thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/python/seed-002.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded database password in connection string
-
-import psycopg2
-from psycopg2.extras import RealDictCursor
-
-DB_HOST = "prod-db.internal.company.com"
-DB_PORT = 5432
-DB_NAME = "users_production"
-DB_USER = "db_admin"
-DB_PASSWORD = "Sup3rS3cr3tPa$$w0rd!"
-
-
-def get_connection():
-    return psycopg2.connect(
-        host=DB_HOST,
-        port=DB_PORT,
-        dbname=DB_NAME,
-        user=DB_USER,
-        password=DB_PASSWORD,
-        cursor_factory=RealDictCursor,
-    )
-
-
-def get_user(user_id: int) -> dict:
-    conn = get_connection()
-    with conn.cursor() as cur:
-        cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
-        return cur.fetchone()
-
-
-def list_users() -> list:
-    conn = get_connection()
-    with conn.cursor() as cur:
-        cur.execute("SELECT id, email, created_at FROM users")
-        return cur.fetchall()
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded database password in connection string
+
+import psycopg2
+from psycopg2.extras import RealDictCursor
+
+DB_HOST = "prod-db.internal.company.com"
+DB_PORT = 5432
+DB_NAME = "users_production"
+DB_USER = "db_admin"
+DB_PASSWORD = "Sup3rS3cr3tPa$$w0rd!"
+
+
+def get_connection():
+    return psycopg2.connect(
+        host=DB_HOST,
+        port=DB_PORT,
+        dbname=DB_NAME,
+        user=DB_USER,
+        password=DB_PASSWORD,
+        cursor_factory=RealDictCursor,
+    )
+
+
+def get_user(user_id: int) -> dict:
+    conn = get_connection()
+    with conn.cursor() as cur:
+        cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
+        return cur.fetchone()
+
+
+def list_users() -> list:
+    conn = get_connection()
+    with conn.cursor() as cur:
+        cur.execute("SELECT id, email, created_at FROM users")
+        return cur.fetchall()

package/dist/packages/crucible/seeds/python/seed-003.py

@@ -1,31 +1,31 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded Django SECRET_KEY and debug credentials
-
-SECRET_KEY = "django-insecure-3abc$xyz!hardcoded-secret-key-never-rotate-this-one"
-DEBUG = True
-
-DATABASES = {
-    "default": {
-        "ENGINE": "django.db.backends.postgresql",
-        "NAME": "production_db",
-        "USER": "django_app",
-        "PASSWORD": "DjangoDBPass!@#2024",
-        "HOST": "db.internal",
-        "PORT": "5432",
-    }
-}
-
-EMAIL_HOST = "smtp.company.com"
-EMAIL_HOST_USER = "noreply@company.com"
-EMAIL_HOST_PASSWORD = "SmtpPa$$w0rd#2024"
-EMAIL_PORT = 587
-EMAIL_USE_TLS = True
-
-STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRst1234567890abcdef"
-STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz12345678"
-
-REDIS_PASSWORD = "r3disPa$$w0rd"
-REDIS_URL = f"redis://:r3disPa$$w0rd@redis.internal:6379/0"
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded Django SECRET_KEY and debug credentials
+
+SECRET_KEY = "django-insecure-3abc$xyz!hardcoded-secret-key-never-rotate-this-one"
+DEBUG = True
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": "production_db",
+        "USER": "django_app",
+        "PASSWORD": "DjangoDBPass!@#2024",
+        "HOST": "db.internal",
+        "PORT": "5432",
+    }
+}
+
+EMAIL_HOST = "smtp.company.com"
+EMAIL_HOST_USER = "noreply@company.com"
+EMAIL_HOST_PASSWORD = "SmtpPa$$w0rd#2024"
+EMAIL_PORT = 587
+EMAIL_USE_TLS = True
+
+STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRst1234567890abcdef"
+STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz12345678"
+
+REDIS_PASSWORD = "r3disPa$$w0rd"
+REDIS_URL = f"redis://:r3disPa$$w0rd@redis.internal:6379/0"

package/dist/packages/crucible/seeds/python/seed-004.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded Stripe and PayPal API credentials
-
-import stripe
-import requests
-
-# Stripe configuration
-STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef"
-STRIPE_PUBLISHABLE_KEY = "pk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz0987654321"
-STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF"
-
-stripe.api_key = STRIPE_SECRET_KEY
-
-# PayPal configuration
-PAYPAL_CLIENT_ID = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz12345678"
-PAYPAL_CLIENT_SECRET = "EeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz123456781234"
-PAYPAL_BASE_URL = "https://api.paypal.com"
-
-
-def get_paypal_token() -> str:
-    response = requests.post(
-        f"{PAYPAL_BASE_URL}/v1/oauth2/token",
-        auth=(PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET),
-        data={"grant_type": "client_credentials"},
-    )
-    return response.json()["access_token"]
-
-
-def create_payment_intent(amount: int, currency: str = "usd") -> dict:
-    return stripe.PaymentIntent.create(amount=amount, currency=currency)
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded Stripe and PayPal API credentials
+
+import stripe
+import requests
+
+# Stripe configuration
+STRIPE_SECRET_KEY = "sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef"
+STRIPE_PUBLISHABLE_KEY = "pk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz0987654321"
+STRIPE_WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF"
+
+stripe.api_key = STRIPE_SECRET_KEY
+
+# PayPal configuration
+PAYPAL_CLIENT_ID = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz12345678"
+PAYPAL_CLIENT_SECRET = "EeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz123456781234"
+PAYPAL_BASE_URL = "https://api.paypal.com"
+
+
+def get_paypal_token() -> str:
+    response = requests.post(
+        f"{PAYPAL_BASE_URL}/v1/oauth2/token",
+        auth=(PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET),
+        data={"grant_type": "client_credentials"},
+    )
+    return response.json()["access_token"]
+
+
+def create_payment_intent(amount: int, currency: str = "usd") -> dict:
+    return stripe.PaymentIntent.create(amount=amount, currency=currency)

package/dist/packages/crucible/seeds/python/seed-005.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: critical
-# language: python
-# expected: hardcoded JWT secret and admin credentials in Flask app
-
-from flask import Flask, request, jsonify
-import jwt
-
-app = Flask(__name__)
-
-JWT_SECRET = "my-super-secret-flask-jwt-key-never-change-abc123!"
-ADMIN_USERNAME = "admin"
-ADMIN_PASSWORD = "AdminP@ssw0rd!#$2024"
-API_MASTER_KEY = "master-api-key-production-xYz9876543210"
-
-
-def generate_token(user_id: int, role: str) -> str:
-    payload = {"user_id": user_id, "role": role}
-    return jwt.encode(payload, JWT_SECRET, algorithm="HS256")
-
-
-def verify_token(token: str) -> dict:
-    return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
-
-
-@app.route("/admin/login", methods=["POST"])
-def admin_login():
-    data = request.get_json()
-    if data["username"] == ADMIN_USERNAME and data["password"] == ADMIN_PASSWORD:
-        token = generate_token(0, "admin")
-        return jsonify({"token": token})
-    return jsonify({"error": "Invalid credentials"}), 401
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: python
+# expected: hardcoded JWT secret and admin credentials in Flask app
+
+from flask import Flask, request, jsonify
+import jwt
+
+app = Flask(__name__)
+
+JWT_SECRET = "my-super-secret-flask-jwt-key-never-change-abc123!"
+ADMIN_USERNAME = "admin"
+ADMIN_PASSWORD = "AdminP@ssw0rd!#$2024"
+API_MASTER_KEY = "master-api-key-production-xYz9876543210"
+
+
+def generate_token(user_id: int, role: str) -> str:
+    payload = {"user_id": user_id, "role": role}
+    return jwt.encode(payload, JWT_SECRET, algorithm="HS256")
+
+
+def verify_token(token: str) -> dict:
+    return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+
+
+@app.route("/admin/login", methods=["POST"])
+def admin_login():
+    data = request.get_json()
+    if data["username"] == ADMIN_USERNAME and data["password"] == ADMIN_PASSWORD:
+        token = generate_token(0, "admin")
+        return jsonify({"token": token})
+    return jsonify({"error": "Invalid credentials"}), 401

package/dist/packages/crucible/seeds/python/seed-006.py

@@ -1,34 +1,34 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded GitHub token and Slack webhook URL
-
-import requests
-
-GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"
-GITHUB_ORG = "my-company"
-
-SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
-SLACK_BOT_TOKEN = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx"
-
-GITHUB_HEADERS = {"Authorization": f"token {GITHUB_TOKEN}", "Accept": "application/vnd.github.v3+json"}
-
-
-def create_github_issue(repo: str, title: str, body: str) -> dict:
-    url = f"https://api.github.com/repos/{GITHUB_ORG}/{repo}/issues"
-    response = requests.post(url, json={"title": title, "body": body}, headers=GITHUB_HEADERS)
-    return response.json()
-
-
-def post_slack_message(text: str, channel: str = "#general") -> dict:
-    response = requests.post(
-        "https://slack.com/api/chat.postMessage",
-        headers={"Authorization": f"Bearer {SLACK_BOT_TOKEN}"},
-        json={"channel": channel, "text": text},
-    )
-    return response.json()
-
-
-def notify_slack_webhook(payload: dict) -> None:
-    requests.post(SLACK_WEBHOOK_URL, json=payload)
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded GitHub token and Slack webhook URL
+
+import requests
+
+GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"
+GITHUB_ORG = "my-company"
+
+SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
+SLACK_BOT_TOKEN = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx"
+
+GITHUB_HEADERS = {"Authorization": f"token {GITHUB_TOKEN}", "Accept": "application/vnd.github.v3+json"}
+
+
+def create_github_issue(repo: str, title: str, body: str) -> dict:
+    url = f"https://api.github.com/repos/{GITHUB_ORG}/{repo}/issues"
+    response = requests.post(url, json={"title": title, "body": body}, headers=GITHUB_HEADERS)
+    return response.json()
+
+
+def post_slack_message(text: str, channel: str = "#general") -> dict:
+    response = requests.post(
+        "https://slack.com/api/chat.postMessage",
+        headers={"Authorization": f"Bearer {SLACK_BOT_TOKEN}"},
+        json={"channel": channel, "text": text},
+    )
+    return response.json()
+
+
+def notify_slack_webhook(payload: dict) -> None:
+    requests.post(SLACK_WEBHOOK_URL, json=payload)

package/dist/packages/crucible/seeds/python/seed-007.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded encryption key and IV in Python crypto utility
-
-from Crypto.Cipher import AES
-import base64
-
-# 32-byte AES key — hardcoded, never rotated
-ENCRYPTION_KEY = b"12345678901234567890123456789012"
-# 16-byte IV — static, reused for every encryption operation
-STATIC_IV = b"abcdef1234567890"
-
-BLOCK_SIZE = AES.block_size
-
-
-def pad(data: bytes) -> bytes:
-    pad_len = BLOCK_SIZE - len(data) % BLOCK_SIZE
-    return data + bytes([pad_len] * pad_len)
-
-
-def encrypt(plaintext: str) -> str:
-    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
-    encrypted = cipher.encrypt(pad(plaintext.encode()))
-    return base64.b64encode(encrypted).decode()
-
-
-def decrypt(ciphertext: str) -> str:
-    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded encryption key and IV in Python crypto utility
+
+from Crypto.Cipher import AES
+import base64
+
+# 32-byte AES key — hardcoded, never rotated
+ENCRYPTION_KEY = b"12345678901234567890123456789012"
+# 16-byte IV — static, reused for every encryption operation
+STATIC_IV = b"abcdef1234567890"
+
+BLOCK_SIZE = AES.block_size
+
+
+def pad(data: bytes) -> bytes:
+    pad_len = BLOCK_SIZE - len(data) % BLOCK_SIZE
+    return data + bytes([pad_len] * pad_len)
+
+
+def encrypt(plaintext: str) -> str:
+    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
+    encrypted = cipher.encrypt(pad(plaintext.encode()))
+    return base64.b64encode(encrypted).decode()
+
+
+def decrypt(ciphertext: str) -> str:
+    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-008.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: hardcoded_secret
-# severity: high
-# language: python
-# expected: hardcoded OAuth2 client credentials and SMTP password in FastAPI app
-
-from fastapi import FastAPI, HTTPException
-import httpx
-
-app = FastAPI()
-
-OAUTH_CLIENT_ID = "oauth2-client-production-id-abc123"
-OAUTH_CLIENT_SECRET = "oauth2-client-secret-XyZ9876543210abcdefGHIJKL"
-OAUTH_TOKEN_URL = "https://auth.provider.com/oauth/token"
-
-SMTP_HOST = "smtp.company.com"
-SMTP_USER = "noreply@company.com"
-SMTP_PASSWORD = "Smtp$Pass#2024Production!"
-
-INTERNAL_API_KEY = "internal-service-api-key-prod-abc123xyz789"
-
-
-async def get_oauth_token() -> str:
-    async with httpx.AsyncClient() as client:
-        resp = await client.post(
-            OAUTH_TOKEN_URL,
-            data={
-                "grant_type": "client_credentials",
-                "client_id": OAUTH_CLIENT_ID,
-                "client_secret": OAUTH_CLIENT_SECRET,
-            },
-        )
-    return resp.json()["access_token"]
-
-
-@app.get("/health")
-async def health():
-    return {"status": "ok"}
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: python
+# expected: hardcoded OAuth2 client credentials and SMTP password in FastAPI app
+
+from fastapi import FastAPI, HTTPException
+import httpx
+
+app = FastAPI()
+
+OAUTH_CLIENT_ID = "oauth2-client-production-id-abc123"
+OAUTH_CLIENT_SECRET = "oauth2-client-secret-XyZ9876543210abcdefGHIJKL"
+OAUTH_TOKEN_URL = "https://auth.provider.com/oauth/token"
+
+SMTP_HOST = "smtp.company.com"
+SMTP_USER = "noreply@company.com"
+SMTP_PASSWORD = "Smtp$Pass#2024Production!"
+
+INTERNAL_API_KEY = "internal-service-api-key-prod-abc123xyz789"
+
+
+async def get_oauth_token() -> str:
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            OAUTH_TOKEN_URL,
+            data={
+                "grant_type": "client_credentials",
+                "client_id": OAUTH_CLIENT_ID,
+                "client_secret": OAUTH_CLIENT_SECRET,
+            },
+        )
+    return resp.json()["access_token"]
+
+
+@app.get("/health")
+async def health():
+    return {"status": "ok"}

package/dist/packages/crucible/seeds/python/seed-009.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection via string formatting in cursor.execute
-
-import sqlite3
-
-
-def get_user_by_name(username: str) -> dict:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    # Direct string formatting — attacker sends: "' OR '1'='1"
-    query = "SELECT * FROM users WHERE username = '%s'" % username
-    cursor.execute(query)
-    row = cursor.fetchone()
-    conn.close()
-    return row
-
-
-def search_products(term: str, category: str) -> list:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    query = (
-        "SELECT * FROM products WHERE name LIKE '%%%s%%' AND category = '%s'" % (term, category)
-    )
-    cursor.execute(query)
-    results = cursor.fetchall()
-    conn.close()
-    return results
-
-
-def delete_user(user_id: str) -> None:
-    conn = sqlite3.connect("app.db")
-    cursor = conn.cursor()
-    cursor.execute("DELETE FROM users WHERE id = " + user_id)
-    conn.commit()
-    conn.close()
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection via string formatting in cursor.execute
+
+import sqlite3
+
+
+def get_user_by_name(username: str) -> dict:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    # Direct string formatting — attacker sends: "' OR '1'='1"
+    query = "SELECT * FROM users WHERE username = '%s'" % username
+    cursor.execute(query)
+    row = cursor.fetchone()
+    conn.close()
+    return row
+
+
+def search_products(term: str, category: str) -> list:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    query = (
+        "SELECT * FROM products WHERE name LIKE '%%%s%%' AND category = '%s'" % (term, category)
+    )
+    cursor.execute(query)
+    results = cursor.fetchall()
+    conn.close()
+    return results
+
+
+def delete_user(user_id: str) -> None:
+    conn = sqlite3.connect("app.db")
+    cursor = conn.cursor()
+    cursor.execute("DELETE FROM users WHERE id = " + user_id)
+    conn.commit()
+    conn.close()

package/dist/packages/crucible/seeds/python/seed-010.py

@@ -1,42 +1,42 @@
-# [CRUCIBLE-SEED]
-# category: sql_injection
-# severity: critical
-# language: python
-# expected: SQL injection in Flask route via f-string in SQL query
-
-from flask import Flask, request, jsonify
-import psycopg2
-
-app = Flask(__name__)
-
-
-def get_db():
-    return psycopg2.connect(dbname="appdb", user="app", password="app", host="localhost")
-
-
-@app.route("/users/login", methods=["POST"])
-def login():
-    data = request.get_json()
-    username = data.get("username", "")
-    password = data.get("password", "")
-
-    conn = get_db()
-    cur = conn.cursor()
-    # Classic SQL injection auth bypass
-    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
-    cur.execute(query)
-    user = cur.fetchone()
-
-    if not user:
-        return jsonify({"error": "Invalid credentials"}), 401
-    return jsonify({"user_id": user[0], "username": user[1]})
-
-
-@app.route("/products")
-def products():
-    category = request.args.get("category", "")
-    sort_by = request.args.get("sort", "name")
-    conn = get_db()
-    cur = conn.cursor()
-    cur.execute(f"SELECT * FROM products WHERE category = '{category}' ORDER BY {sort_by}")
-    return jsonify(cur.fetchall())
+# [CRUCIBLE-SEED]
+# category: sql_injection
+# severity: critical
+# language: python
+# expected: SQL injection in Flask route via f-string in SQL query
+
+from flask import Flask, request, jsonify
+import psycopg2
+
+app = Flask(__name__)
+
+
+def get_db():
+    return psycopg2.connect(dbname="appdb", user="app", password="app", host="localhost")
+
+
+@app.route("/users/login", methods=["POST"])
+def login():
+    data = request.get_json()
+    username = data.get("username", "")
+    password = data.get("password", "")
+
+    conn = get_db()
+    cur = conn.cursor()
+    # Classic SQL injection auth bypass
+    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
+    cur.execute(query)
+    user = cur.fetchone()
+
+    if not user:
+        return jsonify({"error": "Invalid credentials"}), 401
+    return jsonify({"user_id": user[0], "username": user[1]})
+
+
+@app.route("/products")
+def products():
+    category = request.args.get("category", "")
+    sort_by = request.args.get("sort", "name")
+    conn = get_db()
+    cur = conn.cursor()
+    cur.execute(f"SELECT * FROM products WHERE category = '{category}' ORDER BY {sort_by}")
+    return jsonify(cur.fetchall())