thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/go/seed-036.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: SHA1 used for HMAC signing and MD5 for file integrity verification
-
-package security
-
-import (
-	"crypto/hmac"
-	"crypto/md5"
-	"crypto/sha1"
-	"encoding/hex"
-)
-
-// Vulnerable: HMAC-SHA1 is weak for new applications
-func SignHMAC(data, key string) string {
-	mac := hmac.New(sha1.New, []byte(key))
-	mac.Write([]byte(data))
-	return hex.EncodeToString(mac.Sum(nil))
-}
-
-// Vulnerable: MD5 for file integrity — susceptible to collision attacks
-func FileChecksum(data []byte) string {
-	hash := md5.Sum(data)
-	return hex.EncodeToString(hash[:])
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: SHA1 used for HMAC signing and MD5 for file integrity verification
+
+package security
+
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/sha1"
+	"encoding/hex"
+)
+
+// Vulnerable: HMAC-SHA1 is weak for new applications
+func SignHMAC(data, key string) string {
+	mac := hmac.New(sha1.New, []byte(key))
+	mac.Write([]byte(data))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+
+// Vulnerable: MD5 for file integrity — susceptible to collision attacks
+func FileChecksum(data []byte) string {
+	hash := md5.Sum(data)
+	return hex.EncodeToString(hash[:])
+}

package/dist/packages/crucible/seeds/go/seed-037.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
-
-package security
-
-import (
-	"crypto/cipher"
-	"crypto/des"
-)
-
-var desKey = []byte("8byteKey") // Vulnerable: DES key is only 56 bits
-
-func EncryptDES(plaintext []byte) ([]byte, error) {
-	// Vulnerable: DES is broken — brute-forceable since 1999
-	block, err := des.NewCipher(desKey)
-	if err != nil {
-		return nil, err
-	}
-	ciphertext := make([]byte, len(plaintext))
-	iv := desKey // Vulnerable: IV reused from key bytes
-	mode := cipher.NewCBCEncryptor(block, iv)
-	mode.CryptBlocks(ciphertext, plaintext)
-	return ciphertext, nil
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
+
+package security
+
+import (
+	"crypto/cipher"
+	"crypto/des"
+)
+
+var desKey = []byte("8byteKey") // Vulnerable: DES key is only 56 bits
+
+func EncryptDES(plaintext []byte) ([]byte, error) {
+	// Vulnerable: DES is broken — brute-forceable since 1999
+	block, err := des.NewCipher(desKey)
+	if err != nil {
+		return nil, err
+	}
+	ciphertext := make([]byte, len(plaintext))
+	iv := desKey // Vulnerable: IV reused from key bytes
+	mode := cipher.NewCBCEncryptor(block, iv)
+	mode.CryptBlocks(ciphertext, plaintext)
+	return ciphertext, nil
+}

package/dist/packages/crucible/seeds/go/seed-038.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: Hardcoded AES key with ECB-like block-by-block encryption lacking proper IV
-
-package security
-
-import (
-	"crypto/aes"
-)
-
-// Vulnerable: hardcoded key and manual block-level encryption without IV (ECB-equivalent)
-var aesKey = []byte("1234567890abcdef")
-
-func EncryptBlock(plaintext []byte) ([]byte, error) {
-	block, err := aes.NewCipher(aesKey)
-	if err != nil {
-		return nil, err
-	}
-	// Vulnerable: encrypting single blocks without chaining — identical blocks = identical ciphertext
-	ciphertext := make([]byte, len(plaintext))
-	for i := 0; i < len(plaintext); i += aes.BlockSize {
-		block.Encrypt(ciphertext[i:i+aes.BlockSize], plaintext[i:i+aes.BlockSize])
-	}
-	return ciphertext, nil
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: Hardcoded AES key with ECB-like block-by-block encryption lacking proper IV
+
+package security
+
+import (
+	"crypto/aes"
+)
+
+// Vulnerable: hardcoded key and manual block-level encryption without IV (ECB-equivalent)
+var aesKey = []byte("1234567890abcdef")
+
+func EncryptBlock(plaintext []byte) ([]byte, error) {
+	block, err := aes.NewCipher(aesKey)
+	if err != nil {
+		return nil, err
+	}
+	// Vulnerable: encrypting single blocks without chaining — identical blocks = identical ciphertext
+	ciphertext := make([]byte, len(plaintext))
+	for i := 0; i < len(plaintext); i += aes.BlockSize {
+		block.Encrypt(ciphertext[i:i+aes.BlockSize], plaintext[i:i+aes.BlockSize])
+	}
+	return ciphertext, nil
+}

package/dist/packages/crucible/seeds/go/seed-039.go

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get fetching user-supplied image URL for thumbnail generation
-
-package handlers
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-)
-
-func ThumbnailHandler(w http.ResponseWriter, r *http.Request) {
-	imageURL := r.URL.Query().Get("image_url")
-	// Vulnerable: server fetches from any URL; internal AWS metadata or Kubernetes API reachable
-	resp, err := http.Get(imageURL)
-	if err != nil {
-		http.Error(w, "Failed to fetch image", 502)
-		return
-	}
-	defer resp.Body.Close()
-	data, _ := io.ReadAll(resp.Body)
-	fmt.Fprintf(w, "Fetched %d bytes from %s", len(data), imageURL)
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get fetching user-supplied image URL for thumbnail generation
+
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func ThumbnailHandler(w http.ResponseWriter, r *http.Request) {
+	imageURL := r.URL.Query().Get("image_url")
+	// Vulnerable: server fetches from any URL; internal AWS metadata or Kubernetes API reachable
+	resp, err := http.Get(imageURL)
+	if err != nil {
+		http.Error(w, "Failed to fetch image", 502)
+		return
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+	fmt.Fprintf(w, "Fetched %d bytes from %s", len(data), imageURL)
+}

package/dist/packages/crucible/seeds/go/seed-040.go

@@ -1,37 +1,37 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal via os.Stat and os.ReadFile with user-controlled archive entry path
-
-package handlers
-
-import (
-	"archive/zip"
-	"net/http"
-	"os"
-	"path/filepath"
-)
-
-const extractBase = "/var/extracted/"
-
-func ZipExtractHandler(w http.ResponseWriter, r *http.Request) {
-	zipPath := r.URL.Query().Get("zip")
-	zr, err := zip.OpenReader(zipPath)
-	if err != nil {
-		http.Error(w, "Cannot open zip", 400)
-		return
-	}
-	defer zr.Close()
-	for _, f := range zr.File {
-		// Vulnerable: f.Name can contain ../ sequences escaping extractBase
-		target := filepath.Join(extractBase, f.Name)
-		os.MkdirAll(filepath.Dir(target), 0755)
-		out, _ := os.Create(target)
-		rc, _  := f.Open()
-		out.ReadFrom(rc)
-		rc.Close()
-		out.Close()
-	}
-	http.Redirect(w, r, "/files", http.StatusFound)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via os.Stat and os.ReadFile with user-controlled archive entry path
+
+package handlers
+
+import (
+	"archive/zip"
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+const extractBase = "/var/extracted/"
+
+func ZipExtractHandler(w http.ResponseWriter, r *http.Request) {
+	zipPath := r.URL.Query().Get("zip")
+	zr, err := zip.OpenReader(zipPath)
+	if err != nil {
+		http.Error(w, "Cannot open zip", 400)
+		return
+	}
+	defer zr.Close()
+	for _, f := range zr.File {
+		// Vulnerable: f.Name can contain ../ sequences escaping extractBase
+		target := filepath.Join(extractBase, f.Name)
+		os.MkdirAll(filepath.Dir(target), 0755)
+		out, _ := os.Create(target)
+		rc, _  := f.Open()
+		out.ReadFrom(rc)
+		rc.Close()
+		out.Close()
+	}
+	http.Redirect(w, r, "/files", http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-041.go

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: Weak RSA key size (1024-bit) used for certificate generation
-
-package security
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-)
-
-// Vulnerable: 1024-bit RSA is considered broken; minimum is 2048-bit
-func GenerateWeakRSAKey() (*rsa.PrivateKey, error) {
-	return rsa.GenerateKey(rand.Reader, 1024)
-}
-
-// Vulnerable: also using a fixed exponent of 3 is dangerous in some contexts
-func GenerateVeryWeakRSAKey() (*rsa.PrivateKey, error) {
-	key, err := rsa.GenerateKey(rand.Reader, 512)
-	return key, err
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: Weak RSA key size (1024-bit) used for certificate generation
+
+package security
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+)
+
+// Vulnerable: 1024-bit RSA is considered broken; minimum is 2048-bit
+func GenerateWeakRSAKey() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(rand.Reader, 1024)
+}
+
+// Vulnerable: also using a fixed exponent of 3 is dangerous in some contexts
+func GenerateVeryWeakRSAKey() (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 512)
+	return key, err
+}

package/dist/packages/crucible/seeds/go/seed-042.go

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect using user-supplied return URL after password reset
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func PasswordResetConfirmHandler(w http.ResponseWriter, r *http.Request) {
-	token     := r.URL.Query().Get("token")
-	returnURL := r.URL.Query().Get("return")
-
-	if !validateResetToken(token) {
-		http.Error(w, "Invalid token", 400)
-		return
-	}
-
-	// Process password reset...
-
-	// Vulnerable: returnURL not validated — open redirect to external site
-	if returnURL != "" {
-		http.Redirect(w, r, returnURL, http.StatusFound)
-	} else {
-		http.Redirect(w, r, "/login?reset=success", http.StatusFound)
-	}
-}
-
-func validateResetToken(t string) bool { return len(t) == 32 }
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect using user-supplied return URL after password reset
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func PasswordResetConfirmHandler(w http.ResponseWriter, r *http.Request) {
+	token     := r.URL.Query().Get("token")
+	returnURL := r.URL.Query().Get("return")
+
+	if !validateResetToken(token) {
+		http.Error(w, "Invalid token", 400)
+		return
+	}
+
+	// Process password reset...
+
+	// Vulnerable: returnURL not validated — open redirect to external site
+	if returnURL != "" {
+		http.Redirect(w, r, returnURL, http.StatusFound)
+	} else {
+		http.Redirect(w, r, "/login?reset=success", http.StatusFound)
+	}
+}
+
+func validateResetToken(t string) bool { return len(t) == 32 }

package/dist/packages/crucible/seeds/go/seed-043.go

@@ -1,35 +1,35 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via string comparison of CSRF tokens using == operator
-
-package middleware
-
-import (
-	"net/http"
-)
-
-func CSRFMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "POST" || r.Method == "PUT" || r.Method == "DELETE" {
-			sessionToken := getSessionCSRFToken(r)
-			formToken    := r.FormValue("csrf_token")
-
-			// Vulnerable: == comparison is not constant-time; leaks token via timing
-			if sessionToken != formToken {
-				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
-				return
-			}
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func getSessionCSRFToken(r *http.Request) string {
-	c, err := r.Cookie("csrf_token")
-	if err != nil {
-		return ""
-	}
-	return c.Value
-}
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via string comparison of CSRF tokens using == operator
+
+package middleware
+
+import (
+	"net/http"
+)
+
+func CSRFMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "POST" || r.Method == "PUT" || r.Method == "DELETE" {
+			sessionToken := getSessionCSRFToken(r)
+			formToken    := r.FormValue("csrf_token")
+
+			// Vulnerable: == comparison is not constant-time; leaks token via timing
+			if sessionToken != formToken {
+				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
+				return
+			}
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func getSessionCSRFToken(r *http.Request) string {
+	c, err := r.Cookie("csrf_token")
+	if err != nil {
+		return ""
+	}
+	return c.Value
+}

package/dist/packages/crucible/seeds/go/seed-044.go

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get with user-supplied URL parameter
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-)
-
-func ProxyHandler(w http.ResponseWriter, r *http.Request) {
-	targetURL := r.URL.Query().Get("url")
-	// Vulnerable: fetches arbitrary URL including internal services (e.g. http://169.254.169.254)
-	resp, err := http.Get(targetURL)
-	if err != nil {
-		http.Error(w, "Fetch failed", 500)
-		return
-	}
-	defer resp.Body.Close()
-	w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
-	io.Copy(w, resp.Body)
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get with user-supplied URL parameter
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+)
+
+func ProxyHandler(w http.ResponseWriter, r *http.Request) {
+	targetURL := r.URL.Query().Get("url")
+	// Vulnerable: fetches arbitrary URL including internal services (e.g. http://169.254.169.254)
+	resp, err := http.Get(targetURL)
+	if err != nil {
+		http.Error(w, "Fetch failed", 500)
+		return
+	}
+	defer resp.Body.Close()
+	w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
+	io.Copy(w, resp.Body)
+}

package/dist/packages/crucible/seeds/go/seed-045.go

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Post with user-controlled webhook URL
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-)
-
-func WebhookTestHandler(w http.ResponseWriter, r *http.Request) {
-	webhookURL := r.URL.Query().Get("webhook_url")
-	payload    := r.URL.Query().Get("payload")
-	// Vulnerable: server POSTs to attacker-controlled URL
-	resp, err := http.Post(webhookURL, "application/json", strings.NewReader(payload))
-	if err != nil {
-		http.Error(w, "Webhook error: "+err.Error(), 500)
-		return
-	}
-	defer resp.Body.Close()
-	fmt.Fprintf(w, "Webhook responded: %d", resp.StatusCode)
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Post with user-controlled webhook URL
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+func WebhookTestHandler(w http.ResponseWriter, r *http.Request) {
+	webhookURL := r.URL.Query().Get("webhook_url")
+	payload    := r.URL.Query().Get("payload")
+	// Vulnerable: server POSTs to attacker-controlled URL
+	resp, err := http.Post(webhookURL, "application/json", strings.NewReader(payload))
+	if err != nil {
+		http.Error(w, "Webhook error: "+err.Error(), 500)
+		return
+	}
+	defer resp.Body.Close()
+	fmt.Fprintf(w, "Webhook responded: %d", resp.StatusCode)
+}

package/dist/packages/crucible/seeds/go/seed-046.go

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.NewRequest with user-controlled base URL for metadata fetch
-
-package handlers
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-)
-
-func MetadataFetchHandler(w http.ResponseWriter, r *http.Request) {
-	endpoint := r.URL.Query().Get("endpoint")
-	// Vulnerable: attacker can supply http://169.254.169.254/latest/meta-data/
-	req, err := http.NewRequest("GET", endpoint, nil)
-	if err != nil {
-		http.Error(w, "Invalid URL", 400)
-		return
-	}
-	req.Header.Set("User-Agent", "MetadataFetcher/1.0")
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		http.Error(w, "Request failed", 500)
-		return
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	w.Header().Set("Content-Type", "text/plain")
-	fmt.Fprintf(w, "%s", body)
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.NewRequest with user-controlled base URL for metadata fetch
+
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func MetadataFetchHandler(w http.ResponseWriter, r *http.Request) {
+	endpoint := r.URL.Query().Get("endpoint")
+	// Vulnerable: attacker can supply http://169.254.169.254/latest/meta-data/
+	req, err := http.NewRequest("GET", endpoint, nil)
+	if err != nil {
+		http.Error(w, "Invalid URL", 400)
+		return
+	}
+	req.Header.Set("User-Agent", "MetadataFetcher/1.0")
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		http.Error(w, "Request failed", 500)
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	w.Header().Set("Content-Type", "text/plain")
+	fmt.Fprintf(w, "%s", body)
+}