thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/python/seed-034.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for password hashing
-
-import hashlib
-import psycopg2
-
-
-def get_db():
-    return psycopg2.connect(host="localhost", dbname="app", user="app", password="app")
-
-
-def hash_password(password: str) -> str:
-    # MD5 is cryptographically broken — must not be used for passwords
-    return hashlib.md5(password.encode()).hexdigest()
-
-
-def register_user(email: str, password: str) -> None:
-    conn = get_db()
-    cur = conn.cursor()
-    pw_hash = hash_password(password)
-    cur.execute("INSERT INTO users (email, password_hash) VALUES (%s, %s)", (email, pw_hash))
-    conn.commit()
-
-
-def login_user(email: str, password: str) -> bool:
-    conn = get_db()
-    cur = conn.cursor()
-    pw_hash = hash_password(password)
-    cur.execute("SELECT id FROM users WHERE email = %s AND password_hash = %s", (email, pw_hash))
-    return cur.fetchone() is not None
-
-
-def hash_file(file_path: str) -> str:
-    with open(file_path, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for password hashing
+
+import hashlib
+import psycopg2
+
+
+def get_db():
+    return psycopg2.connect(host="localhost", dbname="app", user="app", password="app")
+
+
+def hash_password(password: str) -> str:
+    # MD5 is cryptographically broken — must not be used for passwords
+    return hashlib.md5(password.encode()).hexdigest()
+
+
+def register_user(email: str, password: str) -> None:
+    conn = get_db()
+    cur = conn.cursor()
+    pw_hash = hash_password(password)
+    cur.execute("INSERT INTO users (email, password_hash) VALUES (%s, %s)", (email, pw_hash))
+    conn.commit()
+
+
+def login_user(email: str, password: str) -> bool:
+    conn = get_db()
+    cur = conn.cursor()
+    pw_hash = hash_password(password)
+    cur.execute("SELECT id FROM users WHERE email = %s AND password_hash = %s", (email, pw_hash))
+    return cur.fetchone() is not None
+
+
+def hash_file(file_path: str) -> str:
+    with open(file_path, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()

package/dist/packages/crucible/seeds/python/seed-035.py

@@ -1,35 +1,35 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: SHA1 used for password hashing and random.random() for token generation
-
-import hashlib
-import random
-import time
-
-
-def hash_password(password: str, salt: str = "") -> str:
-    # SHA-1 is deprecated for security-sensitive hashing
-    return hashlib.sha1((salt + password).encode()).hexdigest()
-
-
-def generate_session_token() -> str:
-    # random.random() is not cryptographically secure
-    return hex(int(random.random() * 10**18))[2:]
-
-
-def generate_reset_token(user_id: int) -> str:
-    # Predictable — only uses timestamp and non-secure random
-    return hashlib.sha1(f"{user_id}-{time.time()}-{random.randint(0, 999999)}".encode()).hexdigest()
-
-
-def create_api_key(user_id: str) -> str:
-    # Weak entropy source — easily guessable
-    rand = random.getrandbits(32)
-    return hashlib.md5(f"{user_id}{rand}".encode()).hexdigest()
-
-
-def generate_otp() -> str:
-    # random.randint is predictable — use secrets.randbelow instead
-    return str(random.randint(100000, 999999))
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: SHA1 used for password hashing and random.random() for token generation
+
+import hashlib
+import random
+import time
+
+
+def hash_password(password: str, salt: str = "") -> str:
+    # SHA-1 is deprecated for security-sensitive hashing
+    return hashlib.sha1((salt + password).encode()).hexdigest()
+
+
+def generate_session_token() -> str:
+    # random.random() is not cryptographically secure
+    return hex(int(random.random() * 10**18))[2:]
+
+
+def generate_reset_token(user_id: int) -> str:
+    # Predictable — only uses timestamp and non-secure random
+    return hashlib.sha1(f"{user_id}-{time.time()}-{random.randint(0, 999999)}".encode()).hexdigest()
+
+
+def create_api_key(user_id: str) -> str:
+    # Weak entropy source — easily guessable
+    rand = random.getrandbits(32)
+    return hashlib.md5(f"{user_id}{rand}".encode()).hexdigest()
+
+
+def generate_otp() -> str:
+    # random.randint is predictable — use secrets.randbelow instead
+    return str(random.randint(100000, 999999))

package/dist/packages/crucible/seeds/python/seed-036 2.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: DES cipher usage and AES-ECB mode with static key
+
+from Crypto.Cipher import DES, AES
+import base64
+
+DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
+AES_KEY = b"0123456789abcdef"  # 16 bytes
+
+
+def des_encrypt(data: str) -> str:
+    # DES has only 56-bit effective key length — trivially brute-forced
+    padded = data + " " * (8 - len(data) % 8)
+    cipher = DES.new(DES_KEY, DES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
+
+
+def aes_ecb_encrypt(data: str) -> str:
+    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
+    pad_len = 16 - len(data) % 16
+    padded = (data + chr(pad_len) * pad_len).encode()
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded)).decode()
+
+
+def aes_ecb_decrypt(ciphertext: str) -> str:
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-036.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: DES cipher usage and AES-ECB mode with static key
+
+from Crypto.Cipher import DES, AES
+import base64
+
+DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
+AES_KEY = b"0123456789abcdef"  # 16 bytes
+
+
+def des_encrypt(data: str) -> str:
+    # DES has only 56-bit effective key length — trivially brute-forced
+    padded = data + " " * (8 - len(data) % 8)
+    cipher = DES.new(DES_KEY, DES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
+
+
+def aes_ecb_encrypt(data: str) -> str:
+    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
+    pad_len = 16 - len(data) % 16
+    padded = (data + chr(pad_len) * pad_len).encode()
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    return base64.b64encode(cipher.encrypt(padded)).decode()
+
+
+def aes_ecb_decrypt(ciphertext: str) -> str:
+    cipher = AES.new(AES_KEY, AES.MODE_ECB)
+    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
+    pad_len = decrypted[-1]
+    return decrypted[:-pad_len].decode()

package/dist/packages/crucible/seeds/python/seed-037 2.py

@@ -1,41 +1,41 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: medium
+# language: python
+# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
+
+import hmac
+import hashlib
+
+
+WEBHOOK_SECRET = b"static-webhook-secret-2024"
+
+
+def compute_signature(payload: bytes) -> str:
+    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
+
+
+def verify_signature(payload: bytes, received_sig: str) -> bool:
+    expected = compute_signature(payload)
+    # String comparison leaks timing info — use hmac.compare_digest instead
+    return expected == received_sig
+
+
+def verify_api_key(provided: str, stored: str) -> bool:
+    # Direct equality — timing side-channel attack possible
+    return provided == stored
+
+
+def derive_key(password: str) -> bytes:
+    # Only 1000 iterations — far below NIST recommendation of 600,000+
+    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
+
+
+def check_token(token_a: str, token_b: str) -> bool:
+    # Char-by-char comparison leaks prefix matches
+    if len(token_a) != len(token_b):
+        return False
+    for a, b in zip(token_a, token_b):
+        if a != b:
+            return False
+    return True

package/dist/packages/crucible/seeds/python/seed-037.py

@@ -1,41 +1,41 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: medium
+# language: python
+# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
+
+import hmac
+import hashlib
+
+
+WEBHOOK_SECRET = b"static-webhook-secret-2024"
+
+
+def compute_signature(payload: bytes) -> str:
+    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
+
+
+def verify_signature(payload: bytes, received_sig: str) -> bool:
+    expected = compute_signature(payload)
+    # String comparison leaks timing info — use hmac.compare_digest instead
+    return expected == received_sig
+
+
+def verify_api_key(provided: str, stored: str) -> bool:
+    # Direct equality — timing side-channel attack possible
+    return provided == stored
+
+
+def derive_key(password: str) -> bytes:
+    # Only 1000 iterations — far below NIST recommendation of 600,000+
+    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
+
+
+def check_token(token_a: str, token_b: str) -> bool:
+    # Char-by-char comparison leaks prefix matches
+    if len(token_a) != len(token_b):
+        return False
+    for a, b in zip(token_a, token_b):
+        if a != b:
+            return False
+    return True

package/dist/packages/crucible/seeds/python/seed-038 2.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for file integrity and RSA with insufficient key size
+
+import hashlib
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pkcs1_15
+from Crypto.Hash import MD5
+
+
+def checksum_file(filepath: str) -> str:
+    # MD5 is collision-prone — not suitable for integrity verification
+    with open(filepath, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()
+
+
+def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
+    return checksum_file(filepath) == expected_md5
+
+
+def generate_rsa_keypair():
+    # 512-bit RSA key — trivially factorable in seconds
+    key = RSA.generate(512)
+    return key.export_key().decode(), key.publickey().export_key().decode()
+
+
+def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
+    key = RSA.import_key(private_key_pem)
+    # MD5 with RSA — known-weak combination
+    h = MD5.new(message)
+    return pkcs1_15.new(key).sign(h)

package/dist/packages/crucible/seeds/python/seed-038.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)
+# [CRUCIBLE-SEED]
+# category: insecure_crypto
+# severity: high
+# language: python
+# expected: MD5 used for file integrity and RSA with insufficient key size
+
+import hashlib
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pkcs1_15
+from Crypto.Hash import MD5
+
+
+def checksum_file(filepath: str) -> str:
+    # MD5 is collision-prone — not suitable for integrity verification
+    with open(filepath, "rb") as f:
+        return hashlib.md5(f.read()).hexdigest()
+
+
+def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
+    return checksum_file(filepath) == expected_md5
+
+
+def generate_rsa_keypair():
+    # 512-bit RSA key — trivially factorable in seconds
+    key = RSA.generate(512)
+    return key.export_key().decode(), key.publickey().export_key().decode()
+
+
+def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
+    key = RSA.import_key(private_key_pem)
+    # MD5 with RSA — known-weak combination
+    h = MD5.new(message)
+    return pkcs1_15.new(key).sign(h)

package/dist/packages/crucible/seeds/python/seed-039 2.py

@@ -1,39 +1,39 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval() called with user-controlled expression string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/calculate", methods=["POST"])
-def calculate():
-    data = request.get_json()
-    expression = data.get("expression", "")
-    try:
-        # Attacker sends: "__import__('os').system('id')"
-        result = eval(expression)
-        return jsonify({"result": result})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/filter", methods=["POST"])
-def filter_data():
-    data = request.get_json()
-    records = data.get("records", [])
-    condition = data.get("condition", "True")
-    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
-    filtered = [r for r in records if eval(condition, {"r": r})]
-    return jsonify({"results": filtered})
-
-
-@app.route("/transform", methods=["POST"])
-def transform():
-    expr = request.get_json().get("expr", "x")
-    items = request.get_json().get("items", [1, 2, 3])
-    result = list(map(lambda x: eval(expr), items))
-    return jsonify({"result": result})
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval() called with user-controlled expression string
+
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/calculate", methods=["POST"])
+def calculate():
+    data = request.get_json()
+    expression = data.get("expression", "")
+    try:
+        # Attacker sends: "__import__('os').system('id')"
+        result = eval(expression)
+        return jsonify({"result": result})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 400
+
+
+@app.route("/filter", methods=["POST"])
+def filter_data():
+    data = request.get_json()
+    records = data.get("records", [])
+    condition = data.get("condition", "True")
+    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
+    filtered = [r for r in records if eval(condition, {"r": r})]
+    return jsonify({"results": filtered})
+
+
+@app.route("/transform", methods=["POST"])
+def transform():
+    expr = request.get_json().get("expr", "x")
+    items = request.get_json().get("items", [1, 2, 3])
+    result = list(map(lambda x: eval(expr), items))
+    return jsonify({"result": result})