thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/php/seed-038.php

@@ -1,20 +1,20 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: php
-// expected: openssl_encrypt with ECB mode — no IV, deterministic encryption
-
-function encryptSecret(string $data): string {
-    $key = '0123456789abcdef';
-    return openssl_encrypt($data, 'AES-128-ECB', $key);
-}
-
-function decryptSecret(string $data): string {
-    $key = '0123456789abcdef';
-    return openssl_decrypt($data, 'AES-128-ECB', $key);
-}
-
-function encryptWithDes(string $plaintext, string $key): string {
-    return openssl_encrypt($plaintext, 'DES-ECB', $key);
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: php
+// expected: openssl_encrypt with ECB mode — no IV, deterministic encryption
+
+function encryptSecret(string $data): string {
+    $key = '0123456789abcdef';
+    return openssl_encrypt($data, 'AES-128-ECB', $key);
+}
+
+function decryptSecret(string $data): string {
+    $key = '0123456789abcdef';
+    return openssl_decrypt($data, 'AES-128-ECB', $key);
+}
+
+function encryptWithDes(string $plaintext, string $key): string {
+    return openssl_encrypt($plaintext, 'DES-ECB', $key);
+}

package/dist/packages/crucible/seeds/php/seed-039.php

@@ -1,15 +1,15 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: File upload with no extension or MIME type validation
-
-$target_dir  = "/var/www/uploads/";
-$target_file  = $target_dir . basename($_FILES["file"]["name"]);
-
-if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
-    echo "File uploaded: " . htmlspecialchars(basename($_FILES["file"]["name"]));
-} else {
-    echo "Upload failed";
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: file_upload
+// severity: critical
+// language: php
+// expected: File upload with no extension or MIME type validation
+
+$target_dir  = "/var/www/uploads/";
+$target_file  = $target_dir . basename($_FILES["file"]["name"]);
+
+if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
+    echo "File uploaded: " . htmlspecialchars(basename($_FILES["file"]["name"]));
+} else {
+    echo "Upload failed";
+}

package/dist/packages/crucible/seeds/php/seed-040.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: MIME type validated from user-supplied Content-Type header — bypassable
-
-function handleUpload(): string {
-    $mime      = $_FILES['upload']['type'];
-    $tmp_path  = $_FILES['upload']['tmp_name'];
-    $filename  = $_FILES['upload']['name'];
-
-    $allowed = ['image/jpeg', 'image/png', 'image/gif'];
-    if (!in_array($mime, $allowed)) {
-        die("Invalid file type");
-    }
-
-    $dest = '/var/www/uploads/' . $filename;
-    move_uploaded_file($tmp_path, $dest);
-    return $dest;
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: file_upload
+// severity: critical
+// language: php
+// expected: MIME type validated from user-supplied Content-Type header — bypassable
+
+function handleUpload(): string {
+    $mime      = $_FILES['upload']['type'];
+    $tmp_path  = $_FILES['upload']['tmp_name'];
+    $filename  = $_FILES['upload']['name'];
+
+    $allowed = ['image/jpeg', 'image/png', 'image/gif'];
+    if (!in_array($mime, $allowed)) {
+        die("Invalid file type");
+    }
+
+    $dest = '/var/www/uploads/' . $filename;
+    move_uploaded_file($tmp_path, $dest);
+    return $dest;
+}

package/dist/packages/crucible/seeds/php/seed-041.php

@@ -1,20 +1,20 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: Uploaded file stored with original filename preserving PHP extension
-
-function saveUpload(array $file): string {
-    $upload_dir = '/var/www/html/uploads/';
-    $filename   = $file['name'];
-    $tmp        = $file['tmp_name'];
-
-    $destination = $upload_dir . $filename;
-    move_uploaded_file($tmp, $destination);
-
-    return "https://example.com/uploads/" . urlencode($filename);
-}
-
-$url = saveUpload($_FILES['document']);
-echo "Accessible at: $url";
+<?php
+// [CRUCIBLE-SEED]
+// category: file_upload
+// severity: critical
+// language: php
+// expected: Uploaded file stored with original filename preserving PHP extension
+
+function saveUpload(array $file): string {
+    $upload_dir = '/var/www/html/uploads/';
+    $filename   = $file['name'];
+    $tmp        = $file['tmp_name'];
+
+    $destination = $upload_dir . $filename;
+    move_uploaded_file($tmp, $destination);
+
+    return "https://example.com/uploads/" . urlencode($filename);
+}
+
+$url = saveUpload($_FILES['document']);
+echo "Accessible at: $url";

package/dist/packages/crucible/seeds/php/seed-042.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: high
-// language: php
-// expected: Extension check performed on full filename — bypassable with double extension
-
-function isAllowedExtension(string $filename): bool {
-    $ext      = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
-    $allowed  = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
-    return in_array($ext, $allowed);
-}
-
-$filename = $_FILES['upload']['name'];
-if (!isAllowedExtension($filename)) {
-    die("Extension not allowed");
-}
-
-$dest = '/var/www/uploads/' . $filename;
-move_uploaded_file($_FILES['upload']['tmp_name'], $dest);
-echo "Uploaded: " . $filename;
+<?php
+// [CRUCIBLE-SEED]
+// category: file_upload
+// severity: high
+// language: php
+// expected: Extension check performed on full filename — bypassable with double extension
+
+function isAllowedExtension(string $filename): bool {
+    $ext      = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
+    $allowed  = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
+    return in_array($ext, $allowed);
+}
+
+$filename = $_FILES['upload']['name'];
+if (!isAllowedExtension($filename)) {
+    die("Extension not allowed");
+}
+
+$dest = '/var/www/uploads/' . $filename;
+move_uploaded_file($_FILES['upload']['tmp_name'], $dest);
+echo "Uploaded: " . $filename;

package/dist/packages/crucible/seeds/php/seed-043.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: Upload directory is web-accessible and no .htaccess protection
-
-define('UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/uploads/');
-define('UPLOAD_URL', 'https://' . $_SERVER['HTTP_HOST'] . '/uploads/');
-
-function uploadAvatar(array $file): string {
-    $ext      = pathinfo($file['name'], PATHINFO_EXTENSION);
-    $newName  = uniqid() . '.' . $ext;
-    $path     = UPLOAD_PATH . $newName;
-
-    if (!move_uploaded_file($file['tmp_name'], $path)) {
-        throw new RuntimeException("Upload failed");
-    }
-
-    return UPLOAD_URL . $newName;
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: file_upload
+// severity: critical
+// language: php
+// expected: Upload directory is web-accessible and no .htaccess protection
+
+define('UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/uploads/');
+define('UPLOAD_URL', 'https://' . $_SERVER['HTTP_HOST'] . '/uploads/');
+
+function uploadAvatar(array $file): string {
+    $ext      = pathinfo($file['name'], PATHINFO_EXTENSION);
+    $newName  = uniqid() . '.' . $ext;
+    $path     = UPLOAD_PATH . $newName;
+
+    if (!move_uploaded_file($file['tmp_name'], $path)) {
+        throw new RuntimeException("Upload failed");
+    }
+
+    return UPLOAD_URL . $newName;
+}

package/dist/packages/crucible/seeds/php/seed-044.php

@@ -1,25 +1,25 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: file_get_contents with user-supplied URL — SSRF
-
-$url     = $_GET['url'];
-$timeout = (int) ($_GET['timeout'] ?? 10);
-
-$context = stream_context_create(['http' => ['timeout' => $timeout]]);
-$content = file_get_contents($url, false, $context);
-
-if ($content === false) {
-    http_response_code(502);
-    echo json_encode(['error' => 'Failed to fetch URL', 'url' => $url]);
-} else {
-    echo $content;
-}
-
-$imageUrl = $_POST['image_url'];
-$format   = $_POST['format'] ?? 'jpg';
-$data     = file_get_contents($imageUrl);
-file_put_contents("/tmp/image.$format", $data);
-echo json_encode(['saved' => "/tmp/image.$format", 'size' => strlen($data)]);
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: file_get_contents with user-supplied URL — SSRF
+
+$url     = $_GET['url'];
+$timeout = (int) ($_GET['timeout'] ?? 10);
+
+$context = stream_context_create(['http' => ['timeout' => $timeout]]);
+$content = file_get_contents($url, false, $context);
+
+if ($content === false) {
+    http_response_code(502);
+    echo json_encode(['error' => 'Failed to fetch URL', 'url' => $url]);
+} else {
+    echo $content;
+}
+
+$imageUrl = $_POST['image_url'];
+$format   = $_POST['format'] ?? 'jpg';
+$data     = file_get_contents($imageUrl);
+file_put_contents("/tmp/image.$format", $data);
+echo json_encode(['saved' => "/tmp/image.$format", 'size' => strlen($data)]);

package/dist/packages/crucible/seeds/php/seed-045.php

@@ -1,25 +1,25 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: cURL request to user-controlled URL — SSRF enabling internal network access
-
-function fetchExternalUrl(string $url): string {
-    $ch = curl_init($url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
-    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
-    $response = curl_exec($ch);
-    curl_close($ch);
-    return $response ?: '';
-}
-
-$target   = $_POST['webhook_url'];
-$payload  = json_encode(['event' => 'test', 'data' => $_POST]);
-
-$ch = curl_init($target);
-curl_setopt($ch, CURLOPT_POST, true);
-curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
-curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-curl_exec($ch);
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: cURL request to user-controlled URL — SSRF enabling internal network access
+
+function fetchExternalUrl(string $url): string {
+    $ch = curl_init($url);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+    $response = curl_exec($ch);
+    curl_close($ch);
+    return $response ?: '';
+}
+
+$target   = $_POST['webhook_url'];
+$payload  = json_encode(['event' => 'test', 'data' => $_POST]);
+
+$ch = curl_init($target);
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_exec($ch);

package/dist/packages/crucible/seeds/php/seed-046.php

@@ -1,20 +1,20 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: critical
-// language: php
-// expected: URL composed from user-supplied hostname — SSRF to internal services
-
-$host     = $_GET['host'];
-$port     = $_GET['port'] ?? '80';
-$path     = $_GET['path'] ?? '/';
-
-$url = "http://$host:$port$path";
-$ch  = curl_init($url);
-curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-curl_setopt($ch, CURLOPT_TIMEOUT, 5);
-$result = curl_exec($ch);
-$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-curl_close($ch);
-
-echo "Status: $status\n" . $result;
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: php
+// expected: URL composed from user-supplied hostname — SSRF to internal services
+
+$host     = $_GET['host'];
+$port     = $_GET['port'] ?? '80';
+$path     = $_GET['path'] ?? '/';
+
+$url = "http://$host:$port$path";
+$ch  = curl_init($url);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_setopt($ch, CURLOPT_TIMEOUT, 5);
+$result = curl_exec($ch);
+$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+
+echo "Status: $status\n" . $result;

package/dist/packages/crucible/seeds/php/seed-047.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: php
-// expected: Import/export feature fetches user-supplied URL with no scheme restriction
-
-function importDataFromUrl(string $sourceUrl): array {
-    $allowed_schemes = ['http', 'https'];
-    $scheme = strtolower(parse_url($sourceUrl, PHP_URL_SCHEME));
-    if (!in_array($scheme, $allowed_schemes)) {
-        return ['error' => 'Invalid scheme'];
-    }
-    // Still vulnerable: http://169.254.169.254/ or http://localhost/
-    $data = file_get_contents($sourceUrl);
-    return json_decode($data, true) ?? [];
-}
-
-$url    = $_POST['import_url'];
-$result = importDataFromUrl($url);
-echo json_encode($result);
+<?php
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: php
+// expected: Import/export feature fetches user-supplied URL with no scheme restriction
+
+function importDataFromUrl(string $sourceUrl): array {
+    $allowed_schemes = ['http', 'https'];
+    $scheme = strtolower(parse_url($sourceUrl, PHP_URL_SCHEME));
+    if (!in_array($scheme, $allowed_schemes)) {
+        return ['error' => 'Invalid scheme'];
+    }
+    // Still vulnerable: http://169.254.169.254/ or http://localhost/
+    $data = file_get_contents($sourceUrl);
+    return json_decode($data, true) ?? [];
+}
+
+$url    = $_POST['import_url'];
+$result = importDataFromUrl($url);
+echo json_encode($result);

package/dist/packages/crucible/seeds/php/seed-048.php

@@ -1,19 +1,19 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: high
-// language: php
-// expected: header('Location') with unvalidated user-supplied URL — open redirect
-
-$url     = $_GET['url'];
-$referer = $_SERVER['HTTP_REFERER'] ?? '';
-
-if (empty($url)) {
-    $url = '/';
-}
-
-// Log the redirect for analytics
-error_log("Redirecting user from $referer to: $url");
-
-header('Location: ' . $url);
-exit;
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: high
+// language: php
+// expected: header('Location') with unvalidated user-supplied URL — open redirect
+
+$url     = $_GET['url'];
+$referer = $_SERVER['HTTP_REFERER'] ?? '';
+
+if (empty($url)) {
+    $url = '/';
+}
+
+// Log the redirect for analytics
+error_log("Redirecting user from $referer to: $url");
+
+header('Location: ' . $url);
+exit;

package/dist/packages/crucible/seeds/php/seed-049.php

@@ -1,18 +1,18 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: high
-// language: php
-// expected: Redirect after login using 'next' or 'return_to' parameter without validation
-
-function redirectAfterLogin(): void {
-    $next = $_GET['next'] ?? $_POST['return_to'] ?? '/dashboard';
-    header('Location: ' . $next);
-    exit;
-}
-
-function redirectWithMessage(string $msg): void {
-    $redirect = $_REQUEST['redirect'];
-    header("Location: $redirect?msg=" . urlencode($msg));
-    exit;
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: high
+// language: php
+// expected: Redirect after login using 'next' or 'return_to' parameter without validation
+
+function redirectAfterLogin(): void {
+    $next = $_GET['next'] ?? $_POST['return_to'] ?? '/dashboard';
+    header('Location: ' . $next);
+    exit;
+}
+
+function redirectWithMessage(string $msg): void {
+    $redirect = $_REQUEST['redirect'];
+    header("Location: $redirect?msg=" . urlencode($msg));
+    exit;
+}

package/dist/packages/crucible/seeds/php/seed-050.php

@@ -1,20 +1,20 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: php
-// expected: Redirect target partially validated with strpos — bypassable with subdomain trick
-
-function safeRedirect(string $url): void {
-    $allowed_host = 'example.com';
-    if (strpos($url, $allowed_host) !== false) {
-        header('Location: ' . $url);
-        exit;
-    }
-    header('Location: /error?msg=invalid_redirect');
-    exit;
-}
-
-$target = $_GET['to'];
-safeRedirect($target);
-// Attacker passes: https://evil.com?foo=example.com → strpos match!
+<?php
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: php
+// expected: Redirect target partially validated with strpos — bypassable with subdomain trick
+
+function safeRedirect(string $url): void {
+    $allowed_host = 'example.com';
+    if (strpos($url, $allowed_host) !== false) {
+        header('Location: ' . $url);
+        exit;
+    }
+    header('Location: /error?msg=invalid_redirect');
+    exit;
+}
+
+$target = $_GET['to'];
+safeRedirect($target);
+// Attacker passes: https://evil.com?foo=example.com → strpos match!

package/dist/packages/crucible/seeds/python/seed-001.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded AWS access key and secret key
-
-import boto3
-
-AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
-AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-AWS_REGION = "us-east-1"
-
-s3_client = boto3.client(
-    "s3",
-    aws_access_key_id=AWS_ACCESS_KEY_ID,
-    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
-    region_name=AWS_REGION,
-)
-
-
-def upload_file(file_path: str, bucket: str, key: str) -> dict:
-    with open(file_path, "rb") as f:
-        response = s3_client.put_object(Bucket=bucket, Key=key, Body=f)
-    return response
-
-
-def list_buckets() -> list:
-    response = s3_client.list_buckets()
-    return [b["Name"] for b in response.get("Buckets", [])]
-
-
-if __name__ == "__main__":
-    print(list_buckets())
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded AWS access key and secret key
+
+import boto3
+
+AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
+AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+AWS_REGION = "us-east-1"
+
+s3_client = boto3.client(
+    "s3",
+    aws_access_key_id=AWS_ACCESS_KEY_ID,
+    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
+    region_name=AWS_REGION,
+)
+
+
+def upload_file(file_path: str, bucket: str, key: str) -> dict:
+    with open(file_path, "rb") as f:
+        response = s3_client.put_object(Bucket=bucket, Key=key, Body=f)
+    return response
+
+
+def list_buckets() -> list:
+    response = s3_client.list_buckets()
+    return [b["Name"] for b in response.get("Buckets", [])]
+
+
+if __name__ == "__main__":
+    print(list_buckets())