thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/java/seed-043.java

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via ObjectInputStream reading from Redis cache
-
-import java.io.*;
-import java.util.Base64;
-import redis.clients.jedis.Jedis;
-
-public class CacheService {
-    private final Jedis jedis;
-
-    public CacheService(Jedis jedis) { this.jedis = jedis; }
-
-    public Object get(String key) throws Exception {
-        String raw = jedis.get(key);
-        if (raw == null) return null;
-        byte[] bytes = Base64.getDecoder().decode(raw);
-        // Vulnerable: deserializes data from Redis without class allowlist
-        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
-            return ois.readObject();
-        }
-    }
-
-    public void put(String key, Serializable value) throws Exception {
-        ByteArrayOutputStream bos = new ByteArrayOutputStream();
-        new ObjectOutputStream(bos).writeObject(value);
-        jedis.set(key, Base64.getEncoder().encodeToString(bos.toByteArray()));
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via ObjectInputStream reading from Redis cache
+
+import java.io.*;
+import java.util.Base64;
+import redis.clients.jedis.Jedis;
+
+public class CacheService {
+    private final Jedis jedis;
+
+    public CacheService(Jedis jedis) { this.jedis = jedis; }
+
+    public Object get(String key) throws Exception {
+        String raw = jedis.get(key);
+        if (raw == null) return null;
+        byte[] bytes = Base64.getDecoder().decode(raw);
+        // Vulnerable: deserializes data from Redis without class allowlist
+        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
+            return ois.readObject();
+        }
+    }
+
+    public void put(String key, Serializable value) throws Exception {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        new ObjectOutputStream(bos).writeObject(value);
+        jedis.set(key, Base64.getEncoder().encodeToString(bos.toByteArray()));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-044.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via XMLReader without disabling external entities or DOCTYPE processing
-
-import org.xml.sax.*;
-import org.xml.sax.helpers.XMLReaderFactory;
-import java.io.StringReader;
-import javax.servlet.http.*;
-
-public class XmlImportServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        String xmlBody = new String(req.getInputStream().readAllBytes());
-        // Vulnerable: XMLReader with default settings processes external entities
-        XMLReader reader = XMLReaderFactory.createXMLReader();
-        reader.setContentHandler(new org.xml.sax.helpers.DefaultHandler());
-        reader.parse(new InputSource(new StringReader(xmlBody)));
-        resp.getWriter().println("XML processed");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via XMLReader without disabling external entities or DOCTYPE processing
+
+import org.xml.sax.*;
+import org.xml.sax.helpers.XMLReaderFactory;
+import java.io.StringReader;
+import javax.servlet.http.*;
+
+public class XmlImportServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        String xmlBody = new String(req.getInputStream().readAllBytes());
+        // Vulnerable: XMLReader with default settings processes external entities
+        XMLReader reader = XMLReaderFactory.createXMLReader();
+        reader.setContentHandler(new org.xml.sax.helpers.DefaultHandler());
+        reader.parse(new InputSource(new StringReader(xmlBody)));
+        resp.getWriter().println("XML processed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-045.java

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via DocumentBuilderFactory without disabling external entity expansion
-
-import javax.xml.parsers.*;
-import org.w3c.dom.*;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class DataImportServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: DocumentBuilderFactory default allows XXE
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        DocumentBuilder db = dbf.newDocumentBuilder();
-        Document doc = db.parse(req.getInputStream());
-        NodeList items = doc.getElementsByTagName("item");
-        PrintWriter out = resp.getWriter();
-        for (int i = 0; i < items.getLength(); i++) {
-            out.println("Item: " + items.item(i).getTextContent());
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via DocumentBuilderFactory without disabling external entity expansion
+
+import javax.xml.parsers.*;
+import org.w3c.dom.*;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class DataImportServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: DocumentBuilderFactory default allows XXE
+        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+        DocumentBuilder db = dbf.newDocumentBuilder();
+        Document doc = db.parse(req.getInputStream());
+        NodeList items = doc.getElementsByTagName("item");
+        PrintWriter out = resp.getWriter();
+        for (int i = 0; i < items.getLength(); i++) {
+            out.println("Item: " + items.item(i).getTextContent());
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-046.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via SAXParser without secure processing feature enabled
-
-import javax.xml.parsers.*;
-import org.xml.sax.helpers.DefaultHandler;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FeedParserServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: SAXParserFactory default config allows external entity inclusion
-        SAXParserFactory factory = SAXParserFactory.newInstance();
-        SAXParser parser = factory.newSAXParser();
-        DefaultHandler handler = new DefaultHandler();
-        parser.parse(req.getInputStream(), handler);
-        resp.getWriter().println("Feed parsed");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via SAXParser without secure processing feature enabled
+
+import javax.xml.parsers.*;
+import org.xml.sax.helpers.DefaultHandler;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FeedParserServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: SAXParserFactory default config allows external entity inclusion
+        SAXParserFactory factory = SAXParserFactory.newInstance();
+        SAXParser parser = factory.newSAXParser();
+        DefaultHandler handler = new DefaultHandler();
+        parser.parse(req.getInputStream(), handler);
+        resp.getWriter().println("Feed parsed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-047.java

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via JAXB Unmarshaller processing user-supplied XML without secure settings
-
-import javax.xml.bind.*;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class OrderUnmarshalServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: JAXB uses DocumentBuilderFactory internally; XXE possible by default
-        JAXBContext ctx = JAXBContext.newInstance(Order.class);
-        Unmarshaller um = ctx.createUnmarshaller();
-        Object result = um.unmarshal(req.getInputStream());
-        resp.getWriter().println("Received order: " + result);
-    }
-
-    static class Order {
-        public String id;
-        public String product;
-        public int quantity;
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via JAXB Unmarshaller processing user-supplied XML without secure settings
+
+import javax.xml.bind.*;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class OrderUnmarshalServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: JAXB uses DocumentBuilderFactory internally; XXE possible by default
+        JAXBContext ctx = JAXBContext.newInstance(Order.class);
+        Unmarshaller um = ctx.createUnmarshaller();
+        Object result = um.unmarshal(req.getInputStream());
+        resp.getWriter().println("Received order: " + result);
+    }
+
+    static class Order {
+        public String id;
+        public String product;
+        public int quantity;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-048.java

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via URL.openConnection with user-supplied URL parameter
-
-import java.io.*;
-import java.net.*;
-import javax.servlet.http.*;
-
-public class ProxyServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String targetUrl = req.getParameter("url");
-        // Vulnerable: opens connection to any URL including internal services
-        URL url = new URL(targetUrl);
-        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-        conn.setConnectTimeout(5000);
-        conn.setReadTimeout(5000);
-        InputStream is = conn.getInputStream();
-        resp.setContentType(conn.getContentType());
-        is.transferTo(resp.getOutputStream());
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via URL.openConnection with user-supplied URL parameter
+
+import java.io.*;
+import java.net.*;
+import javax.servlet.http.*;
+
+public class ProxyServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String targetUrl = req.getParameter("url");
+        // Vulnerable: opens connection to any URL including internal services
+        URL url = new URL(targetUrl);
+        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+        conn.setConnectTimeout(5000);
+        conn.setReadTimeout(5000);
+        InputStream is = conn.getInputStream();
+        resp.setContentType(conn.getContentType());
+        is.transferTo(resp.getOutputStream());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-049.java

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via URL.openStream with user-controlled webhook URL
-
-import java.io.*;
-import java.net.*;
-import javax.servlet.http.*;
-
-public class WebhookTesterServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String webhookUrl = req.getParameter("webhook_url");
-        String payload    = req.getParameter("payload");
-        // Vulnerable: attacker can direct the server to POST to internal endpoints
-        URL url = new URL(webhookUrl);
-        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-        conn.setRequestMethod("POST");
-        conn.setDoOutput(true);
-        conn.setRequestProperty("Content-Type", "application/json");
-        try (OutputStream os = conn.getOutputStream()) {
-            os.write(payload.getBytes());
-        }
-        int code = conn.getResponseCode();
-        resp.getWriter().println("Webhook responded: " + code);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via URL.openStream with user-controlled webhook URL
+
+import java.io.*;
+import java.net.*;
+import javax.servlet.http.*;
+
+public class WebhookTesterServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String webhookUrl = req.getParameter("webhook_url");
+        String payload    = req.getParameter("payload");
+        // Vulnerable: attacker can direct the server to POST to internal endpoints
+        URL url = new URL(webhookUrl);
+        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+        conn.setRequestMethod("POST");
+        conn.setDoOutput(true);
+        conn.setRequestProperty("Content-Type", "application/json");
+        try (OutputStream os = conn.getOutputStream()) {
+            os.write(payload.getBytes());
+        }
+        int code = conn.getResponseCode();
+        resp.getWriter().println("Webhook responded: " + code);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-050.java

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via HttpClient built from user-supplied base URL for metadata fetch
-
-import java.net.*;
-import java.net.http.*;
-import java.time.Duration;
-import javax.servlet.http.*;
-import java.io.*;
-
-public class MetadataFetcherServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, InterruptedException {
-        String endpoint = req.getParameter("endpoint");
-        // Vulnerable: endpoint could be http://169.254.169.254/latest/meta-data/
-        HttpClient client = HttpClient.newBuilder()
-            .connectTimeout(Duration.ofSeconds(3))
-            .build();
-        HttpRequest httpReq = HttpRequest.newBuilder()
-            .uri(URI.create(endpoint))
-            .GET()
-            .build();
-        HttpResponse<String> response = client.send(httpReq, HttpResponse.BodyHandlers.ofString());
-        resp.setContentType("text/plain");
-        resp.getWriter().write(response.body());
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via HttpClient built from user-supplied base URL for metadata fetch
+
+import java.net.*;
+import java.net.http.*;
+import java.time.Duration;
+import javax.servlet.http.*;
+import java.io.*;
+
+public class MetadataFetcherServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, InterruptedException {
+        String endpoint = req.getParameter("endpoint");
+        // Vulnerable: endpoint could be http://169.254.169.254/latest/meta-data/
+        HttpClient client = HttpClient.newBuilder()
+            .connectTimeout(Duration.ofSeconds(3))
+            .build();
+        HttpRequest httpReq = HttpRequest.newBuilder()
+            .uri(URI.create(endpoint))
+            .GET()
+            .build();
+        HttpResponse<String> response = client.send(httpReq, HttpResponse.BodyHandlers.ofString());
+        resp.setContentType("text/plain");
+        resp.getWriter().write(response.body());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-051.java

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: log_injection
-// severity: medium
-// language: java
-// expected: Log injection via logger.info with unvalidated user input enabling log forging
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.servlet.http.*;
-import java.io.IOException;
-
-public class LoginAuditServlet extends HttpServlet {
-    private static final Logger logger = LoggerFactory.getLogger(LoginAuditServlet.class);
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String username = req.getParameter("username");
-        String ip       = req.getHeader("X-Forwarded-For");
-        // Vulnerable: attacker-controlled input logged without sanitization
-        // e.g. username = "admin\nINFO: Successful login for admin"
-        logger.info("Login attempt for user: " + username + " from IP: " + ip);
-        // ... authentication logic
-        resp.getWriter().println("Login processed");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: log_injection
+// severity: medium
+// language: java
+// expected: Log injection via logger.info with unvalidated user input enabling log forging
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.servlet.http.*;
+import java.io.IOException;
+
+public class LoginAuditServlet extends HttpServlet {
+    private static final Logger logger = LoggerFactory.getLogger(LoginAuditServlet.class);
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String username = req.getParameter("username");
+        String ip       = req.getHeader("X-Forwarded-For");
+        // Vulnerable: attacker-controlled input logged without sanitization
+        // e.g. username = "admin\nINFO: Successful login for admin"
+        logger.info("Login attempt for user: " + username + " from IP: " + ip);
+        // ... authentication logic
+        resp.getWriter().println("Login processed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-052.java

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: log_injection
-// severity: medium
-// language: java
-// expected: Log injection via logger.error with exception message containing user input
-
-import org.apache.log4j.Logger;
-import javax.servlet.http.*;
-import java.io.IOException;
-
-public class ApiGatewayServlet extends HttpServlet {
-    private static final Logger log = Logger.getLogger(ApiGatewayServlet.class);
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String apiKey  = req.getParameter("api_key");
-        String method  = req.getParameter("method");
-        // Vulnerable: method and apiKey injected into log entries without stripping CR/LF
-        log.warn("API call - method: " + method + ", key: " + apiKey);
-        try {
-            dispatch(method, apiKey);
-        } catch (Exception e) {
-            // Vulnerable: exception message may contain user input
-            log.error("Dispatch failed for method: " + method + " - " + e.getMessage());
-            resp.sendError(500);
-        }
-    }
-
-    private void dispatch(String method, String key) throws Exception {
-        if (method == null) throw new Exception("Unknown method: " + method);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: log_injection
+// severity: medium
+// language: java
+// expected: Log injection via logger.error with exception message containing user input
+
+import org.apache.log4j.Logger;
+import javax.servlet.http.*;
+import java.io.IOException;
+
+public class ApiGatewayServlet extends HttpServlet {
+    private static final Logger log = Logger.getLogger(ApiGatewayServlet.class);
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String apiKey  = req.getParameter("api_key");
+        String method  = req.getParameter("method");
+        // Vulnerable: method and apiKey injected into log entries without stripping CR/LF
+        log.warn("API call - method: " + method + ", key: " + apiKey);
+        try {
+            dispatch(method, apiKey);
+        } catch (Exception e) {
+            // Vulnerable: exception message may contain user input
+            log.error("Dispatch failed for method: " + method + " - " + e.getMessage());
+            resp.sendError(500);
+        }
+    }
+
+    private void dispatch(String method, String key) throws Exception {
+        if (method == null) throw new Exception("Unknown method: " + method);
+    }
+}

package/dist/packages/crucible/seeds/js/seed-001.js

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded API key AWS_SECRET_ACCESS_KEY
-
-const AWS = require('aws-sdk');
-
-// Production credentials - do not commit!
-const credentials = {
-  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
-  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  region: 'us-east-1'
-};
-
-AWS.config.update(credentials);
-const s3 = new AWS.S3();
-
-function uploadFile(buffer, key) {
-  return s3.putObject({
-    Bucket: 'my-production-bucket',
-    Key: key,
-    Body: buffer,
-  }).promise();
-}
-
-module.exports = { s3, uploadFile };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded API key AWS_SECRET_ACCESS_KEY
+
+const AWS = require('aws-sdk');
+
+// Production credentials - do not commit!
+const credentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1'
+};
+
+AWS.config.update(credentials);
+const s3 = new AWS.S3();
+
+function uploadFile(buffer, key) {
+  return s3.putObject({
+    Bucket: 'my-production-bucket',
+    Key: key,
+    Body: buffer,
+  }).promise();
+}
+
+module.exports = { s3, uploadFile };

package/dist/packages/crucible/seeds/js/seed-002.js

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded database password in connection string
-
-const { Pool } = require('pg');
-
-const pool = new Pool({
-  host: 'prod-db.internal.company.com',
-  port: 5432,
-  database: 'users_production',
-  user: 'db_admin',
-  password: 'Sup3rS3cr3tPa$$w0rd!',
-  ssl: { rejectUnauthorized: false },
-});
-
-async function getUser(id) {
-  const result = await pool.query('SELECT * FROM users WHERE id = $1', [id]);
-  return result.rows[0];
-}
-
-async function listUsers() {
-  const result = await pool.query('SELECT id, email, created_at FROM users');
-  return result.rows;
-}
-
-module.exports = { pool, getUser, listUsers };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded database password in connection string
+
+const { Pool } = require('pg');
+
+const pool = new Pool({
+  host: 'prod-db.internal.company.com',
+  port: 5432,
+  database: 'users_production',
+  user: 'db_admin',
+  password: 'Sup3rS3cr3tPa$$w0rd!',
+  ssl: { rejectUnauthorized: false },
+});
+
+async function getUser(id) {
+  const result = await pool.query('SELECT * FROM users WHERE id = $1', [id]);
+  return result.rows[0];
+}
+
+async function listUsers() {
+  const result = await pool.query('SELECT id, email, created_at FROM users');
+  return result.rows;
+}
+
+module.exports = { pool, getUser, listUsers };