thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/go/seed-024.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: go
-// expected: Command injection via exec.Command with user-controlled filename in ffmpeg call
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"os/exec"
-)
-
-func ConvertHandler(w http.ResponseWriter, r *http.Request) {
-	input  := r.URL.Query().Get("input")
-	output := r.URL.Query().Get("output")
-	// Vulnerable: both params injected into shell command string
-	cmdStr := fmt.Sprintf("ffmpeg -i /uploads/%s /output/%s", input, output)
-	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		http.Error(w, string(out), 500)
-		return
-	}
-	fmt.Fprintf(w, "Done: %s", out)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command with user-controlled filename in ffmpeg call
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+
+func ConvertHandler(w http.ResponseWriter, r *http.Request) {
+	input  := r.URL.Query().Get("input")
+	output := r.URL.Query().Get("output")
+	// Vulnerable: both params injected into shell command string
+	cmdStr := fmt.Sprintf("ffmpeg -i /uploads/%s /output/%s", input, output)
+	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		http.Error(w, string(out), 500)
+		return
+	}
+	fmt.Fprintf(w, "Done: %s", out)
+}

package/dist/packages/crucible/seeds/go/seed-025.go

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: go
-// expected: Command injection via strings.Split on user input passed to exec.Command
-
-package services
-
-import (
-	"os/exec"
-	"strings"
-)
-
-type ScriptRunner struct {
-	ScriptDir string
-}
-
-func (s *ScriptRunner) Run(userCommand string) ([]byte, error) {
-	// Vulnerable: splitting user input and passing as command + args
-	parts := strings.Split(userCommand, " ")
-	cmd   := exec.Command(s.ScriptDir+"/"+parts[0], parts[1:]...)
-	return cmd.Output()
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via strings.Split on user input passed to exec.Command
+
+package services
+
+import (
+	"os/exec"
+	"strings"
+)
+
+type ScriptRunner struct {
+	ScriptDir string
+}
+
+func (s *ScriptRunner) Run(userCommand string) ([]byte, error) {
+	// Vulnerable: splitting user input and passing as command + args
+	parts := strings.Split(userCommand, " ")
+	cmd   := exec.Command(s.ScriptDir+"/"+parts[0], parts[1:]...)
+	return cmd.Output()
+}

package/dist/packages/crucible/seeds/go/seed-026.go

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: go
-// expected: Command injection via exec.Command passing user-supplied archive name to unzip
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"os/exec"
-)
-
-const archiveDir = "/var/archives/"
-const outputDir  = "/var/output/"
-
-func ExtractHandler(w http.ResponseWriter, r *http.Request) {
-	archive := r.URL.Query().Get("archive")
-	dest    := r.URL.Query().Get("dest")
-	// Vulnerable: archive and dest injected into unzip shell command
-	cmdStr  := fmt.Sprintf("unzip %s%s -d %s%s", archiveDir, archive, outputDir, dest)
-	cmd     := exec.Command("/bin/bash", "-c", cmdStr)
-	if err   := cmd.Run(); err != nil {
-		http.Error(w, "Extraction failed", 500)
-		return
-	}
-	fmt.Fprint(w, "Extracted successfully")
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command passing user-supplied archive name to unzip
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+
+const archiveDir = "/var/archives/"
+const outputDir  = "/var/output/"
+
+func ExtractHandler(w http.ResponseWriter, r *http.Request) {
+	archive := r.URL.Query().Get("archive")
+	dest    := r.URL.Query().Get("dest")
+	// Vulnerable: archive and dest injected into unzip shell command
+	cmdStr  := fmt.Sprintf("unzip %s%s -d %s%s", archiveDir, archive, outputDir, dest)
+	cmd     := exec.Command("/bin/bash", "-c", cmdStr)
+	if err   := cmd.Run(); err != nil {
+		http.Error(w, "Extraction failed", 500)
+		return
+	}
+	fmt.Fprint(w, "Extracted successfully")
+}

package/dist/packages/crucible/seeds/go/seed-027.go

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: go
-// expected: Command injection via exec.Command running nslookup with unsanitized domain
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"os/exec"
-)
-
-func DnsLookupHandler(w http.ResponseWriter, r *http.Request) {
-	domain := r.URL.Query().Get("domain")
-	// Vulnerable: domain passed via shell -c enables injection
-	cmd    := exec.Command("/bin/sh", "-c", "nslookup "+domain)
-	out, err := cmd.Output()
-	if err != nil {
-		http.Error(w, "Lookup failed", 500)
-		return
-	}
-	w.Header().Set("Content-Type", "text/plain")
-	fmt.Fprintf(w, "%s", out)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command running nslookup with unsanitized domain
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"os/exec"
+)
+
+func DnsLookupHandler(w http.ResponseWriter, r *http.Request) {
+	domain := r.URL.Query().Get("domain")
+	// Vulnerable: domain passed via shell -c enables injection
+	cmd    := exec.Command("/bin/sh", "-c", "nslookup "+domain)
+	out, err := cmd.Output()
+	if err != nil {
+		http.Error(w, "Lookup failed", 500)
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain")
+	fmt.Fprintf(w, "%s", out)
+}

package/dist/packages/crucible/seeds/go/seed-028.go

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: go
-// expected: Command injection via exec.Command with user-supplied email in sendmail call
-
-package services
-
-import (
-	"fmt"
-	"os/exec"
-)
-
-type Mailer struct {
-	ReportBasePath string
-}
-
-func (m *Mailer) SendReport(email, reportName string) error {
-	// Vulnerable: email not sanitized before shell injection via sendmail
-	cmdStr := fmt.Sprintf("sendmail %s < %s/%s", email, m.ReportBasePath, reportName)
-	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
-	return cmd.Run()
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: go
+// expected: Command injection via exec.Command with user-supplied email in sendmail call
+
+package services
+
+import (
+	"fmt"
+	"os/exec"
+)
+
+type Mailer struct {
+	ReportBasePath string
+}
+
+func (m *Mailer) SendReport(email, reportName string) error {
+	// Vulnerable: email not sanitized before shell injection via sendmail
+	cmdStr := fmt.Sprintf("sendmail %s < %s/%s", email, m.ReportBasePath, reportName)
+	cmd    := exec.Command("/bin/sh", "-c", cmdStr)
+	return cmd.Run()
+}

package/dist/packages/crucible/seeds/go/seed-029.go

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal via os.Open with user-supplied filename concatenated to base path
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-	"os"
-)
-
-const uploadDir = "/var/app/uploads/"
-
-func DownloadHandler(w http.ResponseWriter, r *http.Request) {
-	filename := r.URL.Query().Get("file")
-	// Vulnerable: filename not normalized; ../../etc/passwd traversal possible
-	f, err := os.Open(uploadDir + filename)
-	if err != nil {
-		http.Error(w, "File not found", 404)
-		return
-	}
-	defer f.Close()
-	w.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
-	io.Copy(w, f)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via os.Open with user-supplied filename concatenated to base path
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+	"os"
+)
+
+const uploadDir = "/var/app/uploads/"
+
+func DownloadHandler(w http.ResponseWriter, r *http.Request) {
+	filename := r.URL.Query().Get("file")
+	// Vulnerable: filename not normalized; ../../etc/passwd traversal possible
+	f, err := os.Open(uploadDir + filename)
+	if err != nil {
+		http.Error(w, "File not found", 404)
+		return
+	}
+	defer f.Close()
+	w.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
+	io.Copy(w, f)
+}

package/dist/packages/crucible/seeds/go/seed-030.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal via ioutil.ReadFile with unvalidated user path component
-
-package handlers
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-)
-
-const configRoot = "/etc/appservice/configs/"
-
-func ConfigHandler(w http.ResponseWriter, r *http.Request) {
-	name := r.URL.Query().Get("name")
-	// Vulnerable: name allows traversal (e.g. ../../etc/shadow)
-	data, err := ioutil.ReadFile(configRoot + name + ".json")
-	if err != nil {
-		http.Error(w, "Config not found", 404)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	fmt.Fprintf(w, "%s", data)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via ioutil.ReadFile with unvalidated user path component
+
+package handlers
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+const configRoot = "/etc/appservice/configs/"
+
+func ConfigHandler(w http.ResponseWriter, r *http.Request) {
+	name := r.URL.Query().Get("name")
+	// Vulnerable: name allows traversal (e.g. ../../etc/shadow)
+	data, err := ioutil.ReadFile(configRoot + name + ".json")
+	if err != nil {
+		http.Error(w, "Config not found", 404)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	fmt.Fprintf(w, "%s", data)
+}

package/dist/packages/crucible/seeds/go/seed-031.go

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal via filepath.Join without verifying result is within base directory
-
-package handlers
-
-import (
-	"net/http"
-	"os"
-	"path/filepath"
-)
-
-const templateRoot = "/opt/app/templates"
-
-func TemplateHandler(w http.ResponseWriter, r *http.Request) {
-	tmpl := r.URL.Query().Get("template")
-	// Vulnerable: filepath.Join does not prevent traversal if tmpl starts with /
-	fullPath := filepath.Join(templateRoot, tmpl)
-	data, err := os.ReadFile(fullPath)
-	if err != nil {
-		http.Error(w, "Template not found", 404)
-		return
-	}
-	w.Header().Set("Content-Type", "text/html")
-	w.Write(data)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via filepath.Join without verifying result is within base directory
+
+package handlers
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+const templateRoot = "/opt/app/templates"
+
+func TemplateHandler(w http.ResponseWriter, r *http.Request) {
+	tmpl := r.URL.Query().Get("template")
+	// Vulnerable: filepath.Join does not prevent traversal if tmpl starts with /
+	fullPath := filepath.Join(templateRoot, tmpl)
+	data, err := os.ReadFile(fullPath)
+	if err != nil {
+		http.Error(w, "Template not found", 404)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html")
+	w.Write(data)
+}

package/dist/packages/crucible/seeds/go/seed-032.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal in file delete endpoint with user-controlled relative path
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"os"
-)
-
-const uploadRoot = "/var/uploads/"
-
-func DeleteHandler(w http.ResponseWriter, r *http.Request) {
-	rel := r.URL.Query().Get("path")
-	// Vulnerable: rel can traverse outside uploadRoot via ../
-	target := uploadRoot + rel
-	err := os.Remove(target)
-	if err != nil {
-		http.Error(w, "Delete failed: "+err.Error(), 500)
-		return
-	}
-	fmt.Fprintf(w, `{"deleted":true,"path":"%s"}`, target)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal in file delete endpoint with user-controlled relative path
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+)
+
+const uploadRoot = "/var/uploads/"
+
+func DeleteHandler(w http.ResponseWriter, r *http.Request) {
+	rel := r.URL.Query().Get("path")
+	// Vulnerable: rel can traverse outside uploadRoot via ../
+	target := uploadRoot + rel
+	err := os.Remove(target)
+	if err != nil {
+		http.Error(w, "Delete failed: "+err.Error(), 500)
+		return
+	}
+	fmt.Fprintf(w, `{"deleted":true,"path":"%s"}`, target)
+}

package/dist/packages/crucible/seeds/go/seed-033.go

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal in file write with user-supplied output filename
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-	"os"
-)
-
-const reportBase = "/var/reports/"
-
-func SaveReportHandler(w http.ResponseWriter, r *http.Request) {
-	reportName := r.URL.Query().Get("name")
-	// Vulnerable: reportName can escape reportBase (e.g. ../../etc/cron.d/backdoor)
-	outPath := reportBase + reportName + ".txt"
-	f, err  := os.Create(outPath)
-	if err != nil {
-		http.Error(w, "Cannot create file", 500)
-		return
-	}
-	defer f.Close()
-	io.Copy(f, r.Body)
-	io.WriteString(w, "Saved: "+outPath)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal in file write with user-supplied output filename
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+	"os"
+)
+
+const reportBase = "/var/reports/"
+
+func SaveReportHandler(w http.ResponseWriter, r *http.Request) {
+	reportName := r.URL.Query().Get("name")
+	// Vulnerable: reportName can escape reportBase (e.g. ../../etc/cron.d/backdoor)
+	outPath := reportBase + reportName + ".txt"
+	f, err  := os.Create(outPath)
+	if err != nil {
+		http.Error(w, "Cannot create file", 500)
+		return
+	}
+	defer f.Close()
+	io.Copy(f, r.Body)
+	io.WriteString(w, "Saved: "+outPath)
+}

package/dist/packages/crucible/seeds/go/seed-034.go

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: MD5 used for password hashing via crypto/md5
-
-package security
-
-import (
-	"crypto/md5"
-	"fmt"
-)
-
-// Vulnerable: MD5 is cryptographically broken and unsalted
-func HashPassword(password string) string {
-	hash := md5.Sum([]byte(password))
-	return fmt.Sprintf("%x", hash)
-}
-
-func VerifyPassword(password, storedHash string) bool {
-	return HashPassword(password) == storedHash
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: MD5 used for password hashing via crypto/md5
+
+package security
+
+import (
+	"crypto/md5"
+	"fmt"
+)
+
+// Vulnerable: MD5 is cryptographically broken and unsalted
+func HashPassword(password string) string {
+	hash := md5.Sum([]byte(password))
+	return fmt.Sprintf("%x", hash)
+}
+
+func VerifyPassword(password, storedHash string) bool {
+	return HashPassword(password) == storedHash
+}

package/dist/packages/crucible/seeds/go/seed-035.go

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: math/rand used instead of crypto/rand for security token generation
-
-package security
-
-import (
-	"math/rand"
-	"time"
-)
-
-const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
-
-func init() {
-	// Vulnerable: seeding math/rand with time is predictable
-	rand.Seed(time.Now().UnixNano())
-}
-
-// Vulnerable: math/rand is not cryptographically secure
-func GenerateToken(length int) string {
-	b := make([]byte, length)
-	for i := range b {
-		b[i] = alphabet[rand.Intn(len(alphabet))]
-	}
-	return string(b)
-}
-
-func GenerateSessionID() string  { return GenerateToken(32) }
-func GenerateCSRFToken() string  { return GenerateToken(24) }
-func GenerateResetToken() string { return GenerateToken(40) }
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: math/rand used instead of crypto/rand for security token generation
+
+package security
+
+import (
+	"math/rand"
+	"time"
+)
+
+const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+func init() {
+	// Vulnerable: seeding math/rand with time is predictable
+	rand.Seed(time.Now().UnixNano())
+}
+
+// Vulnerable: math/rand is not cryptographically secure
+func GenerateToken(length int) string {
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = alphabet[rand.Intn(len(alphabet))]
+	}
+	return string(b)
+}
+
+func GenerateSessionID() string  { return GenerateToken(32) }
+func GenerateCSRFToken() string  { return GenerateToken(24) }
+func GenerateResetToken() string { return GenerateToken(40) }