub fn xor_decrypt(ciphertext: &[u8], key: &[u8]) -> Vec<u8> {
-    xor_encrypt(ciphertext, key)
-}
-
-pub fn rot13(input: &str) -> String {
-    input.chars().map(|c| match c {
-        'a'..='m' | 'A'..='M' => (c as u8 + 13) as char,
-        'n'..='z' | 'N'..='Z' => (c as u8 - 13) as char,
-        _ => c,
-    }).collect()
-}
-
-pub fn caesar_cipher(text: &str, shift: u8) -> String {
-    text.bytes().map(|b| ((b - b'a' + shift) % 26 + b'a') as char).collect()
-}

package/dist/packages/crucible/seeds/rust/seed-046 2.rs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: crypto_misuse
-// severity: high
-// language: rust
-// expected: rand::random used for security token generation — not cryptographically secure
-
-use rand::Rng;
-
-pub fn generate_session_token() -> String {
-    let mut rng = rand::thread_rng();
-    (0..32).map(|_| format!("{:02x}", rng.gen::<u8>())).collect()
-}
-
-pub fn generate_otp() -> u32 {
-    rand::thread_rng().gen_range(100000..999999)
-}
-
-pub fn generate_api_key(prefix: &str) -> String {
-    let mut rng = rand::thread_rng();
-    let suffix: String = (0..24).map(|_| {
-        let idx = rng.gen_range(0..36usize);
-        "abcdefghijklmnopqrstuvwxyz0123456789".chars().nth(idx).unwrap()
-    }).collect();
-    format!("{}_{}", prefix, suffix)
-}

package/dist/packages/crucible/seeds/rust/seed-047 2.rs

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: crypto_misuse
-// severity: high
-// language: rust
-// expected: RC4 stream cipher implementation — broken cipher, insecure
-
-pub struct Rc4 {
-    s: [u8; 256],
-    i: usize,
-    j: usize,
-}
-
-impl Rc4 {
-    pub fn new(key: &[u8]) -> Self {
-        let mut s = [0u8; 256];
-        for i in 0..256 { s[i] = i as u8; }
-        let mut j = 0usize;
-        for i in 0..256 {
-            j = (j + s[i] as usize + key[i % key.len()] as usize) % 256;
-            s.swap(i, j);
-        }
-        Rc4 { s, i: 0, j: 0 }
-    }
-
-    pub fn apply(&mut self, data: &mut [u8]) {
-        for byte in data.iter_mut() {
-            self.i = (self.i + 1) % 256;
-            self.j = (self.j + self.s[self.i] as usize) % 256;
-            self.s.swap(self.i, self.j);
-            let k = self.s[(self.s[self.i] as usize + self.s[self.j] as usize) % 256];
-            *byte ^= k;
-        }
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-048 2.rs

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: high
-// language: rust
-// expected: Secret from env var logged to stdout/stderr — credential exposure in logs
-
-use std::env;
-
-pub fn initialize_client() {
-    let api_key = env::var("API_KEY").expect("API_KEY not set");
-    let db_password = env::var("DB_PASSWORD").expect("DB_PASSWORD not set");
-    println!("Starting client with API_KEY={}", api_key);
-    eprintln!("DB connection using password: {}", db_password);
-    log::info!("Auth token: {}", env::var("AUTH_TOKEN").unwrap_or_default());
-}
-
-pub fn debug_config() {
-    for (key, value) in env::vars() {
-        println!("{}={}", key, value);
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-049 2.rs

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: high
-// language: rust
-// expected: Environment variable values reflected in HTTP response — credential leak
-
-use axum::{response::IntoResponse, http::StatusCode};
-use std::env;
-
-pub async fn debug_handler() -> impl IntoResponse {
-    let config = serde_json::json!({
-        "database_url": env::var("DATABASE_URL").unwrap_or_default(),
-        "redis_url": env::var("REDIS_URL").unwrap_or_default(),
-        "api_key": env::var("API_KEY").unwrap_or_default(),
-        "jwt_secret": env::var("JWT_SECRET").unwrap_or_default(),
-        "aws_key": env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
-        "aws_secret": env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
-    });
-    (StatusCode::OK, config.to_string())
-}
-
-pub fn get_env_or_log(key: &str) -> String {
-    let value = env::var(key).unwrap_or_default();
-    log::debug!("Reading env {} = {}", key, value);
-    value
-}

package/dist/packages/crucible/seeds/rust/seed-050 2.rs

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: env_injection
-// severity: critical
-// language: rust
-// expected: User-controlled key used to read arbitrary env var — information disclosure
-
-use std::env;
-use axum::{extract::Query, response::IntoResponse};
-use std::collections::HashMap;
-
-pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
-    let key = params.get("key").cloned().unwrap_or_default();
-    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
-    format!("{}={}", key, value)
-}
-
-pub fn lookup_env(user_key: &str) -> String {
-    env::var(user_key).unwrap_or_default()
-}
-
-pub fn set_env_from_input(name: &str, value: &str) {
-    unsafe { env::set_var(name, value) }
-}

package/dist/packages/crucible/seeds/ts/seed-001 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded AWS credentials in typed config object
-
-import * as AWS from 'aws-sdk';
-
-interface AwsCredentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  region: string;
-}
-
-const credentials: AwsCredentials = {
-  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
-  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  region: 'us-east-1',
-};
-
-AWS.config.update(credentials);
-
-const s3 = new AWS.S3();
-const sqs = new AWS.SQS();
-
-export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
-  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
-}
-
-export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
-  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
-}

package/dist/packages/crucible/seeds/ts/seed-002 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded JWT secret in typed auth service
-
-import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
-
-interface TokenPayload {
-  userId: string;
-  role: 'admin' | 'user' | 'moderator';
-  email: string;
-}
-
-const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
-const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
-
-const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
-
-export function signAccessToken(payload: TokenPayload): string {
-  return jwt.sign(payload, JWT_SECRET, signOptions);
-}
-
-export function signRefreshToken(userId: string): string {
-  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
-}
-
-export function verifyAccessToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_SECRET) as JwtPayload;
-}
-
-export function verifyRefreshToken(token: string): JwtPayload {
-  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
-}

package/dist/packages/crucible/seeds/ts/seed-003 2.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded database credentials in TypeORM DataSource config
-
-import { DataSource } from 'typeorm';
-import { User } from './entities/User';
-import { Order } from './entities/Order';
-
-export const AppDataSource = new DataSource({
-  type: 'postgres',
-  host: 'prod-postgres.internal',
-  port: 5432,
-  username: 'app_user',
-  password: 'Pr0dPassw0rd!@#$',
-  database: 'production_db',
-  synchronize: false,
-  logging: false,
-  ssl: { rejectUnauthorized: false },
-  entities: [User, Order],
-  migrations: ['dist/migrations/*.js'],
-});
-
-export async function initializeDatabase(): Promise<void> {
-  await AppDataSource.initialize();
-  console.log('Database connection established');
-}

package/dist/packages/crucible/seeds/ts/seed-004 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded Stripe secret key and webhook secret in typed service
-
-import Stripe from 'stripe';
-
-const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
-const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
-
-const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
-
-export async function createPaymentIntent(
-  amount: number,
-  currency: string = 'usd',
-  customerId?: string
-): Promise<Stripe.PaymentIntent> {
-  return stripe.paymentIntents.create({
-    amount,
-    currency,
-    customer: customerId,
-    automatic_payment_methods: { enabled: true },
-  });
-}
-
-export function constructWebhookEvent(
-  payload: Buffer,
-  signature: string
-): Stripe.Event {
-  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
-}
-
-export { stripe };

package/dist/packages/crucible/seeds/ts/seed-005 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
-
-import sgMail from '@sendgrid/mail';
-import nodemailer from 'nodemailer';
-
-const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_KEY);
-
-interface EmailOptions {
-  to: string;
-  subject: string;
-  text?: string;
-  html?: string;
-}
-
-export async function sendTransactional(opts: EmailOptions): Promise<void> {
-  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
-}
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.myapp.com',
-  port: 587,
-  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
-});
-
-export async function sendInternal(opts: EmailOptions): Promise<void> {
-  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
-}

package/dist/packages/crucible/seeds/ts/seed-006 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
-
-import { Octokit } from '@octokit/rest';
-import axios from 'axios';
-
-interface IntegrationConfig {
-  githubToken: string;
-  slackWebhookUrl: string;
-  slackSigningSecret: string;
-}
-
-const config: IntegrationConfig = {
-  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
-  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
-  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
-};
-
-const octokit = new Octokit({ auth: config.githubToken });
-
-export async function postToSlack(text: string): Promise<void> {
-  await axios.post(config.slackWebhookUrl, { text });
-}
-
-export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
-  const { data } = await octokit.issues.create({ owner, repo, title });
-  return data.number;
-}

package/dist/packages/crucible/seeds/ts/seed-007 2.ts

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded encryption key and static IV in typed crypto utility
-
-import * as crypto from 'crypto';
-
-const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
-const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
-
-export function encrypt(plaintext: string): string {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-}
-
-export function decrypt(ciphertext: string): string {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-export function hashToken(token: string): string {
-  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
-}

package/dist/packages/crucible/seeds/ts/seed-008 2.ts

@@ -1,40 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded OAuth2 client credentials and admin API key in typed config
-
-import { Router, Request, Response } from 'express';
-
-interface OAuthConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-interface AdminConfig {
-  apiKey: string;
-  adminPassword: string;
-}
-
-const oauthConfig: OAuthConfig = {
-  clientId: 'oauth2-client-production-id-abc123',
-  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
-  redirectUri: 'https://app.company.com/oauth/callback',
-};
-
-const adminConfig: AdminConfig = {
-  apiKey: 'admin-api-key-supersecret-prod-2024',
-  adminPassword: 'AdminP@ssw0rd!#$',
-};
-
-const router = Router();
-
-router.post('/oauth/token', (req: Request, res: Response) => {
-  if (req.body.client_secret !== oauthConfig.clientSecret) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  res.json({ access_token: 'generated', token_type: 'bearer' });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-009 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection via TypeORM query() with string concatenation
-
-import { AppDataSource } from '../data-source';
-
-export async function findUserByUsername(username: string) {
-  // Raw query with direct string interpolation — bypasses parameterization
-  const result = await AppDataSource.query(
-    `SELECT * FROM users WHERE username = '${username}'`
-  );
-  return result[0] ?? null;
-}
-
-export async function searchProducts(term: string, category: string) {
-  const sql = `
-    SELECT p.*, c.name as category_name
-    FROM products p
-    JOIN categories c ON p.category_id = c.id
-    WHERE p.name ILIKE '%` + term + `%'
-    AND c.slug = '` + category + `'
-    ORDER BY p.created_at DESC
-  `;
-  return AppDataSource.query(sql);
-}
-
-export async function deleteUserSessions(userId: string) {
-  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
-}

package/dist/packages/crucible/seeds/ts/seed-010 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in TypeORM repository createQueryBuilder with raw where clause
-
-import { Repository } from 'typeorm';
-import { User } from '../entities/User';
-
-export class UserRepository {
-  constructor(private repo: Repository<User>) {}
-
-  async findByEmail(email: string): Promise<User | null> {
-    return this.repo
-      .createQueryBuilder('user')
-      // Direct interpolation into where() — SQL injection
-      .where(`user.email = '${email}'`)
-      .getOne();
-  }
-
-  async searchByName(query: string, role: string): Promise<User[]> {
-    return this.repo
-      .createQueryBuilder('user')
-      .where(`user.name ILIKE '%${query}%' AND user.role = '${role}'`)
-      .orderBy('user.createdAt', 'DESC')
-      .getMany();
-  }
-
-  async getByIds(ids: string[]): Promise<User[]> {
-    const idList = ids.join(', ');
-    return this.repo.query(`SELECT * FROM users WHERE id IN (${idList})`);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-011 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in Prisma $queryRaw with tagged template bypassed via string concat
-
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
-export async function getUserOrders(userId: string, status: string) {
-  // $queryRawUnsafe does NOT parameterize — direct string concatenation
-  const orders = await prisma.$queryRawUnsafe(
-    `SELECT * FROM orders WHERE user_id = '${userId}' AND status = '${status}'`
-  );
-  return orders;
-}
-
-export async function searchInventory(searchTerm: string, warehouseId: string) {
-  const query = `
-    SELECT i.*, w.name as warehouse
-    FROM inventory i
-    JOIN warehouses w ON i.warehouse_id = w.id
-    WHERE i.sku ILIKE '%` + searchTerm + `%'
-    OR i.description ILIKE '%` + searchTerm + `%'
-    AND w.id = '` + warehouseId + `'
-  `;
-  return prisma.$queryRawUnsafe(query);
-}