thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/python/seed-028.py

@@ -1,42 +1,42 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.run with shell=True and user-controlled git operation
+
+import subprocess
+from dataclasses import dataclass
+
+
+@dataclass
+class GitConfig:
+    repo_path: str
+    branch: str      # user-controlled
+    remote: str = "origin"
+
+
+class GitService:
+    def clone(self, repo_url: str, target: str) -> str:
+        # repo_url from user — injection possible
+        result = subprocess.run(
+            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def checkout(self, cfg: GitConfig) -> str:
+        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
+        result = subprocess.run(
+            f"git -C {cfg.repo_path} checkout {cfg.branch}",
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def tag(self, repo: str, tag_name: str, message: str) -> str:
+        result = subprocess.run(
+            f'git -C {repo} tag -a {tag_name} -m "{message}"',
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def archive(self, repo: str, branch: str, output_file: str) -> None:
+        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/dist/packages/crucible/seeds/python/seed-029.py

@@ -1,42 +1,42 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via open() with unvalidated user-supplied file path
-
-import os
-from flask import Flask, request, send_file, abort
-
-app = Flask(__name__)
-
-BASE_DIR = "/var/app/public/files"
-
-
-@app.route("/files/<path:filename>")
-def serve_file(filename: str):
-    # path.join does NOT prevent traversal — "../../etc/passwd" resolves outside BASE_DIR
-    file_path = os.path.join(BASE_DIR, filename)
-    try:
-        with open(file_path, "rb") as f:
-            return f.read()
-    except FileNotFoundError:
-        abort(404)
-
-
-@app.route("/download")
-def download():
-    file_path = request.args.get("path", "")
-    # Completely unvalidated path — reads arbitrary files
-    try:
-        with open(file_path, "r") as f:
-            return f.read()
-    except Exception as e:
-        return str(e), 400
-
-
-@app.route("/logs/view")
-def view_log():
-    log_name = request.args.get("log", "app.log")
-    log_path = f"/var/log/app/{log_name}"
-    with open(log_path, "r") as f:
-        return f.read()
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via open() with unvalidated user-supplied file path
+
+import os
+from flask import Flask, request, send_file, abort
+
+app = Flask(__name__)
+
+BASE_DIR = "/var/app/public/files"
+
+
+@app.route("/files/<path:filename>")
+def serve_file(filename: str):
+    # path.join does NOT prevent traversal — "../../etc/passwd" resolves outside BASE_DIR
+    file_path = os.path.join(BASE_DIR, filename)
+    try:
+        with open(file_path, "rb") as f:
+            return f.read()
+    except FileNotFoundError:
+        abort(404)
+
+
+@app.route("/download")
+def download():
+    file_path = request.args.get("path", "")
+    # Completely unvalidated path — reads arbitrary files
+    try:
+        with open(file_path, "r") as f:
+            return f.read()
+    except Exception as e:
+        return str(e), 400
+
+
+@app.route("/logs/view")
+def view_log():
+    log_name = request.args.get("log", "app.log")
+    log_path = f"/var/log/app/{log_name}"
+    with open(log_path, "r") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-030 2.py

@@ -1,37 +1,37 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal in Django view via user-controlled filename parameter
+
+import os
+from django.http import FileResponse, Http404, HttpResponse
+from django.conf import settings
+
+
+def serve_user_file(request, user_id: str):
+    filename = request.GET.get("file", "")
+    # No normalization — filename can be "../../../etc/passwd"
+    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
+    try:
+        return FileResponse(open(file_path, "rb"))
+    except FileNotFoundError:
+        raise Http404("File not found")
+
+
+def export_report(request):
+    report_name = request.GET.get("report", "monthly")
+    locale = request.GET.get("locale", "en")
+    # Both report_name and locale inserted into path — traversal possible
+    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
+    if not os.path.exists(path):
+        raise Http404
+    with open(path, "rb") as f:
+        return HttpResponse(f.read(), content_type="application/pdf")
+
+
+def read_template(request):
+    template = request.GET.get("template", "welcome")
+    path = f"{settings.TEMPLATES_DIR}/{template}.html"
+    with open(path) as f:
+        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-030.py

@@ -1,37 +1,37 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal in Django view via user-controlled filename parameter
+
+import os
+from django.http import FileResponse, Http404, HttpResponse
+from django.conf import settings
+
+
+def serve_user_file(request, user_id: str):
+    filename = request.GET.get("file", "")
+    # No normalization — filename can be "../../../etc/passwd"
+    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
+    try:
+        return FileResponse(open(file_path, "rb"))
+    except FileNotFoundError:
+        raise Http404("File not found")
+
+
+def export_report(request):
+    report_name = request.GET.get("report", "monthly")
+    locale = request.GET.get("locale", "en")
+    # Both report_name and locale inserted into path — traversal possible
+    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
+    if not os.path.exists(path):
+        raise Http404
+    with open(path, "rb") as f:
+        return HttpResponse(f.read(), content_type="application/pdf")
+
+
+def read_template(request):
+    template = request.GET.get("template", "welcome")
+    path = f"{settings.TEMPLATES_DIR}/{template}.html"
+    with open(path) as f:
+        return HttpResponse(f.read())

package/dist/packages/crucible/seeds/python/seed-031 2.py

@@ -1,34 +1,34 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
+
+import os
+import zipfile
+
+
+EXTRACT_BASE = "/var/app/uploads/extracted"
+
+
+def extract_archive(zip_bytes: bytes, user_id: str) -> list:
+    import io
+    extracted = []
+    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
+        for entry in zf.infolist():
+            # entry.filename can contain "../" — writes outside EXTRACT_BASE
+            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
+            if entry.is_dir():
+                os.makedirs(output_path, exist_ok=True)
+            else:
+                os.makedirs(os.path.dirname(output_path), exist_ok=True)
+                with zf.open(entry) as src, open(output_path, "wb") as dst:
+                    dst.write(src.read())
+                extracted.append(output_path)
+    return extracted
+
+
+def get_extracted_file(user_id: str, relative_path: str) -> bytes:
+    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
+    with open(full_path, "rb") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-031.py

@@ -1,34 +1,34 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
+
+import os
+import zipfile
+
+
+EXTRACT_BASE = "/var/app/uploads/extracted"
+
+
+def extract_archive(zip_bytes: bytes, user_id: str) -> list:
+    import io
+    extracted = []
+    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
+        for entry in zf.infolist():
+            # entry.filename can contain "../" — writes outside EXTRACT_BASE
+            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
+            if entry.is_dir():
+                os.makedirs(output_path, exist_ok=True)
+            else:
+                os.makedirs(os.path.dirname(output_path), exist_ok=True)
+                with zf.open(entry) as src, open(output_path, "wb") as dst:
+                    dst.write(src.read())
+                extracted.append(output_path)
+    return extracted
+
+
+def get_extracted_file(user_id: str, relative_path: str) -> bytes:
+    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
+    with open(full_path, "rb") as f:
+        return f.read()

package/dist/packages/crucible/seeds/python/seed-032.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: medium
-# language: python
-# expected: path traversal via Flask send_from_directory with user-controlled subdirectory
-
-import os
-from flask import Flask, request, send_from_directory, abort
-
-app = Flask(__name__)
-
-UPLOADS_ROOT = "/var/uploads"
-
-
-@app.route("/uploads/<user_id>/files")
-def list_files(user_id: str):
-    subdir = request.args.get("folder", "")
-    # user_id and subdir can include "../" to escape UPLOADS_ROOT
-    target_dir = os.path.join(UPLOADS_ROOT, user_id, subdir)
-    try:
-        files = os.listdir(target_dir)
-        return {"files": files}
-    except FileNotFoundError:
-        abort(404)
-
-
-@app.route("/uploads/<user_id>/get")
-def get_file(user_id: str):
-    filename = request.args.get("name", "")
-    directory = request.args.get("dir", "")
-    # send_from_directory with user-controlled directory + filename
-    full_dir = os.path.join(UPLOADS_ROOT, user_id, directory)
-    return send_from_directory(full_dir, filename)
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: medium
+# language: python
+# expected: path traversal via Flask send_from_directory with user-controlled subdirectory
+
+import os
+from flask import Flask, request, send_from_directory, abort
+
+app = Flask(__name__)
+
+UPLOADS_ROOT = "/var/uploads"
+
+
+@app.route("/uploads/<user_id>/files")
+def list_files(user_id: str):
+    subdir = request.args.get("folder", "")
+    # user_id and subdir can include "../" to escape UPLOADS_ROOT
+    target_dir = os.path.join(UPLOADS_ROOT, user_id, subdir)
+    try:
+        files = os.listdir(target_dir)
+        return {"files": files}
+    except FileNotFoundError:
+        abort(404)
+
+
+@app.route("/uploads/<user_id>/get")
+def get_file(user_id: str):
+    filename = request.args.get("name", "")
+    directory = request.args.get("dir", "")
+    # send_from_directory with user-controlled directory + filename
+    full_dir = os.path.join(UPLOADS_ROOT, user_id, directory)
+    return send_from_directory(full_dir, filename)

package/dist/packages/crucible/seeds/python/seed-033.py

@@ -1,32 +1,32 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via FastAPI file endpoint with unvalidated path parameter
-
-import os
-from fastapi import FastAPI, Query
-from fastapi.responses import FileResponse, PlainTextResponse
-
-app = FastAPI()
-
-STATIC_ROOT = "/var/app/static"
-
-
-@app.get("/static/{file_path:path}")
-async def serve_static(file_path: str):
-    # file_path can be "../../etc/passwd" — no normalization or boundary check
-    full_path = os.path.join(STATIC_ROOT, file_path)
-    if not os.path.isfile(full_path):
-        return PlainTextResponse("Not found", status_code=404)
-    return FileResponse(full_path)
-
-
-@app.get("/config/view")
-async def view_config(name: str = Query(...)):
-    config_path = f"/etc/myapp/{name}.conf"
-    try:
-        with open(config_path) as f:
-            return {"content": f.read()}
-    except FileNotFoundError:
-        return {"error": "Config not found"}, 404
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: python
+# expected: path traversal via FastAPI file endpoint with unvalidated path parameter
+
+import os
+from fastapi import FastAPI, Query
+from fastapi.responses import FileResponse, PlainTextResponse
+
+app = FastAPI()
+
+STATIC_ROOT = "/var/app/static"
+
+
+@app.get("/static/{file_path:path}")
+async def serve_static(file_path: str):
+    # file_path can be "../../etc/passwd" — no normalization or boundary check
+    full_path = os.path.join(STATIC_ROOT, file_path)
+    if not os.path.isfile(full_path):
+        return PlainTextResponse("Not found", status_code=404)
+    return FileResponse(full_path)
+
+
+@app.get("/config/view")
+async def view_config(name: str = Query(...)):
+    config_path = f"/etc/myapp/{name}.conf"
+    try:
+        with open(config_path) as f:
+            return {"content": f.read()}
+    except FileNotFoundError:
+        return {"error": "Config not found"}, 404