thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/java/seed-019.java

@@ -1,38 +1,38 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: Stored XSS — user-supplied comment written to DB then reflected without escaping
-
-import java.io.*;
-import java.sql.*;
-import javax.servlet.http.*;
-
-public class CommentServlet extends HttpServlet {
-    private Connection conn;
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, SQLException {
-        String comment  = req.getParameter("comment");
-        String username = req.getParameter("username");
-        // Store raw (vulnerable: no sanitization before storage)
-        PreparedStatement ps = conn.prepareStatement(
-            "INSERT INTO comments(username, body) VALUES (?, ?)");
-        ps.setString(1, username);
-        ps.setString(2, comment);
-        ps.executeUpdate();
-        resp.sendRedirect("/comments");
-    }
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, SQLException {
-        PrintWriter out = resp.getWriter();
-        ResultSet rs = conn.createStatement().executeQuery(
-            "SELECT username, body FROM comments ORDER BY id DESC LIMIT 20");
-        while (rs.next()) {
-            // Vulnerable: stored comment reflected without escaping
-            out.println("<div><b>" + rs.getString("username") + "</b>: "
-                + rs.getString("body") + "</div>");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: Stored XSS — user-supplied comment written to DB then reflected without escaping
+
+import java.io.*;
+import java.sql.*;
+import javax.servlet.http.*;
+
+public class CommentServlet extends HttpServlet {
+    private Connection conn;
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, SQLException {
+        String comment  = req.getParameter("comment");
+        String username = req.getParameter("username");
+        // Store raw (vulnerable: no sanitization before storage)
+        PreparedStatement ps = conn.prepareStatement(
+            "INSERT INTO comments(username, body) VALUES (?, ?)");
+        ps.setString(1, username);
+        ps.setString(2, comment);
+        ps.executeUpdate();
+        resp.sendRedirect("/comments");
+    }
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, SQLException {
+        PrintWriter out = resp.getWriter();
+        ResultSet rs = conn.createStatement().executeQuery(
+            "SELECT username, body FROM comments ORDER BY id DESC LIMIT 20");
+        while (rs.next()) {
+            // Vulnerable: stored comment reflected without escaping
+            out.println("<div><b>" + rs.getString("username") + "</b>: "
+                + rs.getString("body") + "</div>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-020.java

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via JSON response that directly embeds user input in HTML script block
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ProfileServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String username    = req.getParameter("user");
-        String redirectUrl = req.getParameter("next");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        // Vulnerable: user input injected into inline JS
-        out.println("<script>");
-        out.println("var currentUser = \"" + username + "\";");
-        out.println("var nextUrl = \"" + redirectUrl + "\";");
-        out.println("window.location = nextUrl;");
-        out.println("</script>");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via JSON response that directly embeds user input in HTML script block
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ProfileServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String username    = req.getParameter("user");
+        String redirectUrl = req.getParameter("next");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        // Vulnerable: user input injected into inline JS
+        out.println("<script>");
+        out.println("var currentUser = \"" + username + "\";");
+        out.println("var nextUrl = \"" + redirectUrl + "\";");
+        out.println("window.location = nextUrl;");
+        out.println("</script>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-021.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: java
-// expected: XSS via setAttribute building HTML string with user input
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class BadgeServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String label = req.getParameter("label");
-        String color = req.getParameter("color");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        // Vulnerable: color and label injected into style/text attributes
-        String html = "<span style=\"background-color:" + color +
-                      "; padding:4px; border-radius:3px;\">" + label + "</span>";
-        out.println("<html><body>" + html + "</body></html>");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: java
+// expected: XSS via setAttribute building HTML string with user input
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class BadgeServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String label = req.getParameter("label");
+        String color = req.getParameter("color");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        // Vulnerable: color and label injected into style/text attributes
+        String html = "<span style=\"background-color:" + color +
+                      "; padding:4px; border-radius:3px;\">" + label + "</span>";
+        out.println("<html><body>" + html + "</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-022.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via HttpServletResponse writer echoing HTTP Referer header
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ReferrerLogServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: Referer header reflected directly into HTML
-        String referer = req.getHeader("Referer");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        out.println("<!DOCTYPE html><html><body>");
-        out.println("<p>You came from: " + referer + "</p>");
-        out.println("<p>Thank you for visiting us!</p>");
-        out.println("</body></html>");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: java
+// expected: XSS via HttpServletResponse writer echoing HTTP Referer header
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ReferrerLogServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: Referer header reflected directly into HTML
+        String referer = req.getHeader("Referer");
+        resp.setContentType("text/html");
+        PrintWriter out = resp.getWriter();
+        out.println("<!DOCTYPE html><html><body>");
+        out.println("<p>You came from: " + referer + "</p>");
+        out.println("<p>Thank you for visiting us!</p>");
+        out.println("</body></html>");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-023.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-supplied filename
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileProcessorServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("filename");
-        // Vulnerable: filename injected into shell command via Runtime.exec
-        String cmd = "convert /uploads/" + filename + " /processed/" + filename + ".pdf";
-        Process proc = Runtime.getRuntime().exec(cmd);
-        int exitCode;
-        try { exitCode = proc.waitFor(); } catch (InterruptedException e) { exitCode = -1; }
-        PrintWriter out = resp.getWriter();
-        out.println("Exit: " + exitCode);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-supplied filename
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileProcessorServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("filename");
+        // Vulnerable: filename injected into shell command via Runtime.exec
+        String cmd = "convert /uploads/" + filename + " /processed/" + filename + ".pdf";
+        Process proc = Runtime.getRuntime().exec(cmd);
+        int exitCode;
+        try { exitCode = proc.waitFor(); } catch (InterruptedException e) { exitCode = -1; }
+        PrintWriter out = resp.getWriter();
+        out.println("Exit: " + exitCode);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-024.java

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec array form with unsanitized user argument
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class PingServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String host = req.getParameter("host");
-        // Vulnerable: passing through shell with -c allows injection
-        String[] cmd = {"/bin/sh", "-c", "ping -c 4 " + host};
-        Process proc = Runtime.getRuntime().exec(cmd);
-        BufferedReader reader = new BufferedReader(
-            new InputStreamReader(proc.getInputStream()));
-        PrintWriter out = resp.getWriter();
-        String line;
-        while ((line = reader.readLine()) != null) {
-            out.println(line + "<br>");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec array form with unsanitized user argument
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class PingServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String host = req.getParameter("host");
+        // Vulnerable: passing through shell with -c allows injection
+        String[] cmd = {"/bin/sh", "-c", "ping -c 4 " + host};
+        Process proc = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(
+            new InputStreamReader(proc.getInputStream()));
+        PrintWriter out = resp.getWriter();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.println(line + "<br>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-025.java

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via ProcessBuilder with user-controlled arguments
-
-import java.io.*;
-import java.util.Arrays;
-import javax.servlet.http.*;
-
-public class ImageResizerServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String inputFile  = req.getParameter("input");
-        String width      = req.getParameter("width");
-        String height     = req.getParameter("height");
-        // Vulnerable: width/height not validated, passed to shell via ProcessBuilder
-        ProcessBuilder pb = new ProcessBuilder(
-            "/bin/sh", "-c",
-            "ffmpeg -i " + inputFile + " -vf scale=" + width + ":" + height + " out.mp4");
-        pb.redirectErrorStream(true);
-        Process p = pb.start();
-        PrintWriter out = resp.getWriter();
-        new BufferedReader(new InputStreamReader(p.getInputStream()))
-            .lines().forEach(l -> out.println(l));
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via ProcessBuilder with user-controlled arguments
+
+import java.io.*;
+import java.util.Arrays;
+import javax.servlet.http.*;
+
+public class ImageResizerServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String inputFile  = req.getParameter("input");
+        String width      = req.getParameter("width");
+        String height     = req.getParameter("height");
+        // Vulnerable: width/height not validated, passed to shell via ProcessBuilder
+        ProcessBuilder pb = new ProcessBuilder(
+            "/bin/sh", "-c",
+            "ffmpeg -i " + inputFile + " -vf scale=" + width + ":" + height + " out.mp4");
+        pb.redirectErrorStream(true);
+        Process p = pb.start();
+        PrintWriter out = resp.getWriter();
+        new BufferedReader(new InputStreamReader(p.getInputStream()))
+            .lines().forEach(l -> out.println(l));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-026.java

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-supplied email address
-
-import java.io.*;
-
-public class MailSender {
-    public void sendReport(String email, String reportPath) throws IOException {
-        // Vulnerable: email address concatenated directly into sendmail command
-        String command = "sendmail -v " + email + " < " + reportPath;
-        Process proc = Runtime.getRuntime().exec(
-            new String[]{"/bin/sh", "-c", command});
-        try {
-            proc.waitFor();
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-        }
-    }
-
-    public static void main(String[] args) throws IOException {
-        new MailSender().sendReport(args[0], "/reports/monthly.txt");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-supplied email address
+
+import java.io.*;
+
+public class MailSender {
+    public void sendReport(String email, String reportPath) throws IOException {
+        // Vulnerable: email address concatenated directly into sendmail command
+        String command = "sendmail -v " + email + " < " + reportPath;
+        Process proc = Runtime.getRuntime().exec(
+            new String[]{"/bin/sh", "-c", command});
+        try {
+            proc.waitFor();
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    public static void main(String[] args) throws IOException {
+        new MailSender().sendReport(args[0], "/reports/monthly.txt");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-027.java

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-controlled zip archive name
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ArchiveServlet extends HttpServlet {
-    private static final String ARCHIVE_DIR = "/var/archives/";
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String archiveName = req.getParameter("name");
-        String targetDir   = req.getParameter("dir");
-        // Vulnerable: both parameters injected into unzip command
-        String cmd = "unzip " + ARCHIVE_DIR + archiveName + " -d " + targetDir;
-        Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
-        resp.getWriter().println("Extracting archive...");
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec with user-controlled zip archive name
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ArchiveServlet extends HttpServlet {
+    private static final String ARCHIVE_DIR = "/var/archives/";
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String archiveName = req.getParameter("name");
+        String targetDir   = req.getParameter("dir");
+        // Vulnerable: both parameters injected into unzip command
+        String cmd = "unzip " + ARCHIVE_DIR + archiveName + " -d " + targetDir;
+        Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
+        resp.getWriter().println("Extracting archive...");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-028.java

@@ -1,21 +1,21 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec nslookup with user-supplied domain
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class DnsLookupServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String domain = req.getParameter("domain");
-        // Vulnerable: domain not sanitized before exec
-        Process proc = Runtime.getRuntime().exec("nslookup " + domain);
-        InputStream is = proc.getInputStream();
-        byte[] buf = is.readAllBytes();
-        resp.setContentType("text/plain");
-        resp.getWriter().write(new String(buf));
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: java
+// expected: Command injection via Runtime.exec nslookup with user-supplied domain
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class DnsLookupServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String domain = req.getParameter("domain");
+        // Vulnerable: domain not sanitized before exec
+        Process proc = Runtime.getRuntime().exec("nslookup " + domain);
+        InputStream is = proc.getInputStream();
+        byte[] buf = is.readAllBytes();
+        resp.setContentType("text/plain");
+        resp.getWriter().write(new String(buf));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-029.java

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via new File(basePath + userInput) without normalization
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileDownloadServlet extends HttpServlet {
-    private static final String BASE_DIR = "/var/app/uploads/";
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("file");
-        // Vulnerable: no normalization or containment check
-        File file = new File(BASE_DIR + filename);
-        resp.setContentType("application/octet-stream");
-        resp.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");
-        try (FileInputStream fis = new FileInputStream(file)) {
-            byte[] buf = new byte[4096];
-            int n;
-            while ((n = fis.read(buf)) != -1) {
-                resp.getOutputStream().write(buf, 0, n);
-            }
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via new File(basePath + userInput) without normalization
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FileDownloadServlet extends HttpServlet {
+    private static final String BASE_DIR = "/var/app/uploads/";
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String filename = req.getParameter("file");
+        // Vulnerable: no normalization or containment check
+        File file = new File(BASE_DIR + filename);
+        resp.setContentType("application/octet-stream");
+        resp.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");
+        try (FileInputStream fis = new FileInputStream(file)) {
+            byte[] buf = new byte[4096];
+            int n;
+            while ((n = fis.read(buf)) != -1) {
+                resp.getOutputStream().write(buf, 0, n);
+            }
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-030.java

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via FileInputStream constructed from user-supplied path
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ConfigViewerServlet extends HttpServlet {
-    private static final String CONFIG_ROOT = "/etc/app/configs/";
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String configName = req.getParameter("config");
-        // Vulnerable: traversal allows reading arbitrary files (e.g. ../../etc/passwd)
-        FileInputStream fis = new FileInputStream(CONFIG_ROOT + configName);
-        BufferedReader reader = new BufferedReader(new InputStreamReader(fis));
-        PrintWriter out = resp.getWriter();
-        resp.setContentType("text/plain");
-        String line;
-        while ((line = reader.readLine()) != null) {
-            out.println(line);
-        }
-        fis.close();
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via FileInputStream constructed from user-supplied path
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ConfigViewerServlet extends HttpServlet {
+    private static final String CONFIG_ROOT = "/etc/app/configs/";
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String configName = req.getParameter("config");
+        // Vulnerable: traversal allows reading arbitrary files (e.g. ../../etc/passwd)
+        FileInputStream fis = new FileInputStream(CONFIG_ROOT + configName);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(fis));
+        PrintWriter out = resp.getWriter();
+        resp.setContentType("text/plain");
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.println(line);
+        }
+        fis.close();
+    }
+}