thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/python/seed-024.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.call with shell=True and user input
-
-import subprocess
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/git/clone", methods=["POST"])
-def git_clone():
-    data = request.get_json()
-    repo_url = data.get("url", "")
-    target_dir = data.get("dir", "/tmp/repo")
-    # shell=True means the full string is passed to /bin/sh
-    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
-    return jsonify({"return_code": ret})
-
-
-@app.route("/nmap", methods=["POST"])
-def nmap_scan():
-    target = request.get_json().get("target", "")
-    ports = request.get_json().get("ports", "1-1000")
-    # target and ports from user — shell injection via semicolons
-    result = subprocess.check_output(
-        f"nmap -p {ports} {target}", shell=True, text=True
-    )
-    return jsonify({"output": result})
-
-
-@app.route("/whois")
-def whois():
-    domain = request.args.get("domain", "")
-    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
-    return jsonify({"result": output})
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.call with shell=True and user input
+
+import subprocess
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/git/clone", methods=["POST"])
+def git_clone():
+    data = request.get_json()
+    repo_url = data.get("url", "")
+    target_dir = data.get("dir", "/tmp/repo")
+    # shell=True means the full string is passed to /bin/sh
+    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
+    return jsonify({"return_code": ret})
+
+
+@app.route("/nmap", methods=["POST"])
+def nmap_scan():
+    target = request.get_json().get("target", "")
+    ports = request.get_json().get("ports", "1-1000")
+    # target and ports from user — shell injection via semicolons
+    result = subprocess.check_output(
+        f"nmap -p {ports} {target}", shell=True, text=True
+    )
+    return jsonify({"output": result})
+
+
+@app.route("/whois")
+def whois():
+    domain = request.args.get("domain", "")
+    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
+    return jsonify({"result": output})

package/dist/packages/crucible/seeds/python/seed-025 2.py

@@ -1,40 +1,40 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.Popen with shell=True and f-string
-
-import subprocess
-from fastapi import FastAPI
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class ImageRequest(BaseModel):
-    image_path: str   # user-controlled
-    width: int
-    height: int
-    quality: int = 85
-
-
-class ReportRequest(BaseModel):
-    format: str       # user-controlled
-    date_range: str   # user-controlled
-
-
-@app.post("/images/thumbnail")
-def generate_thumbnail(req: ImageRequest):
-    # image_path is user-controlled — injection via shell metacharacters
-    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    out, err = proc.communicate(timeout=30)
-    return {"output": out.decode(), "errors": err.decode()}
-
-
-@app.post("/reports/generate")
-def generate_report(req: ReportRequest):
-    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
-    out, _ = proc.communicate()
-    return {"path": out.decode().strip()}
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.Popen with shell=True and f-string
+
+import subprocess
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class ImageRequest(BaseModel):
+    image_path: str   # user-controlled
+    width: int
+    height: int
+    quality: int = 85
+
+
+class ReportRequest(BaseModel):
+    format: str       # user-controlled
+    date_range: str   # user-controlled
+
+
+@app.post("/images/thumbnail")
+def generate_thumbnail(req: ImageRequest):
+    # image_path is user-controlled — injection via shell metacharacters
+    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = proc.communicate(timeout=30)
+    return {"output": out.decode(), "errors": err.decode()}
+
+
+@app.post("/reports/generate")
+def generate_report(req: ReportRequest):
+    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
+    out, _ = proc.communicate()
+    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-025.py

@@ -1,40 +1,40 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.Popen with shell=True and f-string
-
-import subprocess
-from fastapi import FastAPI
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class ImageRequest(BaseModel):
-    image_path: str   # user-controlled
-    width: int
-    height: int
-    quality: int = 85
-
-
-class ReportRequest(BaseModel):
-    format: str       # user-controlled
-    date_range: str   # user-controlled
-
-
-@app.post("/images/thumbnail")
-def generate_thumbnail(req: ImageRequest):
-    # image_path is user-controlled — injection via shell metacharacters
-    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    out, err = proc.communicate(timeout=30)
-    return {"output": out.decode(), "errors": err.decode()}
-
-
-@app.post("/reports/generate")
-def generate_report(req: ReportRequest):
-    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
-    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
-    out, _ = proc.communicate()
-    return {"path": out.decode().strip()}
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.Popen with shell=True and f-string
+
+import subprocess
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class ImageRequest(BaseModel):
+    image_path: str   # user-controlled
+    width: int
+    height: int
+    quality: int = 85
+
+
+class ReportRequest(BaseModel):
+    format: str       # user-controlled
+    date_range: str   # user-controlled
+
+
+@app.post("/images/thumbnail")
+def generate_thumbnail(req: ImageRequest):
+    # image_path is user-controlled — injection via shell metacharacters
+    cmd = f"ffmpeg -i {req.image_path} -vf scale={req.width}:{req.height} -q:v {req.quality} out.jpg"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = proc.communicate(timeout=30)
+    return {"output": out.decode(), "errors": err.decode()}
+
+
+@app.post("/reports/generate")
+def generate_report(req: ReportRequest):
+    cmd = f"python3 scripts/report.py --format {req.format} --range {req.date_range}"
+    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
+    out, _ = proc.communicate()
+    return {"path": out.decode().strip()}

package/dist/packages/crucible/seeds/python/seed-026 2.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via os.popen with user-controlled filename
-
-import os
-from flask import Flask, request, send_file
-import io
-
-app = Flask(__name__)
-
-
-@app.route("/export/csv")
-def export_csv():
-    table = request.args.get("table", "users")
-    date = request.args.get("date", "2024-01-01")
-    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
-    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
-    return output, 200, {"Content-Type": "text/csv"}
-
-
-@app.route("/preview/pdf")
-def preview_pdf():
-    filename = request.args.get("file", "")
-    # filename from user — injection via backticks or semicolons
-    output = os.popen(f"pdftotext uploads/{filename} -").read()
-    return {"text": output}
-
-
-@app.route("/image/metadata")
-def image_metadata():
-    path = request.args.get("path", "")
-    result = os.popen(f"exiftool {path}").read()
-    return {"metadata": result}
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via os.popen with user-controlled filename
+
+import os
+from flask import Flask, request, send_file
+import io
+
+app = Flask(__name__)
+
+
+@app.route("/export/csv")
+def export_csv():
+    table = request.args.get("table", "users")
+    date = request.args.get("date", "2024-01-01")
+    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
+    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
+    return output, 200, {"Content-Type": "text/csv"}
+
+
+@app.route("/preview/pdf")
+def preview_pdf():
+    filename = request.args.get("file", "")
+    # filename from user — injection via backticks or semicolons
+    output = os.popen(f"pdftotext uploads/{filename} -").read()
+    return {"text": output}
+
+
+@app.route("/image/metadata")
+def image_metadata():
+    path = request.args.get("path", "")
+    result = os.popen(f"exiftool {path}").read()
+    return {"metadata": result}

package/dist/packages/crucible/seeds/python/seed-026.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via os.popen with user-controlled filename
-
-import os
-from flask import Flask, request, send_file
-import io
-
-app = Flask(__name__)
-
-
-@app.route("/export/csv")
-def export_csv():
-    table = request.args.get("table", "users")
-    date = request.args.get("date", "2024-01-01")
-    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
-    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
-    return output, 200, {"Content-Type": "text/csv"}
-
-
-@app.route("/preview/pdf")
-def preview_pdf():
-    filename = request.args.get("file", "")
-    # filename from user — injection via backticks or semicolons
-    output = os.popen(f"pdftotext uploads/{filename} -").read()
-    return {"text": output}
-
-
-@app.route("/image/metadata")
-def image_metadata():
-    path = request.args.get("path", "")
-    result = os.popen(f"exiftool {path}").read()
-    return {"metadata": result}
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via os.popen with user-controlled filename
+
+import os
+from flask import Flask, request, send_file
+import io
+
+app = Flask(__name__)
+
+
+@app.route("/export/csv")
+def export_csv():
+    table = request.args.get("table", "users")
+    date = request.args.get("date", "2024-01-01")
+    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
+    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
+    return output, 200, {"Content-Type": "text/csv"}
+
+
+@app.route("/preview/pdf")
+def preview_pdf():
+    filename = request.args.get("file", "")
+    # filename from user — injection via backticks or semicolons
+    output = os.popen(f"pdftotext uploads/{filename} -").read()
+    return {"text": output}
+
+
+@app.route("/image/metadata")
+def image_metadata():
+    path = request.args.get("path", "")
+    result = os.popen(f"exiftool {path}").read()
+    return {"metadata": result}

package/dist/packages/crucible/seeds/python/seed-027 2.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via paramiko exec_command with user-controlled command string
+
+import paramiko
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def get_ssh_client(host: str) -> paramiko.SSHClient:
+    client = paramiko.SSHClient()
+    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
+    return client
+
+
+@app.route("/ssh/run", methods=["POST"])
+def run_remote_command():
+    data = request.get_json()
+    host = data.get("host", "")
+    # command from user — attacker appends malicious commands
+    command = data.get("command", "")
+    allowed_hosts = ["web-01.internal", "web-02.internal"]
+    if host not in allowed_hosts:
+        return jsonify({"error": "Host not allowed"}), 403
+
+    client = get_ssh_client(host)
+    # command not validated — attacker sends "ls; cat /etc/shadow"
+    stdin, stdout, stderr = client.exec_command(command)
+    output = stdout.read().decode()
+    client.close()
+    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-027.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: high
+# language: python
+# expected: command injection via paramiko exec_command with user-controlled command string
+
+import paramiko
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def get_ssh_client(host: str) -> paramiko.SSHClient:
+    client = paramiko.SSHClient()
+    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
+    return client
+
+
+@app.route("/ssh/run", methods=["POST"])
+def run_remote_command():
+    data = request.get_json()
+    host = data.get("host", "")
+    # command from user — attacker appends malicious commands
+    command = data.get("command", "")
+    allowed_hosts = ["web-01.internal", "web-02.internal"]
+    if host not in allowed_hosts:
+        return jsonify({"error": "Host not allowed"}), 403
+
+    client = get_ssh_client(host)
+    # command not validated — attacker sends "ls; cat /etc/shadow"
+    stdin, stdout, stderr = client.exec_command(command)
+    output = stdout.read().decode()
+    client.close()
+    return jsonify({"output": output})

package/dist/packages/crucible/seeds/python/seed-028 2.py

@@ -1,42 +1,42 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)
+# [CRUCIBLE-SEED]
+# category: command_injection
+# severity: critical
+# language: python
+# expected: command injection via subprocess.run with shell=True and user-controlled git operation
+
+import subprocess
+from dataclasses import dataclass
+
+
+@dataclass
+class GitConfig:
+    repo_path: str
+    branch: str      # user-controlled
+    remote: str = "origin"
+
+
+class GitService:
+    def clone(self, repo_url: str, target: str) -> str:
+        # repo_url from user — injection possible
+        result = subprocess.run(
+            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def checkout(self, cfg: GitConfig) -> str:
+        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
+        result = subprocess.run(
+            f"git -C {cfg.repo_path} checkout {cfg.branch}",
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def tag(self, repo: str, tag_name: str, message: str) -> str:
+        result = subprocess.run(
+            f'git -C {repo} tag -a {tag_name} -m "{message}"',
+            shell=True, capture_output=True, text=True
+        )
+        return result.stdout
+
+    def archive(self, repo: str, branch: str, output_file: str) -> None:
+        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)