thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/ruby/seed-045 2.rb

@@ -1,22 +1,22 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
-
-class AuthController < ApplicationController
-  def callback
-    next_url = params[:next] || params[:return_to] || dashboard_path
-    redirect_to next_url
-  end
-
-  def logout
-    sign_out current_user
-    redirect_to params[:redirect]
-  end
-
-  def sso_redirect
-    target = request.params['RelayState'] || root_url
-    redirect_to target, allow_other_host: true
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
+
+class AuthController < ApplicationController
+  def callback
+    next_url = params[:next] || params[:return_to] || dashboard_path
+    redirect_to next_url
+  end
+
+  def logout
+    sign_out current_user
+    redirect_to params[:redirect]
+  end
+
+  def sso_redirect
+    target = request.params['RelayState'] || root_url
+    redirect_to target, allow_other_host: true
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-045.rb

@@ -1,22 +1,22 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
-
-class AuthController < ApplicationController
-  def callback
-    next_url = params[:next] || params[:return_to] || dashboard_path
-    redirect_to next_url
-  end
-
-  def logout
-    sign_out current_user
-    redirect_to params[:redirect]
-  end
-
-  def sso_redirect
-    target = request.params['RelayState'] || root_url
-    redirect_to target, allow_other_host: true
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login
+
+class AuthController < ApplicationController
+  def callback
+    next_url = params[:next] || params[:return_to] || dashboard_path
+    redirect_to next_url
+  end
+
+  def logout
+    sign_out current_user
+    redirect_to params[:redirect]
+  end
+
+  def sso_redirect
+    target = request.params['RelayState'] || root_url
+    redirect_to target, allow_other_host: true
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-046 2.rb

@@ -1,27 +1,27 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: medium
-# language: ruby
-# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
-
-class RedirectController < ApplicationController
-  SAFE_DOMAIN = 'example.com'
-
-  def go
-    target = params[:to]
-    if target =~ /example\.com/
-      redirect_to target, allow_other_host: true
-    else
-      redirect_to root_path
-    end
-  end
-
-  def external
-    url     = params[:url]
-    trusted = ['example.com', 'partner.com']
-    host    = URI.parse(url).host rescue ''
-    if trusted.include?(host)
-      redirect_to url, allow_other_host: true
-    end
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: medium
+# language: ruby
+# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
+
+class RedirectController < ApplicationController
+  SAFE_DOMAIN = 'example.com'
+
+  def go
+    target = params[:to]
+    if target =~ /example\.com/
+      redirect_to target, allow_other_host: true
+    else
+      redirect_to root_path
+    end
+  end
+
+  def external
+    url     = params[:url]
+    trusted = ['example.com', 'partner.com']
+    host    = URI.parse(url).host rescue ''
+    if trusted.include?(host)
+      redirect_to url, allow_other_host: true
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-046.rb

@@ -1,27 +1,27 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: medium
-# language: ruby
-# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
-
-class RedirectController < ApplicationController
-  SAFE_DOMAIN = 'example.com'
-
-  def go
-    target = params[:to]
-    if target =~ /example\.com/
-      redirect_to target, allow_other_host: true
-    else
-      redirect_to root_path
-    end
-  end
-
-  def external
-    url     = params[:url]
-    trusted = ['example.com', 'partner.com']
-    host    = URI.parse(url).host rescue ''
-    if trusted.include?(host)
-      redirect_to url, allow_other_host: true
-    end
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: medium
+# language: ruby
+# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick
+
+class RedirectController < ApplicationController
+  SAFE_DOMAIN = 'example.com'
+
+  def go
+    target = params[:to]
+    if target =~ /example\.com/
+      redirect_to target, allow_other_host: true
+    else
+      redirect_to root_path
+    end
+  end
+
+  def external
+    url     = params[:url]
+    trusted = ['example.com', 'partner.com']
+    host    = URI.parse(url).host rescue ''
+    if trusted.include?(host)
+      redirect_to url, allow_other_host: true
+    end
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-047 2.rb

@@ -1,26 +1,26 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: send_file or redirect after download with user-controlled path
-
-class DownloadsController < ApplicationController
-  def complete
-    file      = params[:file]
-    callback  = params[:callback_url]
-    send_file Rails.root.join('public', 'downloads', file)
-    redirect_to callback
-  end
-
-  def track_and_redirect
-    destination = params[:destination]
-    track_click(destination)
-    redirect_to destination, allow_other_host: true
-  end
-
-  private
-
-  def track_click(url)
-    ClickLog.create(url: url, user_id: current_user&.id)
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: send_file or redirect after download with user-controlled path
+
+class DownloadsController < ApplicationController
+  def complete
+    file      = params[:file]
+    callback  = params[:callback_url]
+    send_file Rails.root.join('public', 'downloads', file)
+    redirect_to callback
+  end
+
+  def track_and_redirect
+    destination = params[:destination]
+    track_click(destination)
+    redirect_to destination, allow_other_host: true
+  end
+
+  private
+
+  def track_click(url)
+    ClickLog.create(url: url, user_id: current_user&.id)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-047.rb

@@ -1,26 +1,26 @@
-# [CRUCIBLE-SEED]
-# category: open_redirect
-# severity: high
-# language: ruby
-# expected: send_file or redirect after download with user-controlled path
-
-class DownloadsController < ApplicationController
-  def complete
-    file      = params[:file]
-    callback  = params[:callback_url]
-    send_file Rails.root.join('public', 'downloads', file)
-    redirect_to callback
-  end
-
-  def track_and_redirect
-    destination = params[:destination]
-    track_click(destination)
-    redirect_to destination, allow_other_host: true
-  end
-
-  private
-
-  def track_click(url)
-    ClickLog.create(url: url, user_id: current_user&.id)
-  end
-end
+# [CRUCIBLE-SEED]
+# category: open_redirect
+# severity: high
+# language: ruby
+# expected: send_file or redirect after download with user-controlled path
+
+class DownloadsController < ApplicationController
+  def complete
+    file      = params[:file]
+    callback  = params[:callback_url]
+    send_file Rails.root.join('public', 'downloads', file)
+    redirect_to callback
+  end
+
+  def track_and_redirect
+    destination = params[:destination]
+    track_click(destination)
+    redirect_to destination, allow_other_host: true
+  end
+
+  private
+
+  def track_click(url)
+    ClickLog.create(url: url, user_id: current_user&.id)
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-048 2.rb

@@ -1,24 +1,24 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
-
-class ConfigController < ApplicationController
-  def import
-    config_data = params[:config]
-    config      = YAML.load(config_data)
-    apply_config(config)
-    render json: { applied: true }
-  end
-
-  def load_template(template_string)
-    YAML.load(template_string)
-  end
-
-  private
-
-  def apply_config(cfg)
-    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
-  end
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
+
+class ConfigController < ApplicationController
+  def import
+    config_data = params[:config]
+    config      = YAML.load(config_data)
+    apply_config(config)
+    render json: { applied: true }
+  end
+
+  def load_template(template_string)
+    YAML.load(template_string)
+  end
+
+  private
+
+  def apply_config(cfg)
+    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-048.rb

@@ -1,24 +1,24 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
-
-class ConfigController < ApplicationController
-  def import
-    config_data = params[:config]
-    config      = YAML.load(config_data)
-    apply_config(config)
-    render json: { applied: true }
-  end
-
-  def load_template(template_string)
-    YAML.load(template_string)
-  end
-
-  private
-
-  def apply_config(cfg)
-    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
-  end
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load with user-controlled input — allows arbitrary object instantiation
+
+class ConfigController < ApplicationController
+  def import
+    config_data = params[:config]
+    config      = YAML.load(config_data)
+    apply_config(config)
+    render json: { applied: true }
+  end
+
+  def load_template(template_string)
+    YAML.load(template_string)
+  end
+
+  private
+
+  def apply_config(cfg)
+    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-049 2.rb

@@ -1,20 +1,20 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
-
-def load_config_file(config_name)
-  path    = "/etc/app/configs/#{config_name}.yml"
-  content = File.read(path)
-  YAML.load(content)
-end
-
-def parse_pipeline(pipeline_definition)
-  YAML.load(pipeline_definition)
-end
-
-def deserialize_job(job_yaml)
-  job = YAML.load(job_yaml)
-  job.merge(loaded_at: Time.now)
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
+
+def load_config_file(config_name)
+  path    = "/etc/app/configs/#{config_name}.yml"
+  content = File.read(path)
+  YAML.load(content)
+end
+
+def parse_pipeline(pipeline_definition)
+  YAML.load(pipeline_definition)
+end
+
+def deserialize_job(job_yaml)
+  job = YAML.load(job_yaml)
+  job.merge(loaded_at: Time.now)
+end

package/dist/packages/crucible/seeds/ruby/seed-049.rb

@@ -1,20 +1,20 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
-
-def load_config_file(config_name)
-  path    = "/etc/app/configs/#{config_name}.yml"
-  content = File.read(path)
-  YAML.load(content)
-end
-
-def parse_pipeline(pipeline_definition)
-  YAML.load(pipeline_definition)
-end
-
-def deserialize_job(job_yaml)
-  job = YAML.load(job_yaml)
-  job.merge(loaded_at: Time.now)
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
+
+def load_config_file(config_name)
+  path    = "/etc/app/configs/#{config_name}.yml"
+  content = File.read(path)
+  YAML.load(content)
+end
+
+def parse_pipeline(pipeline_definition)
+  YAML.load(pipeline_definition)
+end
+
+def deserialize_job(job_yaml)
+  job = YAML.load(job_yaml)
+  job.merge(loaded_at: Time.now)
+end

package/dist/packages/crucible/seeds/ruby/seed-050 2.rb

@@ -1,27 +1,27 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load used in API endpoint — remote code execution via crafted payload
-
-require 'sinatra'
-require 'yaml'
-
-post '/api/import' do
-  content_type :json
-  raw_body = request.body.read
-  data     = YAML.load(raw_body)
-  process_import(data)
-  { imported: data.keys.count }.to_json
-end
-
-post '/api/config/update' do
-  yaml_config = params[:yaml]
-  config      = YAML.load(yaml_config)
-  config.each { |k, v| CONFIG[k] = v }
-  { updated: true }.to_json
-end
-
-def process_import(data)
-  data.each { |k, v| puts "#{k}: #{v}" }
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load used in API endpoint — remote code execution via crafted payload
+
+require 'sinatra'
+require 'yaml'
+
+post '/api/import' do
+  content_type :json
+  raw_body = request.body.read
+  data     = YAML.load(raw_body)
+  process_import(data)
+  { imported: data.keys.count }.to_json
+end
+
+post '/api/config/update' do
+  yaml_config = params[:yaml]
+  config      = YAML.load(yaml_config)
+  config.each { |k, v| CONFIG[k] = v }
+  { updated: true }.to_json
+end
+
+def process_import(data)
+  data.each { |k, v| puts "#{k}: #{v}" }
+end

package/dist/packages/crucible/seeds/ruby/seed-050.rb

@@ -1,27 +1,27 @@
-# [CRUCIBLE-SEED]
-# category: yaml_deserialization
-# severity: critical
-# language: ruby
-# expected: YAML.load used in API endpoint — remote code execution via crafted payload
-
-require 'sinatra'
-require 'yaml'
-
-post '/api/import' do
-  content_type :json
-  raw_body = request.body.read
-  data     = YAML.load(raw_body)
-  process_import(data)
-  { imported: data.keys.count }.to_json
-end
-
-post '/api/config/update' do
-  yaml_config = params[:yaml]
-  config      = YAML.load(yaml_config)
-  config.each { |k, v| CONFIG[k] = v }
-  { updated: true }.to_json
-end
-
-def process_import(data)
-  data.each { |k, v| puts "#{k}: #{v}" }
-end
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load used in API endpoint — remote code execution via crafted payload
+
+require 'sinatra'
+require 'yaml'
+
+post '/api/import' do
+  content_type :json
+  raw_body = request.body.read
+  data     = YAML.load(raw_body)
+  process_import(data)
+  { imported: data.keys.count }.to_json
+end
+
+post '/api/config/update' do
+  yaml_config = params[:yaml]
+  config      = YAML.load(yaml_config)
+  config.each { |k, v| CONFIG[k] = v }
+  { updated: true }.to_json
+end
+
+def process_import(data)
+  data.each { |k, v| puts "#{k}: #{v}" }
+end

package/dist/packages/crucible/seeds/rust/seed-001 2.rs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: rust
-// expected: Hardcoded AWS access key and secret in string literals
-
-use aws_sdk_s3::Client;
-
-const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
-const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-const AWS_REGION: &str = "us-east-1";
-const S3_BUCKET: &str = "my-production-bucket";
-
-pub async fn create_s3_client() -> Client {
-    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
-    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
-    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
-    let config = aws_config::load_from_env().await;
-    Client::new(&config)
-}
-
-pub fn get_bucket() -> &'static str {
-    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
-    S3_BUCKET
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded AWS access key and secret in string literals
+
+use aws_sdk_s3::Client;
+
+const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
+const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+const AWS_REGION: &str = "us-east-1";
+const S3_BUCKET: &str = "my-production-bucket";
+
+pub async fn create_s3_client() -> Client {
+    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
+    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
+    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
+    let config = aws_config::load_from_env().await;
+    Client::new(&config)
+}
+
+pub fn get_bucket() -> &'static str {
+    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
+    S3_BUCKET
+}