thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/csharp/seed-042.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: csharp
-// expected: Unsafe deserialization via DataContractSerializer reading from request body
-
-using System.Runtime.Serialization;
-using System.Xml;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class OrderController : ControllerBase
-    {
-        [HttpPost("import")]
-        public IActionResult Import()
-        {
-            // Vulnerable: DataContractSerializer resolves types from XML — SSRF/RCE risk
-            var serializer = new DataContractSerializer(typeof(object));
-            using var reader = XmlReader.Create(Request.Body);
-            object order = serializer.ReadObject(reader);
-            return Ok("Imported: " + order?.GetType().Name);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via DataContractSerializer reading from request body
+
+using System.Runtime.Serialization;
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class OrderController : ControllerBase
+    {
+        [HttpPost("import")]
+        public IActionResult Import()
+        {
+            // Vulnerable: DataContractSerializer resolves types from XML — SSRF/RCE risk
+            var serializer = new DataContractSerializer(typeof(object));
+            using var reader = XmlReader.Create(Request.Body);
+            object order = serializer.ReadObject(reader);
+            return Ok("Imported: " + order?.GetType().Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-043.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: csharp
-// expected: Unsafe deserialization via LosFormatter (ViewState) with user-controlled input
-
-using System.IO;
-using System.Web.UI;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ViewStateController : ControllerBase
-    {
-        [HttpPost("restore")]
-        public IActionResult Restore([FromQuery] string viewState)
-        {
-            // Vulnerable: LosFormatter deserializes attacker-controlled ViewState bytes
-            var formatter = new LosFormatter();
-            byte[] data   = Convert.FromBase64String(viewState);
-            object result = formatter.Deserialize(Convert.ToBase64String(data));
-            return Ok(result?.ToString());
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: csharp
+// expected: Unsafe deserialization via LosFormatter (ViewState) with user-controlled input
+
+using System.IO;
+using System.Web.UI;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ViewStateController : ControllerBase
+    {
+        [HttpPost("restore")]
+        public IActionResult Restore([FromQuery] string viewState)
+        {
+            // Vulnerable: LosFormatter deserializes attacker-controlled ViewState bytes
+            var formatter = new LosFormatter();
+            byte[] data   = Convert.FromBase64String(viewState);
+            object result = formatter.Deserialize(Convert.ToBase64String(data));
+            return Ok(result?.ToString());
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-044.cs

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: csharp
-// expected: SSRF via WebClient.DownloadString with user-supplied URL
-
-using System.Net;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class ProxyController : ControllerBase
-    {
-        [HttpGet]
-        public IActionResult Fetch([FromQuery] string url)
-        {
-            // Vulnerable: fetches arbitrary URL including internal services
-            using var client = new WebClient();
-            string content   = client.DownloadString(url);
-            return Content(content, "text/plain");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via WebClient.DownloadString with user-supplied URL
+
+using System.Net;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class ProxyController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult Fetch([FromQuery] string url)
+        {
+            // Vulnerable: fetches arbitrary URL including internal services
+            using var client = new WebClient();
+            string content   = client.DownloadString(url);
+            return Content(content, "text/plain");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-045.cs

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: csharp
-// expected: SSRF via HttpClient.GetAsync with user-controlled endpoint URL
-
-using System.Net.Http;
-using System.Threading.Tasks;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class WebhookTestController : ControllerBase
-    {
-        private static readonly HttpClient _httpClient = new HttpClient();
-
-        [HttpPost]
-        public async Task<IActionResult> Test([FromQuery] string webhookUrl, [FromBody] string payload)
-        {
-            // Vulnerable: attacker can target internal metadata endpoints
-            var response = await _httpClient.PostAsync(
-                webhookUrl,
-                new StringContent(payload, System.Text.Encoding.UTF8, "application/json"));
-            string body = await response.Content.ReadAsStringAsync();
-            return Ok(body);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via HttpClient.GetAsync with user-controlled endpoint URL
+
+using System.Net.Http;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class WebhookTestController : ControllerBase
+    {
+        private static readonly HttpClient _httpClient = new HttpClient();
+
+        [HttpPost]
+        public async Task<IActionResult> Test([FromQuery] string webhookUrl, [FromBody] string payload)
+        {
+            // Vulnerable: attacker can target internal metadata endpoints
+            var response = await _httpClient.PostAsync(
+                webhookUrl,
+                new StringContent(payload, System.Text.Encoding.UTF8, "application/json"));
+            string body = await response.Content.ReadAsStringAsync();
+            return Ok(body);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-046.cs

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: csharp
-// expected: SSRF via WebRequest.Create with user-supplied URL for avatar fetching
-
-using System.IO;
-using System.Net;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class AvatarController : ControllerBase
-    {
-        [HttpGet]
-        public IActionResult FetchAvatar([FromQuery] string avatarUrl)
-        {
-            // Vulnerable: server fetches any URL, allowing SSRF to internal services
-            WebRequest request  = WebRequest.Create(avatarUrl);
-            WebResponse response = request.GetResponse();
-            using var stream    = response.GetResponseStream();
-            using var ms        = new MemoryStream();
-            stream.CopyTo(ms);
-            return File(ms.ToArray(), response.ContentType);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via WebRequest.Create with user-supplied URL for avatar fetching
+
+using System.IO;
+using System.Net;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AvatarController : ControllerBase
+    {
+        [HttpGet]
+        public IActionResult FetchAvatar([FromQuery] string avatarUrl)
+        {
+            // Vulnerable: server fetches any URL, allowing SSRF to internal services
+            WebRequest request  = WebRequest.Create(avatarUrl);
+            WebResponse response = request.GetResponse();
+            using var stream    = response.GetResponseStream();
+            using var ms        = new MemoryStream();
+            stream.CopyTo(ms);
+            return File(ms.ToArray(), response.ContentType);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-047.cs

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: csharp
-// expected: SSRF via HttpClient built from base URL query parameter for API aggregation
-
-using System.Net.Http;
-using System.Threading.Tasks;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class AggregatorController : ControllerBase
-    {
-        [HttpGet]
-        public async Task<IActionResult> Aggregate([FromQuery] string serviceUrl, [FromQuery] string path)
-        {
-            // Vulnerable: combines user-controlled base URL and path — can reach internal services
-            using var client = new HttpClient { BaseAddress = new System.Uri(serviceUrl) };
-            string response  = await client.GetStringAsync(path);
-            return Ok(response);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: csharp
+// expected: SSRF via HttpClient built from base URL query parameter for API aggregation
+
+using System.Net.Http;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class AggregatorController : ControllerBase
+    {
+        [HttpGet]
+        public async Task<IActionResult> Aggregate([FromQuery] string serviceUrl, [FromQuery] string path)
+        {
+            // Vulnerable: combines user-controlled base URL and path — can reach internal services
+            using var client = new HttpClient { BaseAddress = new System.Uri(serviceUrl) };
+            string response  = await client.GetStringAsync(path);
+            return Ok(response);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-048.cs

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: csharp
-// expected: XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)
-
-using System.Xml;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class XmlImportController : ControllerBase
-    {
-        [HttpPost]
-        public IActionResult Import()
-        {
-            // Vulnerable: default XmlReaderSettings allows DTD and external entities
-            var settings = new XmlReaderSettings
-            {
-                DtdProcessing = DtdProcessing.Parse,   // allows DOCTYPE
-                XmlResolver   = new XmlUrlResolver()    // resolves external entities
-            };
-            using var reader = XmlReader.Create(Request.Body, settings);
-            var doc = new XmlDocument();
-            doc.Load(reader);
-            return Ok("Imported " + doc.DocumentElement?.Name);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)
+
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class XmlImportController : ControllerBase
+    {
+        [HttpPost]
+        public IActionResult Import()
+        {
+            // Vulnerable: default XmlReaderSettings allows DTD and external entities
+            var settings = new XmlReaderSettings
+            {
+                DtdProcessing = DtdProcessing.Parse,   // allows DOCTYPE
+                XmlResolver   = new XmlUrlResolver()    // resolves external entities
+            };
+            using var reader = XmlReader.Create(Request.Body, settings);
+            var doc = new XmlDocument();
+            doc.Load(reader);
+            return Ok("Imported " + doc.DocumentElement?.Name);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-049.cs

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: csharp
-// expected: XXE via XmlDocument.LoadXml with default XmlResolver allowing entity expansion
-
-using System.Xml;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class FeedController : ControllerBase
-    {
-        [HttpPost("parse")]
-        public IActionResult ParseFeed([FromBody] string xmlContent)
-        {
-            // Vulnerable: XmlDocument with default resolver processes external entities
-            var doc = new XmlDocument();
-            doc.XmlResolver = new XmlUrlResolver(); // allows file:// and http:// entities
-            doc.LoadXml(xmlContent);
-            string rootName = doc.DocumentElement?.Name ?? "none";
-            return Ok($"Root element: {rootName}");
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XmlDocument.LoadXml with default XmlResolver allowing entity expansion
+
+using System.Xml;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class FeedController : ControllerBase
+    {
+        [HttpPost("parse")]
+        public IActionResult ParseFeed([FromBody] string xmlContent)
+        {
+            // Vulnerable: XmlDocument with default resolver processes external entities
+            var doc = new XmlDocument();
+            doc.XmlResolver = new XmlUrlResolver(); // allows file:// and http:// entities
+            doc.LoadXml(xmlContent);
+            string rootName = doc.DocumentElement?.Name ?? "none";
+            return Ok($"Root element: {rootName}");
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-050.cs

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: csharp
-// expected: XXE via XPathDocument loaded from request body without disabling DTD processing
-
-using System.IO;
-using System.Xml;
-using System.Xml.XPath;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class XPathQueryController : ControllerBase
-    {
-        [HttpPost("query")]
-        public IActionResult Query([FromQuery] string xpath)
-        {
-            // Vulnerable: XPathDocument with XmlUrlResolver resolves external entities
-            using var reader = new StreamReader(Request.Body);
-            string xml       = reader.ReadToEnd();
-            var doc          = new XPathDocument(new StringReader(xml));
-            var nav          = doc.CreateNavigator();
-            string result    = nav.SelectSingleNode(xpath)?.Value ?? "";
-            return Ok(result);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: csharp
+// expected: XXE via XPathDocument loaded from request body without disabling DTD processing
+
+using System.IO;
+using System.Xml;
+using System.Xml.XPath;
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    [ApiController]
+    [Route("api/[controller]")]
+    public class XPathQueryController : ControllerBase
+    {
+        [HttpPost("query")]
+        public IActionResult Query([FromQuery] string xpath)
+        {
+            // Vulnerable: XPathDocument with XmlUrlResolver resolves external entities
+            using var reader = new StreamReader(Request.Body);
+            string xml       = reader.ReadToEnd();
+            var doc          = new XPathDocument(new StringReader(xml));
+            var nav          = doc.CreateNavigator();
+            string result    = nav.SelectSingleNode(xpath)?.Value ?? "";
+            return Ok(result);
+        }
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-051.cs

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: csharp
-// expected: Open redirect via Response.Redirect with unvalidated user-supplied URL
-
-using System.Web;
-
-namespace App.Handlers
-{
-    public class LoginHandler : IHttpHandler
-    {
-        public bool IsReusable => false;
-
-        public void ProcessRequest(HttpContext context)
-        {
-            string username = context.Request.Form["username"];
-            string password = context.Request.Form["password"];
-            string next     = context.Request.QueryString["next"];
-
-            if (Authenticate(username, password))
-            {
-                // Vulnerable: 'next' not validated — can redirect to external malicious site
-                context.Response.Redirect(next ?? "/dashboard");
-            }
-            else
-            {
-                context.Response.Redirect("/login?error=1");
-            }
-        }
-
-        private bool Authenticate(string u, string p) => u == "admin" && p == "password";
-    }
-}
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: csharp
+// expected: Open redirect via Response.Redirect with unvalidated user-supplied URL
+
+using System.Web;
+
+namespace App.Handlers
+{
+    public class LoginHandler : IHttpHandler
+    {
+        public bool IsReusable => false;
+
+        public void ProcessRequest(HttpContext context)
+        {
+            string username = context.Request.Form["username"];
+            string password = context.Request.Form["password"];
+            string next     = context.Request.QueryString["next"];
+
+            if (Authenticate(username, password))
+            {
+                // Vulnerable: 'next' not validated — can redirect to external malicious site
+                context.Response.Redirect(next ?? "/dashboard");
+            }
+            else
+            {
+                context.Response.Redirect("/login?error=1");
+            }
+        }
+
+        private bool Authenticate(string u, string p) => u == "admin" && p == "password";
+    }
+}

package/dist/packages/crucible/seeds/csharp/seed-052.cs

@@ -1,36 +1,36 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: csharp
-// expected: Open redirect via LocalRedirect with user-controlled URL bypassing local check
-
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    public class AccountController : Controller
-    {
-        [HttpPost("logout")]
-        public IActionResult Logout(string returnUrl)
-        {
-            // Clear session
-            HttpContext.Session.Clear();
-
-            // Vulnerable: returnUrl not properly validated;
-            // attacker can supply //evil.com or /\evil.com to bypass IsLocalUrl
-            if (!string.IsNullOrEmpty(returnUrl))
-                return Redirect(returnUrl);
-
-            return RedirectToAction("Index", "Home");
-        }
-
-        [HttpGet("oauth-callback")]
-        public IActionResult OAuthCallback(string state, string code)
-        {
-            // Vulnerable: state used as redirect target without validation
-            string destination = System.Text.Encoding.UTF8.GetString(
-                Convert.FromBase64String(state));
-            return Redirect(destination);
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: csharp
+// expected: Open redirect via LocalRedirect with user-controlled URL bypassing local check
+
+using Microsoft.AspNetCore.Mvc;
+
+namespace App.Controllers
+{
+    public class AccountController : Controller
+    {
+        [HttpPost("logout")]
+        public IActionResult Logout(string returnUrl)
+        {
+            // Clear session
+            HttpContext.Session.Clear();
+
+            // Vulnerable: returnUrl not properly validated;
+            // attacker can supply //evil.com or /\evil.com to bypass IsLocalUrl
+            if (!string.IsNullOrEmpty(returnUrl))
+                return Redirect(returnUrl);
+
+            return RedirectToAction("Index", "Home");
+        }
+
+        [HttpGet("oauth-callback")]
+        public IActionResult OAuthCallback(string state, string code)
+        {
+            // Vulnerable: state used as redirect target without validation
+            string destination = System.Text.Encoding.UTF8.GetString(
+                Convert.FromBase64String(state));
+            return Redirect(destination);
+        }
+    }
+}