thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/python/seed-011.py

@@ -1,30 +1,30 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via .format() string interpolation in Django raw query
-
-from django.db import connection
-from django.http import JsonResponse
-
-
-def search_articles(request):
-    query = request.GET.get("q", "")
-    tag = request.GET.get("tag", "")
-    author = request.GET.get("author", "")
-
-    with connection.cursor() as cursor:
-        # All three params injected via .format()
-        sql = """
-            SELECT a.id, a.title, a.summary, u.username as author
-            FROM articles a
-            JOIN users u ON a.author_id = u.id
-            WHERE a.published = true
-            AND (a.title ILIKE '%{query}%' OR a.content ILIKE '%{query}%')
-            AND a.tag = '{tag}'
-            AND u.username = '{author}'
-            ORDER BY a.created_at DESC
-        """.format(query=query, tag=tag, author=author)
-        cursor.execute(sql)
-        cols = [col[0] for col in cursor.description]
-        return JsonResponse({"results": [dict(zip(cols, row)) for row in cursor.fetchall()]})
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via .format() string interpolation in Django raw query
+
+from django.db import connection
+from django.http import JsonResponse
+
+
+def search_articles(request):
+    query = request.GET.get("q", "")
+    tag = request.GET.get("tag", "")
+    author = request.GET.get("author", "")
+
+    with connection.cursor() as cursor:
+        # All three params injected via .format()
+        sql = """
+            SELECT a.id, a.title, a.summary, u.username as author
+            FROM articles a
+            JOIN users u ON a.author_id = u.id
+            WHERE a.published = true
+            AND (a.title ILIKE '%{query}%' OR a.content ILIKE '%{query}%')
+            AND a.tag = '{tag}'
+            AND u.username = '{author}'
+            ORDER BY a.created_at DESC
+        """.format(query=query, tag=tag, author=author)
+        cursor.execute(sql)
+        cols = [col[0] for col in cursor.description]
+        return JsonResponse({"results": [dict(zip(cols, row)) for row in cursor.fetchall()]})

package/dist/packages/crucible/seeds/python/seed-012.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via SQLAlchemy text() with string concatenation
-
-from sqlalchemy import text, create_engine
-from sqlalchemy.orm import Session
-
-engine = create_engine("postgresql://user:pass@localhost/appdb")
-
-
-def find_orders(user_id: str, status: str, sort_field: str) -> list:
-    with Session(engine) as session:
-        # text() used correctly — but string concatenation defeats parameterization
-        sql = text(
-            "SELECT * FROM orders WHERE user_id = '"
-            + user_id
-            + "' AND status = '"
-            + status
-            + "' ORDER BY "
-            + sort_field
-        )
-        result = session.execute(sql)
-        return result.fetchall()
-
-
-def bulk_update_status(ids: list, new_status: str) -> int:
-    id_list = ", ".join(str(i) for i in ids)
-    with Session(engine) as session:
-        result = session.execute(
-            text(f"UPDATE orders SET status = '{new_status}' WHERE id IN ({id_list})")
-        )
-        session.commit()
-        return result.rowcount
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via SQLAlchemy text() with string concatenation
+
+from sqlalchemy import text, create_engine
+from sqlalchemy.orm import Session
+
+engine = create_engine("postgresql://user:pass@localhost/appdb")
+
+
+def find_orders(user_id: str, status: str, sort_field: str) -> list:
+    with Session(engine) as session:
+        # text() used correctly — but string concatenation defeats parameterization
+        sql = text(
+            "SELECT * FROM orders WHERE user_id = '"
+            + user_id
+            + "' AND status = '"
+            + status
+            + "' ORDER BY "
+            + sort_field
+        )
+        result = session.execute(sql)
+        return result.fetchall()
+
+
+def bulk_update_status(ids: list, new_status: str) -> int:
+    id_list = ", ".join(str(i) for i in ids)
+    with Session(engine) as session:
+        result = session.execute(
+            text(f"UPDATE orders SET status = '{new_status}' WHERE id IN ({id_list})")
+        )
+        session.commit()
+        return result.rowcount

package/dist/packages/crucible/seeds/python/seed-013.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: high
-# language: python
-# expected: SQL injection in FastAPI route via % operator in SQL string
-
-from fastapi import FastAPI, Query
-import asyncpg
-
-app = FastAPI()
-DB_URL = "postgresql://user:pass@localhost/appdb"
-
-
-@app.get("/employees")
-async def list_employees(
-    department: str = Query(default="Engineering"),
-    sort: str = Query(default="last_name"),
-):
-    conn = await asyncpg.connect(DB_URL)
-    # Both department and sort directly interpolated
-    query = "SELECT * FROM employees WHERE department = '%s' ORDER BY %s" % (department, sort)
-    rows = await conn.fetch(query)
-    await conn.close()
-    return [dict(row) for row in rows]
-
-
-@app.get("/employees/{emp_id}/activity")
-async def get_activity(emp_id: str, action: str = Query(default="login")):
-    conn = await asyncpg.connect(DB_URL)
-    sql = f"SELECT * FROM audit_log WHERE employee_id = '{emp_id}' AND action = '{action}'"
-    rows = await conn.fetch(sql)
-    await conn.close()
-    return [dict(r) for r in rows]
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: high
+# language: python
+# expected: SQL injection in FastAPI route via % operator in SQL string
+
+from fastapi import FastAPI, Query
+import asyncpg
+
+app = FastAPI()
+DB_URL = "postgresql://user:pass@localhost/appdb"
+
+
+@app.get("/employees")
+async def list_employees(
+    department: str = Query(default="Engineering"),
+    sort: str = Query(default="last_name"),
+):
+    conn = await asyncpg.connect(DB_URL)
+    # Both department and sort directly interpolated
+    query = "SELECT * FROM employees WHERE department = '%s' ORDER BY %s" % (department, sort)
+    rows = await conn.fetch(query)
+    await conn.close()
+    return [dict(row) for row in rows]
+
+
+@app.get("/employees/{emp_id}/activity")
+async def get_activity(emp_id: str, action: str = Query(default="login")):
+    conn = await asyncpg.connect(DB_URL)
+    sql = f"SELECT * FROM audit_log WHERE employee_id = '{emp_id}' AND action = '{action}'"
+    rows = await conn.fetch(sql)
+    await conn.close()
+    return [dict(r) for r in rows]

package/dist/packages/crucible/seeds/python/seed-014.py

@@ -1,40 +1,40 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via string concatenation in bulk IN clause
-
-import psycopg2
-
-
-def get_db():
-    return psycopg2.connect(host="localhost", dbname="shop", user="app", password="app")
-
-
-def get_items_by_ids(item_ids: list) -> list:
-    """Fetch multiple items — ids come from user input."""
-    conn = get_db()
-    cur = conn.cursor()
-    # item_ids is user-controlled — attacker can inject into IN() clause
-    id_list = ", ".join(str(i) for i in item_ids)
-    query = f"SELECT * FROM items WHERE id IN ({id_list}) AND active = true"
-    cur.execute(query)
-    return cur.fetchall()
-
-
-def archive_items(item_ids: list, reason: str) -> int:
-    conn = get_db()
-    cur = conn.cursor()
-    id_list = ", ".join(str(i) for i in item_ids)
-    sql = f"UPDATE items SET archived = true, archive_reason = '{reason}' WHERE id IN ({id_list})"
-    cur.execute(sql)
-    conn.commit()
-    return cur.rowcount
-
-
-def get_report(from_date: str, to_date: str, group_by: str) -> list:
-    conn = get_db()
-    cur = conn.cursor()
-    sql = f"SELECT {group_by}, COUNT(*), SUM(price) FROM orders WHERE created_at BETWEEN '{from_date}' AND '{to_date}' GROUP BY {group_by}"
-    cur.execute(sql)
-    return cur.fetchall()
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via string concatenation in bulk IN clause
+
+import psycopg2
+
+
+def get_db():
+    return psycopg2.connect(host="localhost", dbname="shop", user="app", password="app")
+
+
+def get_items_by_ids(item_ids: list) -> list:
+    """Fetch multiple items — ids come from user input."""
+    conn = get_db()
+    cur = conn.cursor()
+    # item_ids is user-controlled — attacker can inject into IN() clause
+    id_list = ", ".join(str(i) for i in item_ids)
+    query = f"SELECT * FROM items WHERE id IN ({id_list}) AND active = true"
+    cur.execute(query)
+    return cur.fetchall()
+
+
+def archive_items(item_ids: list, reason: str) -> int:
+    conn = get_db()
+    cur = conn.cursor()
+    id_list = ", ".join(str(i) for i in item_ids)
+    sql = f"UPDATE items SET archived = true, archive_reason = '{reason}' WHERE id IN ({id_list})"
+    cur.execute(sql)
+    conn.commit()
+    return cur.rowcount
+
+
+def get_report(from_date: str, to_date: str, group_by: str) -> list:
+    conn = get_db()
+    cur = conn.cursor()
+    sql = f"SELECT {group_by}, COUNT(*), SUM(price) FROM orders WHERE created_at BETWEEN '{from_date}' AND '{to_date}' GROUP BY {group_by}"
+    cur.execute(sql)
+    return cur.fetchall()

package/dist/packages/crucible/seeds/python/seed-015.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via Django extra()/RawSQL() with user input
-
-from django.db.models import RawSQL
-from django.http import JsonResponse
-from myapp.models import Product, Order
-
-
-def product_search(request):
-    search = request.GET.get("q", "")
-    price_filter = request.GET.get("max_price", "999999")
-
-    # extra() injects raw SQL directly — vulnerable to injection
-    products = Product.objects.extra(
-        where=["name ILIKE '%%%s%%'" % search, "price <= %s" % price_filter]
-    ).values("id", "name", "price")
-
-    return JsonResponse({"products": list(products)})
-
-
-def revenue_by_region(request):
-    group_field = request.GET.get("group_by", "region")
-    from django.db import connection
-    with connection.cursor() as cur:
-        # group_field from user — ORDER BY injection
-        cur.execute(
-            "SELECT %s, SUM(total) FROM orders GROUP BY %s" % (group_field, group_field)
-        )
-        rows = cur.fetchall()
-    return JsonResponse({"data": rows})
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via Django extra()/RawSQL() with user input
+
+from django.db.models import RawSQL
+from django.http import JsonResponse
+from myapp.models import Product, Order
+
+
+def product_search(request):
+    search = request.GET.get("q", "")
+    price_filter = request.GET.get("max_price", "999999")
+
+    # extra() injects raw SQL directly — vulnerable to injection
+    products = Product.objects.extra(
+        where=["name ILIKE '%%%s%%'" % search, "price <= %s" % price_filter]
+    ).values("id", "name", "price")
+
+    return JsonResponse({"products": list(products)})
+
+
+def revenue_by_region(request):
+    group_field = request.GET.get("group_by", "region")
+    from django.db import connection
+    with connection.cursor() as cur:
+        # group_field from user — ORDER BY injection
+        cur.execute(
+            "SELECT %s, SUM(total) FROM orders GROUP BY %s" % (group_field, group_field)
+        )
+        rows = cur.fetchall()
+    return JsonResponse({"data": rows})

package/dist/packages/crucible/seeds/python/seed-016.py

@@ -1,34 +1,34 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: critical
-# language: python
-# expected: XSS via Jinja2 render_template_string with user input and autoescape disabled
-
-from flask import Flask, request, render_template_string
-
-app = Flask(__name__)
-
-
-@app.route("/greet")
-def greet():
-    name = request.args.get("name", "Guest")
-    # render_template_string with user input — if autoescape is off, XSS is trivial
-    template = f"""
-    <!DOCTYPE html>
-    <html>
-      <head><title>Welcome</title></head>
-      <body>
-        <h1>Hello, {name}!</h1>
-        <p>Welcome to our platform.</p>
-      </body>
-    </html>
-    """
-    return render_template_string(template)
-
-
-@app.route("/search")
-def search():
-    query = request.args.get("q", "")
-    # Jinja2 template injection — attacker sends: {{config}} or {{''.__class__.__mro__}}
-    template = "<p>Results for: " + query + "</p><ul>{% for item in items %}<li>{{ item }}</li>{% endfor %}</ul>"
-    return render_template_string(template, items=["item1", "item2"])
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: critical
+# language: python
+# expected: XSS via Jinja2 render_template_string with user input and autoescape disabled
+
+from flask import Flask, request, render_template_string
+
+app = Flask(__name__)
+
+
+@app.route("/greet")
+def greet():
+    name = request.args.get("name", "Guest")
+    # render_template_string with user input — if autoescape is off, XSS is trivial
+    template = f"""
+    <!DOCTYPE html>
+    <html>
+      <head><title>Welcome</title></head>
+      <body>
+        <h1>Hello, {name}!</h1>
+        <p>Welcome to our platform.</p>
+      </body>
+    </html>
+    """
+    return render_template_string(template)
+
+
+@app.route("/search")
+def search():
+    query = request.args.get("q", "")
+    # Jinja2 template injection — attacker sends: {{config}} or {{''.__class__.__mro__}}
+    template = "<p>Results for: " + query + "</p><ul>{% for item in items %}<li>{{ item }}</li>{% endfor %}</ul>"
+    return render_template_string(template, items=["item1", "item2"])

package/dist/packages/crucible/seeds/python/seed-017.py

@@ -1,34 +1,34 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: python
-# expected: XSS via Flask response with unsanitized user input in HTML string
-
-from flask import Flask, request, make_response
-
-app = Flask(__name__)
-
-
-@app.route("/error")
-def error_page():
-    message = request.args.get("msg", "An error occurred")
-    # User-controlled message embedded in HTML response without escaping
-    html = f"""
-    <html>
-      <head><title>Error</title></head>
-      <body>
-        <div class="error-container">
-          <h1>Error</h1>
-          <p class="message">{message}</p>
-          <a href="/">Go Home</a>
-        </div>
-      </body>
-    </html>
-    """
-    return make_response(html, 400)
-
-
-@app.route("/profile/<username>")
-def profile(username: str):
-    html = f"<html><body><h1>Profile: {username}</h1></body></html>"
-    return html
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Flask response with unsanitized user input in HTML string
+
+from flask import Flask, request, make_response
+
+app = Flask(__name__)
+
+
+@app.route("/error")
+def error_page():
+    message = request.args.get("msg", "An error occurred")
+    # User-controlled message embedded in HTML response without escaping
+    html = f"""
+    <html>
+      <head><title>Error</title></head>
+      <body>
+        <div class="error-container">
+          <h1>Error</h1>
+          <p class="message">{message}</p>
+          <a href="/">Go Home</a>
+        </div>
+      </body>
+    </html>
+    """
+    return make_response(html, 400)
+
+
+@app.route("/profile/<username>")
+def profile(username: str):
+    html = f"<html><body><h1>Profile: {username}</h1></body></html>"
+    return html

package/dist/packages/crucible/seeds/python/seed-018.py

@@ -1,30 +1,30 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: critical
-# language: python
-# expected: SSTI (Server-Side Template Injection) via Jinja2 render_template_string with user-controlled template
-
-from flask import Flask, request, render_template_string
-
-app = Flask(__name__)
-
-
-@app.route("/render")
-def render_custom():
-    # Attacker sends: ?template={{config.SECRET_KEY}} or {{''.__class__.__mro__[1].__subclasses__()}}
-    user_template = request.args.get("template", "<p>Hello World</p>")
-    context = {
-        "user": request.args.get("user", "guest"),
-        "app_name": "MyApp",
-    }
-    # render_template_string with user-controlled template = SSTI
-    return render_template_string(user_template, **context)
-
-
-@app.route("/email-preview", methods=["POST"])
-def email_preview():
-    template_body = request.form.get("template", "")
-    recipient_name = request.form.get("name", "User")
-    # Attacker injects Jinja2 expressions into the template body
-    rendered = render_template_string(template_body, name=recipient_name)
-    return rendered
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: critical
+# language: python
+# expected: SSTI (Server-Side Template Injection) via Jinja2 render_template_string with user-controlled template
+
+from flask import Flask, request, render_template_string
+
+app = Flask(__name__)
+
+
+@app.route("/render")
+def render_custom():
+    # Attacker sends: ?template={{config.SECRET_KEY}} or {{''.__class__.__mro__[1].__subclasses__()}}
+    user_template = request.args.get("template", "<p>Hello World</p>")
+    context = {
+        "user": request.args.get("user", "guest"),
+        "app_name": "MyApp",
+    }
+    # render_template_string with user-controlled template = SSTI
+    return render_template_string(user_template, **context)
+
+
+@app.route("/email-preview", methods=["POST"])
+def email_preview():
+    template_body = request.form.get("template", "")
+    recipient_name = request.form.get("name", "User")
+    # Attacker injects Jinja2 expressions into the template body
+    rendered = render_template_string(template_body, name=recipient_name)
+    return rendered

package/dist/packages/crucible/seeds/python/seed-019.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: xss
-# severity: high
-# language: python
-# expected: XSS via Django HttpResponse with unsanitized user input
-
-from django.http import HttpResponse
-from django.views import View
-
-
-class SearchView(View):
-    def get(self, request):
-        query = request.GET.get("q", "")
-        category = request.GET.get("cat", "all")
-
-        # User input embedded directly in HTML without mark_safe/escape
-        html = """
-        <html>
-          <body>
-            <h1>Search Results</h1>
-            <p>Query: <b>{query}</b> | Category: {category}</p>
-            <div id="results"></div>
-          </body>
-        </html>
-        """.format(query=query, category=category)
-
-        return HttpResponse(html)
-
-
-class NotFoundView(View):
-    def get(self, request, path):
-        # path from URL — attacker crafts URL with XSS payload
-        return HttpResponse(f"<h1>Page not found: {path}</h1>", status=404)
+# [CRUCIBLE-SEED]
+# category: xss
+# severity: high
+# language: python
+# expected: XSS via Django HttpResponse with unsanitized user input
+
+from django.http import HttpResponse
+from django.views import View
+
+
+class SearchView(View):
+    def get(self, request):
+        query = request.GET.get("q", "")
+        category = request.GET.get("cat", "all")
+
+        # User input embedded directly in HTML without mark_safe/escape
+        html = """
+        <html>
+          <body>
+            <h1>Search Results</h1>
+            <p>Query: <b>{query}</b> | Category: {category}</p>
+            <div id="results"></div>
+          </body>
+        </html>
+        """.format(query=query, category=category)
+
+        return HttpResponse(html)
+
+
+class NotFoundView(View):
+    def get(self, request, path):
+        # path from URL — attacker crafts URL with XSS payload
+        return HttpResponse(f"<h1>Page not found: {path}</h1>", status=404)