thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/csharp/seed-031.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: csharp
-// expected: Path traversal via FileStream opened from user-supplied config name
-
-using System.IO;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ConfigController : ControllerBase
-    {
-        private const string ConfigDir = "/etc/appservice/configs/";
-
-        [HttpGet("{configName}")]
-        public IActionResult GetConfig(string configName)
-        {
-            // Vulnerable: configName not validated; ../../etc/shadow possible
-            string filePath = ConfigDir + configName + ".json";
-            using var fs     = new FileStream(filePath, FileMode.Open, FileAccess.Read);
-            using var reader = new StreamReader(fs);
-            return Ok(reader.ReadToEnd());
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via FileStream opened from user-supplied config name
+
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ConfigController : ControllerBase
+    {
+        private const string ConfigDir = "/etc/appservice/configs/";
+
+        [HttpGet("{configName}")]
+        public IActionResult GetConfig(string configName)
+        {
+            // Vulnerable: configName not validated; ../../etc/shadow possible
+            string filePath = ConfigDir + configName + ".json";
+            using var fs     = new FileStream(filePath, FileMode.Open, FileAccess.Read);
+            using var reader = new StreamReader(fs);
+            return Ok(reader.ReadToEnd());
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-032.cs

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: csharp
-// expected: Path traversal in file delete via Directory.Delete with user-controlled path
-
-using System.IO;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class CleanupController : ControllerBase
-    {
-        private const string UploadRoot = "/var/uploads/";
-
-        [HttpDelete]
-        public IActionResult DeleteFile([FromQuery] string relativePath)
-        {
-            // Vulnerable: relativePath with ../ can delete files outside UploadRoot
-            string fullPath = Path.Combine(UploadRoot, relativePath);
-            if (Directory.Exists(fullPath))
-                Directory.Delete(fullPath, recursive: true);
-            else if (File.Exists(fullPath))
-                File.Delete(fullPath);
-            return Ok("Deleted");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal in file delete via Directory.Delete with user-controlled path
+
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class CleanupController : ControllerBase
+    {
+        private const string UploadRoot = "/var/uploads/";
+
+        [HttpDelete]
+        public IActionResult DeleteFile([FromQuery] string relativePath)
+        {
+            // Vulnerable: relativePath with ../ can delete files outside UploadRoot
+            string fullPath = Path.Combine(UploadRoot, relativePath);
+            if (Directory.Exists(fullPath))
+                Directory.Delete(fullPath, recursive: true);
+            else if (File.Exists(fullPath))
+                File.Delete(fullPath);
+            return Ok("Deleted");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-033.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: csharp
-// expected: Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files
-
-using System.IO;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ReportController : ControllerBase
-    {
-        private const string ReportBase = "/var/reports/";
-
-        [HttpPost]
-        public IActionResult SaveReport([FromQuery] string reportName, [FromBody] string content)
-        {
-            // Vulnerable: reportName can traverse directory (../../etc/cron.d/evil)
-            string outputPath = ReportBase + reportName + ".txt";
-            File.WriteAllText(outputPath, content);
-            return Ok($"Saved to {outputPath}");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files
+
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ReportController : ControllerBase
+    {
+        private const string ReportBase = "/var/reports/";
+
+        [HttpPost]
+        public IActionResult SaveReport([FromQuery] string reportName, [FromBody] string content)
+        {
+            // Vulnerable: reportName can traverse directory (../../etc/cron.d/evil)
+            string outputPath = ReportBase + reportName + ".txt";
+            File.WriteAllText(outputPath, content);
+            return Ok($"Saved to {outputPath}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-034.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: csharp
-// expected: MD5 used for password hashing via MD5.Create()
-
-using System.Security.Cryptography;
-using System.Text;
-
-namespace App.Security
-{
-    public class PasswordHasher
-    {
-        // Vulnerable: MD5 is cryptographically broken and unsalted
-        public static string HashPassword(string password)
-        {
-            using var md5  = MD5.Create();
-            byte[] hash    = md5.ComputeHash(Encoding.UTF8.GetBytes(password));
-            return BitConverter.ToString(hash).Replace("-", "").ToLower();
-        }
-
-        public static bool Verify(string password, string storedHash)
-            => HashPassword(password) == storedHash;
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: MD5 used for password hashing via MD5.Create()
+
+using System.Security.Cryptography;
+using System.Text;
+
+namespace App.Security
+{
+    public class PasswordHasher
+    {
+        // Vulnerable: MD5 is cryptographically broken and unsalted
+        public static string HashPassword(string password)
+        {
+            using var md5  = MD5.Create();
+            byte[] hash    = md5.ComputeHash(Encoding.UTF8.GetBytes(password));
+            return BitConverter.ToString(hash).Replace("-", "").ToLower();
+        }
+
+        public static bool Verify(string password, string storedHash)
+            => HashPassword(password) == storedHash;
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-035.cs

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: csharp
-// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
-
-using System.IO;
-using System.Security.Cryptography;
-using System.Text;
-
-namespace App.Security
-{
-    public class LegacyEncryptor
-    {
-        private static readonly byte[] Key = Encoding.ASCII.GetBytes("8ByteKey");
-        private static readonly byte[] IV  = Encoding.ASCII.GetBytes("InitVec!");
-
-        // Vulnerable: DES is broken — 56-bit key susceptible to brute force
-        public static byte[] Encrypt(string plaintext)
-        {
-            using var des    = DES.Create();
-            des.Key          = Key;
-            des.IV           = IV;
-            using var ms     = new MemoryStream();
-            using var cs     = new CryptoStream(ms, des.CreateEncryptor(), CryptoStreamMode.Write);
-            byte[] data      = Encoding.UTF8.GetBytes(plaintext);
-            cs.Write(data, 0, data.Length);
-            cs.FlushFinalBlock();
-            return ms.ToArray();
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: csharp
+// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
+
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace App.Security
+{
+    public class LegacyEncryptor
+    {
+        private static readonly byte[] Key = Encoding.ASCII.GetBytes("8ByteKey");
+        private static readonly byte[] IV  = Encoding.ASCII.GetBytes("InitVec!");
+
+        // Vulnerable: DES is broken — 56-bit key susceptible to brute force
+        public static byte[] Encrypt(string plaintext)
+        {
+            using var des    = DES.Create();
+            des.Key          = Key;
+            des.IV           = IV;
+            using var ms     = new MemoryStream();
+            using var cs     = new CryptoStream(ms, des.CreateEncryptor(), CryptoStreamMode.Write);
+            byte[] data      = Encoding.UTF8.GetBytes(plaintext);
+            cs.Write(data, 0, data.Length);
+            cs.FlushFinalBlock();
+            return ms.ToArray();
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-036.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: csharp
-// expected: System.Random used instead of RNGCryptoServiceProvider for token generation
-
-using System;
-
-namespace App.Security
-{
-    public class TokenService
-    {
-        // Vulnerable: System.Random is not cryptographically secure
-        private static readonly Random Rng = new Random();
-        private const string Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-
-        public static string GenerateToken(int length = 32)
-        {
-            var sb = new System.Text.StringBuilder(length);
-            for (int i = 0; i < length; i++)
-                sb.Append(Alphabet[Rng.Next(Alphabet.Length)]);
-            return sb.ToString();
-        }
-
-        public static string GenerateCsrfToken() => GenerateToken(24);
-        public static string GeneratePasswordReset() => GenerateToken(40);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: System.Random used instead of RNGCryptoServiceProvider for token generation
+
+using System;
+
+namespace App.Security
+{
+    public class TokenService
+    {
+        // Vulnerable: System.Random is not cryptographically secure
+        private static readonly Random Rng = new Random();
+        private const string Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+
+        public static string GenerateToken(int length = 32)
+        {
+            var sb = new System.Text.StringBuilder(length);
+            for (int i = 0; i < length; i++)
+                sb.Append(Alphabet[Rng.Next(Alphabet.Length)]);
+            return sb.ToString();
+        }
+
+        public static string GenerateCsrfToken() => GenerateToken(24);
+        public static string GeneratePasswordReset() => GenerateToken(40);
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-037.cs

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: csharp
-// expected: SHA1 used for HMAC signing instead of SHA256 or higher
-
-using System.Security.Cryptography;
-using System.Text;
-
-namespace App.Security
-{
-    public class SignatureService
-    {
-        // Vulnerable: HMACSHA1 is weak for new applications
-        public static string Sign(string data, string key)
-        {
-            using var hmac = new HMACSHA1(Encoding.UTF8.GetBytes(key));
-            byte[] hash    = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
-            return Convert.ToBase64String(hash);
-        }
-
-        // Vulnerable: MD5 used for payload integrity
-        public static string ComputeMd5(byte[] data)
-        {
-            using var md5 = MD5.Create();
-            return BitConverter.ToString(md5.ComputeHash(data)).Replace("-", "");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: SHA1 used for HMAC signing instead of SHA256 or higher
+
+using System.Security.Cryptography;
+using System.Text;
+
+namespace App.Security
+{
+    public class SignatureService
+    {
+        // Vulnerable: HMACSHA1 is weak for new applications
+        public static string Sign(string data, string key)
+        {
+            using var hmac = new HMACSHA1(Encoding.UTF8.GetBytes(key));
+            byte[] hash    = hmac.ComputeHash(Encoding.UTF8.GetBytes(data));
+            return Convert.ToBase64String(hash);
+        }
+
+        // Vulnerable: MD5 used for payload integrity
+        public static string ComputeMd5(byte[] data)
+        {
+            using var md5 = MD5.Create();
+            return BitConverter.ToString(md5.ComputeHash(data)).Replace("-", "");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-038.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: csharp
-// expected: AES-ECB mode used for encryption (no IV, leaks data patterns)
-
-using System.IO;
-using System.Security.Cryptography;
-using System.Text;
-
-namespace App.Security
-{
-    public class AesEcbEncryptor
-    {
-        private static readonly byte[] Key = Encoding.ASCII.GetBytes("1234567890abcdef");
-
-        // Vulnerable: AES in ECB mode — identical plaintext blocks produce identical ciphertext
-        public static byte[] Encrypt(byte[] data)
-        {
-            using var aes = Aes.Create();
-            aes.Key       = Key;
-            aes.Mode      = CipherMode.ECB;
-            aes.Padding   = PaddingMode.PKCS7;
-            using var encryptor = aes.CreateEncryptor();
-            return encryptor.TransformFinalBlock(data, 0, data.Length);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: csharp
+// expected: AES-ECB mode used for encryption (no IV, leaks data patterns)
+
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace App.Security
+{
+    public class AesEcbEncryptor
+    {
+        private static readonly byte[] Key = Encoding.ASCII.GetBytes("1234567890abcdef");
+
+        // Vulnerable: AES in ECB mode — identical plaintext blocks produce identical ciphertext
+        public static byte[] Encrypt(byte[] data)
+        {
+            using var aes = Aes.Create();
+            aes.Key       = Key;
+            aes.Mode      = CipherMode.ECB;
+            aes.Padding   = PaddingMode.PKCS7;
+            using var encryptor = aes.CreateEncryptor();
+            return encryptor.TransformFinalBlock(data, 0, data.Length);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-039.cs

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: csharp
-// expected: Unsafe deserialization via BinaryFormatter.Deserialize on untrusted stream
-
-using System.IO;
-using System.Runtime.Serialization.Formatters.Binary;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class SessionController : ControllerBase
-    {
-        [HttpPost("restore")]
-        public IActionResult RestoreSession()
-        {
-            // Vulnerable: BinaryFormatter can execute arbitrary code via gadget chains
-            var formatter = new BinaryFormatter();
-#pragma warning disable SYSLIB0011
-            object data = formatter.Deserialize(Request.Body);
-#pragma warning restore SYSLIB0011
-            HttpContext.Session.SetString("data", data.ToString());
-            return Ok("Session restored");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via BinaryFormatter.Deserialize on untrusted stream
+
+using System.IO;
+using System.Runtime.Serialization.Formatters.Binary;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class SessionController : ControllerBase
+    {
+        [HttpPost("restore")]
+        public IActionResult RestoreSession()
+        {
+            // Vulnerable: BinaryFormatter can execute arbitrary code via gadget chains
+            var formatter = new BinaryFormatter();
+#pragma warning disable SYSLIB0011
+            object data = formatter.Deserialize(Request.Body);
+#pragma warning restore SYSLIB0011
+            HttpContext.Session.SetString("data", data.ToString());
+            return Ok("Session restored");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-040.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: csharp
-// expected: Unsafe deserialization via JsonConvert with TypeNameHandling.All on user input
-
-using Newtonsoft.Json;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class DataController : ControllerBase
-    {
-        [HttpPost("load")]
-        public IActionResult Load([FromBody] string json)
-        {
-            // Vulnerable: TypeNameHandling.All allows attacker to specify arbitrary type
-            var settings = new JsonSerializerSettings
-            {
-                TypeNameHandling = TypeNameHandling.All
-            };
-            object result = JsonConvert.DeserializeObject(json, settings);
-            return Ok(result?.GetType().Name);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via JsonConvert with TypeNameHandling.All on user input
+
+using Newtonsoft.Json;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class DataController : ControllerBase
+    {
+        [HttpPost("load")]
+        public IActionResult Load([FromBody] string json)
+        {
+            // Vulnerable: TypeNameHandling.All allows attacker to specify arbitrary type
+            var settings = new JsonSerializerSettings
+            {
+                TypeNameHandling = TypeNameHandling.All
+            };
+            object result = JsonConvert.DeserializeObject(json, settings);
+            return Ok(result?.GetType().Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-041.cs

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: csharp
-// expected: Unsafe deserialization via BinaryFormatter on Base64-decoded cookie value
-
-using System;
-using System.IO;
-using System.Runtime.Serialization.Formatters.Binary;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class AuthController : ControllerBase
-    {
-        [HttpGet("me")]
-        public IActionResult GetCurrentUser()
-        {
-            string cookie = Request.Cookies["session"];
-            if (cookie == null) return Unauthorized();
-
-            byte[] data = Convert.FromBase64String(cookie);
-            // Vulnerable: attacker-crafted cookie triggers gadget chain
-            var formatter = new BinaryFormatter();
-#pragma warning disable SYSLIB0011
-            object principal = formatter.Deserialize(new MemoryStream(data));
-#pragma warning restore SYSLIB0011
-            return Ok(principal.ToString());
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via BinaryFormatter on Base64-decoded cookie value
+
+using System;
+using System.IO;
+using System.Runtime.Serialization.Formatters.Binary;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AuthController : ControllerBase
+    {
+        [HttpGet("me")]
+        public IActionResult GetCurrentUser()
+        {
+            string cookie = Request.Cookies["session"];
+            if (cookie == null) return Unauthorized();
+
+            byte[] data = Convert.FromBase64String(cookie);
+            // Vulnerable: attacker-crafted cookie triggers gadget chain
+            var formatter = new BinaryFormatter();
+#pragma warning disable SYSLIB0011
+            object principal = formatter.Deserialize(new MemoryStream(data));
+#pragma warning restore SYSLIB0011
+            return Ok(principal.ToString());
+        }
+    }
+}