thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/python/seed-043.py

@@ -1,32 +1,32 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval()/compile() used to execute user-uploaded Python module code
-
-import ast
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def safe_eval(code: str, context: dict) -> object:
-    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
-    try:
-        tree = ast.parse(code, mode="eval")
-        # compile() + eval() of user AST still allows dangerous constructs
-        compiled = compile(tree, "<user-input>", "eval")
-        return eval(compiled, {"__builtins__": __builtins__}, context)
-    except SyntaxError:
-        # Falls back to exec for multi-line code
-        exec(compile(code, "<user-input>", "exec"), context)
-        return context.get("result")
-
-
-@app.route("/plugin/evaluate", methods=["POST"])
-def evaluate_plugin():
-    payload = request.get_json()
-    code = payload.get("code", "")
-    params = payload.get("params", {})
-    result = safe_eval(code, params)
-    return jsonify({"output": result})
+# [CRUCIBLE-SEED]
+# category: eval_abuse
+# severity: critical
+# language: python
+# expected: eval()/compile() used to execute user-uploaded Python module code
+
+import ast
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def safe_eval(code: str, context: dict) -> object:
+    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
+    try:
+        tree = ast.parse(code, mode="eval")
+        # compile() + eval() of user AST still allows dangerous constructs
+        compiled = compile(tree, "<user-input>", "eval")
+        return eval(compiled, {"__builtins__": __builtins__}, context)
+    except SyntaxError:
+        # Falls back to exec for multi-line code
+        exec(compile(code, "<user-input>", "exec"), context)
+        return context.get("result")
+
+
+@app.route("/plugin/evaluate", methods=["POST"])
+def evaluate_plugin():
+    payload = request.get_json()
+    code = payload.get("code", "")
+    params = payload.get("params", {})
+    result = safe_eval(code, params)
+    return jsonify({"output": result})

package/dist/packages/crucible/seeds/python/seed-044 2.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-044.py

@@ -1,38 +1,38 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via requests.get with unvalidated user-supplied URL
+
+import requests
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/proxy")
+def proxy():
+    target_url = request.args.get("url", "")
+    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
+    response = requests.get(target_url, timeout=10)
+    return jsonify({
+        "status": response.status_code,
+        "content": response.text[:2000],
+    })
+
+
+@app.route("/webhook/test", methods=["POST"])
+def test_webhook():
+    data = request.get_json()
+    webhook_url = data.get("url", "")
+    payload = data.get("payload", {})
+    # webhook_url from user — attacker targets internal services
+    resp = requests.post(webhook_url, json=payload, timeout=8)
+    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
+
+
+@app.route("/avatar/fetch")
+def fetch_avatar():
+    avatar_url = request.args.get("url", "")
+    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
+    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/dist/packages/crucible/seeds/python/seed-045 2.py

@@ -1,36 +1,36 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-045.py

@@ -1,36 +1,36 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via httpx.get with user-controlled URL and redirect following
+
+import httpx
+from fastapi import FastAPI, Query
+from fastapi.responses import JSONResponse
+
+app = FastAPI()
+
+
+@app.get("/import/data")
+async def import_data(source: str = Query(...)):
+    # source from user — can be internal URL or cloud metadata endpoint
+    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
+        resp = await client.get(source)
+        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
+
+
+@app.post("/oembed")
+async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
+    # provider is an oembed endpoint from user — SSRF to internal services
+    oembed_url = f"{provider}?url={url}&format=json"
+    async with httpx.AsyncClient(timeout=8.0) as client:
+        resp = await client.get(oembed_url)
+        return resp.json()
+
+
+@app.get("/link-preview")
+async def link_preview(target: str = Query(...)):
+    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
+        resp = await client.get(target)
+    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
+    return {"title": title, "url": target}

package/dist/packages/crucible/seeds/python/seed-046 2.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-046.py

@@ -1,33 +1,33 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via urllib.request.urlopen with unvalidated user URL
+
+import urllib.request
+import urllib.parse
+from django.http import JsonResponse
+
+
+def fetch_remote_resource(request):
+    """Fetch an external resource on behalf of the client."""
+    url = request.GET.get("url", "")
+
+    # No validation — internal URLs, file://, gopher:// etc. all accepted
+    try:
+        with urllib.request.urlopen(url, timeout=10) as response:
+            content = response.read(4096).decode("utf-8", errors="replace")
+            content_type = response.headers.get("Content-Type", "")
+        return JsonResponse({"content": content, "content_type": content_type})
+    except Exception as e:
+        return JsonResponse({"error": str(e)}, status=400)
+
+
+def check_url_status(request):
+    target = request.POST.get("target", "")
+    try:
+        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return JsonResponse({"status": resp.status, "url": target})
+    except urllib.error.HTTPError as e:
+        return JsonResponse({"status": e.code})

package/dist/packages/crucible/seeds/python/seed-047 2.py

@@ -1,44 +1,44 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
-
-import aiohttp
-from fastapi import FastAPI, Body
-from pydantic import BaseModel
-
-app = FastAPI()
-
-
-class NotificationConfig(BaseModel):
-    webhook_url: str    # user-controlled
-    event_type: str
-    secret: str = ""
-
-
-class ImportRequest(BaseModel):
-    data_url: str       # user-controlled source URL
-    format: str = "json"
-
-
-@app.post("/notifications/send")
-async def send_notification(config: NotificationConfig):
-    async with aiohttp.ClientSession() as session:
-        # webhook_url from user — attacker targets http://10.0.0.1/admin
-        async with session.post(
-            config.webhook_url,
-            json={"event": config.event_type},
-            headers={"X-Secret": config.secret},
-            timeout=aiohttp.ClientTimeout(total=10),
-            allow_redirects=True,  # follows redirects — pivot to internal
-        ) as resp:
-            return {"status": resp.status}
-
-
-@app.post("/data/import")
-async def import_data(req: ImportRequest):
-    async with aiohttp.ClientSession() as session:
-        async with session.get(req.data_url) as resp:
-            data = await resp.text()
-    return {"preview": data[:500], "format": req.format}
+# [CRUCIBLE-SEED]
+# category: ssrf
+# severity: high
+# language: python
+# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service
+
+import aiohttp
+from fastapi import FastAPI, Body
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class NotificationConfig(BaseModel):
+    webhook_url: str    # user-controlled
+    event_type: str
+    secret: str = ""
+
+
+class ImportRequest(BaseModel):
+    data_url: str       # user-controlled source URL
+    format: str = "json"
+
+
+@app.post("/notifications/send")
+async def send_notification(config: NotificationConfig):
+    async with aiohttp.ClientSession() as session:
+        # webhook_url from user — attacker targets http://10.0.0.1/admin
+        async with session.post(
+            config.webhook_url,
+            json={"event": config.event_type},
+            headers={"X-Secret": config.secret},
+            timeout=aiohttp.ClientTimeout(total=10),
+            allow_redirects=True,  # follows redirects — pivot to internal
+        ) as resp:
+            return {"status": resp.status}
+
+
+@app.post("/data/import")
+async def import_data(req: ImportRequest):
+    async with aiohttp.ClientSession() as session:
+        async with session.get(req.data_url) as resp:
+            data = await resp.text()
+    return {"preview": data[:500], "format": req.format}