thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/ts/seed-015 2.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via Sequelize literal() with user-controlled search input
-
-import { Sequelize, QueryTypes } from 'sequelize';
-
-const sequelize = new Sequelize(process.env.DATABASE_URL!);
-
-export async function fullTextSearch(
-  query: string,
-  table: 'products' | 'articles' | 'users',
-  fields: string[]
-): Promise<Record<string, unknown>[]> {
-  const fieldList = fields.join(', ');
-  const whereClause = fields
-    .map(f => `${f} ILIKE '%${query}%'`)
-    .join(' OR ');
-
-  // Both fieldList and whereClause derived from user input — injection possible
-  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-export async function bulkUpdate(ids: number[], status: string): Promise<void> {
-  const idList = ids.join(',');
-  await sequelize.query(
-    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
-  );
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: typescript
+// expected: SQL injection via Sequelize literal() with user-controlled search input
+
+import { Sequelize, QueryTypes } from 'sequelize';
+
+const sequelize = new Sequelize(process.env.DATABASE_URL!);
+
+export async function fullTextSearch(
+  query: string,
+  table: 'products' | 'articles' | 'users',
+  fields: string[]
+): Promise<Record<string, unknown>[]> {
+  const fieldList = fields.join(', ');
+  const whereClause = fields
+    .map(f => `${f} ILIKE '%${query}%'`)
+    .join(' OR ');
+
+  // Both fieldList and whereClause derived from user input — injection possible
+  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
+  return sequelize.query(sql, { type: QueryTypes.SELECT });
+}
+
+export async function bulkUpdate(ids: number[], status: string): Promise<void> {
+  const idList = ids.join(',');
+  await sequelize.query(
+    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
+  );
+}

package/dist/packages/crucible/seeds/ts/seed-015.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: typescript
-// expected: SQL injection via Sequelize literal() with user-controlled search input
-
-import { Sequelize, QueryTypes } from 'sequelize';
-
-const sequelize = new Sequelize(process.env.DATABASE_URL!);
-
-export async function fullTextSearch(
-  query: string,
-  table: 'products' | 'articles' | 'users',
-  fields: string[]
-): Promise<Record<string, unknown>[]> {
-  const fieldList = fields.join(', ');
-  const whereClause = fields
-    .map(f => `${f} ILIKE '%${query}%'`)
-    .join(' OR ');
-
-  // Both fieldList and whereClause derived from user input — injection possible
-  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-export async function bulkUpdate(ids: number[], status: string): Promise<void> {
-  const idList = ids.join(',');
-  await sequelize.query(
-    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
-  );
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: typescript
+// expected: SQL injection via Sequelize literal() with user-controlled search input
+
+import { Sequelize, QueryTypes } from 'sequelize';
+
+const sequelize = new Sequelize(process.env.DATABASE_URL!);
+
+export async function fullTextSearch(
+  query: string,
+  table: 'products' | 'articles' | 'users',
+  fields: string[]
+): Promise<Record<string, unknown>[]> {
+  const fieldList = fields.join(', ');
+  const whereClause = fields
+    .map(f => `${f} ILIKE '%${query}%'`)
+    .join(' OR ');
+
+  // Both fieldList and whereClause derived from user input — injection possible
+  const sql = `SELECT ${fieldList} FROM "${table}" WHERE ${whereClause} LIMIT 50`;
+  return sequelize.query(sql, { type: QueryTypes.SELECT });
+}
+
+export async function bulkUpdate(ids: number[], status: string): Promise<void> {
+  const idList = ids.join(',');
+  await sequelize.query(
+    `UPDATE orders SET status = '${status}' WHERE id IN (${idList})`
+  );
+}

package/dist/packages/crucible/seeds/ts/seed-016 2.ts

@@ -1,37 +1,37 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
-
-import React from 'react';
-
-interface Comment {
-  id: string;
-  author: string;
-  body: string;
-  avatarHtml: string;
-}
-
-interface CommentCardProps {
-  comment: Comment;
-}
-
-export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
-  return (
-    <div className="comment-card">
-      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
-      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
-      <div className="author">{comment.author}</div>
-      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
-    </div>
-  );
-};
-
-interface RichTextProps {
-  content: string; // user-submitted rich text
-}
-
-export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
-  <article dangerouslySetInnerHTML={{ __html: content }} />
-);
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
+
+import React from 'react';
+
+interface Comment {
+  id: string;
+  author: string;
+  body: string;
+  avatarHtml: string;
+}
+
+interface CommentCardProps {
+  comment: Comment;
+}
+
+export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
+  return (
+    <div className="comment-card">
+      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
+      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
+      <div className="author">{comment.author}</div>
+      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
+    </div>
+  );
+};
+
+interface RichTextProps {
+  content: string; // user-submitted rich text
+}
+
+export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
+  <article dangerouslySetInnerHTML={{ __html: content }} />
+);

package/dist/packages/crucible/seeds/ts/seed-016.ts

@@ -1,37 +1,37 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
-
-import React from 'react';
-
-interface Comment {
-  id: string;
-  author: string;
-  body: string;
-  avatarHtml: string;
-}
-
-interface CommentCardProps {
-  comment: Comment;
-}
-
-export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
-  return (
-    <div className="comment-card">
-      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
-      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
-      <div className="author">{comment.author}</div>
-      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
-    </div>
-  );
-};
-
-interface RichTextProps {
-  content: string; // user-submitted rich text
-}
-
-export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
-  <article dangerouslySetInnerHTML={{ __html: content }} />
-);
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via React dangerouslySetInnerHTML with user-controlled content
+
+import React from 'react';
+
+interface Comment {
+  id: string;
+  author: string;
+  body: string;
+  avatarHtml: string;
+}
+
+interface CommentCardProps {
+  comment: Comment;
+}
+
+export const CommentCard: React.FC<CommentCardProps> = ({ comment }) => {
+  return (
+    <div className="comment-card">
+      {/* avatarHtml and body come from server/user — XSS if unsanitized */}
+      <div className="avatar" dangerouslySetInnerHTML={{ __html: comment.avatarHtml }} />
+      <div className="author">{comment.author}</div>
+      <div className="body" dangerouslySetInnerHTML={{ __html: comment.body }} />
+    </div>
+  );
+};
+
+interface RichTextProps {
+  content: string; // user-submitted rich text
+}
+
+export const RichTextRenderer: React.FC<RichTextProps> = ({ content }) => (
+  <article dangerouslySetInnerHTML={{ __html: content }} />
+);

package/dist/packages/crucible/seeds/ts/seed-017 2.ts

@@ -1,44 +1,44 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Angular [innerHTML] binding with user-controlled data
-
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { UserService } from '../services/user.service';
-
-interface UserProfile {
-  displayName: string;
-  bio: string;        // Rich HTML from user
-  signature: string;  // HTML signature from user
-}
-
-@Component({
-  selector: 'app-user-profile',
-  template: `
-    <div class="profile">
-      <h1>{{ user?.displayName }}</h1>
-      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
-      <div class="bio" [innerHTML]="trustedBio"></div>
-      <footer [innerHTML]="trustedSignature"></footer>
-    </div>
-  `,
-})
-export class UserProfileComponent implements OnInit {
-  user: UserProfile | null = null;
-  trustedBio: any;
-  trustedSignature: any;
-
-  constructor(private route: ActivatedRoute, private userService: UserService) {}
-
-  ngOnInit(): void {
-    const id = this.route.snapshot.paramMap.get('id')!;
-    this.userService.getProfile(id).subscribe(user => {
-      this.user = user;
-      // Bypasses Angular's built-in XSS protection
-      this.trustedBio = user.bio;
-      this.trustedSignature = user.signature;
-    });
-  }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via Angular [innerHTML] binding with user-controlled data
+
+import { Component, OnInit } from '@angular/core';
+import { ActivatedRoute } from '@angular/router';
+import { UserService } from '../services/user.service';
+
+interface UserProfile {
+  displayName: string;
+  bio: string;        // Rich HTML from user
+  signature: string;  // HTML signature from user
+}
+
+@Component({
+  selector: 'app-user-profile',
+  template: `
+    <div class="profile">
+      <h1>{{ user?.displayName }}</h1>
+      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
+      <div class="bio" [innerHTML]="trustedBio"></div>
+      <footer [innerHTML]="trustedSignature"></footer>
+    </div>
+  `,
+})
+export class UserProfileComponent implements OnInit {
+  user: UserProfile | null = null;
+  trustedBio: any;
+  trustedSignature: any;
+
+  constructor(private route: ActivatedRoute, private userService: UserService) {}
+
+  ngOnInit(): void {
+    const id = this.route.snapshot.paramMap.get('id')!;
+    this.userService.getProfile(id).subscribe(user => {
+      this.user = user;
+      // Bypasses Angular's built-in XSS protection
+      this.trustedBio = user.bio;
+      this.trustedSignature = user.signature;
+    });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-017.ts

@@ -1,44 +1,44 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Angular [innerHTML] binding with user-controlled data
-
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { UserService } from '../services/user.service';
-
-interface UserProfile {
-  displayName: string;
-  bio: string;        // Rich HTML from user
-  signature: string;  // HTML signature from user
-}
-
-@Component({
-  selector: 'app-user-profile',
-  template: `
-    <div class="profile">
-      <h1>{{ user?.displayName }}</h1>
-      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
-      <div class="bio" [innerHTML]="trustedBio"></div>
-      <footer [innerHTML]="trustedSignature"></footer>
-    </div>
-  `,
-})
-export class UserProfileComponent implements OnInit {
-  user: UserProfile | null = null;
-  trustedBio: any;
-  trustedSignature: any;
-
-  constructor(private route: ActivatedRoute, private userService: UserService) {}
-
-  ngOnInit(): void {
-    const id = this.route.snapshot.paramMap.get('id')!;
-    this.userService.getProfile(id).subscribe(user => {
-      this.user = user;
-      // Bypasses Angular's built-in XSS protection
-      this.trustedBio = user.bio;
-      this.trustedSignature = user.signature;
-    });
-  }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via Angular [innerHTML] binding with user-controlled data
+
+import { Component, OnInit } from '@angular/core';
+import { ActivatedRoute } from '@angular/router';
+import { UserService } from '../services/user.service';
+
+interface UserProfile {
+  displayName: string;
+  bio: string;        // Rich HTML from user
+  signature: string;  // HTML signature from user
+}
+
+@Component({
+  selector: 'app-user-profile',
+  template: `
+    <div class="profile">
+      <h1>{{ user?.displayName }}</h1>
+      <!-- [innerHTML] bypasses Angular's sanitization when DomSanitizer.bypassSecurityTrustHtml is used -->
+      <div class="bio" [innerHTML]="trustedBio"></div>
+      <footer [innerHTML]="trustedSignature"></footer>
+    </div>
+  `,
+})
+export class UserProfileComponent implements OnInit {
+  user: UserProfile | null = null;
+  trustedBio: any;
+  trustedSignature: any;
+
+  constructor(private route: ActivatedRoute, private userService: UserService) {}
+
+  ngOnInit(): void {
+    const id = this.route.snapshot.paramMap.get('id')!;
+    this.userService.getProfile(id).subscribe(user => {
+      this.user = user;
+      // Bypasses Angular's built-in XSS protection
+      this.trustedBio = user.bio;
+      this.trustedSignature = user.signature;
+    });
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-018 2.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via innerHTML in typed DOM manipulation utility
-
-export class DomRenderer {
-  private container: HTMLElement;
-
-  constructor(containerId: string) {
-    this.container = document.getElementById(containerId) as HTMLElement;
-  }
-
-  renderUserContent(content: string): void {
-    // Direct innerHTML assignment — content from user input
-    this.container.innerHTML = content;
-  }
-
-  appendItem(title: string, description: string): void {
-    // Template literal with user data written to innerHTML
-    this.container.innerHTML += `
-      <div class="item">
-        <h3>${title}</h3>
-        <p>${description}</p>
-      </div>
-    `;
-  }
-
-  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
-    const banner = document.querySelector('.banner') as HTMLElement;
-    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
-  }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via innerHTML in typed DOM manipulation utility
+
+export class DomRenderer {
+  private container: HTMLElement;
+
+  constructor(containerId: string) {
+    this.container = document.getElementById(containerId) as HTMLElement;
+  }
+
+  renderUserContent(content: string): void {
+    // Direct innerHTML assignment — content from user input
+    this.container.innerHTML = content;
+  }
+
+  appendItem(title: string, description: string): void {
+    // Template literal with user data written to innerHTML
+    this.container.innerHTML += `
+      <div class="item">
+        <h3>${title}</h3>
+        <p>${description}</p>
+      </div>
+    `;
+  }
+
+  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
+    const banner = document.querySelector('.banner') as HTMLElement;
+    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-018.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via innerHTML in typed DOM manipulation utility
-
-export class DomRenderer {
-  private container: HTMLElement;
-
-  constructor(containerId: string) {
-    this.container = document.getElementById(containerId) as HTMLElement;
-  }
-
-  renderUserContent(content: string): void {
-    // Direct innerHTML assignment — content from user input
-    this.container.innerHTML = content;
-  }
-
-  appendItem(title: string, description: string): void {
-    // Template literal with user data written to innerHTML
-    this.container.innerHTML += `
-      <div class="item">
-        <h3>${title}</h3>
-        <p>${description}</p>
-      </div>
-    `;
-  }
-
-  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
-    const banner = document.querySelector('.banner') as HTMLElement;
-    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
-  }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via innerHTML in typed DOM manipulation utility
+
+export class DomRenderer {
+  private container: HTMLElement;
+
+  constructor(containerId: string) {
+    this.container = document.getElementById(containerId) as HTMLElement;
+  }
+
+  renderUserContent(content: string): void {
+    // Direct innerHTML assignment — content from user input
+    this.container.innerHTML = content;
+  }
+
+  appendItem(title: string, description: string): void {
+    // Template literal with user data written to innerHTML
+    this.container.innerHTML += `
+      <div class="item">
+        <h3>${title}</h3>
+        <p>${description}</p>
+      </div>
+    `;
+  }
+
+  showBanner(message: string, type: 'info' | 'warning' | 'error'): void {
+    const banner = document.querySelector('.banner') as HTMLElement;
+    banner.innerHTML = `<div class="alert alert-${type}">${message}</div>`;
+  }
+}

package/dist/packages/crucible/seeds/ts/seed-019 2.ts

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Express response with unsanitized template literal containing user input
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-router.get('/search', (req: Request, res: Response) => {
-  const query = (req.query.q as string) || '';
-  const category = (req.query.cat as string) || 'all';
-
-  // Both query and category embedded directly in HTML without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html lang="en">
-      <head><title>Search - ${category}</title></head>
-      <body>
-        <h1>Results for: <em>${query}</em></h1>
-        <p>Category: ${category}</p>
-        <script>
-          const searchQuery = "${query}";
-          const searchCategory = "${category}";
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: typescript
+// expected: XSS via Express response with unsanitized template literal containing user input
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+router.get('/search', (req: Request, res: Response) => {
+  const query = (req.query.q as string) || '';
+  const category = (req.query.cat as string) || 'all';
+
+  // Both query and category embedded directly in HTML without encoding
+  res.send(`
+    <!DOCTYPE html>
+    <html lang="en">
+      <head><title>Search - ${category}</title></head>
+      <body>
+        <h1>Results for: <em>${query}</em></h1>
+        <p>Category: ${category}</p>
+        <script>
+          const searchQuery = "${query}";
+          const searchCategory = "${category}";
+        </script>
+      </body>
+    </html>
+  `);
+});
+
+export default router;