thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/rules/xxe.json

@@ -1,66 +1,66 @@
-[
-  {
-    "id": "XXE001",
-    "pattern": "XMLReaderFactory|DocumentBuilderFactory|XmlReader.*DtdProcessing",
-    "flags": "",
-    "category": "xxe",
-    "description": "XXE",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE002",
-    "pattern": "DtdProcessing\\s*=\\s*DtdProcessing\\.Parse",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XmlDocument/XmlReader",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE003",
-    "pattern": "XmlResolver\\s*=\\s*new XmlUrlResolver\\s*\\(\\)",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XmlDocument/XmlReader",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE004",
-    "pattern": "new XPathDocument\\s*\\(",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XPathDocument (no resolver set = default unsafe on older .NET)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE005",
-    "pattern": "SAXParserFactory\\.newInstance\\s*\\(\\s*\\)",
-    "flags": "",
-    "category": "xxe",
-    "description": "Java: XXE via SAXParserFactory without secure processing",
-    "language": [
-      "java"
-    ],
-    "severity": "critical"
-  }
-]
+[
+  {
+    "id": "XXE001",
+    "pattern": "XMLReaderFactory|DocumentBuilderFactory|XmlReader.*DtdProcessing",
+    "flags": "",
+    "category": "xxe",
+    "description": "XXE",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE002",
+    "pattern": "DtdProcessing\\s*=\\s*DtdProcessing\\.Parse",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XmlDocument/XmlReader",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE003",
+    "pattern": "XmlResolver\\s*=\\s*new XmlUrlResolver\\s*\\(\\)",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XmlDocument/XmlReader",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE004",
+    "pattern": "new XPathDocument\\s*\\(",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XPathDocument (no resolver set = default unsafe on older .NET)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE005",
+    "pattern": "SAXParserFactory\\.newInstance\\s*\\(\\s*\\)",
+    "flags": "",
+    "category": "xxe",
+    "description": "Java: XXE via SAXParserFactory without secure processing",
+    "language": [
+      "java"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/yaml-deserialization.json

@@ -1,22 +1,22 @@
-[
-  {
-    "id": "YAMLD001",
-    "pattern": "YAML\\.load\\s*\\(",
-    "flags": "",
-    "category": "yaml_deserialization",
-    "description": "YAML deserialization",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  }
-]
+[
+  {
+    "id": "YAMLD001",
+    "pattern": "YAML\\.load\\s*\\(",
+    "flags": "",
+    "category": "yaml_deserialization",
+    "description": "YAML deserialization",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/yaml-injection.json

@@ -1,22 +1,22 @@
-[
-  {
-    "id": "YAML001",
-    "pattern": "yaml\\.load\\s*\\((?![^)]*[Ll]oader\\s*=\\s*yaml\\.(?:Safe|Base)Loader)|YAML\\.load\\s*\\(",
-    "flags": "i",
-    "category": "yaml_injection",
-    "description": "YAML injection (yaml.load without safe_load)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  }
-]
+[
+  {
+    "id": "YAML001",
+    "pattern": "yaml\\.load\\s*\\((?![^)]*[Ll]oader\\s*=\\s*yaml\\.(?:Safe|Base)Loader)|YAML\\.load\\s*\\(",
+    "flags": "i",
+    "category": "yaml_injection",
+    "description": "YAML injection (yaml.load without safe_load)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/seeding-engine.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path");function mulberry32(e){let t=e>>>0;return function(){t|=0,t=t+1831565813|0;let e=Math.imul(t^t>>>15,1|t);return e=e+Math.imul(e^e>>>7,61|e)^e,((e^e>>>14)>>>0)/4294967296}}const LANG_DIR_MAP={javascript:"js",js:"js",typescript:"ts",ts:"ts",python:"python",py:"python",java:"java",csharp:"csharp",cs:"csharp",go:"go",golang:"go",kotlin:"kotlin",kt:"kotlin",rust:"rust",rs:"rust",php:"php",ruby:"ruby",rb:"ruby"},ALL_LANGUAGES=["js","ts","python","java","csharp","go","kotlin","rust","php","ruby"];function parseSeedHeader(e){const t=e.split("\n").slice(0,20),s={};let r=!1;for(const e of t){const t=e.trim().replace(/^\/\/\s*/,"").replace(/^#\s*/,"").replace(/^\*\s*/,"");if("[CRUCIBLE-SEED]"===t){r=!0;continue}if(!r)continue;const a=t.match(/^(category|severity|language|expected):\s*(.+)$/);if(a&&(s[a[1]]=a[2].trim()),Object.keys(s).length>=4)break}return Object.keys(s).length>=3?s:null}class SeedingEngine{constructor(e={}){this.seedsDir=e.seedsDir||path.join(__dirname,"seeds"),this.prngseed="number"==typeof e.prngseed?e.prngseed:42,this._byLanguage=new Map,this._byCategory=new Map,this._all=[],this._loaded=!1}load(){if(this._loaded)return this._all.length;if(!fs.existsSync(this.seedsDir))throw new Error(`Seeds directory not found: ${this.seedsDir}`);const e=fs.readdirSync(this.seedsDir,{withFileTypes:!0}).filter(e=>e.isDirectory()).map(e=>e.name);for(const t of e){const e=path.join(this.seedsDir,t),s=fs.readdirSync(e).filter(e=>/\.(js|ts|py|java|cs|go|kt|rs|php|rb)$/.test(e)).sort();for(const r of s){const s=path.join(e,r);let a;try{a=fs.readFileSync(s,"utf-8")}catch{continue}const n=parseSeedHeader(a),i={id:`${t}/${r}`,file:s,langDir:t,filename:r,content:a,category:n?.category||"unknown",severity:n?.severity||"medium",language:n?.language||t,expected:n?.expected||""};this._all.push(i),this._byLanguage.has(t)||this._byLanguage.set(t,[]),this._byLanguage.get(t).push(i);const o=i.category;this._byCategory.has(o)||this._byCategory.set(o,[]),this._byCategory.get(o).push(i)}}return this._loaded=!0,this._all.length}get languages(){return this.load(),Array.from(this._byLanguage.keys()).sort()}get categories(){return this.load(),Array.from(this._byCategory.keys()).sort()}get count(){return this.load(),this._all.length}forLanguage(e){this.load();const t=LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase();return this._byLanguage.get(t)||[]}forCategory(e){return this.load(),this._byCategory.get(e)||[]}forLanguageAndCategory(e,t){return this.load(),this.forLanguage(e).filter(e=>e.category===t)}createPRNG(){return mulberry32(this.prngseed)}_shuffle(e,t){for(let s=e.length-1;s>0;s--){const r=Math.floor(t()*(s+1));[e[s],e[r]]=[e[r],e[s]]}return e}sample(e,t){const s=this.createPRNG(),r=e.slice();return this._shuffle(r,s),r.slice(0,t)}selectForLevel(e,t={}){this.load();let s=this._all.slice();if(t.languages&&t.languages.length){const e=t.languages.map(e=>LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase());s=s.filter(t=>e.includes(t.langDir))}t.categories&&t.categories.length&&(s=s.filter(e=>t.categories.includes(e.category)));const r=this.createPRNG(),a=s.slice();switch(this._shuffle(a,r),e){case"gentle":default:return a.slice(0,50);case"medium":return a.slice(0,200);case"hell":return a}}stats(){this.load();const e={};for(const[t,s]of this._byLanguage)e[t]=s.length;const t={};for(const[e,s]of this._byCategory)t[e]=s.length;const s={critical:0,high:0,medium:0,low:0};for(const e of this._all){const t=(e.severity||"medium").toLowerCase();s[t]=(s[t]||0)+1}return{total:this._all.length,byLanguage:e,byCategory:t,bySeverity:s}}}module.exports={SeedingEngine:SeedingEngine,mulberry32:mulberry32,parseSeedHeader:parseSeedHeader,ALL_LANGUAGES:ALL_LANGUAGES,LANG_DIR_MAP:LANG_DIR_MAP};
+"use strict";const fs=require("fs"),path=require("path");function mulberry32(e){let t=e>>>0;return function(){t|=0,t=t+1831565813|0;let e=Math.imul(t^t>>>15,1|t);return e=e+Math.imul(e^e>>>7,61|e)^e,((e^e>>>14)>>>0)/4294967296}}const LANG_DIR_MAP={javascript:"js",js:"js",typescript:"ts",ts:"ts",python:"python",py:"python",java:"java",csharp:"csharp",cs:"csharp",go:"go",golang:"go",kotlin:"kotlin",kt:"kotlin",rust:"rust",rs:"rust",php:"php",ruby:"ruby",rb:"ruby"},ALL_LANGUAGES=["js","ts","python","java","csharp","go","kotlin","rust","php","ruby"];function parseSeedHeader(e){const t=e.split(/\r?\n/).slice(0,20),s={};let r=!1;for(const e of t){const t=e.trim().replace(/^\/\/\s*/,"").replace(/^#\s*/,"").replace(/^\*\s*/,"");if("[CRUCIBLE-SEED]"===t){r=!0;continue}if(!r)continue;const a=t.match(/^(category|severity|language|expected):\s*(.+)$/);if(a&&(s[a[1]]=a[2].trim()),Object.keys(s).length>=4)break}return Object.keys(s).length>=3?s:null}class SeedingEngine{constructor(e={}){this.seedsDir=e.seedsDir||path.join(__dirname,"seeds"),this.prngseed="number"==typeof e.prngseed?e.prngseed:42,this._byLanguage=new Map,this._byCategory=new Map,this._all=[],this._loaded=!1}load(){if(this._loaded)return this._all.length;if(!fs.existsSync(this.seedsDir))throw new Error(`Seeds directory not found: ${this.seedsDir}`);const e=fs.readdirSync(this.seedsDir,{withFileTypes:!0}).filter(e=>e.isDirectory()).map(e=>e.name);for(const t of e){const e=path.join(this.seedsDir,t),s=fs.readdirSync(e).filter(e=>/\.(js|ts|py|java|cs|go|kt|rs|php|rb)$/.test(e)).sort();for(const r of s){const s=path.join(e,r);let a;try{a=fs.readFileSync(s,"utf-8").replace(/\r\n/g,"\n")}catch{continue}const n=parseSeedHeader(a),i={id:`${t}/${r}`,file:s,langDir:t,filename:r,content:a,category:n?.category||"unknown",severity:n?.severity||"medium",language:n?.language||t,expected:n?.expected||""};this._all.push(i),this._byLanguage.has(t)||this._byLanguage.set(t,[]),this._byLanguage.get(t).push(i);const o=i.category;this._byCategory.has(o)||this._byCategory.set(o,[]),this._byCategory.get(o).push(i)}}return this._loaded=!0,this._all.length}get languages(){return this.load(),Array.from(this._byLanguage.keys()).sort()}get categories(){return this.load(),Array.from(this._byCategory.keys()).sort()}get count(){return this.load(),this._all.length}forLanguage(e){this.load();const t=LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase();return this._byLanguage.get(t)||[]}forCategory(e){return this.load(),this._byCategory.get(e)||[]}forLanguageAndCategory(e,t){return this.load(),this.forLanguage(e).filter(e=>e.category===t)}createPRNG(){return mulberry32(this.prngseed)}_shuffle(e,t){for(let s=e.length-1;s>0;s--){const r=Math.floor(t()*(s+1));[e[s],e[r]]=[e[r],e[s]]}return e}sample(e,t){const s=this.createPRNG(),r=e.slice();return this._shuffle(r,s),r.slice(0,t)}selectForLevel(e,t={}){this.load();let s=this._all.slice();if(t.languages&&t.languages.length){const e=t.languages.map(e=>LANG_DIR_MAP[e.toLowerCase()]||e.toLowerCase());s=s.filter(t=>e.includes(t.langDir))}t.categories&&t.categories.length&&(s=s.filter(e=>t.categories.includes(e.category)));const r=this.createPRNG(),a=s.slice();switch(this._shuffle(a,r),e){case"gentle":default:return a.slice(0,50);case"medium":return a.slice(0,200);case"hell":return a}}stats(){this.load();const e={};for(const[t,s]of this._byLanguage)e[t]=s.length;const t={};for(const[e,s]of this._byCategory)t[e]=s.length;const s={critical:0,high:0,medium:0,low:0};for(const e of this._all){const t=(e.severity||"medium").toLowerCase();s[t]=(s[t]||0)+1}return{total:this._all.length,byLanguage:e,byCategory:t,bySeverity:s}}}module.exports={SeedingEngine:SeedingEngine,mulberry32:mulberry32,parseSeedHeader:parseSeedHeader,ALL_LANGUAGES:ALL_LANGUAGES,LANG_DIR_MAP:LANG_DIR_MAP};

package/dist/packages/crucible/seeds/csharp/seed-001.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded SQL Server connection string with plaintext password
-
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class DatabaseConfig
-    {
-        private const string ConnectionString =
-            "Server=prod-sql.internal;Database=AppDb;User Id=sa;Password=Pr0dS@P@ssw0rd!;";
-
-        public static SqlConnection GetConnection()
-        {
-            return new SqlConnection(ConnectionString);
-        }
-
-        public static void TestConnection()
-        {
-            using var conn = GetConnection();
-            conn.Open();
-            System.Console.WriteLine("Connected to: " + conn.DataSource);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded SQL Server connection string with plaintext password
+
+using System.Data.SqlClient;
+
+namespace App.Data
+{
+    public class DatabaseConfig
+    {
+        private const string ConnectionString =
+            "Server=prod-sql.internal;Database=AppDb;User Id=sa;Password=Pr0dS@P@ssw0rd!;";
+
+        public static SqlConnection GetConnection()
+        {
+            return new SqlConnection(ConnectionString);
+        }
+
+        public static void TestConnection()
+        {
+            using var conn = GetConnection();
+            conn.Open();
+            System.Console.WriteLine("Connected to: " + conn.DataSource);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-002.cs

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded AWS credentials stored as string constants
-
-using Amazon;
-using Amazon.S3;
-using Amazon.Runtime;
-
-namespace App.Cloud
-{
-    public class AwsClientFactory
-    {
-        private const string AccessKeyId     = "AKIAIOSFODNN7EXAMPLE";
-        private const string SecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-
-        public static AmazonS3Client CreateS3Client()
-        {
-            var credentials = new BasicAWSCredentials(AccessKeyId, SecretAccessKey);
-            return new AmazonS3Client(credentials, RegionEndpoint.USEast1);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded AWS credentials stored as string constants
+
+using Amazon;
+using Amazon.S3;
+using Amazon.Runtime;
+
+namespace App.Cloud
+{
+    public class AwsClientFactory
+    {
+        private const string AccessKeyId     = "AKIAIOSFODNN7EXAMPLE";
+        private const string SecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+
+        public static AmazonS3Client CreateS3Client()
+        {
+            var credentials = new BasicAWSCredentials(AccessKeyId, SecretAccessKey);
+            return new AmazonS3Client(credentials, RegionEndpoint.USEast1);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-003.cs

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded JWT signing key embedded in authentication middleware
-
-using Microsoft.IdentityModel.Tokens;
-using System.IdentityModel.Tokens.Jwt;
-using System.Text;
-
-namespace App.Auth
-{
-    public class JwtService
-    {
-        // Vulnerable: secret hardcoded — should come from configuration/vault
-        private const string SigningKey = "my-256-bit-super-secret-jwt-key!!";
-
-        public string GenerateToken(string userId)
-        {
-            var key   = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
-            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
-            var token = new JwtSecurityToken(
-                issuer:   "myapp",
-                audience: "myapp-users",
-                expires:  System.DateTime.UtcNow.AddHours(24),
-                signingCredentials: creds);
-            return new JwtSecurityTokenHandler().WriteToken(token);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded JWT signing key embedded in authentication middleware
+
+using Microsoft.IdentityModel.Tokens;
+using System.IdentityModel.Tokens.Jwt;
+using System.Text;
+
+namespace App.Auth
+{
+    public class JwtService
+    {
+        // Vulnerable: secret hardcoded — should come from configuration/vault
+        private const string SigningKey = "my-256-bit-super-secret-jwt-key!!";
+
+        public string GenerateToken(string userId)
+        {
+            var key   = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
+            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+            var token = new JwtSecurityToken(
+                issuer:   "myapp",
+                audience: "myapp-users",
+                expires:  System.DateTime.UtcNow.AddHours(24),
+                signingCredentials: creds);
+            return new JwtSecurityTokenHandler().WriteToken(token);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-004.cs

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: csharp
-// expected: Hardcoded Stripe secret key used for payment processing
-
-using Stripe;
-
-namespace App.Payments
-{
-    public class PaymentService
-    {
-        private const string StripeSecretKey = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
-
-        public PaymentService()
-        {
-            StripeConfiguration.ApiKey = StripeSecretKey;
-        }
-
-        public Charge CreateCharge(string token, long amountCents)
-        {
-            var options = new ChargeCreateOptions
-            {
-                Amount   = amountCents,
-                Currency = "usd",
-                Source   = token
-            };
-            return new ChargeService().Create(options);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: csharp
+// expected: Hardcoded Stripe secret key used for payment processing
+
+using Stripe;
+
+namespace App.Payments
+{
+    public class PaymentService
+    {
+        private const string StripeSecretKey = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
+
+        public PaymentService()
+        {
+            StripeConfiguration.ApiKey = StripeSecretKey;
+        }
+
+        public Charge CreateCharge(string token, long amountCents)
+        {
+            var options = new ChargeCreateOptions
+            {
+                Amount   = amountCents,
+                Currency = "usd",
+                Source   = token
+            };
+            return new ChargeService().Create(options);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-005.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded Azure Storage connection string containing account key
-
-using Azure.Storage.Blobs;
-
-namespace App.Storage
-{
-    public class BlobStorageService
-    {
-        private const string AzureStorageConnectionString =
-            "DefaultEndpointsProtocol=https;AccountName=prodstorageacct;" +
-            "AccountKey=dGhpcyBpcyBhIGZha2Uga2V5IGZvciBkZW1vIHB1cnBvc2VzIG9ubHkh;" +
-            "EndpointSuffix=core.windows.net";
-
-        private readonly BlobServiceClient _client;
-
-        public BlobStorageService()
-        {
-            _client = new BlobServiceClient(AzureStorageConnectionString);
-        }
-
-        public BlobContainerClient GetContainer(string name)
-            => _client.GetBlobContainerClient(name);
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded Azure Storage connection string containing account key
+
+using Azure.Storage.Blobs;
+
+namespace App.Storage
+{
+    public class BlobStorageService
+    {
+        private const string AzureStorageConnectionString =
+            "DefaultEndpointsProtocol=https;AccountName=prodstorageacct;" +
+            "AccountKey=dGhpcyBpcyBhIGZha2Uga2V5IGZvciBkZW1vIHB1cnBvc2VzIG9ubHkh;" +
+            "EndpointSuffix=core.windows.net";
+
+        private readonly BlobServiceClient _client;
+
+        public BlobStorageService()
+        {
+            _client = new BlobServiceClient(AzureStorageConnectionString);
+        }
+
+        public BlobContainerClient GetContainer(string name)
+            => _client.GetBlobContainerClient(name);
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-006.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: csharp
-// expected: Hardcoded SendGrid API key for email sending
-
-using SendGrid;
-using SendGrid.Helpers.Mail;
-
-namespace App.Notifications
-{
-    public class EmailService
-    {
-        private const string SendGridApiKey = "SG.aBcDeFgHiJkLmNoPqRsTuVwXyZ.0123456789abcdefghijklmno";
-
-        public async System.Threading.Tasks.Task SendAsync(string to, string subject, string body)
-        {
-            var client  = new SendGridClient(SendGridApiKey);
-            var from    = new EmailAddress("noreply@company.com", "Company");
-            var toAddr  = new EmailAddress(to);
-            var msg     = MailHelper.CreateSingleEmail(from, toAddr, subject, body, body);
-            await client.SendEmailAsync(msg);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: csharp
+// expected: Hardcoded SendGrid API key for email sending
+
+using SendGrid;
+using SendGrid.Helpers.Mail;
+
+namespace App.Notifications
+{
+    public class EmailService
+    {
+        private const string SendGridApiKey = "SG.aBcDeFgHiJkLmNoPqRsTuVwXyZ.0123456789abcdefghijklmno";
+
+        public async System.Threading.Tasks.Task SendAsync(string to, string subject, string body)
+        {
+            var client  = new SendGridClient(SendGridApiKey);
+            var from    = new EmailAddress("noreply@company.com", "Company");
+            var toAddr  = new EmailAddress(to);
+            var msg     = MailHelper.CreateSingleEmail(from, toAddr, subject, body, body);
+            await client.SendEmailAsync(msg);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-007.cs

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded encryption key and IV stored as byte array constants
-
-using System.Security.Cryptography;
-
-namespace App.Security
-{
-    public class DataEncryptor
-    {
-        // Vulnerable: hardcoded AES key and IV in source code
-        private static readonly byte[] AesKey = new byte[]
-        {
-            0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
-            0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
-        };
-        private static readonly byte[] AesIv = new byte[]
-        {
-            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
-        };
-
-        public static byte[] Encrypt(byte[] data)
-        {
-            using var aes = Aes.Create();
-            aes.Key = AesKey;
-            aes.IV  = AesIv;
-            using var enc = aes.CreateEncryptor();
-            return enc.TransformFinalBlock(data, 0, data.Length);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: csharp
+// expected: Hardcoded encryption key and IV stored as byte array constants
+
+using System.Security.Cryptography;
+
+namespace App.Security
+{
+    public class DataEncryptor
+    {
+        // Vulnerable: hardcoded AES key and IV in source code
+        private static readonly byte[] AesKey = new byte[]
+        {
+            0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+            0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
+        };
+        private static readonly byte[] AesIv = new byte[]
+        {
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+        };
+
+        public static byte[] Encrypt(byte[] data)
+        {
+            using var aes = Aes.Create();
+            aes.Key = AesKey;
+            aes.IV  = AesIv;
+            using var enc = aes.CreateEncryptor();
+            return enc.TransformFinalBlock(data, 0, data.Length);
+        }
+    }
+}