thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/java/seed-031.java

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via Paths.get with user input enabling directory escape
-
-import java.io.*;
-import java.nio.file.*;
-import javax.servlet.http.*;
-
-public class TemplateServlet extends HttpServlet {
-    private static final Path TEMPLATE_DIR = Paths.get("/opt/app/templates");
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String templateName = req.getParameter("template");
-        // Vulnerable: resolve without startsWith check allows traversal
-        Path templatePath = TEMPLATE_DIR.resolve(templateName);
-        byte[] content = Files.readAllBytes(templatePath);
-        resp.setContentType("text/html");
-        resp.getOutputStream().write(content);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via Paths.get with user input enabling directory escape
+
+import java.io.*;
+import java.nio.file.*;
+import javax.servlet.http.*;
+
+public class TemplateServlet extends HttpServlet {
+    private static final Path TEMPLATE_DIR = Paths.get("/opt/app/templates");
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String templateName = req.getParameter("template");
+        // Vulnerable: resolve without startsWith check allows traversal
+        Path templatePath = TEMPLATE_DIR.resolve(templateName);
+        byte[] content = Files.readAllBytes(templatePath);
+        resp.setContentType("text/html");
+        resp.getOutputStream().write(content);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-032.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal in file delete endpoint with user-controlled filename
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileManagerServlet extends HttpServlet {
-    private static final String UPLOAD_DIR = "/var/uploads/";
-
-    protected void doDelete(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("name");
-        // Vulnerable: attacker can delete arbitrary files via ../
-        File target = new File(UPLOAD_DIR + filename);
-        boolean deleted = target.delete();
-        resp.setContentType("application/json");
-        resp.getWriter().println("{\"deleted\":" + deleted + "}");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal in file delete endpoint with user-controlled filename
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileManagerServlet extends HttpServlet {
+    private static final String UPLOAD_DIR = "/var/uploads/";
+
+    protected void doDelete(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("name");
+        // Vulnerable: attacker can delete arbitrary files via ../
+        File target = new File(UPLOAD_DIR + filename);
+        boolean deleted = target.delete();
+        resp.setContentType("application/json");
+        resp.getWriter().println("{\"deleted\":" + deleted + "}");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-033.java

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via file write using user-supplied output path
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ReportWriterServlet extends HttpServlet {
-    private static final String REPORT_BASE = "/var/reports/";
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String reportName = req.getParameter("reportName");
-        String content    = req.getParameter("content");
-        // Vulnerable: reportName can traverse directories (../../etc/cron.d/backdoor)
-        File out = new File(REPORT_BASE + reportName + ".txt");
-        try (FileWriter fw = new FileWriter(out)) {
-            fw.write(content);
-        }
-        resp.getWriter().println("Report saved.");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via file write using user-supplied output path
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ReportWriterServlet extends HttpServlet {
+    private static final String REPORT_BASE = "/var/reports/";
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String reportName = req.getParameter("reportName");
+        String content    = req.getParameter("content");
+        // Vulnerable: reportName can traverse directories (../../etc/cron.d/backdoor)
+        File out = new File(REPORT_BASE + reportName + ".txt");
+        try (FileWriter fw = new FileWriter(out)) {
+            fw.write(content);
+        }
+        resp.getWriter().println("Report saved.");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-034.java

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: MD5 used for password hashing via MessageDigest
-
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-
-public class PasswordHasher {
-    public static String hashPassword(String password) throws NoSuchAlgorithmException {
-        // Vulnerable: MD5 is cryptographically broken and unsalted
-        MessageDigest md = MessageDigest.getInstance("MD5");
-        byte[] hash = md.digest(password.getBytes());
-        StringBuilder sb = new StringBuilder();
-        for (byte b : hash) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-
-    public static boolean verifyPassword(String password, String storedHash)
-            throws NoSuchAlgorithmException {
-        return hashPassword(password).equals(storedHash);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: MD5 used for password hashing via MessageDigest
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class PasswordHasher {
+    public static String hashPassword(String password) throws NoSuchAlgorithmException {
+        // Vulnerable: MD5 is cryptographically broken and unsalted
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] hash = md.digest(password.getBytes());
+        StringBuilder sb = new StringBuilder();
+        for (byte b : hash) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+
+    public static boolean verifyPassword(String password, String storedHash)
+            throws NoSuchAlgorithmException {
+        return hashPassword(password).equals(storedHash);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-035.java

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: java
-// expected: DES cipher used for data encryption (56-bit key, broken algorithm)
-
-import javax.crypto.*;
-import javax.crypto.spec.SecretKeySpec;
-import java.util.Base64;
-
-public class DataEncryptor {
-    // Vulnerable: DES uses only 56-bit key, broken since 1999
-    private static final String ALGORITHM = "DES";
-    private static final byte[] KEY_BYTES = "8byteKey".getBytes();
-
-    public static String encrypt(String plaintext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
-        Cipher cipher = Cipher.getInstance(ALGORITHM);
-        cipher.init(Cipher.ENCRYPT_MODE, key);
-        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
-    }
-
-    public static String decrypt(String ciphertext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
-        Cipher cipher = Cipher.getInstance(ALGORITHM);
-        cipher.init(Cipher.DECRYPT_MODE, key);
-        return new String(cipher.doFinal(Base64.getDecoder().decode(ciphertext)));
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: java
+// expected: DES cipher used for data encryption (56-bit key, broken algorithm)
+
+import javax.crypto.*;
+import javax.crypto.spec.SecretKeySpec;
+import java.util.Base64;
+
+public class DataEncryptor {
+    // Vulnerable: DES uses only 56-bit key, broken since 1999
+    private static final String ALGORITHM = "DES";
+    private static final byte[] KEY_BYTES = "8byteKey".getBytes();
+
+    public static String encrypt(String plaintext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
+        Cipher cipher = Cipher.getInstance(ALGORITHM);
+        cipher.init(Cipher.ENCRYPT_MODE, key);
+        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
+    }
+
+    public static String decrypt(String ciphertext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
+        Cipher cipher = Cipher.getInstance(ALGORITHM);
+        cipher.init(Cipher.DECRYPT_MODE, key);
+        return new String(cipher.doFinal(Base64.getDecoder().decode(ciphertext)));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-036.java

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: java.util.Random used for security token generation instead of SecureRandom
-
-import java.util.Random;
-
-public class TokenGenerator {
-    // Vulnerable: java.util.Random is not cryptographically secure
-    private static final Random RANDOM = new Random();
-    private static final String CHARS  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-
-    public static String generateSessionToken(int length) {
-        StringBuilder sb = new StringBuilder(length);
-        for (int i = 0; i < length; i++) {
-            sb.append(CHARS.charAt(RANDOM.nextInt(CHARS.length())));
-        }
-        return sb.toString();
-    }
-
-    public static String generatePasswordResetToken() {
-        return generateSessionToken(32);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: java.util.Random used for security token generation instead of SecureRandom
+
+import java.util.Random;
+
+public class TokenGenerator {
+    // Vulnerable: java.util.Random is not cryptographically secure
+    private static final Random RANDOM = new Random();
+    private static final String CHARS  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+
+    public static String generateSessionToken(int length) {
+        StringBuilder sb = new StringBuilder(length);
+        for (int i = 0; i < length; i++) {
+            sb.append(CHARS.charAt(RANDOM.nextInt(CHARS.length())));
+        }
+        return sb.toString();
+    }
+
+    public static String generatePasswordResetToken() {
+        return generateSessionToken(32);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-037.java

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: SHA-1 used for HMAC signature and MD5 for file integrity check
-
-import java.security.MessageDigest;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
-
-public class IntegrityChecker {
-    public static String computeHmac(String data, String key) throws Exception {
-        // Vulnerable: HMAC-SHA1 is weak for new applications
-        Mac mac = Mac.getInstance("HmacSHA1");
-        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA1"));
-        byte[] raw = mac.doFinal(data.getBytes());
-        StringBuilder sb = new StringBuilder();
-        for (byte b : raw) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-
-    public static String md5File(byte[] fileBytes) throws Exception {
-        // Vulnerable: MD5 used for file integrity — collision attacks possible
-        MessageDigest md = MessageDigest.getInstance("MD5");
-        byte[] hash = md.digest(fileBytes);
-        StringBuilder sb = new StringBuilder();
-        for (byte b : hash) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: SHA-1 used for HMAC signature and MD5 for file integrity check
+
+import java.security.MessageDigest;
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+public class IntegrityChecker {
+    public static String computeHmac(String data, String key) throws Exception {
+        // Vulnerable: HMAC-SHA1 is weak for new applications
+        Mac mac = Mac.getInstance("HmacSHA1");
+        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA1"));
+        byte[] raw = mac.doFinal(data.getBytes());
+        StringBuilder sb = new StringBuilder();
+        for (byte b : raw) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+
+    public static String md5File(byte[] fileBytes) throws Exception {
+        // Vulnerable: MD5 used for file integrity — collision attacks possible
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] hash = md.digest(fileBytes);
+        StringBuilder sb = new StringBuilder();
+        for (byte b : hash) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-038.java

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: AES-ECB mode used for encryption (ECB leaks patterns, no IV)
-
-import javax.crypto.*;
-import javax.crypto.spec.SecretKeySpec;
-import java.util.Base64;
-
-public class AesEcbEncryptor {
-    // Vulnerable: AES/ECB/PKCS5Padding does not use an IV and leaks data patterns
-    private static final String CIPHER_SPEC = "AES/ECB/PKCS5Padding";
-    private static final String SECRET_KEY  = "1234567890abcdef"; // 16 bytes
-
-    public static String encrypt(String plaintext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
-        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
-        cipher.init(Cipher.ENCRYPT_MODE, key);
-        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
-    }
-
-    public static String decrypt(String ct) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
-        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
-        cipher.init(Cipher.DECRYPT_MODE, key);
-        return new String(cipher.doFinal(Base64.getDecoder().decode(ct)));
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: AES-ECB mode used for encryption (ECB leaks patterns, no IV)
+
+import javax.crypto.*;
+import javax.crypto.spec.SecretKeySpec;
+import java.util.Base64;
+
+public class AesEcbEncryptor {
+    // Vulnerable: AES/ECB/PKCS5Padding does not use an IV and leaks data patterns
+    private static final String CIPHER_SPEC = "AES/ECB/PKCS5Padding";
+    private static final String SECRET_KEY  = "1234567890abcdef"; // 16 bytes
+
+    public static String encrypt(String plaintext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
+        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
+        cipher.init(Cipher.ENCRYPT_MODE, key);
+        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
+    }
+
+    public static String decrypt(String ct) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
+        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
+        cipher.init(Cipher.DECRYPT_MODE, key);
+        return new String(cipher.doFinal(Base64.getDecoder().decode(ct)));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-039.java

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via ObjectInputStream.readObject on untrusted data
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class SessionRestoreServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: deserializes raw bytes from request body — no type checking
-        InputStream body = req.getInputStream();
-        ObjectInputStream ois = new ObjectInputStream(body);
-        Object sessionData;
-        try {
-            sessionData = ois.readObject();
-        } catch (ClassNotFoundException e) {
-            resp.sendError(400, "Unknown class");
-            return;
-        }
-        req.getSession().setAttribute("data", sessionData);
-        resp.getWriter().println("Session restored");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via ObjectInputStream.readObject on untrusted data
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class SessionRestoreServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: deserializes raw bytes from request body — no type checking
+        InputStream body = req.getInputStream();
+        ObjectInputStream ois = new ObjectInputStream(body);
+        Object sessionData;
+        try {
+            sessionData = ois.readObject();
+        } catch (ClassNotFoundException e) {
+            resp.sendError(400, "Unknown class");
+            return;
+        }
+        req.getSession().setAttribute("data", sessionData);
+        resp.getWriter().println("Session restored");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-040.java

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization of Base64-decoded cookie value via ObjectInputStream
-
-import java.io.*;
-import java.util.Base64;
-import javax.servlet.http.*;
-
-public class RememberMeServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        Cookie[] cookies = req.getCookies();
-        for (Cookie c : cookies) {
-            if ("rememberMe".equals(c.getName())) {
-                byte[] data = Base64.getDecoder().decode(c.getValue());
-                // Vulnerable: deserializes attacker-controlled cookie bytes
-                try (ObjectInputStream ois = new ObjectInputStream(
-                        new ByteArrayInputStream(data))) {
-                    Object principal = ois.readObject();
-                    req.getSession().setAttribute("user", principal);
-                } catch (ClassNotFoundException e) {
-                    resp.sendError(400);
-                }
-                break;
-            }
-        }
-        resp.sendRedirect("/dashboard");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization of Base64-decoded cookie value via ObjectInputStream
+
+import java.io.*;
+import java.util.Base64;
+import javax.servlet.http.*;
+
+public class RememberMeServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        Cookie[] cookies = req.getCookies();
+        for (Cookie c : cookies) {
+            if ("rememberMe".equals(c.getName())) {
+                byte[] data = Base64.getDecoder().decode(c.getValue());
+                // Vulnerable: deserializes attacker-controlled cookie bytes
+                try (ObjectInputStream ois = new ObjectInputStream(
+                        new ByteArrayInputStream(data))) {
+                    Object principal = ois.readObject();
+                    req.getSession().setAttribute("user", principal);
+                } catch (ClassNotFoundException e) {
+                    resp.sendError(400);
+                }
+                break;
+            }
+        }
+        resp.sendRedirect("/dashboard");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-041.java

@@ -1,20 +1,20 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via XMLDecoder on user-supplied XML
-
-import java.beans.XMLDecoder;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class XmlConfigServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: XMLDecoder can execute arbitrary Java code via crafted XML
-        XMLDecoder decoder = new XMLDecoder(req.getInputStream());
-        Object config = decoder.readObject();
-        decoder.close();
-        resp.getWriter().println("Loaded config: " + config.getClass().getName());
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via XMLDecoder on user-supplied XML
+
+import java.beans.XMLDecoder;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class XmlConfigServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: XMLDecoder can execute arbitrary Java code via crafted XML
+        XMLDecoder decoder = new XMLDecoder(req.getInputStream());
+        Object config = decoder.readObject();
+        decoder.close();
+        resp.getWriter().println("Loaded config: " + config.getClass().getName());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-042.java

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization in JMS message listener via ObjectMessage
-
-import javax.jms.*;
-
-public class OrderMessageListener implements MessageListener {
-    @Override
-    public void onMessage(Message message) {
-        try {
-            if (message instanceof ObjectMessage) {
-                // Vulnerable: ObjectMessage.getObject() deserializes untrusted JMS payload
-                Object payload = ((ObjectMessage) message).getObject();
-                processOrder(payload);
-            }
-        } catch (JMSException e) {
-            e.printStackTrace();
-        }
-    }
-
-    private void processOrder(Object order) {
-        System.out.println("Processing: " + order);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization in JMS message listener via ObjectMessage
+
+import javax.jms.*;
+
+public class OrderMessageListener implements MessageListener {
+    @Override
+    public void onMessage(Message message) {
+        try {
+            if (message instanceof ObjectMessage) {
+                // Vulnerable: ObjectMessage.getObject() deserializes untrusted JMS payload
+                Object payload = ((ObjectMessage) message).getObject();
+                processOrder(payload);
+            }
+        } catch (JMSException e) {
+            e.printStackTrace();
+        }
+    }
+
+    private void processOrder(Object order) {
+        System.out.println("Processing: " + order);
+    }
+}