thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/kotlin/seed-033.kt

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: kotlin
-// expected: Intent-supplied file path used directly for file read without validation
-
-package com.example.viewer
-
-import android.app.Activity
-import android.os.Bundle
-import java.io.File
-
-class DocumentActivity : Activity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        val filePath = intent.getStringExtra("file_path")
-        val subDir = intent.getStringExtra("sub_dir") ?: ""
-        if (filePath != null) {
-            val content = File(filesDir, subDir + filePath).readText()
-            displayContent(content)
-        }
-    }
-
-    fun serveFile(relativePath: String): ByteArray {
-        val resolved = File("/app/resources/" + relativePath)
-        return resolved.readBytes()
-    }
-
-    private fun displayContent(content: String) = println(content)
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: kotlin
+// expected: Intent-supplied file path used directly for file read without validation
+
+package com.example.viewer
+
+import android.app.Activity
+import android.os.Bundle
+import java.io.File
+
+class DocumentActivity : Activity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val filePath = intent.getStringExtra("file_path")
+        val subDir = intent.getStringExtra("sub_dir") ?: ""
+        if (filePath != null) {
+            val content = File(filesDir, subDir + filePath).readText()
+            displayContent(content)
+        }
+    }
+
+    fun serveFile(relativePath: String): ByteArray {
+        val resolved = File("/app/resources/" + relativePath)
+        return resolved.readBytes()
+    }
+
+    private fun displayContent(content: String) = println(content)
+}

package/dist/packages/crucible/seeds/kotlin/seed-034.kt

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: kotlin
-// expected: MD5 used for password hashing
-
-package com.example.auth
-
-import java.security.MessageDigest
-
-class PasswordService {
-    fun hashPassword(password: String): String {
-        val md = MessageDigest.getInstance("MD5")
-        val digest = md.digest(password.toByteArray())
-        return digest.joinToString("") { "%02x".format(it) }
-    }
-
-    fun verifyPassword(password: String, hash: String): Boolean {
-        return hashPassword(password) == hash
-    }
-
-    fun hashWithSalt(password: String, username: String): String {
-        val md = MessageDigest.getInstance("MD5")
-        return md.digest("$username:$password".toByteArray()).toString()
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: MD5 used for password hashing
+
+package com.example.auth
+
+import java.security.MessageDigest
+
+class PasswordService {
+    fun hashPassword(password: String): String {
+        val md = MessageDigest.getInstance("MD5")
+        val digest = md.digest(password.toByteArray())
+        return digest.joinToString("") { "%02x".format(it) }
+    }
+
+    fun verifyPassword(password: String, hash: String): Boolean {
+        return hashPassword(password) == hash
+    }
+
+    fun hashWithSalt(password: String, username: String): String {
+        val md = MessageDigest.getInstance("MD5")
+        return md.digest("$username:$password".toByteArray()).toString()
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-035.kt

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: kotlin
-// expected: DES cipher used for encryption — weak key size (56-bit)
-
-package com.example.crypto
-
-import javax.crypto.Cipher
-import javax.crypto.SecretKeyFactory
-import javax.crypto.spec.DESKeySpec
-
-class LegacyEncryptor {
-    private val key = "AbCdEfGh"
-
-    fun encrypt(data: String): ByteArray {
-        val keySpec = DESKeySpec(key.toByteArray())
-        val keyFactory = SecretKeyFactory.getInstance("DES")
-        val secretKey = keyFactory.generateSecret(keySpec)
-        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
-        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
-        return cipher.doFinal(data.toByteArray())
-    }
-
-    fun decrypt(data: ByteArray): String {
-        val keySpec = DESKeySpec(key.toByteArray())
-        val keyFactory = SecretKeyFactory.getInstance("DES")
-        val secretKey = keyFactory.generateSecret(keySpec)
-        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
-        cipher.init(Cipher.DECRYPT_MODE, secretKey)
-        return String(cipher.doFinal(data))
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: DES cipher used for encryption — weak key size (56-bit)
+
+package com.example.crypto
+
+import javax.crypto.Cipher
+import javax.crypto.SecretKeyFactory
+import javax.crypto.spec.DESKeySpec
+
+class LegacyEncryptor {
+    private val key = "AbCdEfGh"
+
+    fun encrypt(data: String): ByteArray {
+        val keySpec = DESKeySpec(key.toByteArray())
+        val keyFactory = SecretKeyFactory.getInstance("DES")
+        val secretKey = keyFactory.generateSecret(keySpec)
+        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
+        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
+        return cipher.doFinal(data.toByteArray())
+    }
+
+    fun decrypt(data: ByteArray): String {
+        val keySpec = DESKeySpec(key.toByteArray())
+        val keyFactory = SecretKeyFactory.getInstance("DES")
+        val secretKey = keyFactory.generateSecret(keySpec)
+        val cipher = Cipher.getInstance("DES/ECB/PKCS5Padding")
+        cipher.init(Cipher.DECRYPT_MODE, secretKey)
+        return String(cipher.doFinal(data))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-036.kt

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: kotlin
-// expected: Math.random() used for security-sensitive token generation
-
-package com.example.auth
-
-import kotlin.math.abs
-
-class TokenGenerator {
-    fun generateSessionToken(): String {
-        val chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
-        return (1..32).map { chars[abs(Math.random() * chars.length).toInt()] }.joinToString("")
-    }
-
-    fun generateOtp(): String {
-        return String.format("%06d", (Math.random() * 1000000).toInt())
-    }
-
-    fun generateResetToken(): String {
-        val rand = (Math.random() * Long.MAX_VALUE).toLong()
-        return java.lang.Long.toHexString(rand)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: Math.random() used for security-sensitive token generation
+
+package com.example.auth
+
+import kotlin.math.abs
+
+class TokenGenerator {
+    fun generateSessionToken(): String {
+        val chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+        return (1..32).map { chars[abs(Math.random() * chars.length).toInt()] }.joinToString("")
+    }
+
+    fun generateOtp(): String {
+        return String.format("%06d", (Math.random() * 1000000).toInt())
+    }
+
+    fun generateResetToken(): String {
+        val rand = (Math.random() * Long.MAX_VALUE).toLong()
+        return java.lang.Long.toHexString(rand)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-037.kt

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: kotlin
-// expected: AES in ECB mode — deterministic, no IV, vulnerable to pattern analysis
-
-package com.example.crypto
-
-import javax.crypto.Cipher
-import javax.crypto.spec.SecretKeySpec
-
-class AesEcbEncryptor {
-    private val key = SecretKeySpec("0123456789abcdef".toByteArray(), "AES")
-
-    fun encrypt(plaintext: String): ByteArray {
-        val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
-        cipher.init(Cipher.ENCRYPT_MODE, key)
-        return cipher.doFinal(plaintext.toByteArray())
-    }
-
-    fun decrypt(ciphertext: ByteArray): String {
-        val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
-        cipher.init(Cipher.DECRYPT_MODE, key)
-        return String(cipher.doFinal(ciphertext))
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: kotlin
+// expected: AES in ECB mode — deterministic, no IV, vulnerable to pattern analysis
+
+package com.example.crypto
+
+import javax.crypto.Cipher
+import javax.crypto.spec.SecretKeySpec
+
+class AesEcbEncryptor {
+    private val key = SecretKeySpec("0123456789abcdef".toByteArray(), "AES")
+
+    fun encrypt(plaintext: String): ByteArray {
+        val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
+        cipher.init(Cipher.ENCRYPT_MODE, key)
+        return cipher.doFinal(plaintext.toByteArray())
+    }
+
+    fun decrypt(ciphertext: ByteArray): String {
+        val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
+        cipher.init(Cipher.DECRYPT_MODE, key)
+        return String(cipher.doFinal(ciphertext))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-038.kt

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: kotlin
-// expected: SHA-1 used for certificate pinning and signature verification
-
-package com.example.security
-
-import java.security.MessageDigest
-import java.security.cert.X509Certificate
-
-class CertificatePinner {
-    private val pinnedSha1 = "da39a3ee5e6b4b0d3255bfef95601890afd80709"
-
-    fun isPinned(cert: X509Certificate): Boolean {
-        val md = MessageDigest.getInstance("SHA-1")
-        val fingerprint = md.digest(cert.encoded).joinToString("") { "%02x".format(it) }
-        return fingerprint == pinnedSha1
-    }
-
-    fun hashData(data: ByteArray): String {
-        val md = MessageDigest.getInstance("SHA1")
-        return md.digest(data).joinToString("") { "%02x".format(it) }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: kotlin
+// expected: SHA-1 used for certificate pinning and signature verification
+
+package com.example.security
+
+import java.security.MessageDigest
+import java.security.cert.X509Certificate
+
+class CertificatePinner {
+    private val pinnedSha1 = "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+
+    fun isPinned(cert: X509Certificate): Boolean {
+        val md = MessageDigest.getInstance("SHA-1")
+        val fingerprint = md.digest(cert.encoded).joinToString("") { "%02x".format(it) }
+        return fingerprint == pinnedSha1
+    }
+
+    fun hashData(data: ByteArray): String {
+        val md = MessageDigest.getInstance("SHA1")
+        return md.digest(data).joinToString("") { "%02x".format(it) }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-039.kt

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: kotlin
-// expected: Java ObjectInputStream used to deserialize untrusted data
-
-package com.example.serialization
-
-import java.io.ObjectInputStream
-import java.io.ByteArrayInputStream
-
-class DataDeserializer {
-    fun deserialize(data: ByteArray): Any? {
-        val bais = ByteArrayInputStream(data)
-        val ois = ObjectInputStream(bais)
-        return ois.readObject()
-    }
-
-    fun deserializeFromNetwork(inputStream: java.io.InputStream): Any? {
-        val ois = ObjectInputStream(inputStream)
-        val obj = ois.readObject()
-        ois.close()
-        return obj
-    }
-
-    fun loadUserSession(sessionData: ByteArray): Map<*, *>? {
-        return deserialize(sessionData) as? Map<*, *>
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: kotlin
+// expected: Java ObjectInputStream used to deserialize untrusted data
+
+package com.example.serialization
+
+import java.io.ObjectInputStream
+import java.io.ByteArrayInputStream
+
+class DataDeserializer {
+    fun deserialize(data: ByteArray): Any? {
+        val bais = ByteArrayInputStream(data)
+        val ois = ObjectInputStream(bais)
+        return ois.readObject()
+    }
+
+    fun deserializeFromNetwork(inputStream: java.io.InputStream): Any? {
+        val ois = ObjectInputStream(inputStream)
+        val obj = ois.readObject()
+        ois.close()
+        return obj
+    }
+
+    fun loadUserSession(sessionData: ByteArray): Map<*, *>? {
+        return deserialize(sessionData) as? Map<*, *>
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-040.kt

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: kotlin
-// expected: ObjectInputStream deserialization from HTTP response body
-
-package com.example.network
-
-import java.io.ObjectInputStream
-import java.net.HttpURLConnection
-import java.net.URL
-
-class RemoteDataLoader {
-    fun fetchAndDeserialize(endpoint: String): Any? {
-        val conn = URL(endpoint).openConnection() as HttpURLConnection
-        conn.requestMethod = "GET"
-        return if (conn.responseCode == 200) {
-            ObjectInputStream(conn.inputStream).readObject()
-        } else null
-    }
-
-    fun loadConfig(serverUrl: String): Map<String, Any>? {
-        val conn = URL("$serverUrl/config").openConnection() as HttpURLConnection
-        val ois = ObjectInputStream(conn.inputStream)
-        @Suppress("UNCHECKED_CAST")
-        return ois.readObject() as? Map<String, Any>
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: kotlin
+// expected: ObjectInputStream deserialization from HTTP response body
+
+package com.example.network
+
+import java.io.ObjectInputStream
+import java.net.HttpURLConnection
+import java.net.URL
+
+class RemoteDataLoader {
+    fun fetchAndDeserialize(endpoint: String): Any? {
+        val conn = URL(endpoint).openConnection() as HttpURLConnection
+        conn.requestMethod = "GET"
+        return if (conn.responseCode == 200) {
+            ObjectInputStream(conn.inputStream).readObject()
+        } else null
+    }
+
+    fun loadConfig(serverUrl: String): Map<String, Any>? {
+        val conn = URL("$serverUrl/config").openConnection() as HttpURLConnection
+        val ois = ObjectInputStream(conn.inputStream)
+        @Suppress("UNCHECKED_CAST")
+        return ois.readObject() as? Map<String, Any>
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-041.kt

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: kotlin
-// expected: Gson deserializes to arbitrary class via user-controlled type token
-
-package com.example.api
-
-import com.google.gson.Gson
-import com.google.gson.reflect.TypeToken
-
-class ApiResponseParser {
-    private val gson = Gson()
-
-    fun <T> parse(json: String, className: String): T? {
-        val clazz = Class.forName(className)
-        @Suppress("UNCHECKED_CAST")
-        return gson.fromJson(json, clazz) as? T
-    }
-
-    fun parseWithTypeToken(json: String, typeDescriptor: String): Any? {
-        val type = Class.forName(typeDescriptor)
-        return gson.fromJson(json, type)
-    }
-
-    fun deserializeList(json: String, elementType: String): List<Any?> {
-        val clazz = Class.forName(elementType)
-        val type = TypeToken.getParameterized(List::class.java, clazz).type
-        return gson.fromJson(json, type)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: kotlin
+// expected: Gson deserializes to arbitrary class via user-controlled type token
+
+package com.example.api
+
+import com.google.gson.Gson
+import com.google.gson.reflect.TypeToken
+
+class ApiResponseParser {
+    private val gson = Gson()
+
+    fun <T> parse(json: String, className: String): T? {
+        val clazz = Class.forName(className)
+        @Suppress("UNCHECKED_CAST")
+        return gson.fromJson(json, clazz) as? T
+    }
+
+    fun parseWithTypeToken(json: String, typeDescriptor: String): Any? {
+        val type = Class.forName(typeDescriptor)
+        return gson.fromJson(json, type)
+    }
+
+    fun deserializeList(json: String, elementType: String): List<Any?> {
+        val clazz = Class.forName(elementType)
+        val type = TypeToken.getParameterized(List::class.java, clazz).type
+        return gson.fromJson(json, type)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-042.kt

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: kotlin
-// expected: Kryo deserialization from untrusted byte stream without allowlist
-
-package com.example.cache
-
-import com.esotericsoftware.kryo.Kryo
-import com.esotericsoftware.kryo.io.Input
-
-class KryoDeserializer {
-    private val kryo = Kryo().apply {
-        isRegistrationRequired = false
-    }
-
-    fun deserialize(data: ByteArray): Any? {
-        val input = Input(data)
-        return kryo.readClassAndObject(input)
-    }
-
-    fun loadFromCache(cacheData: ByteArray): Any? {
-        Input(cacheData).use { input ->
-            return kryo.readClassAndObject(input)
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: kotlin
+// expected: Kryo deserialization from untrusted byte stream without allowlist
+
+package com.example.cache
+
+import com.esotericsoftware.kryo.Kryo
+import com.esotericsoftware.kryo.io.Input
+
+class KryoDeserializer {
+    private val kryo = Kryo().apply {
+        isRegistrationRequired = false
+    }
+
+    fun deserialize(data: ByteArray): Any? {
+        val input = Input(data)
+        return kryo.readClassAndObject(input)
+    }
+
+    fun loadFromCache(cacheData: ByteArray): Any? {
+        Input(cacheData).use { input ->
+            return kryo.readClassAndObject(input)
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-043.kt

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: kotlin
-// expected: SharedPreferences stores and restores serialized object via base64 without validation
-
-package com.example.prefs
-
-import android.content.Context
-import android.util.Base64
-import java.io.ByteArrayInputStream
-import java.io.ObjectInputStream
-
-class PreferencesCache(private val context: Context) {
-    fun restoreObject(key: String): Any? {
-        val prefs = context.getSharedPreferences("cache", Context.MODE_PRIVATE)
-        val encoded = prefs.getString(key, null) ?: return null
-        val bytes = Base64.decode(encoded, Base64.DEFAULT)
-        val ois = ObjectInputStream(ByteArrayInputStream(bytes))
-        return ois.readObject()
-    }
-
-    fun restoreUserState(): Map<*, *>? {
-        return restoreObject("user_state") as? Map<*, *>
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: kotlin
+// expected: SharedPreferences stores and restores serialized object via base64 without validation
+
+package com.example.prefs
+
+import android.content.Context
+import android.util.Base64
+import java.io.ByteArrayInputStream
+import java.io.ObjectInputStream
+
+class PreferencesCache(private val context: Context) {
+    fun restoreObject(key: String): Any? {
+        val prefs = context.getSharedPreferences("cache", Context.MODE_PRIVATE)
+        val encoded = prefs.getString(key, null) ?: return null
+        val bytes = Base64.decode(encoded, Base64.DEFAULT)
+        val ois = ObjectInputStream(ByteArrayInputStream(bytes))
+        return ois.readObject()
+    }
+
+    fun restoreUserState(): Map<*, *>? {
+        return restoreObject("user_state") as? Map<*, *>
+    }
+}