thuban 0.4.12 → 0.4.13

package/dist/packages/crucible/seeds/ts/seed-031 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal in NestJS controller via user-controlled template name
-
-import { Controller, Get, Query, Res } from '@nestjs/common';
-import { Response } from 'express';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const TEMPLATES_DIR = path.resolve(__dirname, '..', 'templates');
-
-@Controller('email')
-export class EmailController {
-  @Get('preview')
-  previewTemplate(
-    @Query('name') templateName: string,
-    @Query('locale') locale: string,
-    @Res() res: Response
-  ): void {
-    // templateName from query — attacker sends "../../config/database"
-    const templatePath = path.join(TEMPLATES_DIR, locale, `${templateName}.html`);
-    try {
-      const html = fs.readFileSync(templatePath, 'utf-8');
-      res.type('text/html').send(html);
-    } catch {
-      res.status(404).send('Template not found');
-    }
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-032 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: zip-slip path traversal via user-uploaded archive with unvalidated entry names
-
-import AdmZip from 'adm-zip';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const EXTRACT_BASE = '/var/app/uploads/extracted';
-
-export function extractArchive(zipBuffer: Buffer, userId: string): string[] {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-  const extractedPaths: string[] = [];
-
-  for (const entry of entries) {
-    // entry.entryName can contain "../" — writes outside EXTRACT_BASE (zip-slip)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, entry.getData());
-      extractedPaths.push(outputPath);
-    }
-  }
-
-  return extractedPaths;
-}

package/dist/packages/crucible/seeds/ts/seed-033 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: typescript
-// expected: path traversal via multer upload with user-controlled destination folder
-
-import multer, { StorageEngine } from 'multer';
-import * as path from 'path';
-import * as fs from 'fs';
-import { Request } from 'express';
-
-const UPLOADS_ROOT = '/var/uploads';
-
-const storage: StorageEngine = multer.diskStorage({
-  destination: (req: Request, file, cb) => {
-    const folder = req.body.folder as string || 'default';
-    // folder from request body — allows writing to arbitrary locations
-    const destPath = path.join(UPLOADS_ROOT, req.user?.id ?? 'anon', folder);
-    fs.mkdirSync(destPath, { recursive: true });
-    cb(null, destPath);
-  },
-  filename: (req: Request, file, cb) => {
-    const prefix = req.body.prefix as string || '';
-    // prefix + originalname — originalname may include path separators
-    cb(null, `${prefix}_${file.originalname}`);
-  },
-});
-
-export const upload = multer({
-  storage,
-  limits: { fileSize: 50 * 1024 * 1024 },
-});

package/dist/packages/crucible/seeds/ts/seed-034 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: MD5 used for password hashing in typed auth service
-
-import * as crypto from 'crypto';
-import { Pool } from 'pg';
-
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-export class AuthService {
-  private hashPassword(password: string): string {
-    // MD5 is cryptographically broken — should use bcrypt/argon2
-    return crypto.createHash('md5').update(password).digest('hex');
-  }
-
-  async register(email: string, password: string): Promise<void> {
-    const hash = this.hashPassword(password);
-    await pool.query(
-      'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-      [email, hash]
-    );
-  }
-
-  async login(email: string, password: string): Promise<boolean> {
-    const hash = this.hashPassword(password);
-    const { rows } = await pool.query(
-      'SELECT id FROM users WHERE email = $1 AND password_hash = $2',
-      [email, hash]
-    );
-    return rows.length > 0;
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-035 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: Math.random() used for security tokens, SHA1 for HMAC
-
-import * as crypto from 'crypto';
-
-export function generateSessionId(): string {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).slice(2) + Date.now().toString(36);
-}
-
-export function generateCsrfToken(): string {
-  // Predictable timestamp-based token
-  return Buffer.from(`csrf_${Date.now()}_${Math.random()}`).toString('base64');
-}
-
-export function generatePasswordResetToken(userId: string): string {
-  // SHA1 HMAC with weak source of randomness
-  const rand = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString();
-  return crypto.createHmac('sha1', 'static-hmac-secret').update(userId + rand).digest('hex');
-}
-
-export function generateApiKey(): string {
-  // Only 32 bits of entropy — trivially brute-forceable
-  const rand = Math.floor(Math.random() * 0xffffffff).toString(16).padStart(8, '0');
-  return `key_${rand}`;
-}

package/dist/packages/crucible/seeds/ts/seed-036 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: AES-ECB mode with no IV and RC4 weak cipher usage
-
-import * as crypto from 'crypto';
-
-type CipherAlgorithm = 'aes-128-ecb' | 'aes-256-ecb' | 'rc4';
-
-export class LegacyCrypto {
-  private key: Buffer;
-
-  constructor(hexKey: string) {
-    this.key = Buffer.from(hexKey, 'hex');
-  }
-
-  // ECB mode: identical plaintext blocks produce identical ciphertext
-  encryptECB(data: string): string {
-    const cipher = crypto.createCipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-
-  decryptECB(data: string): string {
-    const decipher = crypto.createDecipheriv('aes-128-ecb', this.key.slice(0, 16), null);
-    return decipher.update(data, 'hex', 'utf8') + decipher.final('utf8');
-  }
-
-  // RC4 is broken — key reuse leads to plaintext recovery
-  encryptRC4(data: string): string {
-    const cipher = crypto.createCipheriv('rc4', this.key.slice(0, 16), null);
-    return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-  }
-}

package/dist/packages/crucible/seeds/ts/seed-037 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: typescript
-// expected: timing attack via string comparison of HMAC signatures
-
-import * as crypto from 'crypto';
-
-const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
-
-export function computeSignature(payload: string): string {
-  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
-}
-
-export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
-  const expectedSig = computeSignature(payload);
-  // Timing attack: early exit on first mismatch leaks signature length/prefix
-  return expectedSig === receivedSig;
-}
-
-export function verifyApiKey(providedKey: string, storedKey: string): boolean {
-  // Direct string comparison — vulnerable to timing oracle attack
-  return providedKey === storedKey;
-}
-
-export function checkTokenMatch(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  // Character-by-character comparison — timing side-channel
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}

package/dist/packages/crucible/seeds/ts/seed-038 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-
-import * as crypto from 'crypto';
-
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}

package/dist/packages/crucible/seeds/ts/seed-039 2.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-
-interface DeepObject {
-  [key: string]: unknown;
-}
-
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-
-import { Request, Response, Router } from 'express';
-const router = Router();
-
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-040 2.ts

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via bracket-notation assignment with user-controlled key path
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
-  const parts = keyPath.split('.');
-  let cursor: Record<string, unknown> = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    // Allows "__proto__" or "constructor" as path segment
-    if (typeof cursor[part] !== 'object') cursor[part] = {};
-    cursor = cursor[part] as Record<string, unknown>;
-  }
-  cursor[parts[parts.length - 1]] = value;
-}
-
-router.patch('/user/preference', (req: Request, res: Response) => {
-  const { key, value } = req.body as { key: string; value: unknown };
-  const userPrefs: Record<string, unknown> = {};
-  // key = "__proto__.admin" → Object.prototype.admin = value
-  setProperty(userPrefs, key, value);
-  res.json({ updated: true });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-041 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const globalAppConfig: Record<string, unknown> = {};
-
-router.post('/admin/config/set', (req: Request, res: Response) => {
-  const { path, value } = req.body as { path: string; value: unknown };
-  // _.set with user-controlled path — vulnerable to prototype pollution
-  // e.g. path = "__proto__.isAdmin", value = true
-  _.set(globalAppConfig, path, value);
-  res.json({ ok: true });
-});
-
-router.post('/ui/theme', (req: Request, res: Response) => {
-  const userTheme = req.body as Record<string, unknown>;
-  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
-  // _.merge pollutes prototype when userTheme contains __proto__
-  const merged = _.merge({}, defaultTheme, userTheme);
-  res.json({ theme: merged });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-042 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: medium
-// language: typescript
-// expected: prototype pollution via constructor.prototype path in Object.assign chain
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface PluginConfig {
-  [key: string]: unknown;
-}
-
-function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
-  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
-  return Object.assign({}, baseOptions, userOptions);
-}
-
-router.post('/plugins/:id/configure', (req: Request, res: Response) => {
-  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
-  // req.body passed directly — {"__proto__": {"polluted": true}}
-  const config = applyPluginOptions(base, req.body as PluginConfig);
-  res.json({ configured: true, config });
-});
-
-router.patch('/plugins/:id/update', (req: Request, res: Response) => {
-  // Spread operator with user body — same pollution vector
-  const updated = { ...{}, ...req.body };
-  res.json({ updated });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-043 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via qs-parsed query params passed to deep clone utility
-
-import * as qs from 'qs';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function cloneDeep<T extends object>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
-}
-
-function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
-  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
-  for (const [key, val] of Object.entries(filter)) {
-    (base as Record<string, unknown>)[key] = val;
-  }
-  return base;
-}
-
-router.get('/items', (req: Request, res: Response) => {
-  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
-  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
-  const baseQuery = { page: 1, limit: 20, active: true };
-  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
-  res.json({ query: merged });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-044 2.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: eval() called with user-controlled expression in typed handler
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface CalcRequest {
-  expression: string;
-}
-
-router.post('/calc', (req: Request, res: Response) => {
-  const { expression } = req.body as CalcRequest;
-  try {
-    // TypeScript types don't prevent runtime eval injection
-    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
-    // eslint-disable-next-line no-eval
-    const result = eval(expression);
-    res.json({ result });
-  } catch (err: any) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.get('/render-tpl', (req: Request, res: Response) => {
-  const tpl = req.query.tpl as string;
-  const user = req.session?.user ?? {};
-  // eval of backtick template with user-controlled string
-  const output = eval('`' + tpl + '`');
-  res.send(output);
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-045 2.ts

@@ -1,39 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: new Function() constructor with user-supplied code string in typed scripting service
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScriptRequest {
-  code: string;
-  context?: Record<string, unknown>;
-}
-
-function executeUserScript(code: string, context: Record<string, unknown>): unknown {
-  // new Function() is not sandboxed — full access to global scope
-  const fn = new Function('ctx', 'Math', 'JSON', `
-    with (ctx) {
-      ${code}
-    }
-  `);
-  return fn(context, Math, JSON);
-}
-
-router.post('/scripting/execute', (req: Request, res: Response) => {
-  const { code, context = {} } = req.body as ScriptRequest;
-  const result = executeUserScript(code, context);
-  res.json({ result });
-});
-
-router.post('/hooks/transform', (req: Request, res: Response) => {
-  const { transformCode } = req.body;
-  const transform = new Function('data', 'helpers', transformCode);
-  const output = transform(req.body.data, { JSON, Math });
-  res.json({ output });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-046 2.ts

@@ -1,41 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: typescript
-// expected: eval() inside JSON reviver executing serialized function strings from DB
-
-interface SerializedConfig {
-  [key: string]: unknown;
-}
-
-export function deserializeConfig(raw: string): SerializedConfig {
-  return JSON.parse(raw, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__function__:')) {
-      const fnBody = value.slice(13);
-      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
-      // eslint-disable-next-line no-eval
-      return eval(`(${fnBody})`);
-    }
-    return value;
-  });
-}
-
-interface PipelineStep {
-  name: string;
-  handler: ((input: unknown) => unknown) | string;
-}
-
-export function loadPipeline(configJson: string): PipelineStep[] {
-  const config = deserializeConfig(configJson);
-  return config.steps as PipelineStep[];
-}
-
-export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
-  let result = input;
-  for (const step of steps) {
-    if (typeof step.handler === 'function') {
-      result = await step.handler(result);
-    }
-  }
-  return result;
-}

package/dist/packages/crucible/seeds/ts/seed-047 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: lodash template compilation with user-controlled template string (code execution)
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface TemplateRequest {
-  template: string;
-  data: Record<string, unknown>;
-}
-
-router.post('/email/preview', async (req: Request, res: Response) => {
-  const { template, data } = req.body as TemplateRequest;
-  // _.template compiles and executes JS inside <%= %> delimiters
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const output = compiled(data);
-  res.type('text/html').send(output);
-});
-
-router.get('/report/preview', (req: Request, res: Response) => {
-  const tpl = req.query.template as string;
-  const vars = JSON.parse(req.query.vars as string ?? '{}');
-  const compiled = _.template(tpl);
-  res.send(compiled(vars));
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-048 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via fetch with unvalidated user-supplied URL
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ProxyRequest {
-  url: string;
-  method?: 'GET' | 'POST';
-  headers?: Record<string, string>;
-}
-
-router.post('/proxy', async (req: Request, res: Response) => {
-  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
-  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
-  const response = await fetch(url, { method, headers });
-  const body = await response.text();
-  res.status(response.status).send(body);
-});
-
-router.get('/preview', async (req: Request, res: Response) => {
-  const targetUrl = req.query.url as string;
-  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
-  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
-  const data = await resp.text();
-  res.json({ preview: data.slice(0, 500) });
-});
-
-export default router;

package/dist/packages/crucible/seeds/ts/seed-049 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via axios with user-controlled webhook URL and redirect following
-
-import axios from 'axios';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface WebhookConfig {
-  url: string;
-  secret?: string;
-}
-
-router.post('/webhooks/test', async (req: Request, res: Response) => {
-  const { url, secret } = req.body as WebhookConfig;
-  // url user-controlled — attacker probes internal network
-  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
-    headers: { 'X-Webhook-Secret': secret ?? '' },
-    maxRedirects: 5,  // follows redirects — can pivot to internal services
-    timeout: 10000,
-  });
-  res.json({ status: response.status, data: response.data });
-});
-
-router.get('/import', async (req: Request, res: Response) => {
-  const dataUrl = req.query.source as string;
-  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
-  res.set('Content-Type', 'application/octet-stream').send(data);
-});
-
-export default router;