thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/.golden/golden-master.json

@@ -1,414 +1,414 @@
-{
-  "version": 1,
-  "timestamp": "2026-07-01T11:20:04.329Z",
-  "hash": "8752892137ff7720",
-  "count": 50,
-  "meta": {
-    "score": 100,
-    "level": "gentle",
-    "seeds": 50,
-    "duration": 281
-  },
-  "findings": [
-    {
-      "seedId": "csharp/seed-009.cs",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "SQL injection via string concatenation in SqlCommand"
-    },
-    {
-      "seedId": "csharp/seed-033.cs",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files"
-    },
-    {
-      "seedId": "csharp/seed-034.cs",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "MD5 used for password hashing via MD5.Create()"
-    },
-    {
-      "seedId": "csharp/seed-037.cs",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "SHA1 used for HMAC signing instead of SHA256 or higher"
-    },
-    {
-      "seedId": "csharp/seed-042.cs",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "Unsafe deserialization via DataContractSerializer reading from request body"
-    },
-    {
-      "seedId": "csharp/seed-045.cs",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "SSRF via HttpClient.GetAsync with user-controlled endpoint URL"
-    },
-    {
-      "seedId": "csharp/seed-048.cs",
-      "category": "xxe",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)"
-    },
-    {
-      "seedId": "go/seed-019.go",
-      "category": "xss",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "XSS via w.Write injecting user input into inline JavaScript variable"
-    },
-    {
-      "seedId": "go/seed-029.go",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "Path traversal via os.Open with user-supplied filename concatenated to base path"
-    },
-    {
-      "seedId": "go/seed-034.go",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "MD5 used for password hashing via crypto/md5"
-    },
-    {
-      "seedId": "go/seed-036.go",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "SHA1 used for HMAC signing and MD5 for file integrity verification"
-    },
-    {
-      "seedId": "go/seed-042.go",
-      "category": "open_redirect",
-      "severity": "medium",
-      "language": "go",
-      "detected": true,
-      "label": "Open redirect via http.Redirect using user-supplied return URL after password reset"
-    },
-    {
-      "seedId": "go/seed-050.go",
-      "category": "open_redirect",
-      "severity": "medium",
-      "language": "go",
-      "detected": true,
-      "label": "Open redirect via http.Redirect with Referer header used as redirect destination"
-    },
-    {
-      "seedId": "java/seed-009.java",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "SQL injection via string concatenation in executeQuery"
-    },
-    {
-      "seedId": "java/seed-034.java",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "MD5 used for password hashing via MessageDigest"
-    },
-    {
-      "seedId": "java/seed-042.java",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "Unsafe deserialization in JMS message listener via ObjectMessage"
-    },
-    {
-      "seedId": "java/seed-044.java",
-      "category": "xxe",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "XXE via XMLReader without disabling external entities or DOCTYPE processing"
-    },
-    {
-      "seedId": "java/seed-048.java",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "SSRF via URL.openConnection with user-supplied URL parameter"
-    },
-    {
-      "seedId": "java/seed-049.java",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "SSRF via URL.openStream with user-controlled webhook URL"
-    },
-    {
-      "seedId": "js/seed-014.js",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "SQL injection via Sequelize literal() with user input"
-    },
-    {
-      "seedId": "js/seed-015.js",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "SQL injection via bulk IN clause construction with user-supplied IDs"
-    },
-    {
-      "seedId": "js/seed-026.js",
-      "category": "command_injection",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "command injection via child_process.exec in scheduled job"
-    },
-    {
-      "seedId": "js/seed-030.js",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "path traversal via user-controlled directory in readdir and readFileSync"
-    },
-    {
-      "seedId": "js/seed-044.js",
-      "category": "eval_abuse",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() called with user-controlled expression string"
-    },
-    {
-      "seedId": "js/seed-046.js",
-      "category": "eval_abuse",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() used in JSON reviver to execute serialized function strings"
-    },
-    {
-      "seedId": "js/seed-047.js",
-      "category": "eval_abuse",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() inside setTimeout and setInterval with user-controlled string"
-    },
-    {
-      "seedId": "js/seed-052.js",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "SSRF via got/superagent with redirect following and user-controlled URL"
-    },
-    {
-      "seedId": "kotlin/seed-019.kt",
-      "category": "xss",
-      "severity": "medium",
-      "language": "kotlin",
-      "detected": true,
-      "label": "WebView evaluateJavascript with unsanitized user string"
-    },
-    {
-      "seedId": "kotlin/seed-032.kt",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "kotlin",
-      "detected": true,
-      "label": "Download path constructed from user-controlled filename without sanitization"
-    },
-    {
-      "seedId": "kotlin/seed-038.kt",
-      "category": "insecure_crypto",
-      "severity": "medium",
-      "language": "kotlin",
-      "detected": true,
-      "label": "SHA-1 used for certificate pinning and signature verification"
-    },
-    {
-      "seedId": "php/seed-003.php",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "php",
-      "detected": true,
-      "label": "Hardcoded AWS credentials and S3 configuration"
-    },
-    {
-      "seedId": "php/seed-017.php",
-      "category": "xss",
-      "severity": "high",
-      "language": "php",
-      "detected": true,
-      "label": "$_POST values echoed directly into HTML form — stored XSS vector"
-    },
-    {
-      "seedId": "php/seed-018.php",
-      "category": "xss",
-      "severity": "high",
-      "language": "php",
-      "detected": true,
-      "label": "print_r or var_dump of user input rendered in HTML context"
-    },
-    {
-      "seedId": "php/seed-029.php",
-      "category": "path_traversal",
-      "severity": "critical",
-      "language": "php",
-      "detected": true,
-      "label": "include() with user-supplied path — local file inclusion / RFI"
-    },
-    {
-      "seedId": "python/seed-001.py",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "hardcoded AWS access key and secret key"
-    },
-    {
-      "seedId": "python/seed-029.py",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "python",
-      "detected": true,
-      "label": "path traversal via open() with unvalidated user-supplied file path"
-    },
-    {
-      "seedId": "python/seed-036.py",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "python",
-      "detected": true,
-      "label": "DES cipher usage and AES-ECB mode with static key"
-    },
-    {
-      "seedId": "python/seed-049.py",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "pickle.load used with untrusted file upload and shelve with user-controlled key"
-    },
-    {
-      "seedId": "python/seed-052.py",
-      "category": "yaml_injection",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "yaml.load() without safe_load — RCE via !!python/object tags in YAML"
-    },
-    {
-      "seedId": "ruby/seed-002.rb",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "ruby",
-      "detected": true,
-      "label": "Hardcoded database password in database.yml equivalent or initializer"
-    },
-    {
-      "seedId": "ruby/seed-005.rb",
-      "category": "hardcoded_secret",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "Hardcoded JWT secret and admin API token"
-    },
-    {
-      "seedId": "ruby/seed-021.rb",
-      "category": "xss",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "ActionMailer HTML email built with unescaped user content"
-    },
-    {
-      "seedId": "ruby/seed-028.rb",
-      "category": "command_injection",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "Kernel.system called with interpolated hostname for network diagnostics"
-    },
-    {
-      "seedId": "ruby/seed-044.rb",
-      "category": "open_redirect",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "redirect_to params[:url] without validation — open redirect"
-    },
-    {
-      "seedId": "rust/seed-011.rs",
-      "category": "unsafe_block",
-      "severity": "critical",
-      "language": "rust",
-      "detected": true,
-      "label": "Unsafe foreign function interface call without input validation"
-    },
-    {
-      "seedId": "rust/seed-044.rs",
-      "category": "crypto_misuse",
-      "severity": "high",
-      "language": "rust",
-      "detected": true,
-      "label": "MD5 crate used for password or data integrity hashing"
-    },
-    {
-      "seedId": "ts/seed-004.ts",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "typescript",
-      "detected": true,
-      "label": "hardcoded Stripe secret key and webhook secret in typed service"
-    },
-    {
-      "seedId": "ts/seed-032.ts",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "zip-slip path traversal via user-uploaded archive with unvalidated entry names"
-    },
-    {
-      "seedId": "ts/seed-034.ts",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "MD5 used for password hashing in typed auth service"
-    },
-    {
-      "seedId": "ts/seed-048.ts",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "SSRF via fetch with unvalidated user-supplied URL"
-    }
-  ]
+{
+  "version": 1,
+  "timestamp": "2026-07-01T11:20:04.329Z",
+  "hash": "8752892137ff7720",
+  "count": 50,
+  "meta": {
+    "score": 100,
+    "level": "gentle",
+    "seeds": 50,
+    "duration": 281
+  },
+  "findings": [
+    {
+      "seedId": "csharp/seed-009.cs",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "SQL injection via string concatenation in SqlCommand"
+    },
+    {
+      "seedId": "csharp/seed-033.cs",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files"
+    },
+    {
+      "seedId": "csharp/seed-034.cs",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "MD5 used for password hashing via MD5.Create()"
+    },
+    {
+      "seedId": "csharp/seed-037.cs",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "SHA1 used for HMAC signing instead of SHA256 or higher"
+    },
+    {
+      "seedId": "csharp/seed-042.cs",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "Unsafe deserialization via DataContractSerializer reading from request body"
+    },
+    {
+      "seedId": "csharp/seed-045.cs",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "csharp",
+      "detected": true,
+      "label": "SSRF via HttpClient.GetAsync with user-controlled endpoint URL"
+    },
+    {
+      "seedId": "csharp/seed-048.cs",
+      "category": "xxe",
+      "severity": "critical",
+      "language": "csharp",
+      "detected": true,
+      "label": "XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)"
+    },
+    {
+      "seedId": "go/seed-019.go",
+      "category": "xss",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "XSS via w.Write injecting user input into inline JavaScript variable"
+    },
+    {
+      "seedId": "go/seed-029.go",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "Path traversal via os.Open with user-supplied filename concatenated to base path"
+    },
+    {
+      "seedId": "go/seed-034.go",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "MD5 used for password hashing via crypto/md5"
+    },
+    {
+      "seedId": "go/seed-036.go",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "go",
+      "detected": true,
+      "label": "SHA1 used for HMAC signing and MD5 for file integrity verification"
+    },
+    {
+      "seedId": "go/seed-042.go",
+      "category": "open_redirect",
+      "severity": "medium",
+      "language": "go",
+      "detected": true,
+      "label": "Open redirect via http.Redirect using user-supplied return URL after password reset"
+    },
+    {
+      "seedId": "go/seed-050.go",
+      "category": "open_redirect",
+      "severity": "medium",
+      "language": "go",
+      "detected": true,
+      "label": "Open redirect via http.Redirect with Referer header used as redirect destination"
+    },
+    {
+      "seedId": "java/seed-009.java",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "SQL injection via string concatenation in executeQuery"
+    },
+    {
+      "seedId": "java/seed-034.java",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "MD5 used for password hashing via MessageDigest"
+    },
+    {
+      "seedId": "java/seed-042.java",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "Unsafe deserialization in JMS message listener via ObjectMessage"
+    },
+    {
+      "seedId": "java/seed-044.java",
+      "category": "xxe",
+      "severity": "critical",
+      "language": "java",
+      "detected": true,
+      "label": "XXE via XMLReader without disabling external entities or DOCTYPE processing"
+    },
+    {
+      "seedId": "java/seed-048.java",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "SSRF via URL.openConnection with user-supplied URL parameter"
+    },
+    {
+      "seedId": "java/seed-049.java",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "java",
+      "detected": true,
+      "label": "SSRF via URL.openStream with user-controlled webhook URL"
+    },
+    {
+      "seedId": "js/seed-014.js",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "SQL injection via Sequelize literal() with user input"
+    },
+    {
+      "seedId": "js/seed-015.js",
+      "category": "sql_injection",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "SQL injection via bulk IN clause construction with user-supplied IDs"
+    },
+    {
+      "seedId": "js/seed-026.js",
+      "category": "command_injection",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "command injection via child_process.exec in scheduled job"
+    },
+    {
+      "seedId": "js/seed-030.js",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "path traversal via user-controlled directory in readdir and readFileSync"
+    },
+    {
+      "seedId": "js/seed-044.js",
+      "category": "eval_abuse",
+      "severity": "critical",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() called with user-controlled expression string"
+    },
+    {
+      "seedId": "js/seed-046.js",
+      "category": "eval_abuse",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() used in JSON reviver to execute serialized function strings"
+    },
+    {
+      "seedId": "js/seed-047.js",
+      "category": "eval_abuse",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "eval() inside setTimeout and setInterval with user-controlled string"
+    },
+    {
+      "seedId": "js/seed-052.js",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "javascript",
+      "detected": true,
+      "label": "SSRF via got/superagent with redirect following and user-controlled URL"
+    },
+    {
+      "seedId": "kotlin/seed-019.kt",
+      "category": "xss",
+      "severity": "medium",
+      "language": "kotlin",
+      "detected": true,
+      "label": "WebView evaluateJavascript with unsanitized user string"
+    },
+    {
+      "seedId": "kotlin/seed-032.kt",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "kotlin",
+      "detected": true,
+      "label": "Download path constructed from user-controlled filename without sanitization"
+    },
+    {
+      "seedId": "kotlin/seed-038.kt",
+      "category": "insecure_crypto",
+      "severity": "medium",
+      "language": "kotlin",
+      "detected": true,
+      "label": "SHA-1 used for certificate pinning and signature verification"
+    },
+    {
+      "seedId": "php/seed-003.php",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "php",
+      "detected": true,
+      "label": "Hardcoded AWS credentials and S3 configuration"
+    },
+    {
+      "seedId": "php/seed-017.php",
+      "category": "xss",
+      "severity": "high",
+      "language": "php",
+      "detected": true,
+      "label": "$_POST values echoed directly into HTML form — stored XSS vector"
+    },
+    {
+      "seedId": "php/seed-018.php",
+      "category": "xss",
+      "severity": "high",
+      "language": "php",
+      "detected": true,
+      "label": "print_r or var_dump of user input rendered in HTML context"
+    },
+    {
+      "seedId": "php/seed-029.php",
+      "category": "path_traversal",
+      "severity": "critical",
+      "language": "php",
+      "detected": true,
+      "label": "include() with user-supplied path — local file inclusion / RFI"
+    },
+    {
+      "seedId": "python/seed-001.py",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "hardcoded AWS access key and secret key"
+    },
+    {
+      "seedId": "python/seed-029.py",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "python",
+      "detected": true,
+      "label": "path traversal via open() with unvalidated user-supplied file path"
+    },
+    {
+      "seedId": "python/seed-036.py",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "python",
+      "detected": true,
+      "label": "DES cipher usage and AES-ECB mode with static key"
+    },
+    {
+      "seedId": "python/seed-049.py",
+      "category": "deserialization",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "pickle.load used with untrusted file upload and shelve with user-controlled key"
+    },
+    {
+      "seedId": "python/seed-052.py",
+      "category": "yaml_injection",
+      "severity": "critical",
+      "language": "python",
+      "detected": true,
+      "label": "yaml.load() without safe_load — RCE via !!python/object tags in YAML"
+    },
+    {
+      "seedId": "ruby/seed-002.rb",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "ruby",
+      "detected": true,
+      "label": "Hardcoded database password in database.yml equivalent or initializer"
+    },
+    {
+      "seedId": "ruby/seed-005.rb",
+      "category": "hardcoded_secret",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "Hardcoded JWT secret and admin API token"
+    },
+    {
+      "seedId": "ruby/seed-021.rb",
+      "category": "xss",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "ActionMailer HTML email built with unescaped user content"
+    },
+    {
+      "seedId": "ruby/seed-028.rb",
+      "category": "command_injection",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "Kernel.system called with interpolated hostname for network diagnostics"
+    },
+    {
+      "seedId": "ruby/seed-044.rb",
+      "category": "open_redirect",
+      "severity": "high",
+      "language": "ruby",
+      "detected": true,
+      "label": "redirect_to params[:url] without validation — open redirect"
+    },
+    {
+      "seedId": "rust/seed-011.rs",
+      "category": "unsafe_block",
+      "severity": "critical",
+      "language": "rust",
+      "detected": true,
+      "label": "Unsafe foreign function interface call without input validation"
+    },
+    {
+      "seedId": "rust/seed-044.rs",
+      "category": "crypto_misuse",
+      "severity": "high",
+      "language": "rust",
+      "detected": true,
+      "label": "MD5 crate used for password or data integrity hashing"
+    },
+    {
+      "seedId": "ts/seed-004.ts",
+      "category": "hardcoded_secret",
+      "severity": "critical",
+      "language": "typescript",
+      "detected": true,
+      "label": "hardcoded Stripe secret key and webhook secret in typed service"
+    },
+    {
+      "seedId": "ts/seed-032.ts",
+      "category": "path_traversal",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "zip-slip path traversal via user-uploaded archive with unvalidated entry names"
+    },
+    {
+      "seedId": "ts/seed-034.ts",
+      "category": "insecure_crypto",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "MD5 used for password hashing in typed auth service"
+    },
+    {
+      "seedId": "ts/seed-048.ts",
+      "category": "ssrf",
+      "severity": "high",
+      "language": "typescript",
+      "detected": true,
+      "label": "SSRF via fetch with unvalidated user-supplied URL"
+    }
+  ]
 }