thuban 0.4.12 → 0.4.13

package/dist/packages/crucible/seeds/ruby/seed-040 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: HTTParty.get with user-supplied URL — SSRF to internal services
-
-require 'httparty'
-
-class WebhookController < ApplicationController
-  def trigger
-    callback_url = params[:callback]
-    payload      = { event: 'triggered', timestamp: Time.now.to_i }
-    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
-    render json: { triggered: true }
-  end
-
-  def preview_url
-    url  = params[:url]
-    resp = HTTParty.get(url, timeout: 5)
-    render plain: resp.body
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-041 2.rb

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: Faraday connection built from user-controlled base URL
-
-require 'faraday'
-
-class ImportController < ApplicationController
-  def import_feed
-    source_url = params[:feed_url]
-    conn       = Faraday.new(url: source_url)
-    response   = conn.get('/')
-    data       = JSON.parse(response.body)
-    render json: { imported: data.size }
-  end
-
-  def fetch_avatar
-    avatar_url = params[:avatar_url]
-    response   = Faraday.get(avatar_url)
-    send_data response.body, type: 'image/jpeg'
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-042 2.rb

@@ -1,25 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: ruby
-# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme
-
-require 'open-uri'
-
-def fetch_remote_resource(url)
-  URI.open(url).read
-end
-
-def download_image(image_url)
-  URI.open(image_url) do |f|
-    File.write('/tmp/downloaded_image', f.read)
-  end
-end
-
-class ResourceController < ApplicationController
-  def import
-    resource_url = params[:url]
-    content      = URI.open(resource_url).read
-    render plain: content
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-043 2.rb

@@ -1,23 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: critical
-# language: ruby
-# expected: RestClient.get with user-supplied URL — SSRF
-
-require 'rest-client'
-
-class ProxyService
-  def self.relay(target_url, headers = {})
-    RestClient.get(target_url, headers)
-  rescue RestClient::Exception => e
-    e.response
-  end
-
-  def self.post_webhook(url, payload)
-    RestClient.post(url, payload.to_json, content_type: :json)
-  end
-
-  def self.check_health(host)
-    RestClient.get("http://#{host}/health")
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-044 2.rb

@@ -1,16 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to params[:url] without validation — open redirect
-
-class SessionsController < ApplicationController
-  def create
-    if authenticated?
-      redirect_to params[:url] || root_path
-    else
-      flash[:error] = 'Invalid credentials'
-      render :new
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-045 2.rb

@@ -1,22 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
-
-class AuthController < ApplicationController
-  def callback
-    next_url = params[:next] || params[:return_to] || dashboard_path
-    redirect_to next_url
-  end
-
-  def logout
-    sign_out current_user
-    redirect_to params[:redirect]
-  end
-
-  def sso_redirect
-    target = request.params['RelayState'] || root_url
-    redirect_to target, allow_other_host: true
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-046 2.rb

@@ -1,27 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: medium
-# language: ruby
-# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
-
-class RedirectController < ApplicationController
-  SAFE_DOMAIN = 'example.com'
-
-  def go
-    target = params[:to]
-    if target =~ /example\.com/
-      redirect_to target, allow_other_host: true
-    else
-      redirect_to root_path
-    end
-  end
-
-  def external
-    url     = params[:url]
-    trusted = ['example.com', 'partner.com']
-    host    = URI.parse(url).host rescue ''
-    if trusted.include?(host)
-      redirect_to url, allow_other_host: true
-    end
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-047 2.rb

@@ -1,26 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: send_file or redirect after download with user-controlled path
-
-class DownloadsController < ApplicationController
-  def complete
-    file      = params[:file]
-    callback  = params[:callback_url]
-    send_file Rails.root.join('public', 'downloads', file)
-    redirect_to callback
-  end
-
-  def track_and_redirect
-    destination = params[:destination]
-    track_click(destination)
-    redirect_to destination, allow_other_host: true
-  end
-
-  private
-
-  def track_click(url)
-    ClickLog.create(url: url, user_id: current_user&.id)
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-048 2.rb

@@ -1,24 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
-
-class ConfigController < ApplicationController
-  def import
-    config_data = params[:config]
-    config      = YAML.load(config_data)
-    apply_config(config)
-    render json: { applied: true }
-  end
-
-  def load_template(template_string)
-    YAML.load(template_string)
-  end
-
-  private
-
-  def apply_config(cfg)
-    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
-  end
-end

package/dist/packages/crucible/seeds/ruby/seed-049 2.rb

@@ -1,20 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
-
-def load_config_file(config_name)
-  path    = "/etc/app/configs/#{config_name}.yml"
-  content = File.read(path)
-  YAML.load(content)
-end
-
-def parse_pipeline(pipeline_definition)
-  YAML.load(pipeline_definition)
-end
-
-def deserialize_job(job_yaml)
-  job = YAML.load(job_yaml)
-  job.merge(loaded_at: Time.now)
-end

package/dist/packages/crucible/seeds/ruby/seed-050 2.rb

@@ -1,27 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load used in API endpoint — remote code execution via crafted payload
-
-require 'sinatra'
-require 'yaml'
-
-post '/api/import' do
-  content_type :json
-  raw_body = request.body.read
-  data     = YAML.load(raw_body)
-  process_import(data)
-  { imported: data.keys.count }.to_json
-end
-
-post '/api/config/update' do
-  yaml_config = params[:yaml]
-  config      = YAML.load(yaml_config)
-  config.each { |k, v| CONFIG[k] = v }
-  { updated: true }.to_json
-end
-
-def process_import(data)
-  data.each { |k, v| puts "#{k}: #{v}" }
-end

package/dist/packages/crucible/seeds/rust/seed-001 2.rs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded AWS access key and secret in string literals
-
-use aws_sdk_s3::Client;
-
-const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
-const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-const AWS_REGION: &str = "us-east-1";
-const S3_BUCKET: &str = "my-production-bucket";
-
-pub async fn create_s3_client() -> Client {
-    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
-    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
-    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
-    let config = aws_config::load_from_env().await;
-    Client::new(&config)
-}
-
-pub fn get_bucket() -> &'static str {
-    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
-    S3_BUCKET
-}

package/dist/packages/crucible/seeds/rust/seed-002 2.rs

@@ -1,20 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded database password in connection string literal
-
-use sqlx::PgPool;
-
-const DB_URL: &str = "postgresql://appuser:Sup3rS3cr3tP@ssw0rd!@prod-db.example.com:5432/appdb";
-const REDIS_URL: &str = "redis://:myR3d1sS3cret@redis.prod.example.com:6379/0";
-const MONGO_URL: &str = "mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb";
-
-pub async fn connect_db() -> PgPool {
-    PgPool::connect(DB_URL).await.expect("Failed to connect to DB")
-}
-
-pub fn get_db_url() -> &'static str {
-    eprintln!("Connecting to: {}", DB_URL);
-    DB_URL
-}

package/dist/packages/crucible/seeds/rust/seed-003 2.rs

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded JWT secret key used to sign tokens
-
-use hmac::{Hmac, Mac};
-use sha2::Sha256;
-
-const JWT_SECRET: &str = "mySuperSecretJWTSigningKey_2024_doNotCommit";
-const JWT_EXPIRY_HOURS: u64 = 24;
-const ADMIN_API_KEY: &str = "admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
-
-pub fn sign_token(payload: &str) -> Vec<u8> {
-    let mut mac = Hmac::<Sha256>::new_from_slice(JWT_SECRET.as_bytes())
-        .expect("HMAC key error");
-    mac.update(payload.as_bytes());
-    mac.finalize().into_bytes().to_vec()
-}
-
-pub fn verify_admin(key: &str) -> bool {
-    key == ADMIN_API_KEY
-}

package/dist/packages/crucible/seeds/rust/seed-004 2.rs

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded Stripe and payment processor API keys
-
-const STRIPE_SECRET_KEY: &str = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghij";
-const STRIPE_WEBHOOK_SECRET: &str = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ";
-const PAYPAL_CLIENT_ID: &str = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv";
-const PAYPAL_CLIENT_SECRET: &str = "EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyzabcdef";
-
-pub fn get_stripe_headers() -> Vec<(&'static str, String)> {
-    vec![
-        ("Authorization", format!("Bearer {}", STRIPE_SECRET_KEY)),
-        ("Stripe-Version", "2023-10-16".to_string()),
-    ]
-}
-
-pub fn validate_webhook(sig: &str) -> bool {
-    sig.starts_with(&STRIPE_WEBHOOK_SECRET[..10])
-}

package/dist/packages/crucible/seeds/rust/seed-005 2.rs

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: rust
-// expected: Hardcoded GitHub and GitLab personal access tokens
-
-const GITHUB_TOKEN: &str = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
-const GITLAB_TOKEN: &str = "glpat-xxxxxxxxxxxxxxxxxxxxxxxxxxxx";
-const GITHUB_WEBHOOK_SECRET: &str = "github_webhook_secret_super_secret_value_here";
-
-pub fn clone_repo(repo_url: &str) -> String {
-    format!(
-        "https://{}@github.com/{}",
-        GITHUB_TOKEN, repo_url
-    )
-}
-
-pub async fn create_github_issue(owner: &str, repo: &str, title: &str) {
-    let url = format!("https://api.github.com/repos/{}/{}/issues", owner, repo);
-    println!("POST {} with token: {}", url, &GITHUB_TOKEN[..10]);
-}

package/dist/packages/crucible/seeds/rust/seed-006 2.rs

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded encryption key and IV in const literals
-
-use aes::Aes256;
-use cbc::cipher::KeyIvInit;
-
-const ENCRYPTION_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
-const ENCRYPTION_IV: &[u8]  = b"abcdef0123456789";
-const HMAC_KEY: &str = "super-secret-hmac-key-do-not-share";
-
-pub fn create_cipher() -> cbc::Encryptor<Aes256> {
-    cbc::Encryptor::<Aes256>::new(
-        ENCRYPTION_KEY.into(),
-        ENCRYPTION_IV.into(),
-    )
-}
-
-pub fn get_hmac_key() -> &'static [u8] {
-    println!("HMAC key length: {}", HMAC_KEY.len());
-    HMAC_KEY.as_bytes()
-}

package/dist/packages/crucible/seeds/rust/seed-007 2.rs

@@ -1,20 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: rust
-// expected: Hardcoded SMTP credentials and email service API key
-
-const SMTP_HOST: &str = "smtp.sendgrid.net";
-const SMTP_PORT: u16 = 587;
-const SMTP_USERNAME: &str = "apikey";
-const SMTP_PASSWORD: &str = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
-const FROM_EMAIL: &str = "noreply@example.com";
-
-pub fn build_smtp_transport() -> String {
-    format!("{}://{}:{}@{}:{}", "smtp", SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT)
-}
-
-pub fn get_smtp_config() -> (String, String) {
-    println!("SMTP config loaded for: {}", SMTP_HOST);
-    (SMTP_USERNAME.to_string(), SMTP_PASSWORD.to_string())
-}

package/dist/packages/crucible/seeds/rust/seed-008 2.rs

@@ -1,19 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded Slack webhook URL and bot token
-
-const SLACK_BOT_TOKEN: &str = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx";
-const SLACK_SIGNING_SECRET: &str = "abcdef0123456789abcdef0123456789";
-const SLACK_WEBHOOK_URL: &str = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
-
-pub async fn send_slack_message(channel: &str, text: &str) {
-    println!("Sending to {} via token: {}...", channel, &SLACK_BOT_TOKEN[..15]);
-    let client = reqwest::Client::new();
-    let _ = client
-        .post(SLACK_WEBHOOK_URL)
-        .json(&serde_json::json!({"text": text}))
-        .send()
-        .await;
-}

package/dist/packages/crucible/seeds/rust/seed-009 2.rs

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Raw pointer dereference in unsafe block without bounds checking
-
-pub fn read_from_raw_ptr(ptr: *const u8, offset: usize) -> u8 {
-    unsafe {
-        *ptr.add(offset)
-    }
-}
-
-pub fn write_to_raw_ptr(ptr: *mut u8, offset: usize, value: u8) {
-    unsafe {
-        *ptr.add(offset) = value;
-    }
-}
-
-pub fn slice_from_raw(ptr: *const u8, len: usize) -> &'static [u8] {
-    unsafe {
-        std::slice::from_raw_parts(ptr, len)
-    }
-}
-
-pub fn null_ptr_deref_risk() -> u8 {
-    let ptr: *const u8 = 0x0 as *const u8;
-    unsafe { *ptr }
-}

package/dist/packages/crucible/seeds/rust/seed-010 2.rs

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: std::mem::transmute misuse — reinterpret arbitrary bytes as typed reference
-
-use std::mem;
-
-pub fn transmute_bytes_to_struct<T>(bytes: &[u8]) -> &T {
-    unsafe {
-        mem::transmute(bytes.as_ptr())
-    }
-}
-
-pub fn reinterpret_as<S, D>(src: &S) -> &D {
-    unsafe { mem::transmute(src) }
-}
-
-pub fn bytes_to_u64(bytes: &[u8]) -> u64 {
-    unsafe {
-        let arr: [u8; 8] = *(bytes.as_ptr() as *const [u8; 8]);
-        mem::transmute(arr)
-    }
-}
-
-pub fn lifetime_extend<'a, 'b, T>(r: &'a T) -> &'b T {
-    unsafe { mem::transmute(r) }
-}

package/dist/packages/crucible/seeds/rust/seed-011 2.rs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Unsafe foreign function interface call without input validation
-
-extern "C" {
-    fn memcpy(dest: *mut u8, src: *const u8, n: usize) -> *mut u8;
-    fn strlen(s: *const u8) -> usize;
-    fn strcpy(dest: *mut u8, src: *const u8) -> *mut u8;
-}
-
-pub fn raw_memcpy(src: &[u8], dest: &mut Vec<u8>, n: usize) {
-    unsafe {
-        memcpy(dest.as_mut_ptr(), src.as_ptr(), n);
-    }
-}
-
-pub fn get_c_strlen(s: *const u8) -> usize {
-    unsafe { strlen(s) }
-}
-
-pub fn unsafe_string_copy(src: *const u8, dest: *mut u8) {
-    unsafe { strcpy(dest, src); }
-}

package/dist/packages/crucible/seeds/rust/seed-012 2.rs

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: high
-// language: rust
-// expected: Vec::set_len called without initializing memory — UB
-
-pub fn create_uninitialized_vec(size: usize) -> Vec<u8> {
-    let mut v = Vec::with_capacity(size);
-    unsafe {
-        v.set_len(size);
-    }
-    v
-}
-
-pub fn extend_vec_unsafely(v: &mut Vec<u8>, extra: usize) {
-    let new_len = v.len() + extra;
-    if v.capacity() < new_len {
-        v.reserve(extra);
-    }
-    unsafe {
-        v.set_len(new_len);
-    }
-}
-
-pub fn read_uninitialized() -> u32 {
-    let x: u32;
-    unsafe {
-        x = std::mem::MaybeUninit::uninit().assume_init();
-    }
-    x
-}

package/dist/packages/crucible/seeds/rust/seed-013 2.rs

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Mutable aliasing via raw pointers — violates Rust's aliasing rules
-
-pub fn create_aliased_refs(data: &mut Vec<i32>) -> (*mut i32, *mut i32) {
-    let ptr1 = data.as_mut_ptr();
-    let ptr2 = data.as_mut_ptr();
-    (ptr1, ptr2)
-}
-
-pub fn alias_write(v: &mut Vec<u8>) {
-    unsafe {
-        let p1 = v.as_mut_ptr();
-        let p2 = v.as_mut_ptr();
-        *p1 = 1;
-        *p2 = 2;
-    }
-}
-
-pub fn double_free_risk(ptr: *mut u8, len: usize) {
-    unsafe {
-        let _v1 = Vec::from_raw_parts(ptr, len, len);
-        let _v2 = Vec::from_raw_parts(ptr, len, len);
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-014 2.rs

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: high
-// language: rust
-// expected: Use of unsafe to bypass borrow checker — potential use-after-free
-
-use std::collections::HashMap;
-
-pub struct Cache {
-    data: HashMap<String, String>,
-}
-
-impl Cache {
-    pub fn get_or_insert(&mut self, key: &str, value: String) -> &str {
-        if !self.data.contains_key(key) {
-            self.data.insert(key.to_string(), value);
-        }
-        unsafe {
-            let s: *const String = self.data.get(key).unwrap();
-            &*s
-        }
-    }
-
-    pub fn dangling_ref(&mut self) -> &str {
-        let s = String::from("temporary");
-        let ptr = s.as_str() as *const str;
-        drop(s);
-        unsafe { &*ptr }
-    }
-}

package/dist/packages/crucible/seeds/rust/seed-015 2.rs

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Send/Sync implemented for non-thread-safe type via unsafe impl
-
-use std::cell::Cell;
-use std::rc::Rc;
-
-pub struct SharedCounter {
-    value: Cell<i64>,
-    data: Rc<Vec<u8>>,
-}
-
-unsafe impl Send for SharedCounter {}
-unsafe impl Sync for SharedCounter {}
-
-impl SharedCounter {
-    pub fn new() -> Self {
-        SharedCounter {
-            value: Cell::new(0),
-            data: Rc::new(vec![]),
-        }
-    }
-
-    pub fn increment(&self) {
-        self.value.set(self.value.get() + 1);
-    }
-
-    pub fn get(&self) -> i64 {
-        self.value.get()
-    }
-}