thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/go/seed-047.go

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get with user-supplied avatar URL for image fetching
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-)
-
-func AvatarProxyHandler(w http.ResponseWriter, r *http.Request) {
-	avatarURL := r.URL.Query().Get("avatar_url")
-	// Vulnerable: server fetches image from any URL; can reach internal services
-	resp, err := http.Get(avatarURL)
-	if err != nil {
-		http.Error(w, "Could not fetch avatar", 502)
-		return
-	}
-	defer resp.Body.Close()
-	contentType := resp.Header.Get("Content-Type")
-	w.Header().Set("Content-Type", contentType)
-	io.Copy(w, resp.Body)
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get with user-supplied avatar URL for image fetching
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+)
+
+func AvatarProxyHandler(w http.ResponseWriter, r *http.Request) {
+	avatarURL := r.URL.Query().Get("avatar_url")
+	// Vulnerable: server fetches image from any URL; can reach internal services
+	resp, err := http.Get(avatarURL)
+	if err != nil {
+		http.Error(w, "Could not fetch avatar", 502)
+		return
+	}
+	defer resp.Body.Close()
+	contentType := resp.Header.Get("Content-Type")
+	w.Header().Set("Content-Type", contentType)
+	io.Copy(w, resp.Body)
+}

package/dist/packages/crucible/seeds/go/seed-048.go

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect with unvalidated user-controlled URL
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func LoginHandler(w http.ResponseWriter, r *http.Request) {
-	username := r.FormValue("username")
-	password := r.FormValue("password")
-	next     := r.URL.Query().Get("next")
-
-	if authenticate(username, password) {
-		// Vulnerable: 'next' not validated; can redirect to https://evil.com
-		if next == "" {
-			next = "/dashboard"
-		}
-		http.Redirect(w, r, next, http.StatusFound)
-	} else {
-		http.Redirect(w, r, "/login?error=1", http.StatusFound)
-	}
-}
-
-func authenticate(u, p string) bool { return u != "" && p != "" }
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect with unvalidated user-controlled URL
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func LoginHandler(w http.ResponseWriter, r *http.Request) {
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+	next     := r.URL.Query().Get("next")
+
+	if authenticate(username, password) {
+		// Vulnerable: 'next' not validated; can redirect to https://evil.com
+		if next == "" {
+			next = "/dashboard"
+		}
+		http.Redirect(w, r, next, http.StatusFound)
+	} else {
+		http.Redirect(w, r, "/login?error=1", http.StatusFound)
+	}
+}
+
+func authenticate(u, p string) bool { return u != "" && p != "" }

package/dist/packages/crucible/seeds/go/seed-049.go

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect using Base64-decoded state parameter
-
-package handlers
-
-import (
-	"encoding/base64"
-	"net/http"
-)
-
-func OAuthCallbackHandler(w http.ResponseWriter, r *http.Request) {
-	state := r.URL.Query().Get("state")
-	// Vulnerable: state decoded and used as redirect target without validation
-	destination, err := base64.StdEncoding.DecodeString(state)
-	if err != nil {
-		http.Error(w, "Invalid state", 400)
-		return
-	}
-	// Exchange code for token... (omitted)
-	http.Redirect(w, r, string(destination), http.StatusFound)
-}
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect using Base64-decoded state parameter
+
+package handlers
+
+import (
+	"encoding/base64"
+	"net/http"
+)
+
+func OAuthCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	state := r.URL.Query().Get("state")
+	// Vulnerable: state decoded and used as redirect target without validation
+	destination, err := base64.StdEncoding.DecodeString(state)
+	if err != nil {
+		http.Error(w, "Invalid state", 400)
+		return
+	}
+	// Exchange code for token... (omitted)
+	http.Redirect(w, r, string(destination), http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-050.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect with Referer header used as redirect destination
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func LogoutHandler(w http.ResponseWriter, r *http.Request) {
-	// Clear session cookie
-	http.SetCookie(w, &http.Cookie{Name: "session", MaxAge: -1})
-
-	returnURL := r.URL.Query().Get("return_url")
-	if returnURL == "" {
-		// Vulnerable: fallback to Referer header — fully attacker-controlled
-		returnURL = r.Header.Get("Referer")
-	}
-	if returnURL == "" {
-		returnURL = "/"
-	}
-	// Vulnerable: redirects to any URL including external sites
-	http.Redirect(w, r, returnURL, http.StatusFound)
-}
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect with Referer header used as redirect destination
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	// Clear session cookie
+	http.SetCookie(w, &http.Cookie{Name: "session", MaxAge: -1})
+
+	returnURL := r.URL.Query().Get("return_url")
+	if returnURL == "" {
+		// Vulnerable: fallback to Referer header — fully attacker-controlled
+		returnURL = r.Header.Get("Referer")
+	}
+	if returnURL == "" {
+		returnURL = "/"
+	}
+	// Vulnerable: redirects to any URL including external sites
+	http.Redirect(w, r, returnURL, http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-051.go

@@ -1,38 +1,38 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via string equality comparison of API tokens instead of hmac.Equal
-
-package handlers
-
-import (
-	"net/http"
-)
-
-const validAPIToken = "prod-api-token-xK9mP2qRwZ4vBn7"
-
-func APIAuthMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		token := r.Header.Get("X-API-Token")
-		// Vulnerable: == comparison leaks timing information about token correctness
-		if token != validAPIToken {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func verifySignature(expected, actual string) bool {
-	// Also vulnerable: early-exit string comparison
-	if len(expected) != len(actual) {
-		return false
-	}
-	for i := range expected {
-		if expected[i] != actual[i] {
-			return false
-		}
-	}
-	return true
-}
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via string equality comparison of API tokens instead of hmac.Equal
+
+package handlers
+
+import (
+	"net/http"
+)
+
+const validAPIToken = "prod-api-token-xK9mP2qRwZ4vBn7"
+
+func APIAuthMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := r.Header.Get("X-API-Token")
+		// Vulnerable: == comparison leaks timing information about token correctness
+		if token != validAPIToken {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func verifySignature(expected, actual string) bool {
+	// Also vulnerable: early-exit string comparison
+	if len(expected) != len(actual) {
+		return false
+	}
+	for i := range expected {
+		if expected[i] != actual[i] {
+			return false
+		}
+	}
+	return true
+}

package/dist/packages/crucible/seeds/go/seed-052.go

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via bytes.Equal comparison of HMAC values instead of hmac.Equal
-
-package security
-
-import (
-	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
-)
-
-func ValidateWebhookSignature(payload []byte, receivedSig, secret string) bool {
-	mac := hmac.New(sha256.New, []byte(secret))
-	mac.Write(payload)
-	expected := mac.Sum(nil)
-	received := []byte(receivedSig)
-	// Vulnerable: bytes.Equal is not constant-time — use hmac.Equal instead
-	return bytes.Equal(expected, received)
-}
-
-func ValidatePasswordHash(storedHash, inputHash string) bool {
-	// Vulnerable: direct string comparison leaks timing information
-	return storedHash == inputHash
-}
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via bytes.Equal comparison of HMAC values instead of hmac.Equal
+
+package security
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+)
+
+func ValidateWebhookSignature(payload []byte, receivedSig, secret string) bool {
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(payload)
+	expected := mac.Sum(nil)
+	received := []byte(receivedSig)
+	// Vulnerable: bytes.Equal is not constant-time — use hmac.Equal instead
+	return bytes.Equal(expected, received)
+}
+
+func ValidatePasswordHash(storedHash, inputHash string) bool {
+	// Vulnerable: direct string comparison leaks timing information
+	return storedHash == inputHash
+}

package/dist/packages/crucible/seeds/java/seed-001.java

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded database password in constant
-
-import java.sql.Connection;
-import java.sql.DriverManager;
-
-public class DatabaseConfig {
-    private static final String DB_URL      = "jdbc:mysql://prod-db.internal:3306/appdb";
-    private static final String DB_USER     = "app_user";
-    private static final String DB_PASSWORD = "Sup3rS3cr3tP@ssw0rd!";
-
-    public static Connection getConnection() throws Exception {
-        return DriverManager.getConnection(DB_URL, DB_USER, DB_PASSWORD);
-    }
-
-    public static void main(String[] args) throws Exception {
-        Connection conn = getConnection();
-        System.out.println("Connected: " + conn.getMetaData().getURL());
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded database password in constant
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+
+public class DatabaseConfig {
+    private static final String DB_URL      = "jdbc:mysql://prod-db.internal:3306/appdb";
+    private static final String DB_USER     = "app_user";
+    private static final String DB_PASSWORD = "Sup3rS3cr3tP@ssw0rd!";
+
+    public static Connection getConnection() throws Exception {
+        return DriverManager.getConnection(DB_URL, DB_USER, DB_PASSWORD);
+    }
+
+    public static void main(String[] args) throws Exception {
+        Connection conn = getConnection();
+        System.out.println("Connected: " + conn.getMetaData().getURL());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-002.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded AWS access key and secret key in source code
-
-public class AwsClientFactory {
-    private static final String AWS_ACCESS_KEY_ID     = "AKIAIOSFODNN7EXAMPLE";
-    private static final String AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-    private static final String AWS_REGION            = "us-east-1";
-
-    public static software.amazon.awssdk.services.s3.S3Client buildS3Client() {
-        software.amazon.awssdk.auth.credentials.AwsBasicCredentials creds =
-            software.amazon.awssdk.auth.credentials.AwsBasicCredentials.create(
-                AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY);
-        return software.amazon.awssdk.services.s3.S3Client.builder()
-            .credentialsProvider(
-                software.amazon.awssdk.auth.credentials.StaticCredentialsProvider.create(creds))
-            .region(software.amazon.awssdk.regions.Region.of(AWS_REGION))
-            .build();
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded AWS access key and secret key in source code
+
+public class AwsClientFactory {
+    private static final String AWS_ACCESS_KEY_ID     = "AKIAIOSFODNN7EXAMPLE";
+    private static final String AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+    private static final String AWS_REGION            = "us-east-1";
+
+    public static software.amazon.awssdk.services.s3.S3Client buildS3Client() {
+        software.amazon.awssdk.auth.credentials.AwsBasicCredentials creds =
+            software.amazon.awssdk.auth.credentials.AwsBasicCredentials.create(
+                AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY);
+        return software.amazon.awssdk.services.s3.S3Client.builder()
+            .credentialsProvider(
+                software.amazon.awssdk.auth.credentials.StaticCredentialsProvider.create(creds))
+            .region(software.amazon.awssdk.regions.Region.of(AWS_REGION))
+            .build();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-003.java

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded JWT signing secret embedded in source
-
-import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.SignatureAlgorithm;
-import java.util.Date;
-
-public class JwtService {
-    // TODO: move to environment variable before deploy
-    private static final String SECRET = "my-super-secret-jwt-key-do-not-share-12345";
-
-    public String generateToken(String subject) {
-        return Jwts.builder()
-            .setSubject(subject)
-            .setIssuedAt(new Date())
-            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
-            .signWith(SignatureAlgorithm.HS256, SECRET)
-            .compact();
-    }
-
-    public boolean validateToken(String token) {
-        Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token);
-        return true;
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded JWT signing secret embedded in source
+
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import java.util.Date;
+
+public class JwtService {
+    // TODO: move to environment variable before deploy
+    private static final String SECRET = "my-super-secret-jwt-key-do-not-share-12345";
+
+    public String generateToken(String subject) {
+        return Jwts.builder()
+            .setSubject(subject)
+            .setIssuedAt(new Date())
+            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
+            .signWith(SignatureAlgorithm.HS256, SECRET)
+            .compact();
+    }
+
+    public boolean validateToken(String token) {
+        Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token);
+        return true;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-004.java

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: java
-// expected: Hardcoded Stripe API key in application constant
-
-import com.stripe.Stripe;
-import com.stripe.model.Charge;
-import java.util.HashMap;
-import java.util.Map;
-
-public class PaymentService {
-    private static final String STRIPE_SECRET_KEY = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
-
-    static {
-        Stripe.apiKey = STRIPE_SECRET_KEY;
-    }
-
-    public Charge chargeCard(String token, long amountCents) throws Exception {
-        Map<String, Object> params = new HashMap<>();
-        params.put("amount", amountCents);
-        params.put("currency", "usd");
-        params.put("source", token);
-        return Charge.create(params);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: java
+// expected: Hardcoded Stripe API key in application constant
+
+import com.stripe.Stripe;
+import com.stripe.model.Charge;
+import java.util.HashMap;
+import java.util.Map;
+
+public class PaymentService {
+    private static final String STRIPE_SECRET_KEY = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
+
+    static {
+        Stripe.apiKey = STRIPE_SECRET_KEY;
+    }
+
+    public Charge chargeCard(String token, long amountCents) throws Exception {
+        Map<String, Object> params = new HashMap<>();
+        params.put("amount", amountCents);
+        params.put("currency", "usd");
+        params.put("source", token);
+        return Charge.create(params);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-005.java

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded SMTP password used for email authentication
-
-import java.util.Properties;
-import javax.mail.*;
-import javax.mail.internet.*;
-
-public class EmailNotifier {
-    private static final String SMTP_HOST     = "smtp.company.com";
-    private static final String SMTP_USER     = "notifications@company.com";
-    private static final String SMTP_PASSWORD = "N0tif!c@ti0nP@ss#2024";
-
-    public void sendAlert(String to, String subject, String body) throws MessagingException {
-        Properties props = new Properties();
-        props.put("mail.smtp.auth", "true");
-        props.put("mail.smtp.host", SMTP_HOST);
-        props.put("mail.smtp.port", "587");
-
-        Session session = Session.getInstance(props, new Authenticator() {
-            protected PasswordAuthentication getPasswordAuthentication() {
-                return new PasswordAuthentication(SMTP_USER, SMTP_PASSWORD);
-            }
-        });
-        Message msg = new MimeMessage(session);
-        msg.setRecipients(Message.RecipientType.TO, InternetAddress.parse(to));
-        msg.setSubject(subject);
-        msg.setText(body);
-        Transport.send(msg);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded SMTP password used for email authentication
+
+import java.util.Properties;
+import javax.mail.*;
+import javax.mail.internet.*;
+
+public class EmailNotifier {
+    private static final String SMTP_HOST     = "smtp.company.com";
+    private static final String SMTP_USER     = "notifications@company.com";
+    private static final String SMTP_PASSWORD = "N0tif!c@ti0nP@ss#2024";
+
+    public void sendAlert(String to, String subject, String body) throws MessagingException {
+        Properties props = new Properties();
+        props.put("mail.smtp.auth", "true");
+        props.put("mail.smtp.host", SMTP_HOST);
+        props.put("mail.smtp.port", "587");
+
+        Session session = Session.getInstance(props, new Authenticator() {
+            protected PasswordAuthentication getPasswordAuthentication() {
+                return new PasswordAuthentication(SMTP_USER, SMTP_PASSWORD);
+            }
+        });
+        Message msg = new MimeMessage(session);
+        msg.setRecipients(Message.RecipientType.TO, InternetAddress.parse(to));
+        msg.setSubject(subject);
+        msg.setText(body);
+        Transport.send(msg);
+    }
+}