thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/js/seed-013.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: javascript
-// expected: SQL injection via string format in stored procedure call
-
-const mssql = require('mssql');
-
-const config = {
-  server: process.env.DB_HOST,
-  database: process.env.DB_NAME,
-  authentication: { type: 'default', options: { userName: process.env.DB_USER, password: process.env.DB_PASS } },
-};
-
-async function findEmployee(lastName, department) {
-  const pool = await mssql.connect(config);
-  // Vulnerable: lastName and department inserted directly
-  const query = `EXEC sp_GetEmployee @LastName='${lastName}', @Department='${department}'`;
-  const result = await pool.request().query(query);
-  return result.recordset;
-}
-
-async function updateSalary(employeeId, amount) {
-  const pool = await mssql.connect(config);
-  const sql = "UPDATE employees SET salary = " + amount + " WHERE id = " + employeeId;
-  await pool.request().query(sql);
-}
-
-module.exports = { findEmployee, updateSalary };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: javascript
+// expected: SQL injection via string format in stored procedure call
+
+const mssql = require('mssql');
+
+const config = {
+  server: process.env.DB_HOST,
+  database: process.env.DB_NAME,
+  authentication: { type: 'default', options: { userName: process.env.DB_USER, password: process.env.DB_PASS } },
+};
+
+async function findEmployee(lastName, department) {
+  const pool = await mssql.connect(config);
+  // Vulnerable: lastName and department inserted directly
+  const query = `EXEC sp_GetEmployee @LastName='${lastName}', @Department='${department}'`;
+  const result = await pool.request().query(query);
+  return result.recordset;
+}
+
+async function updateSalary(employeeId, amount) {
+  const pool = await mssql.connect(config);
+  const sql = "UPDATE employees SET salary = " + amount + " WHERE id = " + employeeId;
+  await pool.request().query(sql);
+}
+
+module.exports = { findEmployee, updateSalary };

package/dist/packages/crucible/seeds/js/seed-014.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via Sequelize literal() with user input
-
-const { sequelize, User } = require('../models');
-const { QueryTypes } = require('sequelize');
-
-async function searchUsers(searchTerm) {
-  // Using literal() bypasses parameterization
-  const results = await sequelize.query(
-    `SELECT * FROM "Users" WHERE name ILIKE '%${searchTerm}%' OR email ILIKE '%${searchTerm}%'`,
-    { type: QueryTypes.SELECT }
-  );
-  return results;
-}
-
-async function getUsersByRole(role, tenantId) {
-  const sql = `
-    SELECT u.*, r.name as role_name
-    FROM "Users" u
-    JOIN "Roles" r ON u.role_id = r.id
-    WHERE r.name = '` + role + `'
-    AND u.tenant_id = ` + tenantId;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-module.exports = { searchUsers, getUsersByRole };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via Sequelize literal() with user input
+
+const { sequelize, User } = require('../models');
+const { QueryTypes } = require('sequelize');
+
+async function searchUsers(searchTerm) {
+  // Using literal() bypasses parameterization
+  const results = await sequelize.query(
+    `SELECT * FROM "Users" WHERE name ILIKE '%${searchTerm}%' OR email ILIKE '%${searchTerm}%'`,
+    { type: QueryTypes.SELECT }
+  );
+  return results;
+}
+
+async function getUsersByRole(role, tenantId) {
+  const sql = `
+    SELECT u.*, r.name as role_name
+    FROM "Users" u
+    JOIN "Roles" r ON u.role_id = r.id
+    WHERE r.name = '` + role + `'
+    AND u.tenant_id = ` + tenantId;
+  return sequelize.query(sql, { type: QueryTypes.SELECT });
+}
+
+module.exports = { searchUsers, getUsersByRole };

package/dist/packages/crucible/seeds/js/seed-015.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via bulk IN clause construction with user-supplied IDs
-
-const { Pool } = require('pg');
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-async function getItemsByIds(ids) {
-  // ids is a user-supplied array — never sanitized
-  const idList = ids.join(',');
-  const query = `SELECT * FROM items WHERE id IN (${idList})`;
-  const { rows } = await pool.query(query);
-  return rows;
-}
-
-async function archiveItems(itemIds, archiveReason) {
-  const idList = itemIds.join(', ');
-  const sql = `UPDATE items SET archived = true, archive_reason = '${archiveReason}' WHERE id IN (${idList})`;
-  await pool.query(sql);
-}
-
-async function getProductStats(category, fromDate) {
-  const query = "SELECT COUNT(*), AVG(price) FROM products WHERE category='" +
-    category + "' AND created_at > '" + fromDate + "'";
-  const { rows } = await pool.query(query);
-  return rows[0];
-}
-
-module.exports = { getItemsByIds, archiveItems, getProductStats };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via bulk IN clause construction with user-supplied IDs
+
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+async function getItemsByIds(ids) {
+  // ids is a user-supplied array — never sanitized
+  const idList = ids.join(',');
+  const query = `SELECT * FROM items WHERE id IN (${idList})`;
+  const { rows } = await pool.query(query);
+  return rows;
+}
+
+async function archiveItems(itemIds, archiveReason) {
+  const idList = itemIds.join(', ');
+  const sql = `UPDATE items SET archived = true, archive_reason = '${archiveReason}' WHERE id IN (${idList})`;
+  await pool.query(sql);
+}
+
+async function getProductStats(category, fromDate) {
+  const query = "SELECT COUNT(*), AVG(price) FROM products WHERE category='" +
+    category + "' AND created_at > '" + fromDate + "'";
+  const { rows } = await pool.query(query);
+  return rows[0];
+}
+
+module.exports = { getItemsByIds, archiveItems, getProductStats };

package/dist/packages/crucible/seeds/js/seed-016.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via innerHTML assignment with unsanitized user input
-
-function renderUserProfile(userData) {
-  const container = document.getElementById('profile-container');
-  // Direct assignment of user-controlled data to innerHTML
-  container.innerHTML = `
-    <div class="profile">
-      <h2>${userData.displayName}</h2>
-      <p class="bio">${userData.bio}</p>
-      <a href="${userData.website}">Visit Website</a>
-    </div>
-  `;
-}
-
-function showSearchResults(query, results) {
-  const resultsDiv = document.getElementById('results');
-  resultsDiv.innerHTML = `<p>Results for: <b>${query}</b></p>`;
-  results.forEach(item => {
-    resultsDiv.innerHTML += `<div class="item"><h3>${item.title}</h3><p>${item.description}</p></div>`;
-  });
-}
-
-function displayNotification(message) {
-  document.getElementById('notification').innerHTML = message;
-}
-
-module.exports = { renderUserProfile, showSearchResults, displayNotification };
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via innerHTML assignment with unsanitized user input
+
+function renderUserProfile(userData) {
+  const container = document.getElementById('profile-container');
+  // Direct assignment of user-controlled data to innerHTML
+  container.innerHTML = `
+    <div class="profile">
+      <h2>${userData.displayName}</h2>
+      <p class="bio">${userData.bio}</p>
+      <a href="${userData.website}">Visit Website</a>
+    </div>
+  `;
+}
+
+function showSearchResults(query, results) {
+  const resultsDiv = document.getElementById('results');
+  resultsDiv.innerHTML = `<p>Results for: <b>${query}</b></p>`;
+  results.forEach(item => {
+    resultsDiv.innerHTML += `<div class="item"><h3>${item.title}</h3><p>${item.description}</p></div>`;
+  });
+}
+
+function displayNotification(message) {
+  document.getElementById('notification').innerHTML = message;
+}
+
+module.exports = { renderUserProfile, showSearchResults, displayNotification };

package/dist/packages/crucible/seeds/js/seed-017.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: critical
-// language: javascript
-// expected: XSS via document.write with URL parameter
-
-function loadPage() {
-  const params = new URLSearchParams(window.location.search);
-  const name = params.get('name');
-  const ref = params.get('ref');
-
-  // Writes unescaped URL params directly into the document
-  document.write('<h1>Hello, ' + name + '!</h1>');
-  document.write('<p>You came from: ' + ref + '</p>');
-}
-
-function renderError(errorMsg) {
-  // errorMsg may come from server reflecting user input
-  document.write(`<div class="error">${errorMsg}</div>`);
-}
-
-function initPage() {
-  const hash = decodeURIComponent(window.location.hash.substring(1));
-  document.getElementById('content').innerHTML = hash;
-}
-
-window.addEventListener('DOMContentLoaded', () => {
-  loadPage();
-  initPage();
-});
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: critical
+// language: javascript
+// expected: XSS via document.write with URL parameter
+
+function loadPage() {
+  const params = new URLSearchParams(window.location.search);
+  const name = params.get('name');
+  const ref = params.get('ref');
+
+  // Writes unescaped URL params directly into the document
+  document.write('<h1>Hello, ' + name + '!</h1>');
+  document.write('<p>You came from: ' + ref + '</p>');
+}
+
+function renderError(errorMsg) {
+  // errorMsg may come from server reflecting user input
+  document.write(`<div class="error">${errorMsg}</div>`);
+}
+
+function initPage() {
+  const hash = decodeURIComponent(window.location.hash.substring(1));
+  document.getElementById('content').innerHTML = hash;
+}
+
+window.addEventListener('DOMContentLoaded', () => {
+  loadPage();
+  initPage();
+});

package/dist/packages/crucible/seeds/js/seed-018.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via jQuery .html() with user-controlled data
-
-const $ = require('jquery');
-
-function renderComments(comments) {
-  const container = $('#comments-section');
-  container.empty();
-  comments.forEach(comment => {
-    // .html() interprets the string as HTML — XSS if comment.body contains script tags
-    container.append($('<div>').html(comment.body));
-    container.append($('<small>').html('— ' + comment.authorName));
-  });
-}
-
-function updateUserCard(user) {
-  $('#user-name').html(user.name);
-  $('#user-title').html(user.jobTitle);
-  $('#user-about').html(user.aboutMe);
-}
-
-function showToast(message) {
-  $('#toast').html(message).fadeIn().delay(3000).fadeOut();
-}
-
-module.exports = { renderComments, updateUserCard, showToast };
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via jQuery .html() with user-controlled data
+
+const $ = require('jquery');
+
+function renderComments(comments) {
+  const container = $('#comments-section');
+  container.empty();
+  comments.forEach(comment => {
+    // .html() interprets the string as HTML — XSS if comment.body contains script tags
+    container.append($('<div>').html(comment.body));
+    container.append($('<small>').html('— ' + comment.authorName));
+  });
+}
+
+function updateUserCard(user) {
+  $('#user-name').html(user.name);
+  $('#user-title').html(user.jobTitle);
+  $('#user-about').html(user.aboutMe);
+}
+
+function showToast(message) {
+  $('#toast').html(message).fadeIn().delay(3000).fadeOut();
+}
+
+module.exports = { renderComments, updateUserCard, showToast };

package/dist/packages/crucible/seeds/js/seed-019.js

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via server-side template rendering with unsanitized variable
-
-const express = require('express');
-const router = express.Router();
-
-router.get('/search', (req, res) => {
-  const query = req.query.q || '';
-  // Directly embedding user input into HTML response without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html>
-      <head><title>Search</title></head>
-      <body>
-        <h1>Search Results</h1>
-        <p>Showing results for: <b>${query}</b></p>
-        <div id="results"></div>
-        <script>
-          const searchTerm = "${query}";
-          fetch('/api/search?q=' + searchTerm)
-            .then(r => r.json())
-            .then(data => document.getElementById('results').innerHTML = data.html);
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via server-side template rendering with unsanitized variable
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/search', (req, res) => {
+  const query = req.query.q || '';
+  // Directly embedding user input into HTML response without encoding
+  res.send(`
+    <!DOCTYPE html>
+    <html>
+      <head><title>Search</title></head>
+      <body>
+        <h1>Search Results</h1>
+        <p>Showing results for: <b>${query}</b></p>
+        <div id="results"></div>
+        <script>
+          const searchTerm = "${query}";
+          fetch('/api/search?q=' + searchTerm)
+            .then(r => r.json())
+            .then(data => document.getElementById('results').innerHTML = data.html);
+        </script>
+      </body>
+    </html>
+  `);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-020.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: javascript
-// expected: XSS via eval of user-controlled JSON embedded in script tag
-
-const express = require('express');
-const router = express.Router();
-
-router.get('/dashboard', (req, res) => {
-  const userConfig = req.query.config || '{}';
-  const userName = req.query.name || 'Guest';
-
-  // userConfig is injected directly into a script block
-  res.send(`
-    <html>
-      <body>
-        <h1>Welcome, ${userName}</h1>
-        <script>
-          var config = ${userConfig};
-          var username = "${userName}";
-          initDashboard(config, username);
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: javascript
+// expected: XSS via eval of user-controlled JSON embedded in script tag
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/dashboard', (req, res) => {
+  const userConfig = req.query.config || '{}';
+  const userName = req.query.name || 'Guest';
+
+  // userConfig is injected directly into a script block
+  res.send(`
+    <html>
+      <body>
+        <h1>Welcome, ${userName}</h1>
+        <script>
+          var config = ${userConfig};
+          var username = "${userName}";
+          initDashboard(config, username);
+        </script>
+      </body>
+    </html>
+  `);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-021.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via postMessage handler writing to DOM without validation
-
-window.addEventListener('message', (event) => {
-  // Missing origin check and no sanitization
-  const data = event.data;
-
-  if (data.type === 'updateContent') {
-    document.getElementById('dynamic-content').innerHTML = data.html;
-  }
-
-  if (data.type === 'showAlert') {
-    document.getElementById('alert-box').innerHTML = `
-      <div class="alert alert-${data.level}">${data.message}</div>
-    `;
-  }
-
-  if (data.type === 'renderTemplate') {
-    const container = document.querySelector(data.selector);
-    if (container) {
-      container.outerHTML = data.template;
-    }
-  }
-});
-
-function sendResponse(targetWindow, payload) {
-  targetWindow.postMessage(payload, '*'); // Wildcard origin
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via postMessage handler writing to DOM without validation
+
+window.addEventListener('message', (event) => {
+  // Missing origin check and no sanitization
+  const data = event.data;
+
+  if (data.type === 'updateContent') {
+    document.getElementById('dynamic-content').innerHTML = data.html;
+  }
+
+  if (data.type === 'showAlert') {
+    document.getElementById('alert-box').innerHTML = `
+      <div class="alert alert-${data.level}">${data.message}</div>
+    `;
+  }
+
+  if (data.type === 'renderTemplate') {
+    const container = document.querySelector(data.selector);
+    if (container) {
+      container.outerHTML = data.template;
+    }
+  }
+});
+
+function sendResponse(targetWindow, payload) {
+  targetWindow.postMessage(payload, '*'); // Wildcard origin
+}

package/dist/packages/crucible/seeds/js/seed-022.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via Handlebars triple-stache {{{ }}} unescaped output
-
-const Handlebars = require('handlebars');
-const express = require('express');
-const router = express.Router();
-
-const profileTemplate = Handlebars.compile(`
-  <div class="user-profile">
-    <h2>{{{user.displayName}}}</h2>
-    <div class="bio">{{{user.bio}}}</div>
-    <div class="links">{{{user.socialLinks}}}</div>
-  </div>
-`);
-
-const commentTemplate = Handlebars.compile(`
-  <article class="comment">
-    <header>{{{comment.authorHtml}}}</header>
-    <section>{{{comment.body}}}</section>
-  </article>
-`);
-
-router.get('/profile/:id', async (req, res) => {
-  const user = await getUserById(req.params.id);
-  res.send(profileTemplate({ user }));
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: javascript
+// expected: XSS via Handlebars triple-stache {{{ }}} unescaped output
+
+const Handlebars = require('handlebars');
+const express = require('express');
+const router = express.Router();
+
+const profileTemplate = Handlebars.compile(`
+  <div class="user-profile">
+    <h2>{{{user.displayName}}}</h2>
+    <div class="bio">{{{user.bio}}}</div>
+    <div class="links">{{{user.socialLinks}}}</div>
+  </div>
+`);
+
+const commentTemplate = Handlebars.compile(`
+  <article class="comment">
+    <header>{{{comment.authorHtml}}}</header>
+    <section>{{{comment.body}}}</section>
+  </article>
+`);
+
+router.get('/profile/:id', async (req, res) => {
+  const user = await getUserById(req.params.id);
+  res.send(profileTemplate({ user }));
+});
+
+module.exports = router;