thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/js/seed-033.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: medium
-// language: javascript
-// expected: path traversal via multer upload destination with user-controlled subfolder
-
-const multer = require('multer');
-const path = require('path');
-const fs = require('fs');
-
-const storage = multer.diskStorage({
-  destination: (req, file, cb) => {
-    // req.body.folder is user-controlled — allows writing to arbitrary directories
-    const uploadPath = path.join('/var/uploads', req.body.folder || 'default');
-    fs.mkdirSync(uploadPath, { recursive: true });
-    cb(null, uploadPath);
-  },
-  filename: (req, file, cb) => {
-    // originalname preserved — could include path separators on some OS
-    cb(null, req.body.prefix + '_' + file.originalname);
-  },
-});
-
-const upload = multer({ storage });
-
-const express = require('express');
-const router = express.Router();
-
-router.post('/upload', upload.single('file'), (req, res) => {
-  res.json({ path: req.file.path, size: req.file.size });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: medium
+// language: javascript
+// expected: path traversal via multer upload destination with user-controlled subfolder
+
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs');
+
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => {
+    // req.body.folder is user-controlled — allows writing to arbitrary directories
+    const uploadPath = path.join('/var/uploads', req.body.folder || 'default');
+    fs.mkdirSync(uploadPath, { recursive: true });
+    cb(null, uploadPath);
+  },
+  filename: (req, file, cb) => {
+    // originalname preserved — could include path separators on some OS
+    cb(null, req.body.prefix + '_' + file.originalname);
+  },
+});
+
+const upload = multer({ storage });
+
+const express = require('express');
+const router = express.Router();
+
+router.post('/upload', upload.single('file'), (req, res) => {
+  res.json({ path: req.file.path, size: req.file.size });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-034.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: javascript
-// expected: MD5 used for password hashing
-
-const crypto = require('crypto');
-const { Pool } = require('pg');
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-function hashPassword(password) {
-  // MD5 is cryptographically broken and must not be used for passwords
-  return crypto.createHash('md5').update(password).digest('hex');
-}
-
-async function registerUser(email, password) {
-  const hashedPw = hashPassword(password);
-  await pool.query(
-    'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
-    [email, hashedPw]
-  );
-}
-
-async function loginUser(email, password) {
-  const hash = hashPassword(password);
-  const result = await pool.query(
-    'SELECT * FROM users WHERE email = $1 AND password_hash = $2',
-    [email, hash]
-  );
-  return result.rows[0] || null;
-}
-
-module.exports = { hashPassword, registerUser, loginUser };
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: MD5 used for password hashing
+
+const crypto = require('crypto');
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+function hashPassword(password) {
+  // MD5 is cryptographically broken and must not be used for passwords
+  return crypto.createHash('md5').update(password).digest('hex');
+}
+
+async function registerUser(email, password) {
+  const hashedPw = hashPassword(password);
+  await pool.query(
+    'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
+    [email, hashedPw]
+  );
+}
+
+async function loginUser(email, password) {
+  const hash = hashPassword(password);
+  const result = await pool.query(
+    'SELECT * FROM users WHERE email = $1 AND password_hash = $2',
+    [email, hash]
+  );
+  return result.rows[0] || null;
+}
+
+module.exports = { hashPassword, registerUser, loginUser };

package/dist/packages/crucible/seeds/js/seed-035.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: javascript
-// expected: SHA1 used for password hashing and weak random for token generation
-
-const crypto = require('crypto');
-
-function hashPassword(password, salt) {
-  // SHA-1 is deprecated for security-sensitive operations
-  return crypto.createHash('sha1').update(salt + password).digest('hex');
-}
-
-function generateSessionToken() {
-  // Math.random() is not cryptographically secure
-  return Math.random().toString(36).substring(2) + Date.now().toString(36);
-}
-
-function generateResetToken() {
-  // Predictable: only uses current timestamp
-  return Buffer.from(Date.now().toString()).toString('base64');
-}
-
-function createApiKey(userId) {
-  // Weak entropy source
-  const rand = Math.floor(Math.random() * 999999999).toString();
-  return crypto.createHash('sha1').update(userId + rand).digest('hex');
-}
-
-module.exports = { hashPassword, generateSessionToken, generateResetToken, createApiKey };
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: SHA1 used for password hashing and weak random for token generation
+
+const crypto = require('crypto');
+
+function hashPassword(password, salt) {
+  // SHA-1 is deprecated for security-sensitive operations
+  return crypto.createHash('sha1').update(salt + password).digest('hex');
+}
+
+function generateSessionToken() {
+  // Math.random() is not cryptographically secure
+  return Math.random().toString(36).substring(2) + Date.now().toString(36);
+}
+
+function generateResetToken() {
+  // Predictable: only uses current timestamp
+  return Buffer.from(Date.now().toString()).toString('base64');
+}
+
+function createApiKey(userId) {
+  // Weak entropy source
+  const rand = Math.floor(Math.random() * 999999999).toString();
+  return crypto.createHash('sha1').update(userId + rand).digest('hex');
+}
+
+module.exports = { hashPassword, generateSessionToken, generateResetToken, createApiKey };

package/dist/packages/crucible/seeds/js/seed-036.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: javascript
-// expected: DES/RC4 weak cipher and static IV reuse in AES-ECB mode
-
-const crypto = require('crypto');
-
-// ECB mode has no semantic security — identical plaintexts produce identical ciphertext
-function encryptWithECB(data, key) {
-  const cipher = crypto.createCipheriv('aes-128-ecb', Buffer.from(key), null);
-  let enc = cipher.update(data, 'utf8', 'hex');
-  enc += cipher.final('hex');
-  return enc;
-}
-
-function decryptWithECB(data, key) {
-  const decipher = crypto.createDecipheriv('aes-128-ecb', Buffer.from(key), null);
-  let dec = decipher.update(data, 'hex', 'utf8');
-  dec += decipher.final('utf8');
-  return dec;
-}
-
-// RC4 is a broken stream cipher
-function encryptRC4(data, key) {
-  const cipher = crypto.createCipheriv('rc4', Buffer.from(key), null);
-  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
-}
-
-module.exports = { encryptWithECB, decryptWithECB, encryptRC4 };
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: DES/RC4 weak cipher and static IV reuse in AES-ECB mode
+
+const crypto = require('crypto');
+
+// ECB mode has no semantic security — identical plaintexts produce identical ciphertext
+function encryptWithECB(data, key) {
+  const cipher = crypto.createCipheriv('aes-128-ecb', Buffer.from(key), null);
+  let enc = cipher.update(data, 'utf8', 'hex');
+  enc += cipher.final('hex');
+  return enc;
+}
+
+function decryptWithECB(data, key) {
+  const decipher = crypto.createDecipheriv('aes-128-ecb', Buffer.from(key), null);
+  let dec = decipher.update(data, 'hex', 'utf8');
+  dec += decipher.final('utf8');
+  return dec;
+}
+
+// RC4 is a broken stream cipher
+function encryptRC4(data, key) {
+  const cipher = crypto.createCipheriv('rc4', Buffer.from(key), null);
+  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex');
+}
+
+module.exports = { encryptWithECB, decryptWithECB, encryptRC4 };

package/dist/packages/crucible/seeds/js/seed-037.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: javascript
-// expected: insufficient key length and no salt in PBKDF2, MD5 for data integrity
-
-const crypto = require('crypto');
-
-function deriveKey(password) {
-  // Insufficient iterations (1000 — NIST recommends 600,000+) and no salt
-  return crypto.pbkdf2Sync(password, 'static-salt-value', 1000, 16, 'sha1');
-}
-
-function signData(data) {
-  // MD5 HMAC is collision-prone
-  return crypto.createHmac('md5', 'hardcoded-hmac-key').update(data).digest('hex');
-}
-
-function verifySignature(data, expectedSig) {
-  const sig = signData(data);
-  // Timing attack: string comparison instead of timingSafeEqual
-  return sig === expectedSig;
-}
-
-function checksumFile(buffer) {
-  return crypto.createHash('md5').update(buffer).digest('hex');
-}
-
-module.exports = { deriveKey, signData, verifySignature, checksumFile };
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: javascript
+// expected: insufficient key length and no salt in PBKDF2, MD5 for data integrity
+
+const crypto = require('crypto');
+
+function deriveKey(password) {
+  // Insufficient iterations (1000 — NIST recommends 600,000+) and no salt
+  return crypto.pbkdf2Sync(password, 'static-salt-value', 1000, 16, 'sha1');
+}
+
+function signData(data) {
+  // MD5 HMAC is collision-prone
+  return crypto.createHmac('md5', 'hardcoded-hmac-key').update(data).digest('hex');
+}
+
+function verifySignature(data, expectedSig) {
+  const sig = signData(data);
+  // Timing attack: string comparison instead of timingSafeEqual
+  return sig === expectedSig;
+}
+
+function checksumFile(buffer) {
+  return crypto.createHash('md5').update(buffer).digest('hex');
+}
+
+module.exports = { deriveKey, signData, verifySignature, checksumFile };

package/dist/packages/crucible/seeds/js/seed-038.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: javascript
-// expected: hardcoded RSA private key and weak key size (512-bit)
-
-const crypto = require('crypto');
-const { createSign, createVerify } = crypto;
-
-// 512-bit RSA key — trivially factorable
-const PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----
-MIIBOgIBAAJBALRiMLAHudeSA/xKl1oMEBKFOeOPIQbQEsZHMPMIqVQXaFFC
-9m0YG8dMdgoKGDHb9FMtSGQm/fB8CtMmBwsN4mECAwEAAQJAcLMSZ5XwJKGQ
-nL7VlKl9M4kzGaIDM7l0x7G/zE+7n8fGOJxHj3pzfH0fQRaDVzfZuAXXl/jP
-cxjk1u1Y+sJBAQIhANSXB5jRfMv2VpUBsGAeTR/3a5pEPP5DlMqVVLfZqLkB
-AiEA3pB4GOdMNL7Z0cqVUvWNrRHuHu2+6P7NXZZ1yM2sM9kCIBY6ovRdJKGS
------END RSA PRIVATE KEY-----`;
-
-function signPayload(data) {
-  const sign = createSign('SHA256');
-  sign.update(data);
-  return sign.sign(PRIVATE_KEY, 'base64');
-}
-
-function verifyPayload(data, signature, publicKey) {
-  const verify = createVerify('SHA256');
-  verify.update(data);
-  return verify.verify(publicKey, signature, 'base64');
-}
-
-module.exports = { signPayload, verifyPayload };
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: javascript
+// expected: hardcoded RSA private key and weak key size (512-bit)
+
+const crypto = require('crypto');
+const { createSign, createVerify } = crypto;
+
+// 512-bit RSA key — trivially factorable
+const PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----
+MIIBOgIBAAJBALRiMLAHudeSA/xKl1oMEBKFOeOPIQbQEsZHMPMIqVQXaFFC
+9m0YG8dMdgoKGDHb9FMtSGQm/fB8CtMmBwsN4mECAwEAAQJAcLMSZ5XwJKGQ
+nL7VlKl9M4kzGaIDM7l0x7G/zE+7n8fGOJxHj3pzfH0fQRaDVzfZuAXXl/jP
+cxjk1u1Y+sJBAQIhANSXB5jRfMv2VpUBsGAeTR/3a5pEPP5DlMqVVLfZqLkB
+AiEA3pB4GOdMNL7Z0cqVUvWNrRHuHu2+6P7NXZZ1yM2sM9kCIBY6ovRdJKGS
+-----END RSA PRIVATE KEY-----`;
+
+function signPayload(data) {
+  const sign = createSign('SHA256');
+  sign.update(data);
+  return sign.sign(PRIVATE_KEY, 'base64');
+}
+
+function verifyPayload(data, signature, publicKey) {
+  const verify = createVerify('SHA256');
+  verify.update(data);
+  return verify.verify(publicKey, signature, 'base64');
+}
+
+module.exports = { signPayload, verifyPayload };

package/dist/packages/crucible/seeds/js/seed-039.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: javascript
-// expected: prototype pollution via recursive merge of user-controlled object
-
-function deepMerge(target, source) {
-  for (const key of Object.keys(source)) {
-    // Allows "__proto__" or "constructor" as a key — pollutes Object.prototype
-    if (typeof source[key] === 'object' && source[key] !== null) {
-      if (!target[key]) target[key] = {};
-      deepMerge(target[key], source[key]);
-    } else {
-      target[key] = source[key];
-    }
-  }
-  return target;
-}
-
-function applyUserSettings(defaultConfig, userConfig) {
-  // userConfig comes directly from request body — not validated
-  return deepMerge({ ...defaultConfig }, userConfig);
-}
-
-// Attacker sends: { "__proto__": { "isAdmin": true } }
-// After merge, ({}).isAdmin === true for ALL objects
-const express = require('express');
-const router = express.Router();
-router.post('/settings', (req, res) => {
-  const config = applyUserSettings({ theme: 'light', lang: 'en' }, req.body);
-  res.json({ config });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via recursive merge of user-controlled object
+
+function deepMerge(target, source) {
+  for (const key of Object.keys(source)) {
+    // Allows "__proto__" or "constructor" as a key — pollutes Object.prototype
+    if (typeof source[key] === 'object' && source[key] !== null) {
+      if (!target[key]) target[key] = {};
+      deepMerge(target[key], source[key]);
+    } else {
+      target[key] = source[key];
+    }
+  }
+  return target;
+}
+
+function applyUserSettings(defaultConfig, userConfig) {
+  // userConfig comes directly from request body — not validated
+  return deepMerge({ ...defaultConfig }, userConfig);
+}
+
+// Attacker sends: { "__proto__": { "isAdmin": true } }
+// After merge, ({}).isAdmin === true for ALL objects
+const express = require('express');
+const router = express.Router();
+router.post('/settings', (req, res) => {
+  const config = applyUserSettings({ theme: 'light', lang: 'en' }, req.body);
+  res.json({ config });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-040.js

@@ -1,35 +1,35 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: javascript
-// expected: prototype pollution via bracket-notation property assignment with user key
-
-const express = require('express');
-const router = express.Router();
-
-function setNestedProperty(obj, path, value) {
-  const parts = path.split('.');
-  let current = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    // Unguarded bracket notation — path can include "__proto__"
-    if (!current[parts[i]]) current[parts[i]] = {};
-    current = current[parts[i]];
-  }
-  current[parts[parts.length - 1]] = value;
-}
-
-router.post('/preferences', (req, res) => {
-  const userPrefs = {};
-  const { key, value } = req.body;
-  // key = "__proto__.admin" poisons Object.prototype
-  setNestedProperty(userPrefs, key, value);
-  res.json({ saved: true, prefs: userPrefs });
-});
-
-router.patch('/config', (req, res) => {
-  const { path: propPath, val } = req.body;
-  setNestedProperty(global.appConfig, propPath, val);
-  res.json({ updated: true });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via bracket-notation property assignment with user key
+
+const express = require('express');
+const router = express.Router();
+
+function setNestedProperty(obj, path, value) {
+  const parts = path.split('.');
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    // Unguarded bracket notation — path can include "__proto__"
+    if (!current[parts[i]]) current[parts[i]] = {};
+    current = current[parts[i]];
+  }
+  current[parts[parts.length - 1]] = value;
+}
+
+router.post('/preferences', (req, res) => {
+  const userPrefs = {};
+  const { key, value } = req.body;
+  // key = "__proto__.admin" poisons Object.prototype
+  setNestedProperty(userPrefs, key, value);
+  res.json({ saved: true, prefs: userPrefs });
+});
+
+router.patch('/config', (req, res) => {
+  const { path: propPath, val } = req.body;
+  setNestedProperty(global.appConfig, propPath, val);
+  res.json({ updated: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-041.js

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: javascript
-// expected: prototype pollution via Object.assign with user-controlled source
-
-const express = require('express');
-const router = express.Router();
-
-const defaultOptions = { timeout: 5000, retries: 3, debug: false };
-
-router.post('/api/options', (req, res) => {
-  // Object.assign does NOT deep copy — assigning user object containing __proto__ pollutes
-  const options = Object.assign({}, defaultOptions, req.body.options);
-  // Attacker: { "options": { "__proto__": { "polluted": true } } }
-  res.json({ applied: options });
-});
-
-function createUserContext(baseCtx, overrides) {
-  // Spread of user-controlled overrides — shallow, but __proto__ key is still dangerous
-  return Object.assign(Object.create(null), baseCtx, overrides);
-}
-
-router.post('/context', (req, res) => {
-  const ctx = createUserContext(
-    { userId: req.session.userId, role: 'user' },
-    req.body // direct spread of request body
-  );
-  res.json(ctx);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via Object.assign with user-controlled source
+
+const express = require('express');
+const router = express.Router();
+
+const defaultOptions = { timeout: 5000, retries: 3, debug: false };
+
+router.post('/api/options', (req, res) => {
+  // Object.assign does NOT deep copy — assigning user object containing __proto__ pollutes
+  const options = Object.assign({}, defaultOptions, req.body.options);
+  // Attacker: { "options": { "__proto__": { "polluted": true } } }
+  res.json({ applied: options });
+});
+
+function createUserContext(baseCtx, overrides) {
+  // Spread of user-controlled overrides — shallow, but __proto__ key is still dangerous
+  return Object.assign(Object.create(null), baseCtx, overrides);
+}
+
+router.post('/context', (req, res) => {
+  const ctx = createUserContext(
+    { userId: req.session.userId, role: 'user' },
+    req.body // direct spread of request body
+  );
+  res.json(ctx);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-042.js

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: medium
-// language: javascript
-// expected: prototype pollution via JSON.parse result passed to merge function
-
-const express = require('express');
-const router = express.Router();
-
-function mergeObjects(base, extension) {
-  for (const [key, value] of Object.entries(extension)) {
-    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
-      // Attempted guard — but Object.entries still iterates inherited keys on some engines
-      continue;
-    }
-    if (value && typeof value === 'object' && !Array.isArray(value)) {
-      mergeObjects(base[key] || (base[key] = {}), value);
-    } else {
-      base[key] = value;
-    }
-  }
-  return base;
-}
-
-router.post('/merge', (req, res) => {
-  // The raw JSON body may contain {"__proto__":{"isAdmin":true}} before parsing
-  const payload = JSON.parse(req.body.raw);
-  const result = mergeObjects({}, payload); // Still pollutable via constructor.prototype
-  res.json(result);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: javascript
+// expected: prototype pollution via JSON.parse result passed to merge function
+
+const express = require('express');
+const router = express.Router();
+
+function mergeObjects(base, extension) {
+  for (const [key, value] of Object.entries(extension)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      // Attempted guard — but Object.entries still iterates inherited keys on some engines
+      continue;
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      mergeObjects(base[key] || (base[key] = {}), value);
+    } else {
+      base[key] = value;
+    }
+  }
+  return base;
+}
+
+router.post('/merge', (req, res) => {
+  // The raw JSON body may contain {"__proto__":{"isAdmin":true}} before parsing
+  const payload = JSON.parse(req.body.raw);
+  const result = mergeObjects({}, payload); // Still pollutable via constructor.prototype
+  res.json(result);
+});
+
+module.exports = router;