thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/ts/seed-042.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: medium
-// language: typescript
-// expected: prototype pollution via constructor.prototype path in Object.assign chain
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface PluginConfig {
-  [key: string]: unknown;
-}
-
-function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
-  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
-  return Object.assign({}, baseOptions, userOptions);
-}
-
-router.post('/plugins/:id/configure', (req: Request, res: Response) => {
-  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
-  // req.body passed directly — {"__proto__": {"polluted": true}}
-  const config = applyPluginOptions(base, req.body as PluginConfig);
-  res.json({ configured: true, config });
-});
-
-router.patch('/plugins/:id/update', (req: Request, res: Response) => {
-  // Spread operator with user body — same pollution vector
-  const updated = { ...{}, ...req.body };
-  res.json({ updated });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: typescript
+// expected: prototype pollution via constructor.prototype path in Object.assign chain
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface PluginConfig {
+  [key: string]: unknown;
+}
+
+function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
+  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
+  return Object.assign({}, baseOptions, userOptions);
+}
+
+router.post('/plugins/:id/configure', (req: Request, res: Response) => {
+  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
+  // req.body passed directly — {"__proto__": {"polluted": true}}
+  const config = applyPluginOptions(base, req.body as PluginConfig);
+  res.json({ configured: true, config });
+});
+
+router.patch('/plugins/:id/update', (req: Request, res: Response) => {
+  // Spread operator with user body — same pollution vector
+  const updated = { ...{}, ...req.body };
+  res.json({ updated });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-043 2.ts

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via qs-parsed query params passed to deep clone utility
-
-import * as qs from 'qs';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function cloneDeep<T extends object>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
-}
-
-function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
-  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
-  for (const [key, val] of Object.entries(filter)) {
-    (base as Record<string, unknown>)[key] = val;
-  }
-  return base;
-}
-
-router.get('/items', (req: Request, res: Response) => {
-  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
-  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
-  const baseQuery = { page: 1, limit: 20, active: true };
-  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
-  res.json({ query: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via qs-parsed query params passed to deep clone utility
+
+import * as qs from 'qs';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function cloneDeep<T extends object>(obj: T): T {
+  return JSON.parse(JSON.stringify(obj)) as T;
+}
+
+function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
+  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
+  for (const [key, val] of Object.entries(filter)) {
+    (base as Record<string, unknown>)[key] = val;
+  }
+  return base;
+}
+
+router.get('/items', (req: Request, res: Response) => {
+  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
+  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
+  const baseQuery = { page: 1, limit: 20, active: true };
+  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
+  res.json({ query: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-043.ts

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via qs-parsed query params passed to deep clone utility
-
-import * as qs from 'qs';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function cloneDeep<T extends object>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
-}
-
-function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
-  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
-  for (const [key, val] of Object.entries(filter)) {
-    (base as Record<string, unknown>)[key] = val;
-  }
-  return base;
-}
-
-router.get('/items', (req: Request, res: Response) => {
-  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
-  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
-  const baseQuery = { page: 1, limit: 20, active: true };
-  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
-  res.json({ query: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via qs-parsed query params passed to deep clone utility
+
+import * as qs from 'qs';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function cloneDeep<T extends object>(obj: T): T {
+  return JSON.parse(JSON.stringify(obj)) as T;
+}
+
+function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
+  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
+  for (const [key, val] of Object.entries(filter)) {
+    (base as Record<string, unknown>)[key] = val;
+  }
+  return base;
+}
+
+router.get('/items', (req: Request, res: Response) => {
+  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
+  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
+  const baseQuery = { page: 1, limit: 20, active: true };
+  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
+  res.json({ query: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-044 2.ts

@@ -1,36 +1,36 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: eval() called with user-controlled expression in typed handler
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface CalcRequest {
-  expression: string;
-}
-
-router.post('/calc', (req: Request, res: Response) => {
-  const { expression } = req.body as CalcRequest;
-  try {
-    // TypeScript types don't prevent runtime eval injection
-    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
-    // eslint-disable-next-line no-eval
-    const result = eval(expression);
-    res.json({ result });
-  } catch (err: any) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.get('/render-tpl', (req: Request, res: Response) => {
-  const tpl = req.query.tpl as string;
-  const user = req.session?.user ?? {};
-  // eval of backtick template with user-controlled string
-  const output = eval('`' + tpl + '`');
-  res.send(output);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: eval() called with user-controlled expression in typed handler
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface CalcRequest {
+  expression: string;
+}
+
+router.post('/calc', (req: Request, res: Response) => {
+  const { expression } = req.body as CalcRequest;
+  try {
+    // TypeScript types don't prevent runtime eval injection
+    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
+    // eslint-disable-next-line no-eval
+    const result = eval(expression);
+    res.json({ result });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.get('/render-tpl', (req: Request, res: Response) => {
+  const tpl = req.query.tpl as string;
+  const user = req.session?.user ?? {};
+  // eval of backtick template with user-controlled string
+  const output = eval('`' + tpl + '`');
+  res.send(output);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-044.ts

@@ -1,36 +1,36 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: eval() called with user-controlled expression in typed handler
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface CalcRequest {
-  expression: string;
-}
-
-router.post('/calc', (req: Request, res: Response) => {
-  const { expression } = req.body as CalcRequest;
-  try {
-    // TypeScript types don't prevent runtime eval injection
-    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
-    // eslint-disable-next-line no-eval
-    const result = eval(expression);
-    res.json({ result });
-  } catch (err: any) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.get('/render-tpl', (req: Request, res: Response) => {
-  const tpl = req.query.tpl as string;
-  const user = req.session?.user ?? {};
-  // eval of backtick template with user-controlled string
-  const output = eval('`' + tpl + '`');
-  res.send(output);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: eval() called with user-controlled expression in typed handler
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface CalcRequest {
+  expression: string;
+}
+
+router.post('/calc', (req: Request, res: Response) => {
+  const { expression } = req.body as CalcRequest;
+  try {
+    // TypeScript types don't prevent runtime eval injection
+    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
+    // eslint-disable-next-line no-eval
+    const result = eval(expression);
+    res.json({ result });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.get('/render-tpl', (req: Request, res: Response) => {
+  const tpl = req.query.tpl as string;
+  const user = req.session?.user ?? {};
+  // eval of backtick template with user-controlled string
+  const output = eval('`' + tpl + '`');
+  res.send(output);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-045 2.ts

@@ -1,39 +1,39 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: new Function() constructor with user-supplied code string in typed scripting service
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScriptRequest {
-  code: string;
-  context?: Record<string, unknown>;
-}
-
-function executeUserScript(code: string, context: Record<string, unknown>): unknown {
-  // new Function() is not sandboxed — full access to global scope
-  const fn = new Function('ctx', 'Math', 'JSON', `
-    with (ctx) {
-      ${code}
-    }
-  `);
-  return fn(context, Math, JSON);
-}
-
-router.post('/scripting/execute', (req: Request, res: Response) => {
-  const { code, context = {} } = req.body as ScriptRequest;
-  const result = executeUserScript(code, context);
-  res.json({ result });
-});
-
-router.post('/hooks/transform', (req: Request, res: Response) => {
-  const { transformCode } = req.body;
-  const transform = new Function('data', 'helpers', transformCode);
-  const output = transform(req.body.data, { JSON, Math });
-  res.json({ output });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: new Function() constructor with user-supplied code string in typed scripting service
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ScriptRequest {
+  code: string;
+  context?: Record<string, unknown>;
+}
+
+function executeUserScript(code: string, context: Record<string, unknown>): unknown {
+  // new Function() is not sandboxed — full access to global scope
+  const fn = new Function('ctx', 'Math', 'JSON', `
+    with (ctx) {
+      ${code}
+    }
+  `);
+  return fn(context, Math, JSON);
+}
+
+router.post('/scripting/execute', (req: Request, res: Response) => {
+  const { code, context = {} } = req.body as ScriptRequest;
+  const result = executeUserScript(code, context);
+  res.json({ result });
+});
+
+router.post('/hooks/transform', (req: Request, res: Response) => {
+  const { transformCode } = req.body;
+  const transform = new Function('data', 'helpers', transformCode);
+  const output = transform(req.body.data, { JSON, Math });
+  res.json({ output });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-045.ts

@@ -1,39 +1,39 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: new Function() constructor with user-supplied code string in typed scripting service
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScriptRequest {
-  code: string;
-  context?: Record<string, unknown>;
-}
-
-function executeUserScript(code: string, context: Record<string, unknown>): unknown {
-  // new Function() is not sandboxed — full access to global scope
-  const fn = new Function('ctx', 'Math', 'JSON', `
-    with (ctx) {
-      ${code}
-    }
-  `);
-  return fn(context, Math, JSON);
-}
-
-router.post('/scripting/execute', (req: Request, res: Response) => {
-  const { code, context = {} } = req.body as ScriptRequest;
-  const result = executeUserScript(code, context);
-  res.json({ result });
-});
-
-router.post('/hooks/transform', (req: Request, res: Response) => {
-  const { transformCode } = req.body;
-  const transform = new Function('data', 'helpers', transformCode);
-  const output = transform(req.body.data, { JSON, Math });
-  res.json({ output });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: new Function() constructor with user-supplied code string in typed scripting service
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ScriptRequest {
+  code: string;
+  context?: Record<string, unknown>;
+}
+
+function executeUserScript(code: string, context: Record<string, unknown>): unknown {
+  // new Function() is not sandboxed — full access to global scope
+  const fn = new Function('ctx', 'Math', 'JSON', `
+    with (ctx) {
+      ${code}
+    }
+  `);
+  return fn(context, Math, JSON);
+}
+
+router.post('/scripting/execute', (req: Request, res: Response) => {
+  const { code, context = {} } = req.body as ScriptRequest;
+  const result = executeUserScript(code, context);
+  res.json({ result });
+});
+
+router.post('/hooks/transform', (req: Request, res: Response) => {
+  const { transformCode } = req.body;
+  const transform = new Function('data', 'helpers', transformCode);
+  const output = transform(req.body.data, { JSON, Math });
+  res.json({ output });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-046 2.ts

@@ -1,41 +1,41 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: typescript
-// expected: eval() inside JSON reviver executing serialized function strings from DB
-
-interface SerializedConfig {
-  [key: string]: unknown;
-}
-
-export function deserializeConfig(raw: string): SerializedConfig {
-  return JSON.parse(raw, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__function__:')) {
-      const fnBody = value.slice(13);
-      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
-      // eslint-disable-next-line no-eval
-      return eval(`(${fnBody})`);
-    }
-    return value;
-  });
-}
-
-interface PipelineStep {
-  name: string;
-  handler: ((input: unknown) => unknown) | string;
-}
-
-export function loadPipeline(configJson: string): PipelineStep[] {
-  const config = deserializeConfig(configJson);
-  return config.steps as PipelineStep[];
-}
-
-export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
-  let result = input;
-  for (const step of steps) {
-    if (typeof step.handler === 'function') {
-      result = await step.handler(result);
-    }
-  }
-  return result;
-}
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: typescript
+// expected: eval() inside JSON reviver executing serialized function strings from DB
+
+interface SerializedConfig {
+  [key: string]: unknown;
+}
+
+export function deserializeConfig(raw: string): SerializedConfig {
+  return JSON.parse(raw, (key, value) => {
+    if (typeof value === 'string' && value.startsWith('__function__:')) {
+      const fnBody = value.slice(13);
+      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
+      // eslint-disable-next-line no-eval
+      return eval(`(${fnBody})`);
+    }
+    return value;
+  });
+}
+
+interface PipelineStep {
+  name: string;
+  handler: ((input: unknown) => unknown) | string;
+}
+
+export function loadPipeline(configJson: string): PipelineStep[] {
+  const config = deserializeConfig(configJson);
+  return config.steps as PipelineStep[];
+}
+
+export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
+  let result = input;
+  for (const step of steps) {
+    if (typeof step.handler === 'function') {
+      result = await step.handler(result);
+    }
+  }
+  return result;
+}