thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/kotlin/seed-044.kt

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: kotlin
-// expected: URL opened from user-supplied input without validation — SSRF
-
-package com.example.proxy
-
-import java.net.URL
-
-class WebProxy {
-    fun fetchUrl(userUrl: String): String {
-        val url = URL(userUrl)
-        val conn = url.openConnection()
-        return conn.getInputStream().bufferedReader().readText()
-    }
-
-    fun fetchImage(imageUrl: String): ByteArray {
-        return URL(imageUrl).readBytes()
-    }
-
-    fun checkEndpoint(url: String): Boolean {
-        val conn = URL(url).openConnection() as java.net.HttpURLConnection
-        conn.requestMethod = "HEAD"
-        return conn.responseCode == 200
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: kotlin
+// expected: URL opened from user-supplied input without validation — SSRF
+
+package com.example.proxy
+
+import java.net.URL
+
+class WebProxy {
+    fun fetchUrl(userUrl: String): String {
+        val url = URL(userUrl)
+        val conn = url.openConnection()
+        return conn.getInputStream().bufferedReader().readText()
+    }
+
+    fun fetchImage(imageUrl: String): ByteArray {
+        return URL(imageUrl).readBytes()
+    }
+
+    fun checkEndpoint(url: String): Boolean {
+        val conn = URL(url).openConnection() as java.net.HttpURLConnection
+        conn.requestMethod = "HEAD"
+        return conn.responseCode == 200
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-045.kt

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: kotlin
-// expected: OkHttp request built from user-controlled URL without allowlist
-
-package com.example.network
-
-import okhttp3.OkHttpClient
-import okhttp3.Request
-
-class HttpForwarder {
-    private val client = OkHttpClient()
-
-    fun forward(targetUrl: String): String {
-        val request = Request.Builder()
-            .url(targetUrl)
-            .build()
-        val response = client.newCall(request).execute()
-        return response.body?.string() ?: ""
-    }
-
-    fun fetchMetadata(instanceMetaUrl: String): String {
-        val req = Request.Builder().url(instanceMetaUrl).header("X-Forwarded-For", "127.0.0.1").build()
-        return client.newCall(req).execute().body?.string() ?: ""
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: kotlin
+// expected: OkHttp request built from user-controlled URL without allowlist
+
+package com.example.network
+
+import okhttp3.OkHttpClient
+import okhttp3.Request
+
+class HttpForwarder {
+    private val client = OkHttpClient()
+
+    fun forward(targetUrl: String): String {
+        val request = Request.Builder()
+            .url(targetUrl)
+            .build()
+        val response = client.newCall(request).execute()
+        return response.body?.string() ?: ""
+    }
+
+    fun fetchMetadata(instanceMetaUrl: String): String {
+        val req = Request.Builder().url(instanceMetaUrl).header("X-Forwarded-For", "127.0.0.1").build()
+        return client.newCall(req).execute().body?.string() ?: ""
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-046.kt

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: kotlin
-// expected: Ktor server acts as open proxy — fetches user-supplied URL server-side
-
-package com.example.server
-
-import io.ktor.client.*
-import io.ktor.client.request.*
-import io.ktor.server.application.*
-import io.ktor.server.response.*
-import io.ktor.server.routing.*
-
-val httpClient = HttpClient()
-
-fun Application.proxyRoutes() {
-    routing {
-        get("/proxy") {
-            val url = call.parameters["url"] ?: return@get
-            val response = httpClient.get(url)
-            call.respond(response)
-        }
-
-        post("/webhook-test") {
-            val targetUrl = call.parameters["callback"] ?: return@post
-            httpClient.post(targetUrl) {
-                setBody("""{"event":"test"}""")
-            }
-            call.respondText("Triggered")
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: kotlin
+// expected: Ktor server acts as open proxy — fetches user-supplied URL server-side
+
+package com.example.server
+
+import io.ktor.client.*
+import io.ktor.client.request.*
+import io.ktor.server.application.*
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+
+val httpClient = HttpClient()
+
+fun Application.proxyRoutes() {
+    routing {
+        get("/proxy") {
+            val url = call.parameters["url"] ?: return@get
+            val response = httpClient.get(url)
+            call.respond(response)
+        }
+
+        post("/webhook-test") {
+            val targetUrl = call.parameters["callback"] ?: return@post
+            httpClient.post(targetUrl) {
+                setBody("""{"event":"test"}""")
+            }
+            call.respondText("Triggered")
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-047.kt

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: kotlin
-// expected: HttpURLConnection opened to URL composed from user-supplied hostname
-
-package com.example.health
-
-import java.net.HttpURLConnection
-import java.net.URL
-
-class HealthChecker {
-    fun checkService(host: String, port: Int, path: String): Int {
-        val url = URL("http://$host:$port$path")
-        val conn = url.openConnection() as HttpURLConnection
-        conn.requestMethod = "GET"
-        conn.connectTimeout = 3000
-        conn.readTimeout = 3000
-        return conn.responseCode
-    }
-
-    fun scanPort(host: String, port: Int): Boolean {
-        return try {
-            val url = URL("http://$host:$port")
-            val conn = url.openConnection() as HttpURLConnection
-            conn.connectTimeout = 1000
-            conn.responseCode < 500
-        } catch (e: Exception) {
-            false
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: kotlin
+// expected: HttpURLConnection opened to URL composed from user-supplied hostname
+
+package com.example.health
+
+import java.net.HttpURLConnection
+import java.net.URL
+
+class HealthChecker {
+    fun checkService(host: String, port: Int, path: String): Int {
+        val url = URL("http://$host:$port$path")
+        val conn = url.openConnection() as HttpURLConnection
+        conn.requestMethod = "GET"
+        conn.connectTimeout = 3000
+        conn.readTimeout = 3000
+        return conn.responseCode
+    }
+
+    fun scanPort(host: String, port: Int): Boolean {
+        return try {
+            val url = URL("http://$host:$port")
+            val conn = url.openConnection() as HttpURLConnection
+            conn.connectTimeout = 1000
+            conn.responseCode < 500
+        } catch (e: Exception) {
+            false
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-048.kt

@@ -1,20 +1,20 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_url
-// severity: medium
-// language: kotlin
-// expected: Hardcoded production API base URL and debug endpoint left in code
-
-package com.example.api
-
-object ApiConfig {
-    const val BASE_URL = "https://api.prod.example.com/v2/"
-    const val DEBUG_URL = "http://192.168.1.100:8080/debug/"
-    const val INTERNAL_ADMIN_URL = "https://admin-internal.example.com/api/"
-    const val LEGACY_URL = "http://old-api.example.com/v1/"
-
-    fun getBaseUrl(debug: Boolean = false): String {
-        return if (debug) DEBUG_URL else BASE_URL
-    }
-
-    fun getAdminEndpoint(path: String) = "$INTERNAL_ADMIN_URL$path"
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_url
+// severity: medium
+// language: kotlin
+// expected: Hardcoded production API base URL and debug endpoint left in code
+
+package com.example.api
+
+object ApiConfig {
+    const val BASE_URL = "https://api.prod.example.com/v2/"
+    const val DEBUG_URL = "http://192.168.1.100:8080/debug/"
+    const val INTERNAL_ADMIN_URL = "https://admin-internal.example.com/api/"
+    const val LEGACY_URL = "http://old-api.example.com/v1/"
+
+    fun getBaseUrl(debug: Boolean = false): String {
+        return if (debug) DEBUG_URL else BASE_URL
+    }
+
+    fun getAdminEndpoint(path: String) = "$INTERNAL_ADMIN_URL$path"
+}

package/dist/packages/crucible/seeds/kotlin/seed-049.kt

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_url
-// severity: medium
-// language: kotlin
-// expected: Hardcoded IP address and dev server URL with credentials embedded
-
-package com.example.config
-
-class ServerConfig {
-    val prodServer = "https://backend.example.com"
-    val devServer = "http://10.0.2.2:3000"
-    val stagingServer = "https://staging.example.com"
-    val debugEndpoint = "http://localhost:9229/json/list"
-
-    val dbConnectionString = "mongodb://admin:password123@mongo.internal.example.com:27017/proddb"
-    val redisUrl = "redis://:myRedisSecret@redis.internal.example.com:6379"
-
-    fun getActiveServer(env: String): String = when (env) {
-        "prod" -> prodServer
-        "staging" -> stagingServer
-        else -> devServer
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_url
+// severity: medium
+// language: kotlin
+// expected: Hardcoded IP address and dev server URL with credentials embedded
+
+package com.example.config
+
+class ServerConfig {
+    val prodServer = "https://backend.example.com"
+    val devServer = "http://10.0.2.2:3000"
+    val stagingServer = "https://staging.example.com"
+    val debugEndpoint = "http://localhost:9229/json/list"
+
+    val dbConnectionString = "mongodb://admin:password123@mongo.internal.example.com:27017/proddb"
+    val redisUrl = "redis://:myRedisSecret@redis.internal.example.com:6379"
+
+    fun getActiveServer(env: String): String = when (env) {
+        "prod" -> prodServer
+        "staging" -> stagingServer
+        else -> devServer
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-050.kt

@@ -1,19 +1,19 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_url
-// severity: low
-// language: kotlin
-// expected: Hardcoded webhook and analytics endpoint URLs with tracking tokens
-
-package com.example.analytics
-
-object TrackingConfig {
-    const val MIXPANEL_ENDPOINT = "https://api.mixpanel.com/track?token=abc123def456ghi789"
-    const val SEGMENT_WRITE_KEY = "sEgMeNtWrItEkEy1234567890abcdef"
-    const val AMPLITUDE_KEY = "amp_prod_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-    const val WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
-    const val DATADOG_API_KEY = "datadog_api_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-
-    fun trackEvent(event: String, properties: Map<String, Any>) {
-        println("Tracking to $MIXPANEL_ENDPOINT: $event with key $SEGMENT_WRITE_KEY")
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_url
+// severity: low
+// language: kotlin
+// expected: Hardcoded webhook and analytics endpoint URLs with tracking tokens
+
+package com.example.analytics
+
+object TrackingConfig {
+    const val MIXPANEL_ENDPOINT = "https://api.mixpanel.com/track?token=abc123def456ghi789"
+    const val SEGMENT_WRITE_KEY = "sEgMeNtWrItEkEy1234567890abcdef"
+    const val AMPLITUDE_KEY = "amp_prod_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+    const val WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
+    const val DATADOG_API_KEY = "datadog_api_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+
+    fun trackEvent(event: String, properties: Map<String, Any>) {
+        println("Tracking to $MIXPANEL_ENDPOINT: $event with key $SEGMENT_WRITE_KEY")
+    }
+}

package/dist/packages/crucible/seeds/php/seed-001.php

@@ -1,23 +1,23 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: php
-// expected: Hardcoded database credentials in PHP source file
-
-define('DB_HOST', 'prod-db.example.com');
-define('DB_USER', 'root');
-define('DB_PASS', 'Sup3rS3cr3tP@ssw0rd!2024');
-define('DB_NAME', 'production_db');
-
-function getDbConnection() {
-    $conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
-    if ($conn->connect_error) {
-        die("Connection failed: " . $conn->connect_error);
-    }
-    return $conn;
-}
-
-function getAdminPassword() {
-    return 'Admin@123456!';
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: php
+// expected: Hardcoded database credentials in PHP source file
+
+define('DB_HOST', 'prod-db.example.com');
+define('DB_USER', 'root');
+define('DB_PASS', 'Sup3rS3cr3tP@ssw0rd!2024');
+define('DB_NAME', 'production_db');
+
+function getDbConnection() {
+    $conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
+    if ($conn->connect_error) {
+        die("Connection failed: " . $conn->connect_error);
+    }
+    return $conn;
+}
+
+function getAdminPassword() {
+    return 'Admin@123456!';
+}

package/dist/packages/crucible/seeds/php/seed-002.php

@@ -1,18 +1,18 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: php
-// expected: Hardcoded Stripe and PayPal API keys
-
-$stripe_secret_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh';
-$stripe_publishable_key = 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu';
-$stripe_webhook_secret = 'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEF';
-
-$paypal_client_id = 'AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSs';
-$paypal_client_secret = 'EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyz';
-
-function getStripeHeaders() {
-    global $stripe_secret_key;
-    return ['Authorization: Bearer ' . $stripe_secret_key];
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: php
+// expected: Hardcoded Stripe and PayPal API keys
+
+$stripe_secret_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh';
+$stripe_publishable_key = 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu';
+$stripe_webhook_secret = 'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEF';
+
+$paypal_client_id = 'AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSs';
+$paypal_client_secret = 'EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyz';
+
+function getStripeHeaders() {
+    global $stripe_secret_key;
+    return ['Authorization: Bearer ' . $stripe_secret_key];
+}

package/dist/packages/crucible/seeds/php/seed-003.php

@@ -1,25 +1,25 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: php
-// expected: Hardcoded AWS credentials and S3 configuration
-
-class AwsConfig {
-    const ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1';
-    const SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY';
-    const REGION     = 'us-east-1';
-    const BUCKET     = 'my-production-bucket';
-
-    public static function getCredentials(): array {
-        return [
-            'key'    => self::ACCESS_KEY,
-            'secret' => self::SECRET_KEY,
-            'region' => self::REGION,
-        ];
-    }
-
-    public static function getS3Url(string $key): string {
-        return "https://s3.amazonaws.com/" . self::BUCKET . "/$key?AWSAccessKeyId=" . self::ACCESS_KEY;
-    }
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: php
+// expected: Hardcoded AWS credentials and S3 configuration
+
+class AwsConfig {
+    const ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1';
+    const SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY';
+    const REGION     = 'us-east-1';
+    const BUCKET     = 'my-production-bucket';
+
+    public static function getCredentials(): array {
+        return [
+            'key'    => self::ACCESS_KEY,
+            'secret' => self::SECRET_KEY,
+            'region' => self::REGION,
+        ];
+    }
+
+    public static function getS3Url(string $key): string {
+        return "https://s3.amazonaws.com/" . self::BUCKET . "/$key?AWSAccessKeyId=" . self::ACCESS_KEY;
+    }
+}

package/dist/packages/crucible/seeds/php/seed-004.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: php
-// expected: Hardcoded JWT secret and encryption key
-
-define('JWT_SECRET', 'mySuperSecretJWTKey_doNotShare_2024_production');
-define('ENCRYPTION_KEY', 'AES256Key-32CharactersLongSecret!!');
-define('ADMIN_API_KEY', 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');
-
-function generateJwt(array $payload): string {
-    $header  = base64_encode(json_encode(['typ' => 'JWT', 'alg' => 'HS256']));
-    $body    = base64_encode(json_encode($payload));
-    $sig     = hash_hmac('sha256', "$header.$body", JWT_SECRET);
-    return "$header.$body.$sig";
-}
-
-function verifyAdmin(string $key): bool {
-    return $key === ADMIN_API_KEY;
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: php
+// expected: Hardcoded JWT secret and encryption key
+
+define('JWT_SECRET', 'mySuperSecretJWTKey_doNotShare_2024_production');
+define('ENCRYPTION_KEY', 'AES256Key-32CharactersLongSecret!!');
+define('ADMIN_API_KEY', 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');
+
+function generateJwt(array $payload): string {
+    $header  = base64_encode(json_encode(['typ' => 'JWT', 'alg' => 'HS256']));
+    $body    = base64_encode(json_encode($payload));
+    $sig     = hash_hmac('sha256', "$header.$body", JWT_SECRET);
+    return "$header.$body.$sig";
+}
+
+function verifyAdmin(string $key): bool {
+    return $key === ADMIN_API_KEY;
+}

package/dist/packages/crucible/seeds/php/seed-005.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: php
-// expected: Hardcoded SMTP credentials in mailer configuration
-
-$mail_config = [
-    'host'     => 'smtp.sendgrid.net',
-    'port'     => 587,
-    'username' => 'apikey',
-    'password' => 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
-    'from'     => 'noreply@example.com',
-];
-
-function sendMail(string $to, string $subject, string $body): bool {
-    global $mail_config;
-    // PHPMailer usage with hardcoded credentials
-    echo "Connecting to {$mail_config['host']} with password: {$mail_config['password']}\n";
-    return true;
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: php
+// expected: Hardcoded SMTP credentials in mailer configuration
+
+$mail_config = [
+    'host'     => 'smtp.sendgrid.net',
+    'port'     => 587,
+    'username' => 'apikey',
+    'password' => 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
+    'from'     => 'noreply@example.com',
+];
+
+function sendMail(string $to, string $subject, string $body): bool {
+    global $mail_config;
+    // PHPMailer usage with hardcoded credentials
+    echo "Connecting to {$mail_config['host']} with password: {$mail_config['password']}\n";
+    return true;
+}

package/dist/packages/crucible/seeds/php/seed-006.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: php
-// expected: Hardcoded OAuth client secret and social login tokens
-
-define('GOOGLE_CLIENT_ID', '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com');
-define('GOOGLE_CLIENT_SECRET', 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456');
-define('FACEBOOK_APP_SECRET', 'abcdef0123456789abcdef0123456789');
-define('GITHUB_CLIENT_SECRET', 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');
-
-class OAuthHelper {
-    public static function getGoogleConfig(): array {
-        return [
-            'client_id'     => GOOGLE_CLIENT_ID,
-            'client_secret' => GOOGLE_CLIENT_SECRET,
-            'redirect_uri'  => 'https://example.com/auth/google/callback',
-        ];
-    }
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: php
+// expected: Hardcoded OAuth client secret and social login tokens
+
+define('GOOGLE_CLIENT_ID', '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com');
+define('GOOGLE_CLIENT_SECRET', 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456');
+define('FACEBOOK_APP_SECRET', 'abcdef0123456789abcdef0123456789');
+define('GITHUB_CLIENT_SECRET', 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');
+
+class OAuthHelper {
+    public static function getGoogleConfig(): array {
+        return [
+            'client_id'     => GOOGLE_CLIENT_ID,
+            'client_secret' => GOOGLE_CLIENT_SECRET,
+            'redirect_uri'  => 'https://example.com/auth/google/callback',
+        ];
+    }
+}