thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/rust/seed-014.rs

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: high
-// language: rust
-// expected: Use of unsafe to bypass borrow checker — potential use-after-free
-
-use std::collections::HashMap;
-
-pub struct Cache {
-    data: HashMap<String, String>,
-}
-
-impl Cache {
-    pub fn get_or_insert(&mut self, key: &str, value: String) -> &str {
-        if !self.data.contains_key(key) {
-            self.data.insert(key.to_string(), value);
-        }
-        unsafe {
-            let s: *const String = self.data.get(key).unwrap();
-            &*s
-        }
-    }
-
-    pub fn dangling_ref(&mut self) -> &str {
-        let s = String::from("temporary");
-        let ptr = s.as_str() as *const str;
-        drop(s);
-        unsafe { &*ptr }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: unsafe_block
+// severity: high
+// language: rust
+// expected: Use of unsafe to bypass borrow checker — potential use-after-free
+
+use std::collections::HashMap;
+
+pub struct Cache {
+    data: HashMap<String, String>,
+}
+
+impl Cache {
+    pub fn get_or_insert(&mut self, key: &str, value: String) -> &str {
+        if !self.data.contains_key(key) {
+            self.data.insert(key.to_string(), value);
+        }
+        unsafe {
+            let s: *const String = self.data.get(key).unwrap();
+            &*s
+        }
+    }
+
+    pub fn dangling_ref(&mut self) -> &str {
+        let s = String::from("temporary");
+        let ptr = s.as_str() as *const str;
+        drop(s);
+        unsafe { &*ptr }
+    }
+}

package/dist/packages/crucible/seeds/rust/seed-015 2.rs

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Send/Sync implemented for non-thread-safe type via unsafe impl
-
-use std::cell::Cell;
-use std::rc::Rc;
-
-pub struct SharedCounter {
-    value: Cell<i64>,
-    data: Rc<Vec<u8>>,
-}
-
-unsafe impl Send for SharedCounter {}
-unsafe impl Sync for SharedCounter {}
-
-impl SharedCounter {
-    pub fn new() -> Self {
-        SharedCounter {
-            value: Cell::new(0),
-            data: Rc::new(vec![]),
-        }
-    }
-
-    pub fn increment(&self) {
-        self.value.set(self.value.get() + 1);
-    }
-
-    pub fn get(&self) -> i64 {
-        self.value.get()
-    }
-}
+// [CRUCIBLE-SEED]
+// category: unsafe_block
+// severity: critical
+// language: rust
+// expected: Send/Sync implemented for non-thread-safe type via unsafe impl
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+pub struct SharedCounter {
+    value: Cell<i64>,
+    data: Rc<Vec<u8>>,
+}
+
+unsafe impl Send for SharedCounter {}
+unsafe impl Sync for SharedCounter {}
+
+impl SharedCounter {
+    pub fn new() -> Self {
+        SharedCounter {
+            value: Cell::new(0),
+            data: Rc::new(vec![]),
+        }
+    }
+
+    pub fn increment(&self) {
+        self.value.set(self.value.get() + 1);
+    }
+
+    pub fn get(&self) -> i64 {
+        self.value.get()
+    }
+}

package/dist/packages/crucible/seeds/rust/seed-015.rs

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: unsafe_block
-// severity: critical
-// language: rust
-// expected: Send/Sync implemented for non-thread-safe type via unsafe impl
-
-use std::cell::Cell;
-use std::rc::Rc;
-
-pub struct SharedCounter {
-    value: Cell<i64>,
-    data: Rc<Vec<u8>>,
-}
-
-unsafe impl Send for SharedCounter {}
-unsafe impl Sync for SharedCounter {}
-
-impl SharedCounter {
-    pub fn new() -> Self {
-        SharedCounter {
-            value: Cell::new(0),
-            data: Rc::new(vec![]),
-        }
-    }
-
-    pub fn increment(&self) {
-        self.value.set(self.value.get() + 1);
-    }
-
-    pub fn get(&self) -> i64 {
-        self.value.get()
-    }
-}
+// [CRUCIBLE-SEED]
+// category: unsafe_block
+// severity: critical
+// language: rust
+// expected: Send/Sync implemented for non-thread-safe type via unsafe impl
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+pub struct SharedCounter {
+    value: Cell<i64>,
+    data: Rc<Vec<u8>>,
+}
+
+unsafe impl Send for SharedCounter {}
+unsafe impl Sync for SharedCounter {}
+
+impl SharedCounter {
+    pub fn new() -> Self {
+        SharedCounter {
+            value: Cell::new(0),
+            data: Rc::new(vec![]),
+        }
+    }
+
+    pub fn increment(&self) {
+        self.value.set(self.value.get() + 1);
+    }
+
+    pub fn get(&self) -> i64 {
+        self.value.get()
+    }
+}

package/dist/packages/crucible/seeds/rust/seed-016 2.rs

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Command::new with user-controlled string passed to shell
-
-use std::process::Command;
-
-pub fn ping_host(host: &str) -> String {
-    let output = Command::new("sh")
-        .arg("-c")
-        .arg(format!("ping -c 4 {}", host))
-        .output()
-        .expect("Failed to execute ping");
-    String::from_utf8_lossy(&output.stdout).to_string()
-}
-
-pub fn lookup_dns(domain: &str) -> String {
-    let cmd = format!("nslookup {}", domain);
-    let output = Command::new("/bin/sh").arg("-c").arg(cmd).output().unwrap();
-    String::from_utf8_lossy(&output.stdout).to_string()
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Command::new with user-controlled string passed to shell
+
+use std::process::Command;
+
+pub fn ping_host(host: &str) -> String {
+    let output = Command::new("sh")
+        .arg("-c")
+        .arg(format!("ping -c 4 {}", host))
+        .output()
+        .expect("Failed to execute ping");
+    String::from_utf8_lossy(&output.stdout).to_string()
+}
+
+pub fn lookup_dns(domain: &str) -> String {
+    let cmd = format!("nslookup {}", domain);
+    let output = Command::new("/bin/sh").arg("-c").arg(cmd).output().unwrap();
+    String::from_utf8_lossy(&output.stdout).to_string()
+}

package/dist/packages/crucible/seeds/rust/seed-016.rs

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Command::new with user-controlled string passed to shell
-
-use std::process::Command;
-
-pub fn ping_host(host: &str) -> String {
-    let output = Command::new("sh")
-        .arg("-c")
-        .arg(format!("ping -c 4 {}", host))
-        .output()
-        .expect("Failed to execute ping");
-    String::from_utf8_lossy(&output.stdout).to_string()
-}
-
-pub fn lookup_dns(domain: &str) -> String {
-    let cmd = format!("nslookup {}", domain);
-    let output = Command::new("/bin/sh").arg("-c").arg(cmd).output().unwrap();
-    String::from_utf8_lossy(&output.stdout).to_string()
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Command::new with user-controlled string passed to shell
+
+use std::process::Command;
+
+pub fn ping_host(host: &str) -> String {
+    let output = Command::new("sh")
+        .arg("-c")
+        .arg(format!("ping -c 4 {}", host))
+        .output()
+        .expect("Failed to execute ping");
+    String::from_utf8_lossy(&output.stdout).to_string()
+}
+
+pub fn lookup_dns(domain: &str) -> String {
+    let cmd = format!("nslookup {}", domain);
+    let output = Command::new("/bin/sh").arg("-c").arg(cmd).output().unwrap();
+    String::from_utf8_lossy(&output.stdout).to_string()
+}

package/dist/packages/crucible/seeds/rust/seed-017 2.rs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: User input interpolated into shell command string passed to sh -c
-
-use std::process::Command;
-
-pub fn convert_image(input: &str, output: &str, width: &str, height: &str) -> bool {
-    let cmd = format!("convert {} -resize {}x{} {}", input, width, height, output);
-    Command::new("sh")
-        .arg("-c")
-        .arg(&cmd)
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false)
-}
-
-pub fn compress_file(path: &str, dest: &str) -> i32 {
-    let cmd = format!("gzip -c {} > {}", path, dest);
-    Command::new("bash")
-        .arg("-c")
-        .arg(cmd)
-        .status()
-        .unwrap()
-        .code()
-        .unwrap_or(-1)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: User input interpolated into shell command string passed to sh -c
+
+use std::process::Command;
+
+pub fn convert_image(input: &str, output: &str, width: &str, height: &str) -> bool {
+    let cmd = format!("convert {} -resize {}x{} {}", input, width, height, output);
+    Command::new("sh")
+        .arg("-c")
+        .arg(&cmd)
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+pub fn compress_file(path: &str, dest: &str) -> i32 {
+    let cmd = format!("gzip -c {} > {}", path, dest);
+    Command::new("bash")
+        .arg("-c")
+        .arg(cmd)
+        .status()
+        .unwrap()
+        .code()
+        .unwrap_or(-1)
+}

package/dist/packages/crucible/seeds/rust/seed-017.rs

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: User input interpolated into shell command string passed to sh -c
-
-use std::process::Command;
-
-pub fn convert_image(input: &str, output: &str, width: &str, height: &str) -> bool {
-    let cmd = format!("convert {} -resize {}x{} {}", input, width, height, output);
-    Command::new("sh")
-        .arg("-c")
-        .arg(&cmd)
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false)
-}
-
-pub fn compress_file(path: &str, dest: &str) -> i32 {
-    let cmd = format!("gzip -c {} > {}", path, dest);
-    Command::new("bash")
-        .arg("-c")
-        .arg(cmd)
-        .status()
-        .unwrap()
-        .code()
-        .unwrap_or(-1)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: User input interpolated into shell command string passed to sh -c
+
+use std::process::Command;
+
+pub fn convert_image(input: &str, output: &str, width: &str, height: &str) -> bool {
+    let cmd = format!("convert {} -resize {}x{} {}", input, width, height, output);
+    Command::new("sh")
+        .arg("-c")
+        .arg(&cmd)
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+pub fn compress_file(path: &str, dest: &str) -> i32 {
+    let cmd = format!("gzip -c {} > {}", path, dest);
+    Command::new("bash")
+        .arg("-c")
+        .arg(cmd)
+        .status()
+        .unwrap()
+        .code()
+        .unwrap_or(-1)
+}

package/dist/packages/crucible/seeds/rust/seed-018 2.rs

@@ -1,21 +1,21 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Actix-web handler passes query param to shell command
-
-use actix_web::{web, HttpResponse};
-use std::process::Command;
-
-pub async fn run_report(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
-    let report_type = query.get("type").map(|s| s.as_str()).unwrap_or("summary");
-    let date = query.get("date").unwrap_or(&String::new()).clone();
-    let cmd = format!("./scripts/generate_report.sh {} {}", report_type, date);
-    let output = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
-    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
-}
-
-pub async fn execute_tool(body: String) -> HttpResponse {
-    let output = Command::new("sh").arg("-c").arg(&body).output().unwrap();
-    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Actix-web handler passes query param to shell command
+
+use actix_web::{web, HttpResponse};
+use std::process::Command;
+
+pub async fn run_report(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
+    let report_type = query.get("type").map(|s| s.as_str()).unwrap_or("summary");
+    let date = query.get("date").unwrap_or(&String::new()).clone();
+    let cmd = format!("./scripts/generate_report.sh {} {}", report_type, date);
+    let output = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
+    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
+}
+
+pub async fn execute_tool(body: String) -> HttpResponse {
+    let output = Command::new("sh").arg("-c").arg(&body).output().unwrap();
+    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-018.rs

@@ -1,21 +1,21 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Actix-web handler passes query param to shell command
-
-use actix_web::{web, HttpResponse};
-use std::process::Command;
-
-pub async fn run_report(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
-    let report_type = query.get("type").map(|s| s.as_str()).unwrap_or("summary");
-    let date = query.get("date").unwrap_or(&String::new()).clone();
-    let cmd = format!("./scripts/generate_report.sh {} {}", report_type, date);
-    let output = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
-    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
-}
-
-pub async fn execute_tool(body: String) -> HttpResponse {
-    let output = Command::new("sh").arg("-c").arg(&body).output().unwrap();
-    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Actix-web handler passes query param to shell command
+
+use actix_web::{web, HttpResponse};
+use std::process::Command;
+
+pub async fn run_report(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
+    let report_type = query.get("type").map(|s| s.as_str()).unwrap_or("summary");
+    let date = query.get("date").unwrap_or(&String::new()).clone();
+    let cmd = format!("./scripts/generate_report.sh {} {}", report_type, date);
+    let output = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
+    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
+}
+
+pub async fn execute_tool(body: String) -> HttpResponse {
+    let output = Command::new("sh").arg("-c").arg(&body).output().unwrap();
+    HttpResponse::Ok().body(String::from_utf8_lossy(&output.stdout).to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-019 2.rs

@@ -1,36 +1,36 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Git command constructed with user-supplied repository URL
-
-use std::process::Command;
-
-pub fn clone_repo(url: &str, dest: &str) -> bool {
-    let output = Command::new("git")
-        .arg("clone")
-        .arg(url)
-        .arg(dest)
-        .output();
-
-    match output {
-        Ok(o) => o.status.success(),
-        Err(_) => false,
-    }
-}
-
-pub fn git_pull(repo_path: &str, branch: &str) -> String {
-    let cmd = format!("cd {} && git pull origin {}", repo_path, branch);
-    let out = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
-    String::from_utf8_lossy(&out.stdout).to_string()
-}
-
-pub fn run_git_hook(hook_name: &str, args: &str) -> i32 {
-    Command::new("sh")
-        .arg("-c")
-        .arg(format!(".git/hooks/{} {}", hook_name, args))
-        .status()
-        .unwrap()
-        .code()
-        .unwrap_or(-1)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Git command constructed with user-supplied repository URL
+
+use std::process::Command;
+
+pub fn clone_repo(url: &str, dest: &str) -> bool {
+    let output = Command::new("git")
+        .arg("clone")
+        .arg(url)
+        .arg(dest)
+        .output();
+
+    match output {
+        Ok(o) => o.status.success(),
+        Err(_) => false,
+    }
+}
+
+pub fn git_pull(repo_path: &str, branch: &str) -> String {
+    let cmd = format!("cd {} && git pull origin {}", repo_path, branch);
+    let out = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
+    String::from_utf8_lossy(&out.stdout).to_string()
+}
+
+pub fn run_git_hook(hook_name: &str, args: &str) -> i32 {
+    Command::new("sh")
+        .arg("-c")
+        .arg(format!(".git/hooks/{} {}", hook_name, args))
+        .status()
+        .unwrap()
+        .code()
+        .unwrap_or(-1)
+}

package/dist/packages/crucible/seeds/rust/seed-019.rs

@@ -1,36 +1,36 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: rust
-// expected: Git command constructed with user-supplied repository URL
-
-use std::process::Command;
-
-pub fn clone_repo(url: &str, dest: &str) -> bool {
-    let output = Command::new("git")
-        .arg("clone")
-        .arg(url)
-        .arg(dest)
-        .output();
-
-    match output {
-        Ok(o) => o.status.success(),
-        Err(_) => false,
-    }
-}
-
-pub fn git_pull(repo_path: &str, branch: &str) -> String {
-    let cmd = format!("cd {} && git pull origin {}", repo_path, branch);
-    let out = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
-    String::from_utf8_lossy(&out.stdout).to_string()
-}
-
-pub fn run_git_hook(hook_name: &str, args: &str) -> i32 {
-    Command::new("sh")
-        .arg("-c")
-        .arg(format!(".git/hooks/{} {}", hook_name, args))
-        .status()
-        .unwrap()
-        .code()
-        .unwrap_or(-1)
-}
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: rust
+// expected: Git command constructed with user-supplied repository URL
+
+use std::process::Command;
+
+pub fn clone_repo(url: &str, dest: &str) -> bool {
+    let output = Command::new("git")
+        .arg("clone")
+        .arg(url)
+        .arg(dest)
+        .output();
+
+    match output {
+        Ok(o) => o.status.success(),
+        Err(_) => false,
+    }
+}
+
+pub fn git_pull(repo_path: &str, branch: &str) -> String {
+    let cmd = format!("cd {} && git pull origin {}", repo_path, branch);
+    let out = Command::new("sh").arg("-c").arg(cmd).output().unwrap();
+    String::from_utf8_lossy(&out.stdout).to_string()
+}
+
+pub fn run_git_hook(hook_name: &str, args: &str) -> i32 {
+    Command::new("sh")
+        .arg("-c")
+        .arg(format!(".git/hooks/{} {}", hook_name, args))
+        .status()
+        .unwrap()
+        .code()
+        .unwrap_or(-1)
+}