thuban 0.4.12 → 0.4.13

package/dist/packages/crucible/seeds/python/seed-040 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: exec() called with user-controlled code string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/scripting/run", methods=["POST"])
-def run_script():
-    data = request.get_json()
-    code = data.get("code", "")
-    context = data.get("context", {})
-    local_vars = {"result": None, **context}
-    try:
-        # exec() executes arbitrary Python — no sandboxing
-        exec(code, {"__builtins__": __builtins__}, local_vars)
-        return jsonify({"result": local_vars.get("result")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/hooks/execute", methods=["POST"])
-def execute_hook():
-    hook_code = request.get_json().get("hook", "")
-    event = request.get_json().get("event", {})
-    # User-controlled hook code executed server-side
-    exec(hook_code, {"event": event, "print": print})
-    return jsonify({"executed": True})
-
-
-@app.route("/migration/run", methods=["POST"])
-def run_migration():
-    migration_script = request.get_json().get("script", "")
-    exec(compile(migration_script, "<migration>", "exec"))
-    return jsonify({"status": "done"})

package/dist/packages/crucible/seeds/python/seed-041 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() used in Jinja2-like custom template rendering with user template string
-
-import re
-from flask import Flask, request
-
-app = Flask(__name__)
-
-
-def render_template(template: str, context: dict) -> str:
-    """Simple template renderer that evaluates {{ expr }} blocks."""
-    def evaluate(match):
-        expr = match.group(1).strip()
-        # eval with user-controlled expression — attacker injects arbitrary Python
-        return str(eval(expr, {"__builtins__": {}}, context))
-
-    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
-
-
-@app.route("/preview", methods=["POST"])
-def preview():
-    data = request.get_json()
-    template = data.get("template", "Hello {{ name }}!")
-    ctx = data.get("context", {"name": "World"})
-    # Attacker template: "{{ __import__('os').system('id') }}"
-    output = render_template(template, ctx)
-    return output
-
-
-@app.route("/report", methods=["POST"])
-def report():
-    tpl = request.form.get("template", "")
-    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
-    return rendered

package/dist/packages/crucible/seeds/python/seed-042 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() in pandas query/eval with user-controlled expression
-
-import pandas as pd
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-# Simulated data store
-DATA = pd.DataFrame({
-    "id": range(1, 101),
-    "amount": [i * 10.5 for i in range(1, 101)],
-    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
-    "active": [True] * 100,
-})
-
-
-@app.route("/data/query", methods=["POST"])
-def query_data():
-    body = request.get_json()
-    filter_expr = body.get("filter", "active == True")
-    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
-    # Attacker: "@__import__('os').system('id')"
-    try:
-        result = DATA.query(filter_expr)
-        return jsonify({"count": len(result), "data": result.to_dict("records")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/data/eval", methods=["POST"])
-def eval_expression():
-    expr = request.get_json().get("expr", "amount * 2")
-    result = DATA.eval(expr)
-    return jsonify({"result": result.tolist()})

package/dist/packages/crucible/seeds/python/seed-043 2.py

@@ -1,32 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval()/compile() used to execute user-uploaded Python module code
-
-import ast
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def safe_eval(code: str, context: dict) -> object:
-    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
-    try:
-        tree = ast.parse(code, mode="eval")
-        # compile() + eval() of user AST still allows dangerous constructs
-        compiled = compile(tree, "<user-input>", "eval")
-        return eval(compiled, {"__builtins__": __builtins__}, context)
-    except SyntaxError:
-        # Falls back to exec for multi-line code
-        exec(compile(code, "<user-input>", "exec"), context)
-        return context.get("result")
-
-
-@app.route("/plugin/evaluate", methods=["POST"])
-def evaluate_plugin():
-    payload = request.get_json()
-    code = payload.get("code", "")
-    params = payload.get("params", {})
-    result = safe_eval(code, params)
-    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-044 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-045 2.py

@@ -1,36 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-046 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-047 2.py

@@ -1,44 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
-
-import aiohttp
-from fastapi import FastAPI, Body
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class NotificationConfig(BaseModel):
-    webhook_url: str    # user-controlled
-    event_type: str
-    secret: str = ""
-
-
-class ImportRequest(BaseModel):
-    data_url: str       # user-controlled source URL
-    format: str = "json"
-
-
-@app.post("/notifications/send")
-async def send_notification(config: NotificationConfig):
-    async with aiohttp.ClientSession() as session:
-        # webhook_url from user — attacker targets http://10.0.0.1/admin
-        async with session.post(
-            config.webhook_url,
-            json={"event": config.event_type},
-            headers={"X-Secret": config.secret},
-            timeout=aiohttp.ClientTimeout(total=10),
-            allow_redirects=True,  # follows redirects — pivot to internal
-        ) as resp:
-            return {"status": resp.status}
-
-
-@app.post("/data/import")
-async def import_data(req: ImportRequest):
-    async with aiohttp.ClientSession() as session:
-        async with session.get(req.data_url) as resp:
-            data = await resp.text()
-    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-048 2.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.loads used with untrusted data — arbitrary code execution
-
-import pickle
-import base64
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/session/restore", methods=["POST"])
-def restore_session():
-    session_data = request.cookies.get("session", "")
-    if not session_data:
-        return jsonify({"error": "No session"}), 401
-
-    try:
-        # pickle.loads executes arbitrary Python code embedded in the payload
-        # Attacker payload: object with __reduce__ returning os.system('id')
-        decoded = base64.b64decode(session_data)
-        session = pickle.loads(decoded)
-        return jsonify({"user": session.get("user"), "role": session.get("role")})
-    except Exception as e:
-        return jsonify({"error": "Invalid session"}), 400
-
-
-@app.route("/cache/get", methods=["POST"])
-def get_cached():
-    raw = request.get_json().get("data", "")
-    # Data from Redis — but Redis can be poisoned by attacker
-    obj = pickle.loads(base64.b64decode(raw))
-    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-049 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
-
-import pickle
-import shelve
-from fastapi import FastAPI, UploadFile, File, HTTPException
-
-app = FastAPI()
-
-
-@app.post("/models/load")
-async def load_model(file: UploadFile = File(...)):
-    contents = await file.read()
-    try:
-        # User-uploaded .pkl file deserialized without any validation
-        model = pickle.loads(contents)
-        return {"model_type": type(model).__name__}
-    except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-
-@app.get("/cache/{key}")
-def get_from_cache(key: str):
-    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
-    with shelve.open("/var/cache/app_cache") as db:
-        if key not in db:
-            raise HTTPException(status_code=404, detail="Not found")
-        value = db[key]  # deserialized via pickle
-    return {"value": value}
-
-
-@app.post("/tasks/restore")
-async def restore_task_state(file: UploadFile = File(...)):
-    data = await file.read()
-    state = pickle.loads(data)  # untrusted task state from client
-    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-050 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: high
-# language: python
-# expected: marshal.loads and jsonpickle.decode used with untrusted data
-
-import marshal
-import jsonpickle
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.post("/code/load")
-def load_code():
-    """Load a compiled Python code object from client."""
-    data = request.get_data()
-    # marshal.loads with user data can reconstruct code objects — arbitrary execution
-    code_obj = marshal.loads(data)
-    result = eval(code_obj)
-    return jsonify({"result": str(result)})
-
-
-@app.post("/object/restore")
-def restore_object():
-    payload = request.get_json()
-    serialized = payload.get("object", "")
-    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
-    obj = jsonpickle.decode(serialized)
-    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
-
-
-@app.post("/state/import")
-def import_state():
-    body = request.get_json()
-    state_json = body.get("state", "null")
-    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
-    state = jsonpickle.decode(state_json, classes=None)
-    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-051 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_injection
-# severity: critical
-# language: python
-# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
-
-import yaml
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/config/upload", methods=["POST"])
-def upload_config():
-    raw_yaml = request.data.decode("utf-8")
-    # yaml.load without Loader= defaults to full deserialization — RCE possible
-    # Attacker payload: "!!python/object/apply:os.system ['id']"
-    config = yaml.load(raw_yaml)
-    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
-
-
-@app.route("/workflow/import", methods=["POST"])
-def import_workflow():
-    yaml_content = request.get_json().get("yaml", "")
-    # yaml.load with untrusted string
-    workflow = yaml.load(yaml_content)
-    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
-    return jsonify({"steps": steps})
-
-
-@app.route("/settings/restore", methods=["POST"])
-def restore_settings():
-    uploaded = request.files.get("settings")
-    if not uploaded:
-        return jsonify({"error": "No file"}), 400
-    content = uploaded.read().decode("utf-8")
-    settings = yaml.load(content)  # unsafe loader
-    return jsonify({"restored": True, "settings": settings})

package/dist/packages/crucible/seeds/python/seed-052 2.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_injection
-# severity: critical
-# language: python
-# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML
-
-import yaml
-import os
-from pathlib import Path
-
-
-def load_pipeline_config(config_path: str) -> dict:
-    """Load a pipeline configuration from a YAML file."""
-    with open(config_path, "r") as f:
-        # yaml.load() without Loader allows arbitrary Python object instantiation
-        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
-        return yaml.load(f)
-
-
-def load_user_preferences(user_id: str) -> dict:
-    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
-    if not prefs_path.exists():
-        return {}
-    with prefs_path.open() as f:
-        # User controls their own preference file — YAML injection if file content is user-controlled
-        return yaml.load(f.read())
-
-
-def merge_configs(*config_paths: str) -> dict:
-    merged = {}
-    for path in config_paths:
-        with open(path) as f:
-            data = yaml.load(f)  # unsafe
-            if isinstance(data, dict):
-                merged.update(data)
-    return merged
-
-
-def parse_webhook_payload(yaml_str: str) -> dict:
-    # Webhook body parsed as YAML without safe_load
-    return yaml.load(yaml_str)

package/dist/packages/crucible/seeds/ruby/seed-001 2.rb

@@ -1,15 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Rails secret_key_base in source code
-
-module MyApp
-  class Application < Rails::Application
-    config.secret_key_base = "b3f6d9e2a1c4f7a8b9d0e1f2a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
-
-    config.active_record.encryption.primary_key   = "my_primary_encryption_key_not_secret"
-    config.active_record.encryption.deterministic_key = "my_deterministic_key_not_secret_too"
-    config.active_record.encryption.key_derivation_salt = "my_key_derivation_salt_hardcoded"
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-002 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded database password in database.yml equivalent or initializer
-
-DB_CONFIG = {
-  adapter:  'postgresql',
-  host:     'prod-db.example.com',
-  database: 'production_db',
-  username: 'app_user',
-  password: 'Sup3rS3cr3tP@ssw0rd!2024',
-  port:     5432
-}.freeze
-
-REDIS_URL = 'redis://:myR3d1sS3cret@redis.prod.example.com:6379/0'
-MONGO_URI = 'mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb'
-
-def establish_db_connection
-  puts "Connecting with password: #{DB_CONFIG[:password]}"
-  ActiveRecord::Base.establish_connection(DB_CONFIG)
-end

package/dist/packages/crucible/seeds/ruby/seed-003 2.rb

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded AWS credentials in Ruby initializer
-
-require 'aws-sdk-s3'
-
-AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1'
-AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
-AWS_REGION     = 'us-east-1'
-S3_BUCKET      = 'my-production-bucket'
-
-Aws.config.update(
-  region:      AWS_REGION,
-  credentials: Aws::Credentials.new(AWS_ACCESS_KEY, AWS_SECRET_KEY)
-)
-
-def s3_client
-  Aws::S3::Client.new(
-    access_key_id:     AWS_ACCESS_KEY,
-    secret_access_key: AWS_SECRET_KEY,
-    region:            AWS_REGION
-  )
-end

package/dist/packages/crucible/seeds/ruby/seed-004 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Stripe API keys in Rails initializer
-
-Stripe.api_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
-
-STRIPE_CONFIG = {
-  publishable_key: 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu',
-  webhook_secret:  'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ',
-  api_key:         'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
-}.freeze
-
-def charge_customer(amount, token)
-  Stripe::Charge.create(amount: amount, currency: 'usd', source: token)
-end

package/dist/packages/crucible/seeds/ruby/seed-005 2.rb

@@ -1,21 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: ruby
-# expected: Hardcoded JWT secret and admin API token
-
-JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
-ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
-
-def generate_jwt(payload)
-  JWT.encode(payload, JWT_SECRET, 'HS256')
-end
-
-def verify_admin(token)
-  token == ADMIN_TOKEN
-end
-
-def sign_request(body)
-  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
-end

package/dist/packages/crucible/seeds/ruby/seed-006 2.rb

@@ -1,17 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded OAuth client secret and social login credentials
-
-GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
-GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
-GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
-
-OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
-
-Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
-  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
-end

package/dist/packages/crucible/seeds/ruby/seed-007 2.rb

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Twilio credentials and SendGrid API key
-
-TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
-TWILIO_PHONE       = '+15005550006'
-SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
-
-def send_sms(to, message)
-  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
-  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
-  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
-end

package/dist/packages/crucible/seeds/ruby/seed-008 2.rb

@@ -1,18 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: ruby
-# expected: Hardcoded Slack webhook URL and signing secret
-
-SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
-SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
-SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
-
-def post_to_slack(message)
-  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
-  Net::HTTP.post(
-    URI(SLACK_WEBHOOK_URL),
-    { text: message }.to_json,
-    'Content-Type' => 'application/json'
-  )
-end