thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/python/seed-047.py

@@ -1,44 +1,44 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
-
-import aiohttp
-from fastapi import FastAPI, Body
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class NotificationConfig(BaseModel):
-    webhook_url: str    # user-controlled
-    event_type: str
-    secret: str = ""
-
-
-class ImportRequest(BaseModel):
-    data_url: str       # user-controlled source URL
-    format: str = "json"
-
-
-@app.post("/notifications/send")
-async def send_notification(config: NotificationConfig):
-    async with aiohttp.ClientSession() as session:
-        # webhook_url from user — attacker targets http://10.0.0.1/admin
-        async with session.post(
-            config.webhook_url,
-            json={"event": config.event_type},
-            headers={"X-Secret": config.secret},
-            timeout=aiohttp.ClientTimeout(total=10),
-            allow_redirects=True,  # follows redirects — pivot to internal
-        ) as resp:
-            return {"status": resp.status}
-
-
-@app.post("/data/import")
-async def import_data(req: ImportRequest):
-    async with aiohttp.ClientSession() as session:
-        async with session.get(req.data_url) as resp:
-            data = await resp.text()
-    return {"preview": data[:500], "format": req.format}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
+
+import aiohttp
+from fastapi import FastAPI, Body
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class NotificationConfig(BaseModel):
+    webhook_url: str    # user-controlled
+    event_type: str
+    secret: str = ""
+
+
+class ImportRequest(BaseModel):
+    data_url: str       # user-controlled source URL
+    format: str = "json"
+
+
+@app.post("/notifications/send")
+async def send_notification(config: NotificationConfig):
+    async with aiohttp.ClientSession() as session:
+        # webhook_url from user — attacker targets http://10.0.0.1/admin
+        async with session.post(
+            config.webhook_url,
+            json={"event": config.event_type},
+            headers={"X-Secret": config.secret},
+            timeout=aiohttp.ClientTimeout(total=10),
+            allow_redirects=True,  # follows redirects — pivot to internal
+        ) as resp:
+            return {"status": resp.status}
+
+
+@app.post("/data/import")
+async def import_data(req: ImportRequest):
+    async with aiohttp.ClientSession() as session:
+        async with session.get(req.data_url) as resp:
+            data = await resp.text()
+    return {"preview": data[:500], "format": req.format}

package/dist/packages/crucible/seeds/python/seed-048 2.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.loads used with untrusted data — arbitrary code execution
-
-import pickle
-import base64
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/session/restore", methods=["POST"])
-def restore_session():
-    session_data = request.cookies.get("session", "")
-    if not session_data:
-        return jsonify({"error": "No session"}), 401
-
-    try:
-        # pickle.loads executes arbitrary Python code embedded in the payload
-        # Attacker payload: object with __reduce__ returning os.system('id')
-        decoded = base64.b64decode(session_data)
-        session = pickle.loads(decoded)
-        return jsonify({"user": session.get("user"), "role": session.get("role")})
-    except Exception as e:
-        return jsonify({"error": "Invalid session"}), 400
-
-
-@app.route("/cache/get", methods=["POST"])
-def get_cached():
-    raw = request.get_json().get("data", "")
-    # Data from Redis — but Redis can be poisoned by attacker
-    obj = pickle.loads(base64.b64decode(raw))
-    return jsonify({"value": str(obj)})
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.loads used with untrusted data — arbitrary code execution
+
+import pickle
+import base64
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/session/restore", methods=["POST"])
+def restore_session():
+    session_data = request.cookies.get("session", "")
+    if not session_data:
+        return jsonify({"error": "No session"}), 401
+
+    try:
+        # pickle.loads executes arbitrary Python code embedded in the payload
+        # Attacker payload: object with __reduce__ returning os.system('id')
+        decoded = base64.b64decode(session_data)
+        session = pickle.loads(decoded)
+        return jsonify({"user": session.get("user"), "role": session.get("role")})
+    except Exception as e:
+        return jsonify({"error": "Invalid session"}), 400
+
+
+@app.route("/cache/get", methods=["POST"])
+def get_cached():
+    raw = request.get_json().get("data", "")
+    # Data from Redis — but Redis can be poisoned by attacker
+    obj = pickle.loads(base64.b64decode(raw))
+    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-048.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.loads used with untrusted data — arbitrary code execution
-
-import pickle
-import base64
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/session/restore", methods=["POST"])
-def restore_session():
-    session_data = request.cookies.get("session", "")
-    if not session_data:
-        return jsonify({"error": "No session"}), 401
-
-    try:
-        # pickle.loads executes arbitrary Python code embedded in the payload
-        # Attacker payload: object with __reduce__ returning os.system('id')
-        decoded = base64.b64decode(session_data)
-        session = pickle.loads(decoded)
-        return jsonify({"user": session.get("user"), "role": session.get("role")})
-    except Exception as e:
-        return jsonify({"error": "Invalid session"}), 400
-
-
-@app.route("/cache/get", methods=["POST"])
-def get_cached():
-    raw = request.get_json().get("data", "")
-    # Data from Redis — but Redis can be poisoned by attacker
-    obj = pickle.loads(base64.b64decode(raw))
-    return jsonify({"value": str(obj)})
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.loads used with untrusted data — arbitrary code execution
+
+import pickle
+import base64
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/session/restore", methods=["POST"])
+def restore_session():
+    session_data = request.cookies.get("session", "")
+    if not session_data:
+        return jsonify({"error": "No session"}), 401
+
+    try:
+        # pickle.loads executes arbitrary Python code embedded in the payload
+        # Attacker payload: object with __reduce__ returning os.system('id')
+        decoded = base64.b64decode(session_data)
+        session = pickle.loads(decoded)
+        return jsonify({"user": session.get("user"), "role": session.get("role")})
+    except Exception as e:
+        return jsonify({"error": "Invalid session"}), 400
+
+
+@app.route("/cache/get", methods=["POST"])
+def get_cached():
+    raw = request.get_json().get("data", "")
+    # Data from Redis — but Redis can be poisoned by attacker
+    obj = pickle.loads(base64.b64decode(raw))
+    return jsonify({"value": str(obj)})

package/dist/packages/crucible/seeds/python/seed-049 2.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
-
-import pickle
-import shelve
-from fastapi import FastAPI, UploadFile, File, HTTPException
-
-app = FastAPI()
-
-
-@app.post("/models/load")
-async def load_model(file: UploadFile = File(...)):
-    contents = await file.read()
-    try:
-        # User-uploaded .pkl file deserialized without any validation
-        model = pickle.loads(contents)
-        return {"model_type": type(model).__name__}
-    except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-
-@app.get("/cache/{key}")
-def get_from_cache(key: str):
-    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
-    with shelve.open("/var/cache/app_cache") as db:
-        if key not in db:
-            raise HTTPException(status_code=404, detail="Not found")
-        value = db[key]  # deserialized via pickle
-    return {"value": value}
-
-
-@app.post("/tasks/restore")
-async def restore_task_state(file: UploadFile = File(...)):
-    data = await file.read()
-    state = pickle.loads(data)  # untrusted task state from client
-    return {"task_id": state.get("id"), "status": state.get("status")}
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
+
+import pickle
+import shelve
+from fastapi import FastAPI, UploadFile, File, HTTPException
+
+app = FastAPI()
+
+
+@app.post("/models/load")
+async def load_model(file: UploadFile = File(...)):
+    contents = await file.read()
+    try:
+        # User-uploaded .pkl file deserialized without any validation
+        model = pickle.loads(contents)
+        return {"model_type": type(model).__name__}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@app.get("/cache/{key}")
+def get_from_cache(key: str):
+    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
+    with shelve.open("/var/cache/app_cache") as db:
+        if key not in db:
+            raise HTTPException(status_code=404, detail="Not found")
+        value = db[key]  # deserialized via pickle
+    return {"value": value}
+
+
+@app.post("/tasks/restore")
+async def restore_task_state(file: UploadFile = File(...)):
+    data = await file.read()
+    state = pickle.loads(data)  # untrusted task state from client
+    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-049.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: critical
-# language: python
-# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
-
-import pickle
-import shelve
-from fastapi import FastAPI, UploadFile, File, HTTPException
-
-app = FastAPI()
-
-
-@app.post("/models/load")
-async def load_model(file: UploadFile = File(...)):
-    contents = await file.read()
-    try:
-        # User-uploaded .pkl file deserialized without any validation
-        model = pickle.loads(contents)
-        return {"model_type": type(model).__name__}
-    except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-
-@app.get("/cache/{key}")
-def get_from_cache(key: str):
-    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
-    with shelve.open("/var/cache/app_cache") as db:
-        if key not in db:
-            raise HTTPException(status_code=404, detail="Not found")
-        value = db[key]  # deserialized via pickle
-    return {"value": value}
-
-
-@app.post("/tasks/restore")
-async def restore_task_state(file: UploadFile = File(...)):
-    data = await file.read()
-    state = pickle.loads(data)  # untrusted task state from client
-    return {"task_id": state.get("id"), "status": state.get("status")}
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: critical
+# language: python
+# expected: pickle.load used with untrusted file upload and shelve with user-controlled key
+
+import pickle
+import shelve
+from fastapi import FastAPI, UploadFile, File, HTTPException
+
+app = FastAPI()
+
+
+@app.post("/models/load")
+async def load_model(file: UploadFile = File(...)):
+    contents = await file.read()
+    try:
+        # User-uploaded .pkl file deserialized without any validation
+        model = pickle.loads(contents)
+        return {"model_type": type(model).__name__}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@app.get("/cache/{key}")
+def get_from_cache(key: str):
+    # shelve uses pickle internally — user-controlled key reads arbitrary shelf entries
+    with shelve.open("/var/cache/app_cache") as db:
+        if key not in db:
+            raise HTTPException(status_code=404, detail="Not found")
+        value = db[key]  # deserialized via pickle
+    return {"value": value}
+
+
+@app.post("/tasks/restore")
+async def restore_task_state(file: UploadFile = File(...)):
+    data = await file.read()
+    state = pickle.loads(data)  # untrusted task state from client
+    return {"task_id": state.get("id"), "status": state.get("status")}

package/dist/packages/crucible/seeds/python/seed-050 2.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: high
-# language: python
-# expected: marshal.loads and jsonpickle.decode used with untrusted data
-
-import marshal
-import jsonpickle
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.post("/code/load")
-def load_code():
-    """Load a compiled Python code object from client."""
-    data = request.get_data()
-    # marshal.loads with user data can reconstruct code objects — arbitrary execution
-    code_obj = marshal.loads(data)
-    result = eval(code_obj)
-    return jsonify({"result": str(result)})
-
-
-@app.post("/object/restore")
-def restore_object():
-    payload = request.get_json()
-    serialized = payload.get("object", "")
-    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
-    obj = jsonpickle.decode(serialized)
-    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
-
-
-@app.post("/state/import")
-def import_state():
-    body = request.get_json()
-    state_json = body.get("state", "null")
-    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
-    state = jsonpickle.decode(state_json, classes=None)
-    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: high
+# language: python
+# expected: marshal.loads and jsonpickle.decode used with untrusted data
+
+import marshal
+import jsonpickle
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.post("/code/load")
+def load_code():
+    """Load a compiled Python code object from client."""
+    data = request.get_data()
+    # marshal.loads with user data can reconstruct code objects — arbitrary execution
+    code_obj = marshal.loads(data)
+    result = eval(code_obj)
+    return jsonify({"result": str(result)})
+
+
+@app.post("/object/restore")
+def restore_object():
+    payload = request.get_json()
+    serialized = payload.get("object", "")
+    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
+    obj = jsonpickle.decode(serialized)
+    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
+
+
+@app.post("/state/import")
+def import_state():
+    body = request.get_json()
+    state_json = body.get("state", "null")
+    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
+    state = jsonpickle.decode(state_json, classes=None)
+    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-050.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: deserialization
-# severity: high
-# language: python
-# expected: marshal.loads and jsonpickle.decode used with untrusted data
-
-import marshal
-import jsonpickle
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.post("/code/load")
-def load_code():
-    """Load a compiled Python code object from client."""
-    data = request.get_data()
-    # marshal.loads with user data can reconstruct code objects — arbitrary execution
-    code_obj = marshal.loads(data)
-    result = eval(code_obj)
-    return jsonify({"result": str(result)})
-
-
-@app.post("/object/restore")
-def restore_object():
-    payload = request.get_json()
-    serialized = payload.get("object", "")
-    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
-    obj = jsonpickle.decode(serialized)
-    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
-
-
-@app.post("/state/import")
-def import_state():
-    body = request.get_json()
-    state_json = body.get("state", "null")
-    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
-    state = jsonpickle.decode(state_json, classes=None)
-    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})
+# [CRUCIBLE-SEED]
+# category: deserialization
+# severity: high
+# language: python
+# expected: marshal.loads and jsonpickle.decode used with untrusted data
+
+import marshal
+import jsonpickle
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.post("/code/load")
+def load_code():
+    """Load a compiled Python code object from client."""
+    data = request.get_data()
+    # marshal.loads with user data can reconstruct code objects — arbitrary execution
+    code_obj = marshal.loads(data)
+    result = eval(code_obj)
+    return jsonify({"result": str(result)})
+
+
+@app.post("/object/restore")
+def restore_object():
+    payload = request.get_json()
+    serialized = payload.get("object", "")
+    # jsonpickle can deserialize arbitrary Python objects including those with __reduce__
+    obj = jsonpickle.decode(serialized)
+    return jsonify({"type": type(obj).__name__, "repr": repr(obj)})
+
+
+@app.post("/state/import")
+def import_state():
+    body = request.get_json()
+    state_json = body.get("state", "null")
+    # jsonpickle.decode with py/object tags allows instantiation of arbitrary classes
+    state = jsonpickle.decode(state_json, classes=None)
+    return jsonify({"imported": True, "keys": list(state.keys()) if isinstance(state, dict) else []})

package/dist/packages/crucible/seeds/python/seed-051 2.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: yaml_injection
-# severity: critical
-# language: python
-# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
-
-import yaml
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/config/upload", methods=["POST"])
-def upload_config():
-    raw_yaml = request.data.decode("utf-8")
-    # yaml.load without Loader= defaults to full deserialization — RCE possible
-    # Attacker payload: "!!python/object/apply:os.system ['id']"
-    config = yaml.load(raw_yaml)
-    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
-
-
-@app.route("/workflow/import", methods=["POST"])
-def import_workflow():
-    yaml_content = request.get_json().get("yaml", "")
-    # yaml.load with untrusted string
-    workflow = yaml.load(yaml_content)
-    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
-    return jsonify({"steps": steps})
-
-
-@app.route("/settings/restore", methods=["POST"])
-def restore_settings():
-    uploaded = request.files.get("settings")
-    if not uploaded:
-        return jsonify({"error": "No file"}), 400
-    content = uploaded.read().decode("utf-8")
-    settings = yaml.load(content)  # unsafe loader
-    return jsonify({"restored": True, "settings": settings})
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
+
+import yaml
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/config/upload", methods=["POST"])
+def upload_config():
+    raw_yaml = request.data.decode("utf-8")
+    # yaml.load without Loader= defaults to full deserialization — RCE possible
+    # Attacker payload: "!!python/object/apply:os.system ['id']"
+    config = yaml.load(raw_yaml)
+    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
+
+
+@app.route("/workflow/import", methods=["POST"])
+def import_workflow():
+    yaml_content = request.get_json().get("yaml", "")
+    # yaml.load with untrusted string
+    workflow = yaml.load(yaml_content)
+    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
+    return jsonify({"steps": steps})
+
+
+@app.route("/settings/restore", methods=["POST"])
+def restore_settings():
+    uploaded = request.files.get("settings")
+    if not uploaded:
+        return jsonify({"error": "No file"}), 400
+    content = uploaded.read().decode("utf-8")
+    settings = yaml.load(content)  # unsafe loader
+    return jsonify({"restored": True, "settings": settings})