thuban 0.4.12 → 0.4.13

package/dist/packages/crucible/seeds/ts/seed-012 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in NestJS service using raw pg query with string interpolation
-
-import { Injectable } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/typeorm';
-import { Connection } from 'typeorm';
-
-@Injectable()
-export class ReportService {
-  constructor(@InjectConnection() private connection: Connection) {}
-
-  async getRevenueReport(fromDate: string, toDate: string, groupBy: string): Promise<any[]> {
-    const sql = `
-      SELECT
-        ${groupBy} as period,
-        SUM(amount) as total_revenue,
-        COUNT(*) as transaction_count
-      FROM transactions
-      WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
-      GROUP BY ${groupBy}
-      ORDER BY period ASC
-    `;
-    return this.connection.query(sql);
-  }
-
-  async getUserActivity(userId: string, action: string): Promise<any[]> {
-    return this.connection.query(
-      `SELECT * FROM audit_log WHERE user_id = '` + userId + `' AND action = '` + action + `'`
-    );
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-013 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via dynamic ORDER BY column name from user input
-
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-interface ListOptions {
-  sortField: string;  // user-controlled
-  sortDir: 'asc' | 'desc';  // type claim but not validated
-  limit: number;
-  offset: number;
-  filter?: string;
-}
-
-export async function listProducts(opts: ListOptions) {
-  // sortField and sortDir inserted verbatim — type annotations don't prevent injection
-  const query = `
-    SELECT id, name, price, stock, created_at
-    FROM products
-    WHERE archived = false
-    ${opts.filter ? `AND name ILIKE '%${opts.filter}%'` : ''}
-    ORDER BY ${opts.sortField} ${opts.sortDir}
-    LIMIT ${opts.limit} OFFSET ${opts.offset}
-  `;
-  const { rows } = await pool.query(query);
-  return rows;
-}

package/dist/packages/crucible/seeds/ts/seed-014 2.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection in authentication middleware via raw query with login credentials
-
-import { Request, Response, NextFunction } from 'express';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export async function authenticateMiddleware(
-  req: Request,
-  res: Response,
-  next: NextFunction
-): Promise<void> {
-  const { username, password } = req.body as { username: string; password: string };
-
-  // Classic auth bypass: username = "admin'--"
-  const query = `
-    SELECT id, username, role, email
-    FROM users
-    WHERE username = '${username}'
-    AND password_hash = crypt('${password}', password_hash)
-    AND active = true
-  `;
-
-  const { rows } = await pool.query(query);
-  if (!rows.length) {
-    res.status(401).json({ error: 'Invalid credentials' });
-    return;
-  }
-
-  req.user = rows[0];
-  next();
-}

package/dist/packages/crucible/seeds/ts/seed-015 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via Sequelize literal() with user-controlled search input
-
-import { Sequelize, QueryTypes } from 'sequelize';
-
-const sequelize = new Sequelize(process.env.DATABASE_URL!);
-
-export async function fullTextSearch(
-  query: string,
-  table: 'products' | 'articles' | 'users',
-  fields: string[]
-): Promise<Record<string, unknown>[]> {
-  const fieldList = fields.join(', ');
-  const whereClause = fields
-    .map(f => `${f} ILIKE '%${query}%'`)
-    .join(' OR ');
-
-  // Both fieldList and whereClause derived from user input — injection possible
-  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-export async function bulkUpdate(ids: number[], status: string): Promise<void> {
-  const idList = ids.join(',');
-  await sequelize.query(
-    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
-  );
-}

package/dist/packages/crucible/seeds/ts/seed-016 2.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
-
-import React from 'react';
-
-interface Comment {
-  id: string;
-  author: string;
-  body: string;
-  avatarHtml: string;
-}
-
-interface CommentCardProps {
-  comment: Comment;
-}
-
-export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
-  return (
-    <div className="comment-card">
-      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
-      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
-      <div className="author">{comment.author}</div>
-      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
-    </div>
-  );
-};
-
-interface RichTextProps {
-  content: string; // user-submitted rich text
-}
-
-export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
-  <article dangerouslySetInnerHTML={{ __html: content }} />
-);

package/dist/packages/crucible/seeds/ts/seed-017 2.ts

@@ -1,44 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Angular [innerHTML] binding with user-controlled data
-
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { UserService } from '../services/user.service';
-
-interface UserProfile {
-  displayName: string;
-  bio: string;        // Rich HTML from user
-  signature: string;  // HTML signature from user
-}
-
-@Component({
-  selector: 'app-user-profile',
-  template: `
-    <div class="profile">
-      <h1>{{ user?.displayName }}</h1>
-      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
-      <div class="bio" [innerHTML]="trustedBio"></div>
-      <footer [innerHTML]="trustedSignature"></footer>
-    </div>
-  `,
-})
-export class UserProfileComponent implements OnInit {
-  user: UserProfile | null = null;
-  trustedBio: any;
-  trustedSignature: any;
-
-  constructor(private route: ActivatedRoute, private userService: UserService) {}
-
-  ngOnInit(): void {
-    const id = this.route.snapshot.paramMap.get('id')!;
-    this.userService.getProfile(id).subscribe(user => {
-      this.user = user;
-      // Bypasses Angular's built-in XSS protection
-      this.trustedBio = user.bio;
-      this.trustedSignature = user.signature;
-    });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-018 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via innerHTML in typed DOM manipulation utility
-
-export class DomRenderer {
-  private container: HTMLElement;
-
-  constructor(containerId: string) {
-    this.container = document.getElementById(containerId) as HTMLElement;
-  }
-
-  renderUserContent(content: string): void {
-    // Direct innerHTML assignment — content from user input
-    this.container.innerHTML = content;
-  }
-
-  appendItem(title: string, description: string): void {
-    // Template literal with user data written to innerHTML
-    this.container.innerHTML += `
-      <div class="item">
-        <h3>${title}</h3>
-        <p>${description}</p>
-      </div>
-    `;
-  }
-
-  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
-    const banner = document.querySelector('.banner') as HTMLElement;
-    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-019 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Express response with unsanitized template literal containing user input
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-router.get('/search', (req: Request, res: Response) => {
-  const query = (req.query.q as string) || '';
-  const category = (req.query.cat as string) || 'all';
-
-  // Both query and category embedded directly in HTML without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html lang="en">
-      <head><title>Search - ${category}</title></head>
-      <body>
-        <h1>Results for: <em>${query}</em></h1>
-        <p>Category: ${category}</p>
-        <script>
-          const searchQuery = "${query}";
-          const searchCategory = "${category}";
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-020 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: typescript
-// expected: XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
-
-import { GetServerSideProps, NextPage } from 'next';
-
-interface PageProps {
-  name: string;
-  description: string;
-}
-
-const ProfilePage: NextPage<PageProps> = ({ name, description }) => {
-  return (
-    <div>
-      <h1>Profile: {name}</h1>
-      {/* description from query string — dangerouslySetInnerHTML without sanitization */}
-      <div dangerouslySetInnerHTML={{ __html: description }} />
-    </div>
-  );
-};
-
-export const getServerSideProps: GetServerSideProps = async ({ query }) => {
-  return {
-    props: {
-      name: query.name as string ?? 'Unknown',
-      description: query.description as string ?? '',
-    },
-  };
-};
-
-export default ProfilePage;

package/dist/packages/crucible/seeds/ts/seed-021 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Vue.js v-html directive with user-supplied content
-
-import { defineComponent, ref, onMounted } from 'vue';
-import axios from 'axios';
-
-export default defineComponent({
-  name: 'ArticleViewer',
-  props: {
-    articleId: { type: String, required: true },
-  },
-  setup(props) {
-    const article = ref<{ title: string; content: string; authorBio: string } | null>(null);
-
-    onMounted(async () => {
-      const { data } = await axios.get(`/api/articles/${props.articleId}`);
-      article.value = data;
-    });
-
-    return { article };
-  },
-  // v-html renders raw HTML — XSS if content contains malicious script tags
-  template: `
-    <div class="article" v-if="article">
-      <h1>{{ article.title }}</h1>
-      <div class="content" v-html="article.content"></div>
-      <aside class="author-bio" v-html="article.authorBio"></aside>
-    </div>
-  `,
-});

package/dist/packages/crucible/seeds/ts/seed-022 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Marked.js rendering user markdown without sanitization
-
-import marked from 'marked';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface MarkdownRequest {
-  markdown: string;
-  title?: string;
-}
-
-router.post('/preview', (req: Request, res: Response) => {
-  const { markdown, title } = req.body as MarkdownRequest;
-
-  // marked() renders to HTML without XSS protection — <script> tags in markdown execute
-  const renderedHtml = marked(markdown);
-
-  res.send(`
-    <html>
-      <head><title>${title ?? 'Preview'}</title></head>
-      <body>
-        <h1>${title}</h1>
-        <div class="content">${renderedHtml}</div>
-      </body>
-    </html>
-  `);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-023 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via child_process.exec with typed but unsanitized user input
-
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { Request, Response, Router } from 'express';
-
-const execAsync = promisify(exec);
-const router = Router();
-
-interface PingRequest {
-  host: string;
-  count?: number;
-}
-
-router.post('/tools/ping', async (req: Request, res: Response) => {
-  const { host, count = 4 } = req.body as PingRequest;
-  // TypeScript types don't prevent injection — host can be "8.8.8.8; id"
-  const cmd = `ping -c ${count} ${host}`;
-  const { stdout, stderr } = await execAsync(cmd);
-  res.json({ output: stdout, errors: stderr });
-});
-
-router.post('/tools/traceroute', async (req: Request, res: Response) => {
-  const target: string = req.body.target;
-  const { stdout } = await execAsync(`traceroute ${target}`);
-  res.json({ hops: stdout });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-024 2.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execSync in typed file processing service
-
-import { execSync } from 'child_process';
-import * as path from 'path';
-
-interface ConversionOptions {
-  inputPath: string;  // user-controlled filename
-  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
-  quality?: number;
-}
-
-export class FileConverter {
-  private readonly outputDir: string;
-
-  constructor(outputDir: string) {
-    this.outputDir = outputDir;
-  }
-
-  convert(opts: ConversionOptions): string {
-    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
-    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
-    // opts.inputPath is user-controlled — no sanitization before execSync
-    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
-    execSync(cmd, { timeout: 30000 });
-    return outputPath;
-  }
-
-  extractText(pdfPath: string): string {
-    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-025 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via spawn with shell:true and user-controlled arguments
-
-import { spawn } from 'child_process';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function runCommand(cmd: string, args: string[]): Promise<string> {
-  return new Promise((resolve, reject) => {
-    // shell: true means the full command string is interpreted by /bin/sh
-    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
-    let output = '';
-    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
-    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
-    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-
-router.post('/scripts/run', async (req: Request, res: Response) => {
-  const { script, params }: { script: string; params: string[] } = req.body;
-  const result = await runCommand(`node scripts/${script}`, params);
-  res.json({ output: result });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-026 2.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection via git operations with user-controlled branch/tag names
-
-import { execSync } from 'child_process';
-
-interface GitOptions {
-  repoPath: string;
-  branch: string;    // user-controlled
-  remote?: string;
-}
-
-export class GitService {
-  clone(repoUrl: string, targetDir: string): void {
-    // repoUrl from user — can include shell metacharacters
-    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
-  }
-
-  checkout(opts: GitOptions): string {
-    // opts.branch may be "main; cat /etc/shadow"
-    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
-  }
-
-  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
-    return execSync(
-      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
-      { encoding: 'utf8' }
-    );
-  }
-
-  tag(repoPath: string, tagName: string, message: string): string {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-027 2.ts

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection in NestJS service using exec with user-provided report parameters
-
-import { Injectable } from '@nestjs/common';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-
-const execAsync = promisify(exec);
-
-interface ReportParams {
-  format: string;       // user-controlled
-  dateRange: string;    // user-controlled
-  recipient: string;    // user-controlled email
-}
-
-@Injectable()
-export class ReportingService {
-  async generateAndSendReport(params: ReportParams): Promise<void> {
-    const { format, dateRange, recipient } = params;
-    // All three params go directly into shell command
-    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
-    const { stdout: reportPath } = await execAsync(generateCmd);
-
-    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
-    await execAsync(sendCmd);
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-028 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execa with shell:true and template literal from user data
-
-import execa from 'execa';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScanRequest {
-  target: string;   // IP or hostname — user-controlled
-  ports?: string;   // port range — user-controlled
-  flags?: string;   // nmap flags — user-controlled
-}
-
-router.post('/security/scan', async (req: Request, res: Response) => {
-  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
-  try {
-    // All fields from user body — injection via shell metacharacters
-    const { stdout } = await execa.command(
-      `nmap ${flags} -p ${ports} ${target}`,
-      { shell: true, timeout: 60000 }
-    );
-    res.json({ results: stdout });
-  } catch (err: any) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-029 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via unvalidated user path in fs.readFile
-
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
-
-router.get('/static/:file', async (req: Request, res: Response) => {
-  const requestedFile: string = req.params.file;
-  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
-  const filePath = path.join(PUBLIC_DIR, requestedFile);
-
-  try {
-    const data = await fs.readFile(filePath, 'utf-8');
-    res.type('text/plain').send(data);
-  } catch {
-    res.status(404).send('Not found');
-  }
-});
-
-router.get('/download', async (req: Request, res: Response) => {
-  const file = req.query.file as string;
-  // Completely unvalidated — reads arbitrary path on filesystem
-  const content = await fs.readFile(file);
-  res.send(content);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-030 2.ts

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via typed file service with user-controlled subdirectory
-
-import * as fs from 'fs';
-import * as path from 'path';
-
-interface FileServiceConfig {
-  baseDir: string;
-}
-
-export class FileService {
-  private readonly baseDir: string;
-
-  constructor(config: FileServiceConfig) {
-    this.baseDir = config.baseDir;
-  }
-
-  readUserFile(userId: string, fileName: string): string {
-    // No normalization check — fileName can be "../../../etc/passwd"
-    const filePath = path.join(this.baseDir, userId, fileName);
-    return fs.readFileSync(filePath, 'utf-8');
-  }
-
-  listDirectory(userId: string, subDir: string): string[] {
-    // subDir from user — directory traversal possible
-    const dirPath = path.join(this.baseDir, userId, subDir);
-    return fs.readdirSync(dirPath);
-  }
-
-  deleteFile(userId: string, fileName: string): void {
-    const filePath = path.join(this.baseDir, userId, fileName);
-    fs.unlinkSync(filePath);
-  }
-}