thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/ts/seed-046.ts

@@ -1,41 +1,41 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: typescript
-// expected: eval() inside JSON reviver executing serialized function strings from DB
-
-interface SerializedConfig {
-  [key: string]: unknown;
-}
-
-export function deserializeConfig(raw: string): SerializedConfig {
-  return JSON.parse(raw, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__function__:')) {
-      const fnBody = value.slice(13);
-      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
-      // eslint-disable-next-line no-eval
-      return eval(`(${fnBody})`);
-    }
-    return value;
-  });
-}
-
-interface PipelineStep {
-  name: string;
-  handler: ((input: unknown) => unknown) | string;
-}
-
-export function loadPipeline(configJson: string): PipelineStep[] {
-  const config = deserializeConfig(configJson);
-  return config.steps as PipelineStep[];
-}
-
-export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
-  let result = input;
-  for (const step of steps) {
-    if (typeof step.handler === 'function') {
-      result = await step.handler(result);
-    }
-  }
-  return result;
-}
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: typescript
+// expected: eval() inside JSON reviver executing serialized function strings from DB
+
+interface SerializedConfig {
+  [key: string]: unknown;
+}
+
+export function deserializeConfig(raw: string): SerializedConfig {
+  return JSON.parse(raw, (key, value) => {
+    if (typeof value === 'string' && value.startsWith('__function__:')) {
+      const fnBody = value.slice(13);
+      // eval executes arbitrary code stored in the config (from DB, user-uploaded file, etc.)
+      // eslint-disable-next-line no-eval
+      return eval(`(${fnBody})`);
+    }
+    return value;
+  });
+}
+
+interface PipelineStep {
+  name: string;
+  handler: ((input: unknown) => unknown) | string;
+}
+
+export function loadPipeline(configJson: string): PipelineStep[] {
+  const config = deserializeConfig(configJson);
+  return config.steps as PipelineStep[];
+}
+
+export async function executePipeline(steps: PipelineStep[], input: unknown): Promise<unknown> {
+  let result = input;
+  for (const step of steps) {
+    if (typeof step.handler === 'function') {
+      result = await step.handler(result);
+    }
+  }
+  return result;
+}

package/dist/packages/crucible/seeds/ts/seed-047 2.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: lodash template compilation with user-controlled template string (code execution)
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface TemplateRequest {
-  template: string;
-  data: Record<string, unknown>;
-}
-
-router.post('/email/preview', async (req: Request, res: Response) => {
-  const { template, data } = req.body as TemplateRequest;
-  // _.template compiles and executes JS inside <%= %> delimiters
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const output = compiled(data);
-  res.type('text/html').send(output);
-});
-
-router.get('/report/preview', (req: Request, res: Response) => {
-  const tpl = req.query.template as string;
-  const vars = JSON.parse(req.query.vars as string ?? '{}');
-  const compiled = _.template(tpl);
-  res.send(compiled(vars));
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: lodash template compilation with user-controlled template string (code execution)
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface TemplateRequest {
+  template: string;
+  data: Record<string, unknown>;
+}
+
+router.post('/email/preview', async (req: Request, res: Response) => {
+  const { template, data } = req.body as TemplateRequest;
+  // _.template compiles and executes JS inside <%= %> delimiters
+  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
+  const compiled = _.template(template);
+  const output = compiled(data);
+  res.type('text/html').send(output);
+});
+
+router.get('/report/preview', (req: Request, res: Response) => {
+  const tpl = req.query.template as string;
+  const vars = JSON.parse(req.query.vars as string ?? '{}');
+  const compiled = _.template(tpl);
+  res.send(compiled(vars));
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-047.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: typescript
-// expected: lodash template compilation with user-controlled template string (code execution)
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface TemplateRequest {
-  template: string;
-  data: Record<string, unknown>;
-}
-
-router.post('/email/preview', async (req: Request, res: Response) => {
-  const { template, data } = req.body as TemplateRequest;
-  // _.template compiles and executes JS inside <%= %> delimiters
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const output = compiled(data);
-  res.type('text/html').send(output);
-});
-
-router.get('/report/preview', (req: Request, res: Response) => {
-  const tpl = req.query.template as string;
-  const vars = JSON.parse(req.query.vars as string ?? '{}');
-  const compiled = _.template(tpl);
-  res.send(compiled(vars));
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: lodash template compilation with user-controlled template string (code execution)
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface TemplateRequest {
+  template: string;
+  data: Record<string, unknown>;
+}
+
+router.post('/email/preview', async (req: Request, res: Response) => {
+  const { template, data } = req.body as TemplateRequest;
+  // _.template compiles and executes JS inside <%= %> delimiters
+  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
+  const compiled = _.template(template);
+  const output = compiled(data);
+  res.type('text/html').send(output);
+});
+
+router.get('/report/preview', (req: Request, res: Response) => {
+  const tpl = req.query.template as string;
+  const vars = JSON.parse(req.query.vars as string ?? '{}');
+  const compiled = _.template(tpl);
+  res.send(compiled(vars));
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-048 2.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via fetch with unvalidated user-supplied URL
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ProxyRequest {
-  url: string;
-  method?: 'GET' | 'POST';
-  headers?: Record<string, string>;
-}
-
-router.post('/proxy', async (req: Request, res: Response) => {
-  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
-  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
-  const response = await fetch(url, { method, headers });
-  const body = await response.text();
-  res.status(response.status).send(body);
-});
-
-router.get('/preview', async (req: Request, res: Response) => {
-  const targetUrl = req.query.url as string;
-  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
-  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
-  const data = await resp.text();
-  res.json({ preview: data.slice(0, 500) });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via fetch with unvalidated user-supplied URL
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ProxyRequest {
+  url: string;
+  method?: 'GET' | 'POST';
+  headers?: Record<string, string>;
+}
+
+router.post('/proxy', async (req: Request, res: Response) => {
+  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
+  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
+  const response = await fetch(url, { method, headers });
+  const body = await response.text();
+  res.status(response.status).send(body);
+});
+
+router.get('/preview', async (req: Request, res: Response) => {
+  const targetUrl = req.query.url as string;
+  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
+  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
+  const data = await resp.text();
+  res.json({ preview: data.slice(0, 500) });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-048.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via fetch with unvalidated user-supplied URL
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ProxyRequest {
-  url: string;
-  method?: 'GET' | 'POST';
-  headers?: Record<string, string>;
-}
-
-router.post('/proxy', async (req: Request, res: Response) => {
-  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
-  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
-  const response = await fetch(url, { method, headers });
-  const body = await response.text();
-  res.status(response.status).send(body);
-});
-
-router.get('/preview', async (req: Request, res: Response) => {
-  const targetUrl = req.query.url as string;
-  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
-  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
-  const data = await resp.text();
-  res.json({ preview: data.slice(0, 500) });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via fetch with unvalidated user-supplied URL
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface ProxyRequest {
+  url: string;
+  method?: 'GET' | 'POST';
+  headers?: Record<string, string>;
+}
+
+router.post('/proxy', async (req: Request, res: Response) => {
+  const { url, method = 'GET', headers = {} } = req.body as ProxyRequest;
+  // No URL validation — allows SSRF to internal services, cloud metadata, etc.
+  const response = await fetch(url, { method, headers });
+  const body = await response.text();
+  res.status(response.status).send(body);
+});
+
+router.get('/preview', async (req: Request, res: Response) => {
+  const targetUrl = req.query.url as string;
+  // Attacker: ?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
+  const resp = await fetch(targetUrl, { signal: AbortSignal.timeout(5000) });
+  const data = await resp.text();
+  res.json({ preview: data.slice(0, 500) });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-049 2.ts

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via axios with user-controlled webhook URL and redirect following
-
-import axios from 'axios';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface WebhookConfig {
-  url: string;
-  secret?: string;
-}
-
-router.post('/webhooks/test', async (req: Request, res: Response) => {
-  const { url, secret } = req.body as WebhookConfig;
-  // url user-controlled — attacker probes internal network
-  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
-    headers: { 'X-Webhook-Secret': secret ?? '' },
-    maxRedirects: 5,  // follows redirects — can pivot to internal services
-    timeout: 10000,
-  });
-  res.json({ status: response.status, data: response.data });
-});
-
-router.get('/import', async (req: Request, res: Response) => {
-  const dataUrl = req.query.source as string;
-  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
-  res.set('Content-Type', 'application/octet-stream').send(data);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via axios with user-controlled webhook URL and redirect following
+
+import axios from 'axios';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface WebhookConfig {
+  url: string;
+  secret?: string;
+}
+
+router.post('/webhooks/test', async (req: Request, res: Response) => {
+  const { url, secret } = req.body as WebhookConfig;
+  // url user-controlled — attacker probes internal network
+  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
+    headers: { 'X-Webhook-Secret': secret ?? '' },
+    maxRedirects: 5,  // follows redirects — can pivot to internal services
+    timeout: 10000,
+  });
+  res.json({ status: response.status, data: response.data });
+});
+
+router.get('/import', async (req: Request, res: Response) => {
+  const dataUrl = req.query.source as string;
+  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
+  res.set('Content-Type', 'application/octet-stream').send(data);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-049.ts

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via axios with user-controlled webhook URL and redirect following
-
-import axios from 'axios';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface WebhookConfig {
-  url: string;
-  secret?: string;
-}
-
-router.post('/webhooks/test', async (req: Request, res: Response) => {
-  const { url, secret } = req.body as WebhookConfig;
-  // url user-controlled — attacker probes internal network
-  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
-    headers: { 'X-Webhook-Secret': secret ?? '' },
-    maxRedirects: 5,  // follows redirects — can pivot to internal services
-    timeout: 10000,
-  });
-  res.json({ status: response.status, data: response.data });
-});
-
-router.get('/import', async (req: Request, res: Response) => {
-  const dataUrl = req.query.source as string;
-  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
-  res.set('Content-Type', 'application/octet-stream').send(data);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via axios with user-controlled webhook URL and redirect following
+
+import axios from 'axios';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface WebhookConfig {
+  url: string;
+  secret?: string;
+}
+
+router.post('/webhooks/test', async (req: Request, res: Response) => {
+  const { url, secret } = req.body as WebhookConfig;
+  // url user-controlled — attacker probes internal network
+  const response = await axios.post(url, { test: true, timestamp: Date.now() }, {
+    headers: { 'X-Webhook-Secret': secret ?? '' },
+    maxRedirects: 5,  // follows redirects — can pivot to internal services
+    timeout: 10000,
+  });
+  res.json({ status: response.status, data: response.data });
+});
+
+router.get('/import', async (req: Request, res: Response) => {
+  const dataUrl = req.query.source as string;
+  const { data } = await axios.get(dataUrl, { responseType: 'arraybuffer' });
+  res.set('Content-Type', 'application/octet-stream').send(data);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-050 2.ts

@@ -1,41 +1,41 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
-
-import got from 'got';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface LinkPreviewResult {
-  title: string;
-  description: string;
-  image?: string;
-  url: string;
-}
-
-router.get('/link-preview', async (req: Request, res: Response) => {
-  const url = req.query.url as string;
-
-  // url is user-controlled — attacker can reach internal services
-  const response = await got(url, {
-    followRedirect: true,
-    timeout: { request: 8000 },
-    throwHttpErrors: false,
-  });
-
-  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
-  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
-
-  const result: LinkPreviewResult = {
-    title: titleMatch?.[1] ?? '',
-    description: descMatch?.[1] ?? '',
-    url,
-  };
-
-  res.json(result);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
+
+import got from 'got';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface LinkPreviewResult {
+  title: string;
+  description: string;
+  image?: string;
+  url: string;
+}
+
+router.get('/link-preview', async (req: Request, res: Response) => {
+  const url = req.query.url as string;
+
+  // url is user-controlled — attacker can reach internal services
+  const response = await got(url, {
+    followRedirect: true,
+    timeout: { request: 8000 },
+    throwHttpErrors: false,
+  });
+
+  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
+  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
+
+  const result: LinkPreviewResult = {
+    title: titleMatch?.[1] ?? '',
+    description: descMatch?.[1] ?? '',
+    url,
+  };
+
+  res.json(result);
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-050.ts

@@ -1,41 +1,41 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: typescript
-// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
-
-import got from 'got';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface LinkPreviewResult {
-  title: string;
-  description: string;
-  image?: string;
-  url: string;
-}
-
-router.get('/link-preview', async (req: Request, res: Response) => {
-  const url = req.query.url as string;
-
-  // url is user-controlled — attacker can reach internal services
-  const response = await got(url, {
-    followRedirect: true,
-    timeout: { request: 8000 },
-    throwHttpErrors: false,
-  });
-
-  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
-  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
-
-  const result: LinkPreviewResult = {
-    title: titleMatch?.[1] ?? '',
-    description: descMatch?.[1] ?? '',
-    url,
-  };
-
-  res.json(result);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: typescript
+// expected: SSRF via got library with user-controlled URL in oEmbed/link-preview feature
+
+import got from 'got';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface LinkPreviewResult {
+  title: string;
+  description: string;
+  image?: string;
+  url: string;
+}
+
+router.get('/link-preview', async (req: Request, res: Response) => {
+  const url = req.query.url as string;
+
+  // url is user-controlled — attacker can reach internal services
+  const response = await got(url, {
+    followRedirect: true,
+    timeout: { request: 8000 },
+    throwHttpErrors: false,
+  });
+
+  const titleMatch = response.body.match(/<title>(.*?)<\/title>/i);
+  const descMatch = response.body.match(/<meta name="description" content="(.*?)"/i);
+
+  const result: LinkPreviewResult = {
+    title: titleMatch?.[1] ?? '',
+    description: descMatch?.[1] ?? '',
+    url,
+  };
+
+  res.json(result);
+});
+
+export default router;