thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/csharp/seed-020.cs

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via Razor @Html.Raw with user-controlled error message parameter
-
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.RazorPages;
-
-namespace App.Pages
-{
-    public class ErrorModel : PageModel
-    {
-        public string ErrorMessage { get; private set; }
-
-        public void OnGet(string message, string code)
-        {
-            // Vulnerable: message stored as raw HTML to be rendered with @Html.Raw
-            ErrorMessage = $"<b>Error {code}:</b> {message}";
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS via Razor @Html.Raw with user-controlled error message parameter
+
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+
+namespace App.Pages
+{
+    public class ErrorModel : PageModel
+    {
+        public string ErrorMessage { get; private set; }
+
+        public void OnGet(string message, string code)
+        {
+            // Vulnerable: message stored as raw HTML to be rendered with @Html.Raw
+            ErrorMessage = $"<b>Error {code}:</b> {message}";
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-021.cs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: csharp
-// expected: XSS via Response.Write injecting user input into JavaScript variable
-
-using System.Web;
-
-namespace App.Handlers
-{
-    public class UserDataHandler : IHttpHandler
-    {
-        public bool IsReusable => false;
-
-        public void ProcessRequest(HttpContext context)
-        {
-            string userId   = context.Request.QueryString["uid"];
-            string redirect = context.Request.QueryString["next"];
-            context.Response.ContentType = "text/html";
-            // Vulnerable: userId and redirect injected into inline JS
-            context.Response.Write("<script>");
-            context.Response.Write("var userId = \"" + userId + "\";");
-            context.Response.Write("var nextUrl = \"" + redirect + "\";");
-            context.Response.Write("window.location = nextUrl;");
-            context.Response.Write("</script>");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: csharp
+// expected: XSS via Response.Write injecting user input into JavaScript variable
+
+using System.Web;
+
+namespace App.Handlers
+{
+    public class UserDataHandler : IHttpHandler
+    {
+        public bool IsReusable => false;
+
+        public void ProcessRequest(HttpContext context)
+        {
+            string userId   = context.Request.QueryString["uid"];
+            string redirect = context.Request.QueryString["next"];
+            context.Response.ContentType = "text/html";
+            // Vulnerable: userId and redirect injected into inline JS
+            context.Response.Write("<script>");
+            context.Response.Write("var userId = \"" + userId + "\";");
+            context.Response.Write("var nextUrl = \"" + redirect + "\";");
+            context.Response.Write("window.location = nextUrl;");
+            context.Response.Write("</script>");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-022.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS bypass via HtmlEncode applied to already-composed HTML string instead of individual inputs
-
-using System.Web;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    public class MessageController : Controller
-    {
-        [HttpGet("message")]
-        public ContentResult Show(string template, string value)
-        {
-            // Vulnerable: HtmlEncode is applied to the fully composed string,
-            // so the attacker can inject into 'template' before encoding occurs.
-            // The final response uses the unencoded 'composed' variable.
-            string composed = $"<div class='{template}'>{value}</div>";
-            string encoded  = HttpUtility.HtmlEncode(composed); // too late — not used below
-            return Content("<html><body>" + composed + "</body></html>", "text/html");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: csharp
+// expected: XSS bypass via HtmlEncode applied to already-composed HTML string instead of individual inputs
+
+using System.Web;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    public class MessageController : Controller
+    {
+        [HttpGet("message")]
+        public ContentResult Show(string template, string value)
+        {
+            // Vulnerable: HtmlEncode is applied to the fully composed string,
+            // so the attacker can inject into 'template' before encoding occurs.
+            // The final response uses the unencoded 'composed' variable.
+            string composed = $"<div class='{template}'>{value}</div>";
+            string encoded  = HttpUtility.HtmlEncode(composed); // too late — not used below
+            return Content("<html><body>" + composed + "</body></html>", "text/html");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-023.cs

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via Process.Start with user-controlled argument string
-
-using System.Diagnostics;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class PingController : ControllerBase
-    {
-        [HttpGet]
-        public IActionResult Ping([FromQuery] string host)
-        {
-            // Vulnerable: host injected directly into shell command arguments
-            var psi = new ProcessStartInfo
-            {
-                FileName               = "/bin/bash",
-                Arguments              = $"-c \"ping -c 4 {host}\"",
-                RedirectStandardOutput = true,
-                UseShellExecute        = false
-            };
-            using var proc = Process.Start(psi);
-            string output = proc.StandardOutput.ReadToEnd();
-            proc.WaitForExit();
-            return Ok(output);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled argument string
+
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class PingController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult Ping([FromQuery] string host)
+        {
+            // Vulnerable: host injected directly into shell command arguments
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "/bin/bash",
+                Arguments              = $"-c \"ping -c 4 {host}\"",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string output = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return Ok(output);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-024.cs

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via Process.Start with user-supplied filename in ffmpeg command
-
-using System.Diagnostics;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ConvertController : ControllerBase
-    {
-        [HttpPost]
-        public IActionResult Convert([FromQuery] string inputFile, [FromQuery] string outputFile)
-        {
-            // Vulnerable: inputFile and outputFile not sanitized before shell execution
-            string cmd = $"ffmpeg -i /uploads/{inputFile} /output/{outputFile}";
-            var psi = new ProcessStartInfo("/bin/sh", $"-c \"{cmd}\"")
-            {
-                RedirectStandardOutput = true,
-                UseShellExecute        = false
-            };
-            using var proc = Process.Start(psi);
-            proc.WaitForExit();
-            return Ok($"Exit code: {proc.ExitCode}");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-supplied filename in ffmpeg command
+
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ConvertController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Convert([FromQuery] string inputFile, [FromQuery] string outputFile)
+        {
+            // Vulnerable: inputFile and outputFile not sanitized before shell execution
+            string cmd = $"ffmpeg -i /uploads/{inputFile} /output/{outputFile}";
+            var psi = new ProcessStartInfo("/bin/sh", $"-c \"{cmd}\"")
+            {
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            proc.WaitForExit();
+            return Ok($"Exit code: {proc.ExitCode}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-025.cs

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via Process.Start executing user-supplied script name
-
-using System.Diagnostics;
-
-namespace App.Services
-{
-    public class ScriptRunner
-    {
-        private const string ScriptDir = "/opt/app/scripts/";
-
-        public string RunScript(string scriptName, string args)
-        {
-            // Vulnerable: scriptName and args appended without escaping
-            var psi = new ProcessStartInfo
-            {
-                FileName               = "/bin/bash",
-                Arguments              = $"{ScriptDir}{scriptName} {args}",
-                RedirectStandardOutput = true,
-                UseShellExecute        = false
-            };
-            using var proc = Process.Start(psi);
-            string result = proc.StandardOutput.ReadToEnd();
-            proc.WaitForExit();
-            return result;
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start executing user-supplied script name
+
+using System.Diagnostics;
+
+namespace App.Services
+{
+    public class ScriptRunner
+    {
+        private const string ScriptDir = "/opt/app/scripts/";
+
+        public string RunScript(string scriptName, string args)
+        {
+            // Vulnerable: scriptName and args appended without escaping
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "/bin/bash",
+                Arguments              = $"{ScriptDir}{scriptName} {args}",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string result = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return result;
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-026.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via Process.Start with user-controlled zip archive path
-
-using System.Diagnostics;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ArchiveController : ControllerBase
-    {
-        [HttpPost("extract")]
-        public IActionResult Extract([FromQuery] string archiveName, [FromQuery] string destDir)
-        {
-            // Vulnerable: both params injected into shell command
-            string command = $"unzip /uploads/{archiveName} -d /output/{destDir}";
-            Process.Start("/bin/sh", $"-c \"{command}\"")?.WaitForExit();
-            return Ok("Extraction started");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled zip archive path
+
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ArchiveController : ControllerBase
+    {
+        [HttpPost("extract")]
+        public IActionResult Extract([FromQuery] string archiveName, [FromQuery] string destDir)
+        {
+            // Vulnerable: both params injected into shell command
+            string command = $"unzip /uploads/{archiveName} -d /output/{destDir}";
+            Process.Start("/bin/sh", $"-c \"{command}\"")?.WaitForExit();
+            return Ok("Extraction started");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-027.cs

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via cmd.exe with user-supplied network path
-
-using System.Diagnostics;
-
-namespace App.Services
-{
-    public class NetworkScanner
-    {
-        public string ScanHost(string ipAddress)
-        {
-            // Vulnerable: ipAddress passed to cmd.exe without validation
-            var psi = new ProcessStartInfo
-            {
-                FileName               = "cmd.exe",
-                Arguments              = $"/c nslookup {ipAddress}",
-                RedirectStandardOutput = true,
-                UseShellExecute        = false
-            };
-            using var proc = Process.Start(psi);
-            string output = proc.StandardOutput.ReadToEnd();
-            proc.WaitForExit();
-            return output;
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via cmd.exe with user-supplied network path
+
+using System.Diagnostics;
+
+namespace App.Services
+{
+    public class NetworkScanner
+    {
+        public string ScanHost(string ipAddress)
+        {
+            // Vulnerable: ipAddress passed to cmd.exe without validation
+            var psi = new ProcessStartInfo
+            {
+                FileName               = "cmd.exe",
+                Arguments              = $"/c nslookup {ipAddress}",
+                RedirectStandardOutput = true,
+                UseShellExecute        = false
+            };
+            using var proc = Process.Start(psi);
+            string output = proc.StandardOutput.ReadToEnd();
+            proc.WaitForExit();
+            return output;
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-028.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: csharp
-// expected: Command injection via Process.Start with user-controlled email and report path
-
-using System.Diagnostics;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ReportMailerController : ControllerBase
-    {
-        [HttpPost]
-        public IActionResult Send([FromQuery] string email, [FromQuery] string reportPath)
-        {
-            // Vulnerable: email and reportPath injected into sendmail command
-            string cmd = $"sendmail {email} < {reportPath}";
-            Process.Start("/bin/sh", $"-c \"{cmd}\"")?.WaitForExit();
-            return Ok("Report sent");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: csharp
+// expected: Command injection via Process.Start with user-controlled email and report path
+
+using System.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ReportMailerController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Send([FromQuery] string email, [FromQuery] string reportPath)
+        {
+            // Vulnerable: email and reportPath injected into sendmail command
+            string cmd = $"sendmail {email} < {reportPath}";
+            Process.Start("/bin/sh", $"-c \"{cmd}\"")?.WaitForExit();
+            return Ok("Report sent");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-029.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: csharp
-// expected: Path traversal via File.ReadAllText with unvalidated user-supplied filename
-
-using System.IO;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class FileController : ControllerBase
-    {
-        private const string BaseDir = @"C:\App\Files\";
-
-        [HttpGet]
-        public IActionResult Download([FromQuery] string filename)
-        {
-            // Vulnerable: no normalization or containment check
-            string fullPath = BaseDir + filename;
-            string content  = File.ReadAllText(fullPath);
-            return Ok(content);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via File.ReadAllText with unvalidated user-supplied filename
+
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class FileController : ControllerBase
+    {
+        private const string BaseDir = @"C:\App\Files\";
+
+        [HttpGet]
+        public IActionResult Download([FromQuery] string filename)
+        {
+            // Vulnerable: no normalization or containment check
+            string fullPath = BaseDir + filename;
+            string content  = File.ReadAllText(fullPath);
+            return Ok(content);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-030.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: csharp
-// expected: Path traversal via Path.Combine without verifying result stays within base directory
-
-using System.IO;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class TemplateController : ControllerBase
-    {
-        private const string TemplateRoot = "/var/app/templates/";
-
-        [HttpGet]
-        public IActionResult GetTemplate([FromQuery] string name)
-        {
-            // Vulnerable: Path.Combine does not prevent traversal if name starts with /
-            string path    = Path.Combine(TemplateRoot, name);
-            byte[] content = File.ReadAllBytes(path);
-            return File(content, "text/html");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: csharp
+// expected: Path traversal via Path.Combine without verifying result stays within base directory
+
+using System.IO;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class TemplateController : ControllerBase
+    {
+        private const string TemplateRoot = "/var/app/templates/";
+
+        [HttpGet]
+        public IActionResult GetTemplate([FromQuery] string name)
+        {
+            // Vulnerable: Path.Combine does not prevent traversal if name starts with /
+            string path    = Path.Combine(TemplateRoot, name);
+            byte[] content = File.ReadAllBytes(path);
+            return File(content, "text/html");
+        }
+    }
+}