thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/js/seed-003.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded JWT secret used to sign tokens
-
-const jwt = require('jsonwebtoken');
-
-const JWT_SECRET = 'my-super-secret-jwt-key-do-not-share-1234';
-const JWT_REFRESH_SECRET = 'refresh-secret-key-also-private-5678';
-
-function generateTokens(userId, role) {
-  const accessToken = jwt.sign(
-    { userId, role },
-    JWT_SECRET,
-    { expiresIn: '15m' }
-  );
-  const refreshToken = jwt.sign(
-    { userId },
-    JWT_REFRESH_SECRET,
-    { expiresIn: '7d' }
-  );
-  return { accessToken, refreshToken };
-}
-
-function verifyToken(token) {
-  return jwt.verify(token, JWT_SECRET);
-}
-
-module.exports = { generateTokens, verifyToken };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded JWT secret used to sign tokens
+
+const jwt = require('jsonwebtoken');
+
+const JWT_SECRET = 'my-super-secret-jwt-key-do-not-share-1234';
+const JWT_REFRESH_SECRET = 'refresh-secret-key-also-private-5678';
+
+function generateTokens(userId, role) {
+  const accessToken = jwt.sign(
+    { userId, role },
+    JWT_SECRET,
+    { expiresIn: '15m' }
+  );
+  const refreshToken = jwt.sign(
+    { userId },
+    JWT_REFRESH_SECRET,
+    { expiresIn: '7d' }
+  );
+  return { accessToken, refreshToken };
+}
+
+function verifyToken(token) {
+  return jwt.verify(token, JWT_SECRET);
+}
+
+module.exports = { generateTokens, verifyToken };

package/dist/packages/crucible/seeds/js/seed-004.js

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded Stripe API secret key
-
-const stripe = require('stripe');
-
-// TODO: move this to env vars before going to prod
-const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
-const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
-
-const stripeClient = stripe(STRIPE_SECRET_KEY);
-
-async function createPaymentIntent(amount, currency = 'usd') {
-  const intent = await stripeClient.paymentIntents.create({
-    amount,
-    currency,
-    automatic_payment_methods: { enabled: true },
-  });
-  return intent.client_secret;
-}
-
-async function handleWebhook(payload, sig) {
-  return stripeClient.webhooks.constructEvent(payload, sig, STRIPE_WEBHOOK_SECRET);
-}
-
-module.exports = { createPaymentIntent, handleWebhook };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded Stripe API secret key
+
+const stripe = require('stripe');
+
+// TODO: move this to env vars before going to prod
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripeClient = stripe(STRIPE_SECRET_KEY);
+
+async function createPaymentIntent(amount, currency = 'usd') {
+  const intent = await stripeClient.paymentIntents.create({
+    amount,
+    currency,
+    automatic_payment_methods: { enabled: true },
+  });
+  return intent.client_secret;
+}
+
+async function handleWebhook(payload, sig) {
+  return stripeClient.webhooks.constructEvent(payload, sig, STRIPE_WEBHOOK_SECRET);
+}
+
+module.exports = { createPaymentIntent, handleWebhook };

package/dist/packages/crucible/seeds/js/seed-005.js

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded SendGrid API key and SMTP password
-
-const nodemailer = require('nodemailer');
-const sgMail = require('@sendgrid/mail');
-
-const SENDGRID_API_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_API_KEY);
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.company.com',
-  port: 587,
-  auth: {
-    user: 'noreply@company.com',
-    pass: 'EmailPassw0rd#2024',
-  },
-});
-
-async function sendWelcomeEmail(to, name) {
-  await sgMail.send({
-    to,
-    from: 'noreply@company.com',
-    subject: `Welcome, ${name}!`,
-    text: `Thanks for signing up, ${name}.`,
-  });
-}
-
-module.exports = { sendWelcomeEmail, smtpTransport };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded SendGrid API key and SMTP password
+
+const nodemailer = require('nodemailer');
+const sgMail = require('@sendgrid/mail');
+
+const SENDGRID_API_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_API_KEY);
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.company.com',
+  port: 587,
+  auth: {
+    user: 'noreply@company.com',
+    pass: 'EmailPassw0rd#2024',
+  },
+});
+
+async function sendWelcomeEmail(to, name) {
+  await sgMail.send({
+    to,
+    from: 'noreply@company.com',
+    subject: `Welcome, ${name}!`,
+    text: `Thanks for signing up, ${name}.`,
+  });
+}
+
+module.exports = { sendWelcomeEmail, smtpTransport };

package/dist/packages/crucible/seeds/js/seed-006.js

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded GitHub personal access token
-
-const { Octokit } = require('@octokit/rest');
-
-// Personal access token with repo + admin scopes
-const GITHUB_TOKEN = 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890';
-
-const octokit = new Octokit({ auth: GITHUB_TOKEN });
-
-async function listRepos(org) {
-  const { data } = await octokit.repos.listForOrg({ org, per_page: 100 });
-  return data.map(r => r.full_name);
-}
-
-async function createWebhook(owner, repo, url) {
-  return octokit.repos.createWebhook({
-    owner,
-    repo,
-    config: { url, content_type: 'json' },
-    events: ['push', 'pull_request'],
-  });
-}
-
-module.exports = { octokit, listRepos, createWebhook };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded GitHub personal access token
+
+const { Octokit } = require('@octokit/rest');
+
+// Personal access token with repo + admin scopes
+const GITHUB_TOKEN = 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890';
+
+const octokit = new Octokit({ auth: GITHUB_TOKEN });
+
+async function listRepos(org) {
+  const { data } = await octokit.repos.listForOrg({ org, per_page: 100 });
+  return data.map(r => r.full_name);
+}
+
+async function createWebhook(owner, repo, url) {
+  return octokit.repos.createWebhook({
+    owner,
+    repo,
+    config: { url, content_type: 'json' },
+    events: ['push', 'pull_request'],
+  });
+}
+
+module.exports = { octokit, listRepos, createWebhook };

package/dist/packages/crucible/seeds/js/seed-007.js

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded encryption key and IV used for AES encryption
-
-const crypto = require('crypto');
-
-const ENCRYPTION_KEY = '12345678901234567890123456789012'; // 32-byte key
-const IV = '1234567890123456'; // 16-byte IV — fixed, never rotated
-
-function encrypt(text) {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
-  let encrypted = cipher.update(text, 'utf8', 'hex');
-  encrypted += cipher.final('hex');
-  return encrypted;
-}
-
-function decrypt(encryptedText) {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
-  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-module.exports = { encrypt, decrypt };
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded encryption key and IV used for AES encryption
+
+const crypto = require('crypto');
+
+const ENCRYPTION_KEY = '12345678901234567890123456789012'; // 32-byte key
+const IV = '1234567890123456'; // 16-byte IV — fixed, never rotated
+
+function encrypt(text) {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
+  let encrypted = cipher.update(text, 'utf8', 'hex');
+  encrypted += cipher.final('hex');
+  return encrypted;
+}
+
+function decrypt(encryptedText) {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
+  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+module.exports = { encrypt, decrypt };

package/dist/packages/crucible/seeds/js/seed-008.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded OAuth client secret and admin password
-
-const express = require('express');
-const router = express.Router();
-
-const OAUTH_CLIENT_ID = 'app-client-id-production-abc123';
-const OAUTH_CLIENT_SECRET = 'oauth-client-secret-XyZ9876543210abcdefGHIJKL';
-const ADMIN_PASSWORD = 'AdminP@ssw0rd2024!';
-
-router.post('/oauth/token', async (req, res) => {
-  const { client_id, client_secret, grant_type } = req.body;
-  if (client_id !== OAUTH_CLIENT_ID || client_secret !== OAUTH_CLIENT_SECRET) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  // issue token...
-  res.json({ access_token: 'generated_token', token_type: 'bearer' });
-});
-
-router.post('/admin/login', (req, res) => {
-  if (req.body.password !== ADMIN_PASSWORD) {
-    return res.status(403).json({ error: 'forbidden' });
-  }
-  res.json({ success: true });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: javascript
+// expected: hardcoded OAuth client secret and admin password
+
+const express = require('express');
+const router = express.Router();
+
+const OAUTH_CLIENT_ID = 'app-client-id-production-abc123';
+const OAUTH_CLIENT_SECRET = 'oauth-client-secret-XyZ9876543210abcdefGHIJKL';
+const ADMIN_PASSWORD = 'AdminP@ssw0rd2024!';
+
+router.post('/oauth/token', async (req, res) => {
+  const { client_id, client_secret, grant_type } = req.body;
+  if (client_id !== OAUTH_CLIENT_ID || client_secret !== OAUTH_CLIENT_SECRET) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  // issue token...
+  res.json({ access_token: 'generated_token', token_type: 'bearer' });
+});
+
+router.post('/admin/login', (req, res) => {
+  if (req.body.password !== ADMIN_PASSWORD) {
+    return res.status(403).json({ error: 'forbidden' });
+  }
+  res.json({ success: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-009.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via string concatenation in user query
-
-const mysql = require('mysql2');
-const db = mysql.createConnection({ host: 'localhost', user: 'app', password: 'app', database: 'shop' });
-
-function getProductByName(productName) {
-  const query = "SELECT * FROM products WHERE name = '" + productName + "'";
-  return new Promise((resolve, reject) => {
-    db.query(query, (err, results) => {
-      if (err) return reject(err);
-      resolve(results);
-    });
-  });
-}
-
-function searchProducts(term, category) {
-  const query = `SELECT id, name, price FROM products WHERE name LIKE '%${term}%' AND category = '${category}' ORDER BY created_at DESC`;
-  return new Promise((resolve, reject) => {
-    db.query(query, (err, results) => {
-      if (err) return reject(err);
-      resolve(results);
-    });
-  });
-}
-
-module.exports = { getProductByName, searchProducts };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via string concatenation in user query
+
+const mysql = require('mysql2');
+const db = mysql.createConnection({ host: 'localhost', user: 'app', password: 'app', database: 'shop' });
+
+function getProductByName(productName) {
+  const query = "SELECT * FROM products WHERE name = '" + productName + "'";
+  return new Promise((resolve, reject) => {
+    db.query(query, (err, results) => {
+      if (err) return reject(err);
+      resolve(results);
+    });
+  });
+}
+
+function searchProducts(term, category) {
+  const query = `SELECT id, name, price FROM products WHERE name LIKE '%${term}%' AND category = '${category}' ORDER BY created_at DESC`;
+  return new Promise((resolve, reject) => {
+    db.query(query, (err, results) => {
+      if (err) return reject(err);
+      resolve(results);
+    });
+  });
+}
+
+module.exports = { getProductByName, searchProducts };

package/dist/packages/crucible/seeds/js/seed-010.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via string concatenation in login query
-
-const { Client } = require('pg');
-const client = new Client({ connectionString: process.env.DATABASE_URL });
-
-async function authenticateUser(username, password) {
-  // Direct string interpolation — attacker can bypass auth
-  const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
-  const result = await client.query(query);
-  return result.rows.length > 0 ? result.rows[0] : null;
-}
-
-async function getUserOrders(userId, status) {
-  const sql = "SELECT o.* FROM orders o WHERE o.user_id = " + userId +
-              " AND o.status = '" + status + "' ORDER BY o.created_at DESC";
-  const result = await client.query(sql);
-  return result.rows;
-}
-
-async function deleteUserData(userId) {
-  await client.query("DELETE FROM sessions WHERE user_id = " + userId);
-  await client.query("DELETE FROM tokens WHERE user_id = " + userId);
-}
-
-module.exports = { authenticateUser, getUserOrders, deleteUserData };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via string concatenation in login query
+
+const { Client } = require('pg');
+const client = new Client({ connectionString: process.env.DATABASE_URL });
+
+async function authenticateUser(username, password) {
+  // Direct string interpolation — attacker can bypass auth
+  const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
+  const result = await client.query(query);
+  return result.rows.length > 0 ? result.rows[0] : null;
+}
+
+async function getUserOrders(userId, status) {
+  const sql = "SELECT o.* FROM orders o WHERE o.user_id = " + userId +
+              " AND o.status = '" + status + "' ORDER BY o.created_at DESC";
+  const result = await client.query(sql);
+  return result.rows;
+}
+
+async function deleteUserData(userId) {
+  await client.query("DELETE FROM sessions WHERE user_id = " + userId);
+  await client.query("DELETE FROM tokens WHERE user_id = " + userId);
+}
+
+module.exports = { authenticateUser, getUserOrders, deleteUserData };

package/dist/packages/crucible/seeds/js/seed-011.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via dynamic ORDER BY and LIMIT clauses
-
-const knex = require('knex')({ client: 'pg', connection: process.env.DATABASE_URL });
-
-async function listUsers(sortField, sortDir, limitCount) {
-  // Dangerous: sortField and sortDir are directly interpolated
-  const rawQuery = `SELECT id, email, name, created_at FROM users ORDER BY ${sortField} ${sortDir} LIMIT ${limitCount}`;
-  const result = await knex.raw(rawQuery);
-  return result.rows;
-}
-
-async function searchByEmail(domain) {
-  const result = await knex.raw(
-    `SELECT * FROM users WHERE email LIKE '%@` + domain + `'`
-  );
-  return result.rows;
-}
-
-async function getReport(fromDate, toDate, groupBy) {
-  const sql = `
-    SELECT ${groupBy}, COUNT(*) as cnt, SUM(amount) as total
-    FROM transactions
-    WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
-    GROUP BY ${groupBy}
-  `;
-  const result = await knex.raw(sql);
-  return result.rows;
-}
-
-module.exports = { listUsers, searchByEmail, getReport };
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection via dynamic ORDER BY and LIMIT clauses
+
+const knex = require('knex')({ client: 'pg', connection: process.env.DATABASE_URL });
+
+async function listUsers(sortField, sortDir, limitCount) {
+  // Dangerous: sortField and sortDir are directly interpolated
+  const rawQuery = `SELECT id, email, name, created_at FROM users ORDER BY ${sortField} ${sortDir} LIMIT ${limitCount}`;
+  const result = await knex.raw(rawQuery);
+  return result.rows;
+}
+
+async function searchByEmail(domain) {
+  const result = await knex.raw(
+    `SELECT * FROM users WHERE email LIKE '%@` + domain + `'`
+  );
+  return result.rows;
+}
+
+async function getReport(fromDate, toDate, groupBy) {
+  const sql = `
+    SELECT ${groupBy}, COUNT(*) as cnt, SUM(amount) as total
+    FROM transactions
+    WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
+    GROUP BY ${groupBy}
+  `;
+  const result = await knex.raw(sql);
+  return result.rows;
+}
+
+module.exports = { listUsers, searchByEmail, getReport };

package/dist/packages/crucible/seeds/js/seed-012.js

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection in Express route via query parameter concatenation
-
-const express = require('express');
-const sqlite3 = require('sqlite3').verbose();
-const router = express.Router();
-const db = new sqlite3.Database('./data.db');
-
-router.get('/articles', (req, res) => {
-  const { tag, author } = req.query;
-  let query = 'SELECT * FROM articles WHERE published = 1';
-  if (tag) query += ` AND tag = '${tag}'`;
-  if (author) query += ` AND author = '${author}'`;
-  db.all(query, [], (err, rows) => {
-    if (err) return res.status(500).json({ error: err.message });
-    res.json(rows);
-  });
-});
-
-router.get('/articles/:id', (req, res) => {
-  const query = 'SELECT * FROM articles WHERE id = ' + req.params.id;
-  db.get(query, [], (err, row) => {
-    if (err) return res.status(500).json({ error: err.message });
-    if (!row) return res.status(404).json({ error: 'Not found' });
-    res.json(row);
-  });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: javascript
+// expected: SQL injection in Express route via query parameter concatenation
+
+const express = require('express');
+const sqlite3 = require('sqlite3').verbose();
+const router = express.Router();
+const db = new sqlite3.Database('./data.db');
+
+router.get('/articles', (req, res) => {
+  const { tag, author } = req.query;
+  let query = 'SELECT * FROM articles WHERE published = 1';
+  if (tag) query += ` AND tag = '${tag}'`;
+  if (author) query += ` AND author = '${author}'`;
+  db.all(query, [], (err, rows) => {
+    if (err) return res.status(500).json({ error: err.message });
+    res.json(rows);
+  });
+});
+
+router.get('/articles/:id', (req, res) => {
+  const query = 'SELECT * FROM articles WHERE id = ' + req.params.id;
+  db.get(query, [], (err, row) => {
+    if (err) return res.status(500).json({ error: err.message });
+    if (!row) return res.status(404).json({ error: 'Not found' });
+    res.json(row);
+  });
+});
+
+module.exports = router;