thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/seeds/ts/seed-037.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: medium
-// language: typescript
-// expected: timing attack via string comparison of HMAC signatures
-
-import * as crypto from 'crypto';
-
-const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
-
-export function computeSignature(payload: string): string {
-  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
-}
-
-export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
-  const expectedSig = computeSignature(payload);
-  // Timing attack: early exit on first mismatch leaks signature length/prefix
-  return expectedSig === receivedSig;
-}
-
-export function verifyApiKey(providedKey: string, storedKey: string): boolean {
-  // Direct string comparison — vulnerable to timing oracle attack
-  return providedKey === storedKey;
-}
-
-export function checkTokenMatch(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  // Character-by-character comparison — timing side-channel
-  for (let i = 0; i < a.length; i++) {
-    if (a[i] !== b[i]) return false;
-  }
-  return true;
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: typescript
+// expected: timing attack via string comparison of HMAC signatures
+
+import * as crypto from 'crypto';
+
+const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
+
+export function computeSignature(payload: string): string {
+  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
+}
+
+export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
+  const expectedSig = computeSignature(payload);
+  // Timing attack: early exit on first mismatch leaks signature length/prefix
+  return expectedSig === receivedSig;
+}
+
+export function verifyApiKey(providedKey: string, storedKey: string): boolean {
+  // Direct string comparison — vulnerable to timing oracle attack
+  return providedKey === storedKey;
+}
+
+export function checkTokenMatch(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  // Character-by-character comparison — timing side-channel
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}

package/dist/packages/crucible/seeds/ts/seed-038 2.ts

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-
-import * as crypto from 'crypto';
-
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-038.ts

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: typescript
-// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
-
-import * as crypto from 'crypto';
-
-interface DerivedKey {
-  key: Buffer;
-  salt: string;
-}
-
-export function deriveEncryptionKey(password: string): DerivedKey {
-  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
-  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
-  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
-  return { key, salt };
-}
-
-export function checksumFile(data: Buffer): string {
-  // MD5 is collision-prone — not suitable for integrity checks
-  return crypto.createHash('md5').update(data).digest('hex');
-}
-
-export function fingerprintUser(userId: string, email: string): string {
-  // SHA1 fingerprint — deprecated for new security applications
-  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
-}
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-039 2.ts

@@ -1,35 +1,35 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-
-interface DeepObject {
-  [key: string]: unknown;
-}
-
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-
-import { Request, Response, Router } from 'express';
-const router = Router();
-
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-039.ts

@@ -1,35 +1,35 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via typed recursive merge accepting user object
-
-interface DeepObject {
-  [key: string]: unknown;
-}
-
-function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
-  for (const key of Object.keys(source)) {
-    const srcVal = source[key];
-    // TypeScript types don't prevent __proto__ key at runtime
-    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
-      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
-      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
-    } else {
-      (target as DeepObject)[key] = srcVal;
-    }
-  }
-  return target;
-}
-
-import { Request, Response, Router } from 'express';
-const router = Router();
-
-router.post('/settings', (req: Request, res: Response) => {
-  const defaults = { theme: 'light', language: 'en', notifications: true };
-  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
-  const merged = deepMerge(defaults, req.body as DeepObject);
-  res.json({ settings: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-040 2.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via bracket-notation assignment with user-controlled key path
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
-  const parts = keyPath.split('.');
-  let cursor: Record<string, unknown> = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    // Allows "__proto__" or "constructor" as path segment
-    if (typeof cursor[part] !== 'object') cursor[part] = {};
-    cursor = cursor[part] as Record<string, unknown>;
-  }
-  cursor[parts[parts.length - 1]] = value;
-}
-
-router.patch('/user/preference', (req: Request, res: Response) => {
-  const { key, value } = req.body as { key: string; value: unknown };
-  const userPrefs: Record<string, unknown> = {};
-  // key = "__proto__.admin" → Object.prototype.admin = value
-  setProperty(userPrefs, key, value);
-  res.json({ updated: true });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via bracket-notation assignment with user-controlled key path
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
+  const parts = keyPath.split('.');
+  let cursor: Record<string, unknown> = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    // Allows "__proto__" or "constructor" as path segment
+    if (typeof cursor[part] !== 'object') cursor[part] = {};
+    cursor = cursor[part] as Record<string, unknown>;
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+router.patch('/user/preference', (req: Request, res: Response) => {
+  const { key, value } = req.body as { key: string; value: unknown };
+  const userPrefs: Record<string, unknown> = {};
+  // key = "__proto__.admin" → Object.prototype.admin = value
+  setProperty(userPrefs, key, value);
+  res.json({ updated: true });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-040.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via bracket-notation assignment with user-controlled key path
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
-  const parts = keyPath.split('.');
-  let cursor: Record<string, unknown> = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    // Allows "__proto__" or "constructor" as path segment
-    if (typeof cursor[part] !== 'object') cursor[part] = {};
-    cursor = cursor[part] as Record<string, unknown>;
-  }
-  cursor[parts[parts.length - 1]] = value;
-}
-
-router.patch('/user/preference', (req: Request, res: Response) => {
-  const { key, value } = req.body as { key: string; value: unknown };
-  const userPrefs: Record<string, unknown> = {};
-  // key = "__proto__.admin" → Object.prototype.admin = value
-  setProperty(userPrefs, key, value);
-  res.json({ updated: true });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via bracket-notation assignment with user-controlled key path
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
+  const parts = keyPath.split('.');
+  let cursor: Record<string, unknown> = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    // Allows "__proto__" or "constructor" as path segment
+    if (typeof cursor[part] !== 'object') cursor[part] = {};
+    cursor = cursor[part] as Record<string, unknown>;
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+router.patch('/user/preference', (req: Request, res: Response) => {
+  const { key, value } = req.body as { key: string; value: unknown };
+  const userPrefs: Record<string, unknown> = {};
+  // key = "__proto__.admin" → Object.prototype.admin = value
+  setProperty(userPrefs, key, value);
+  res.json({ updated: true });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-041 2.ts

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const globalAppConfig: Record<string, unknown> = {};
-
-router.post('/admin/config/set', (req: Request, res: Response) => {
-  const { path, value } = req.body as { path: string; value: unknown };
-  // _.set with user-controlled path — vulnerable to prototype pollution
-  // e.g. path = "__proto__.isAdmin", value = true
-  _.set(globalAppConfig, path, value);
-  res.json({ ok: true });
-});
-
-router.post('/ui/theme', (req: Request, res: Response) => {
-  const userTheme = req.body as Record<string, unknown>;
-  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
-  // _.merge pollutes prototype when userTheme contains __proto__
-  const merged = _.merge({}, defaultTheme, userTheme);
-  res.json({ theme: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const globalAppConfig: Record<string, unknown> = {};
+
+router.post('/admin/config/set', (req: Request, res: Response) => {
+  const { path, value } = req.body as { path: string; value: unknown };
+  // _.set with user-controlled path — vulnerable to prototype pollution
+  // e.g. path = "__proto__.isAdmin", value = true
+  _.set(globalAppConfig, path, value);
+  res.json({ ok: true });
+});
+
+router.post('/ui/theme', (req: Request, res: Response) => {
+  const userTheme = req.body as Record<string, unknown>;
+  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
+  // _.merge pollutes prototype when userTheme contains __proto__
+  const merged = _.merge({}, defaultTheme, userTheme);
+  res.json({ theme: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-041.ts

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: high
-// language: typescript
-// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
-
-import _ from 'lodash';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const globalAppConfig: Record<string, unknown> = {};
-
-router.post('/admin/config/set', (req: Request, res: Response) => {
-  const { path, value } = req.body as { path: string; value: unknown };
-  // _.set with user-controlled path — vulnerable to prototype pollution
-  // e.g. path = "__proto__.isAdmin", value = true
-  _.set(globalAppConfig, path, value);
-  res.json({ ok: true });
-});
-
-router.post('/ui/theme', (req: Request, res: Response) => {
-  const userTheme = req.body as Record<string, unknown>;
-  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
-  // _.merge pollutes prototype when userTheme contains __proto__
-  const merged = _.merge({}, defaultTheme, userTheme);
-  res.json({ theme: merged });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const globalAppConfig: Record<string, unknown> = {};
+
+router.post('/admin/config/set', (req: Request, res: Response) => {
+  const { path, value } = req.body as { path: string; value: unknown };
+  // _.set with user-controlled path — vulnerable to prototype pollution
+  // e.g. path = "__proto__.isAdmin", value = true
+  _.set(globalAppConfig, path, value);
+  res.json({ ok: true });
+});
+
+router.post('/ui/theme', (req: Request, res: Response) => {
+  const userTheme = req.body as Record<string, unknown>;
+  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
+  // _.merge pollutes prototype when userTheme contains __proto__
+  const merged = _.merge({}, defaultTheme, userTheme);
+  res.json({ theme: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-042 2.ts

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: prototype_pollution
-// severity: medium
-// language: typescript
-// expected: prototype pollution via constructor.prototype path in Object.assign chain
-
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface PluginConfig {
-  [key: string]: unknown;
-}
-
-function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
-  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
-  return Object.assign({}, baseOptions, userOptions);
-}
-
-router.post('/plugins/:id/configure', (req: Request, res: Response) => {
-  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
-  // req.body passed directly — {"__proto__": {"polluted": true}}
-  const config = applyPluginOptions(base, req.body as PluginConfig);
-  res.json({ configured: true, config });
-});
-
-router.patch('/plugins/:id/update', (req: Request, res: Response) => {
-  // Spread operator with user body — same pollution vector
-  const updated = { ...{}, ...req.body };
-  res.json({ updated });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: typescript
+// expected: prototype pollution via constructor.prototype path in Object.assign chain
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface PluginConfig {
+  [key: string]: unknown;
+}
+
+function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
+  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
+  return Object.assign({}, baseOptions, userOptions);
+}
+
+router.post('/plugins/:id/configure', (req: Request, res: Response) => {
+  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
+  // req.body passed directly — {"__proto__": {"polluted": true}}
+  const config = applyPluginOptions(base, req.body as PluginConfig);
+  res.json({ configured: true, config });
+});
+
+router.patch('/plugins/:id/update', (req: Request, res: Response) => {
+  // Spread operator with user body — same pollution vector
+  const updated = { ...{}, ...req.body };
+  res.json({ updated });
+});
+
+export default router;