thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/ruby/seed-030 2.rb

@@ -1,20 +1,20 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: send_file with user-controlled path — arbitrary file download
-
-class DownloadsController < ApplicationController
-  def get_file
-    filename = params[:file]
-    base_dir = Rails.root.join('public', 'downloads')
-    file_path = File.join(base_dir, filename)
-    send_file file_path
-  end
-
-  def export
-    name = params[:name]
-    path = "/var/reports/#{name}"
-    send_file path, type: 'application/octet-stream'
-  end
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: send_file with user-controlled path — arbitrary file download
+
+class DownloadsController < ApplicationController
+  def get_file
+    filename = params[:file]
+    base_dir = Rails.root.join('public', 'downloads')
+    file_path = File.join(base_dir, filename)
+    send_file file_path
+  end
+
+  def export
+    name = params[:name]
+    path = "/var/reports/#{name}"
+    send_file path, type: 'application/octet-stream'
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-030.rb

@@ -1,20 +1,20 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: send_file with user-controlled path — arbitrary file download
-
-class DownloadsController < ApplicationController
-  def get_file
-    filename = params[:file]
-    base_dir = Rails.root.join('public', 'downloads')
-    file_path = File.join(base_dir, filename)
-    send_file file_path
-  end
-
-  def export
-    name = params[:name]
-    path = "/var/reports/#{name}"
-    send_file path, type: 'application/octet-stream'
-  end
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: send_file with user-controlled path — arbitrary file download
+
+class DownloadsController < ApplicationController
+  def get_file
+    filename = params[:file]
+    base_dir = Rails.root.join('public', 'downloads')
+    file_path = File.join(base_dir, filename)
+    send_file file_path
+  end
+
+  def export
+    name = params[:name]
+    path = "/var/reports/#{name}"
+    send_file path, type: 'application/octet-stream'
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-031 2.rb

@@ -1,17 +1,17 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Zip extraction writes files using entry name without sanitization — zip slip
-
-require 'zip'
-
-def extract_zip(zip_path, dest_dir)
-  Zip::File.open(zip_path) do |zip|
-    zip.each do |entry|
-      output_path = File.join(dest_dir, entry.name)
-      FileUtils.mkdir_p(File.dirname(output_path))
-      entry.extract(output_path) { true }
-    end
-  end
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: Zip extraction writes files using entry name without sanitization — zip slip
+
+require 'zip'
+
+def extract_zip(zip_path, dest_dir)
+  Zip::File.open(zip_path) do |zip|
+    zip.each do |entry|
+      output_path = File.join(dest_dir, entry.name)
+      FileUtils.mkdir_p(File.dirname(output_path))
+      entry.extract(output_path) { true }
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-031.rb

@@ -1,17 +1,17 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Zip extraction writes files using entry name without sanitization — zip slip
-
-require 'zip'
-
-def extract_zip(zip_path, dest_dir)
-  Zip::File.open(zip_path) do |zip|
-    zip.each do |entry|
-      output_path = File.join(dest_dir, entry.name)
-      FileUtils.mkdir_p(File.dirname(output_path))
-      entry.extract(output_path) { true }
-    end
-  end
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: Zip extraction writes files using entry name without sanitization — zip slip
+
+require 'zip'
+
+def extract_zip(zip_path, dest_dir)
+  Zip::File.open(zip_path) do |zip|
+    zip.each do |entry|
+      output_path = File.join(dest_dir, entry.name)
+      FileUtils.mkdir_p(File.dirname(output_path))
+      entry.extract(output_path) { true }
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-032 2.rb

@@ -1,22 +1,22 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: ruby
-# expected: File.write to user-controlled destination path
-
-def save_export(filename, data)
-  path = "/var/app/exports/#{filename}"
-  File.write(path, data)
-  path
-end
-
-def cache_response(cache_key, content)
-  cache_path = "/tmp/cache/#{cache_key}"
-  FileUtils.mkdir_p(File.dirname(cache_path))
-  File.write(cache_path, content)
-end
-
-def write_template(template_name, subdir, content)
-  full_path = "/app/templates/#{subdir}/#{template_name}"
-  File.write(full_path, content)
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: ruby
+# expected: File.write to user-controlled destination path
+
+def save_export(filename, data)
+  path = "/var/app/exports/#{filename}"
+  File.write(path, data)
+  path
+end
+
+def cache_response(cache_key, content)
+  cache_path = "/tmp/cache/#{cache_key}"
+  FileUtils.mkdir_p(File.dirname(cache_path))
+  File.write(cache_path, content)
+end
+
+def write_template(template_name, subdir, content)
+  full_path = "/app/templates/#{subdir}/#{template_name}"
+  File.write(full_path, content)
+end

package/dist/packages/crucible/seeds/ruby/seed-032.rb

@@ -1,22 +1,22 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: ruby
-# expected: File.write to user-controlled destination path
-
-def save_export(filename, data)
-  path = "/var/app/exports/#{filename}"
-  File.write(path, data)
-  path
-end
-
-def cache_response(cache_key, content)
-  cache_path = "/tmp/cache/#{cache_key}"
-  FileUtils.mkdir_p(File.dirname(cache_path))
-  File.write(cache_path, content)
-end
-
-def write_template(template_name, subdir, content)
-  full_path = "/app/templates/#{subdir}/#{template_name}"
-  File.write(full_path, content)
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: high
+# language: ruby
+# expected: File.write to user-controlled destination path
+
+def save_export(filename, data)
+  path = "/var/app/exports/#{filename}"
+  File.write(path, data)
+  path
+end
+
+def cache_response(cache_key, content)
+  cache_path = "/tmp/cache/#{cache_key}"
+  FileUtils.mkdir_p(File.dirname(cache_path))
+  File.write(cache_path, content)
+end
+
+def write_template(template_name, subdir, content)
+  full_path = "/app/templates/#{subdir}/#{template_name}"
+  File.write(full_path, content)
+end

package/dist/packages/crucible/seeds/ruby/seed-033 2.rb

@@ -1,18 +1,18 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Dir.glob and File.open with user-controlled subdirectory
-
-def list_files(base_dir, subdir)
-  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
-end
-
-def read_config(config_name)
-  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
-end
-
-def load_plugin(plugin_id)
-  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
-  JSON.parse(manifest)
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: Dir.glob and File.open with user-controlled subdirectory
+
+def list_files(base_dir, subdir)
+  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
+end
+
+def read_config(config_name)
+  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
+end
+
+def load_plugin(plugin_id)
+  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
+  JSON.parse(manifest)
+end

package/dist/packages/crucible/seeds/ruby/seed-033.rb

@@ -1,18 +1,18 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: critical
-# language: ruby
-# expected: Dir.glob and File.open with user-controlled subdirectory
-
-def list_files(base_dir, subdir)
-  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
-end
-
-def read_config(config_name)
-  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
-end
-
-def load_plugin(plugin_id)
-  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
-  JSON.parse(manifest)
-end
+# [CRUCIBLE-SEED]
+# category: path_traversal
+# severity: critical
+# language: ruby
+# expected: Dir.glob and File.open with user-controlled subdirectory
+
+def list_files(base_dir, subdir)
+  Dir.glob("#{base_dir}/#{subdir}/*").map { |f| File.basename(f) }
+end
+
+def read_config(config_name)
+  File.open("/etc/app/configs/#{config_name}") { |f| f.read }
+end
+
+def load_plugin(plugin_id)
+  manifest = File.read("./plugins/#{plugin_id}/manifest.json")
+  JSON.parse(manifest)
+end

package/dist/packages/crucible/seeds/ruby/seed-034 2.rb

@@ -1,19 +1,19 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: params.permit(:all) or ActionController::Parameters without strong params
-
-class UsersController < ApplicationController
-  def update
-    @user = User.find(params[:id])
-    @user.update(params[:user])
-    redirect_to @user
-  end
-
-  def create
-    @user = User.new(params[:user].permit!)
-    @user.save
-    render json: @user
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: params.permit(:all) or ActionController::Parameters without strong params
+
+class UsersController < ApplicationController
+  def update
+    @user = User.find(params[:id])
+    @user.update(params[:user])
+    redirect_to @user
+  end
+
+  def create
+    @user = User.new(params[:user].permit!)
+    @user.save
+    render json: @user
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-034.rb

@@ -1,19 +1,19 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: params.permit(:all) or ActionController::Parameters without strong params
-
-class UsersController < ApplicationController
-  def update
-    @user = User.find(params[:id])
-    @user.update(params[:user])
-    redirect_to @user
-  end
-
-  def create
-    @user = User.new(params[:user].permit!)
-    @user.save
-    render json: @user
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: params.permit(:all) or ActionController::Parameters without strong params
+
+class UsersController < ApplicationController
+  def update
+    @user = User.find(params[:id])
+    @user.update(params[:user])
+    redirect_to @user
+  end
+
+  def create
+    @user = User.new(params[:user].permit!)
+    @user.save
+    render json: @user
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-035 2.rb

@@ -1,19 +1,19 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: ActiveRecord.new(params) without strong parameters — mass assignment
-
-class ProfilesController < ApplicationController
-  def update
-    profile = Profile.find(params[:id])
-    profile.update_attributes(params[:profile])
-    render json: profile
-  end
-
-  def create
-    profile = Profile.new(params)
-    profile.save!
-    render json: profile, status: :created
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: ActiveRecord.new(params) without strong parameters — mass assignment
+
+class ProfilesController < ApplicationController
+  def update
+    profile = Profile.find(params[:id])
+    profile.update_attributes(params[:profile])
+    render json: profile
+  end
+
+  def create
+    profile = Profile.new(params)
+    profile.save!
+    render json: profile, status: :created
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-035.rb

@@ -1,19 +1,19 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: ActiveRecord.new(params) without strong parameters — mass assignment
-
-class ProfilesController < ApplicationController
-  def update
-    profile = Profile.find(params[:id])
-    profile.update_attributes(params[:profile])
-    render json: profile
-  end
-
-  def create
-    profile = Profile.new(params)
-    profile.save!
-    render json: profile, status: :created
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: ActiveRecord.new(params) without strong parameters — mass assignment
+
+class ProfilesController < ApplicationController
+  def update
+    profile = Profile.find(params[:id])
+    profile.update_attributes(params[:profile])
+    render json: profile
+  end
+
+  def create
+    profile = Profile.new(params)
+    profile.save!
+    render json: profile, status: :created
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-036 2.rb

@@ -1,18 +1,18 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: critical
-# language: ruby
-# expected: attr_accessible :all or missing attr_protected — mass assignment in model
-
-class User < ActiveRecord::Base
-  # No attr_protected or attr_accessible defined
-  # Allows setting admin, role, confirmed fields via mass assignment
-
-  def self.create_from_params(params)
-    create(params)
-  end
-
-  def self.register(registration_params)
-    new(registration_params).tap(&:save)
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: critical
+# language: ruby
+# expected: attr_accessible :all or missing attr_protected — mass assignment in model
+
+class User < ActiveRecord::Base
+  # No attr_protected or attr_accessible defined
+  # Allows setting admin, role, confirmed fields via mass assignment
+
+  def self.create_from_params(params)
+    create(params)
+  end
+
+  def self.register(registration_params)
+    new(registration_params).tap(&:save)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-036.rb

@@ -1,18 +1,18 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: critical
-# language: ruby
-# expected: attr_accessible :all or missing attr_protected — mass assignment in model
-
-class User < ActiveRecord::Base
-  # No attr_protected or attr_accessible defined
-  # Allows setting admin, role, confirmed fields via mass assignment
-
-  def self.create_from_params(params)
-    create(params)
-  end
-
-  def self.register(registration_params)
-    new(registration_params).tap(&:save)
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: critical
+# language: ruby
+# expected: attr_accessible :all or missing attr_protected — mass assignment in model
+
+class User < ActiveRecord::Base
+  # No attr_protected or attr_accessible defined
+  # Allows setting admin, role, confirmed fields via mass assignment
+
+  def self.create_from_params(params)
+    create(params)
+  end
+
+  def self.register(registration_params)
+    new(registration_params).tap(&:save)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-037 2.rb

@@ -1,21 +1,21 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
-
-class OrdersController < ApplicationController
-  def create
-    permitted = params.require(:order).permit!
-    @order    = Order.create(permitted)
-    render json: @order
-  end
-
-  def bulk_update
-    params[:records].each do |record_params|
-      item = Item.find(record_params[:id])
-      item.update(record_params.except(:id))
-    end
-    render json: { updated: params[:records].count }
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
+
+class OrdersController < ApplicationController
+  def create
+    permitted = params.require(:order).permit!
+    @order    = Order.create(permitted)
+    render json: @order
+  end
+
+  def bulk_update
+    params[:records].each do |record_params|
+      item = Item.find(record_params[:id])
+      item.update(record_params.except(:id))
+    end
+    render json: { updated: params[:records].count }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-037.rb

@@ -1,21 +1,21 @@
-# [CRUCIBLE-SEED]
-# category: mass_assignment
-# severity: high
-# language: ruby
-# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
-
-class OrdersController < ApplicationController
-  def create
-    permitted = params.require(:order).permit!
-    @order    = Order.create(permitted)
-    render json: @order
-  end
-
-  def bulk_update
-    params[:records].each do |record_params|
-      item = Item.find(record_params[:id])
-      item.update(record_params.except(:id))
-    end
-    render json: { updated: params[:records].count }
-  end
-end
+# [CRUCIBLE-SEED]
+# category: mass_assignment
+# severity: high
+# language: ruby
+# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes
+
+class OrdersController < ApplicationController
+  def create
+    permitted = params.require(:order).permit!
+    @order    = Order.create(permitted)
+    render json: @order
+  end
+
+  def bulk_update
+    params[:records].each do |record_params|
+      item = Item.find(record_params[:id])
+      item.update(record_params.except(:id))
+    end
+    render json: { updated: params[:records].count }
+  end
+end