thuban 0.4.9 → 0.4.11

package/dist/packages/crucible/seeds/go/seed-037.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
+
+package security
+
+import (
+	"crypto/cipher"
+	"crypto/des"
+)
+
+var desKey = []byte("8byteKey") // Vulnerable: DES key is only 56 bits
+
+func EncryptDES(plaintext []byte) ([]byte, error) {
+	// Vulnerable: DES is broken — brute-forceable since 1999
+	block, err := des.NewCipher(desKey)
+	if err != nil {
+		return nil, err
+	}
+	ciphertext := make([]byte, len(plaintext))
+	iv := desKey // Vulnerable: IV reused from key bytes
+	mode := cipher.NewCBCEncryptor(block, iv)
+	mode.CryptBlocks(ciphertext, plaintext)
+	return ciphertext, nil
+}

package/dist/packages/crucible/seeds/go/seed-038.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: Hardcoded AES key with ECB-like block-by-block encryption lacking proper IV
+
+package security
+
+import (
+	"crypto/aes"
+)
+
+// Vulnerable: hardcoded key and manual block-level encryption without IV (ECB-equivalent)
+var aesKey = []byte("1234567890abcdef")
+
+func EncryptBlock(plaintext []byte) ([]byte, error) {
+	block, err := aes.NewCipher(aesKey)
+	if err != nil {
+		return nil, err
+	}
+	// Vulnerable: encrypting single blocks without chaining — identical blocks = identical ciphertext
+	ciphertext := make([]byte, len(plaintext))
+	for i := 0; i < len(plaintext); i += aes.BlockSize {
+		block.Encrypt(ciphertext[i:i+aes.BlockSize], plaintext[i:i+aes.BlockSize])
+	}
+	return ciphertext, nil
+}

package/dist/packages/crucible/seeds/go/seed-039.go

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get fetching user-supplied image URL for thumbnail generation
+
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func ThumbnailHandler(w http.ResponseWriter, r *http.Request) {
+	imageURL := r.URL.Query().Get("image_url")
+	// Vulnerable: server fetches from any URL; internal AWS metadata or Kubernetes API reachable
+	resp, err := http.Get(imageURL)
+	if err != nil {
+		http.Error(w, "Failed to fetch image", 502)
+		return
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+	fmt.Fprintf(w, "Fetched %d bytes from %s", len(data), imageURL)
+}

package/dist/packages/crucible/seeds/go/seed-040.go

@@ -0,0 +1,37 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: go
+// expected: Path traversal via os.Stat and os.ReadFile with user-controlled archive entry path
+
+package handlers
+
+import (
+	"archive/zip"
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+const extractBase = "/var/extracted/"
+
+func ZipExtractHandler(w http.ResponseWriter, r *http.Request) {
+	zipPath := r.URL.Query().Get("zip")
+	zr, err := zip.OpenReader(zipPath)
+	if err != nil {
+		http.Error(w, "Cannot open zip", 400)
+		return
+	}
+	defer zr.Close()
+	for _, f := range zr.File {
+		// Vulnerable: f.Name can contain ../ sequences escaping extractBase
+		target := filepath.Join(extractBase, f.Name)
+		os.MkdirAll(filepath.Dir(target), 0755)
+		out, _ := os.Create(target)
+		rc, _  := f.Open()
+		out.ReadFrom(rc)
+		rc.Close()
+		out.Close()
+	}
+	http.Redirect(w, r, "/files", http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-041.go

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: go
+// expected: Weak RSA key size (1024-bit) used for certificate generation
+
+package security
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+)
+
+// Vulnerable: 1024-bit RSA is considered broken; minimum is 2048-bit
+func GenerateWeakRSAKey() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(rand.Reader, 1024)
+}
+
+// Vulnerable: also using a fixed exponent of 3 is dangerous in some contexts
+func GenerateVeryWeakRSAKey() (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 512)
+	return key, err
+}

package/dist/packages/crucible/seeds/go/seed-042.go

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect using user-supplied return URL after password reset
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func PasswordResetConfirmHandler(w http.ResponseWriter, r *http.Request) {
+	token     := r.URL.Query().Get("token")
+	returnURL := r.URL.Query().Get("return")
+
+	if !validateResetToken(token) {
+		http.Error(w, "Invalid token", 400)
+		return
+	}
+
+	// Process password reset...
+
+	// Vulnerable: returnURL not validated — open redirect to external site
+	if returnURL != "" {
+		http.Redirect(w, r, returnURL, http.StatusFound)
+	} else {
+		http.Redirect(w, r, "/login?reset=success", http.StatusFound)
+	}
+}
+
+func validateResetToken(t string) bool { return len(t) == 32 }

package/dist/packages/crucible/seeds/go/seed-043.go

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via string comparison of CSRF tokens using == operator
+
+package middleware
+
+import (
+	"net/http"
+)
+
+func CSRFMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "POST" || r.Method == "PUT" || r.Method == "DELETE" {
+			sessionToken := getSessionCSRFToken(r)
+			formToken    := r.FormValue("csrf_token")
+
+			// Vulnerable: == comparison is not constant-time; leaks token via timing
+			if sessionToken != formToken {
+				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
+				return
+			}
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func getSessionCSRFToken(r *http.Request) string {
+	c, err := r.Cookie("csrf_token")
+	if err != nil {
+		return ""
+	}
+	return c.Value
+}

package/dist/packages/crucible/seeds/go/seed-044.go

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get with user-supplied URL parameter
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+)
+
+func ProxyHandler(w http.ResponseWriter, r *http.Request) {
+	targetURL := r.URL.Query().Get("url")
+	// Vulnerable: fetches arbitrary URL including internal services (e.g. http://169.254.169.254)
+	resp, err := http.Get(targetURL)
+	if err != nil {
+		http.Error(w, "Fetch failed", 500)
+		return
+	}
+	defer resp.Body.Close()
+	w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
+	io.Copy(w, resp.Body)
+}

package/dist/packages/crucible/seeds/go/seed-045.go

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Post with user-controlled webhook URL
+
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+func WebhookTestHandler(w http.ResponseWriter, r *http.Request) {
+	webhookURL := r.URL.Query().Get("webhook_url")
+	payload    := r.URL.Query().Get("payload")
+	// Vulnerable: server POSTs to attacker-controlled URL
+	resp, err := http.Post(webhookURL, "application/json", strings.NewReader(payload))
+	if err != nil {
+		http.Error(w, "Webhook error: "+err.Error(), 500)
+		return
+	}
+	defer resp.Body.Close()
+	fmt.Fprintf(w, "Webhook responded: %d", resp.StatusCode)
+}

package/dist/packages/crucible/seeds/go/seed-046.go

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.NewRequest with user-controlled base URL for metadata fetch
+
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func MetadataFetchHandler(w http.ResponseWriter, r *http.Request) {
+	endpoint := r.URL.Query().Get("endpoint")
+	// Vulnerable: attacker can supply http://169.254.169.254/latest/meta-data/
+	req, err := http.NewRequest("GET", endpoint, nil)
+	if err != nil {
+		http.Error(w, "Invalid URL", 400)
+		return
+	}
+	req.Header.Set("User-Agent", "MetadataFetcher/1.0")
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		http.Error(w, "Request failed", 500)
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	w.Header().Set("Content-Type", "text/plain")
+	fmt.Fprintf(w, "%s", body)
+}

package/dist/packages/crucible/seeds/go/seed-047.go

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: go
+// expected: SSRF via http.Get with user-supplied avatar URL for image fetching
+
+package handlers
+
+import (
+	"io"
+	"net/http"
+)
+
+func AvatarProxyHandler(w http.ResponseWriter, r *http.Request) {
+	avatarURL := r.URL.Query().Get("avatar_url")
+	// Vulnerable: server fetches image from any URL; can reach internal services
+	resp, err := http.Get(avatarURL)
+	if err != nil {
+		http.Error(w, "Could not fetch avatar", 502)
+		return
+	}
+	defer resp.Body.Close()
+	contentType := resp.Header.Get("Content-Type")
+	w.Header().Set("Content-Type", contentType)
+	io.Copy(w, resp.Body)
+}

package/dist/packages/crucible/seeds/go/seed-048.go

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect with unvalidated user-controlled URL
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func LoginHandler(w http.ResponseWriter, r *http.Request) {
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+	next     := r.URL.Query().Get("next")
+
+	if authenticate(username, password) {
+		// Vulnerable: 'next' not validated; can redirect to https://evil.com
+		if next == "" {
+			next = "/dashboard"
+		}
+		http.Redirect(w, r, next, http.StatusFound)
+	} else {
+		http.Redirect(w, r, "/login?error=1", http.StatusFound)
+	}
+}
+
+func authenticate(u, p string) bool { return u != "" && p != "" }

package/dist/packages/crucible/seeds/go/seed-049.go

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect using Base64-decoded state parameter
+
+package handlers
+
+import (
+	"encoding/base64"
+	"net/http"
+)
+
+func OAuthCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	state := r.URL.Query().Get("state")
+	// Vulnerable: state decoded and used as redirect target without validation
+	destination, err := base64.StdEncoding.DecodeString(state)
+	if err != nil {
+		http.Error(w, "Invalid state", 400)
+		return
+	}
+	// Exchange code for token... (omitted)
+	http.Redirect(w, r, string(destination), http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-050.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: open_redirect
+// severity: medium
+// language: go
+// expected: Open redirect via http.Redirect with Referer header used as redirect destination
+
+package handlers
+
+import (
+	"net/http"
+)
+
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	// Clear session cookie
+	http.SetCookie(w, &http.Cookie{Name: "session", MaxAge: -1})
+
+	returnURL := r.URL.Query().Get("return_url")
+	if returnURL == "" {
+		// Vulnerable: fallback to Referer header — fully attacker-controlled
+		returnURL = r.Header.Get("Referer")
+	}
+	if returnURL == "" {
+		returnURL = "/"
+	}
+	// Vulnerable: redirects to any URL including external sites
+	http.Redirect(w, r, returnURL, http.StatusFound)
+}

package/dist/packages/crucible/seeds/go/seed-051.go

@@ -0,0 +1,38 @@
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via string equality comparison of API tokens instead of hmac.Equal
+
+package handlers
+
+import (
+	"net/http"
+)
+
+const validAPIToken = "prod-api-token-xK9mP2qRwZ4vBn7"
+
+func APIAuthMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := r.Header.Get("X-API-Token")
+		// Vulnerable: == comparison leaks timing information about token correctness
+		if token != validAPIToken {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func verifySignature(expected, actual string) bool {
+	// Also vulnerable: early-exit string comparison
+	if len(expected) != len(actual) {
+		return false
+	}
+	for i := range expected {
+		if expected[i] != actual[i] {
+			return false
+		}
+	}
+	return true
+}

package/dist/packages/crucible/seeds/go/seed-052.go

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: timing_attack
+// severity: medium
+// language: go
+// expected: Timing attack via bytes.Equal comparison of HMAC values instead of hmac.Equal
+
+package security
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+)
+
+func ValidateWebhookSignature(payload []byte, receivedSig, secret string) bool {
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(payload)
+	expected := mac.Sum(nil)
+	received := []byte(receivedSig)
+	// Vulnerable: bytes.Equal is not constant-time — use hmac.Equal instead
+	return bytes.Equal(expected, received)
+}
+
+func ValidatePasswordHash(storedHash, inputHash string) bool {
+	// Vulnerable: direct string comparison leaks timing information
+	return storedHash == inputHash
+}

package/dist/packages/crucible/seeds/java/seed-001.java

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded database password in constant
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+
+public class DatabaseConfig {
+    private static final String DB_URL      = "jdbc:mysql://prod-db.internal:3306/appdb";
+    private static final String DB_USER     = "app_user";
+    private static final String DB_PASSWORD = "Sup3rS3cr3tP@ssw0rd!";
+
+    public static Connection getConnection() throws Exception {
+        return DriverManager.getConnection(DB_URL, DB_USER, DB_PASSWORD);
+    }
+
+    public static void main(String[] args) throws Exception {
+        Connection conn = getConnection();
+        System.out.println("Connected: " + conn.getMetaData().getURL());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-002.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded AWS access key and secret key in source code
+
+public class AwsClientFactory {
+    private static final String AWS_ACCESS_KEY_ID     = "AKIAIOSFODNN7EXAMPLE";
+    private static final String AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+    private static final String AWS_REGION            = "us-east-1";
+
+    public static software.amazon.awssdk.services.s3.S3Client buildS3Client() {
+        software.amazon.awssdk.auth.credentials.AwsBasicCredentials creds =
+            software.amazon.awssdk.auth.credentials.AwsBasicCredentials.create(
+                AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY);
+        return software.amazon.awssdk.services.s3.S3Client.builder()
+            .credentialsProvider(
+                software.amazon.awssdk.auth.credentials.StaticCredentialsProvider.create(creds))
+            .region(software.amazon.awssdk.regions.Region.of(AWS_REGION))
+            .build();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-003.java

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded JWT signing secret embedded in source
+
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import java.util.Date;
+
+public class JwtService {
+    // TODO: move to environment variable before deploy
+    private static final String SECRET = "my-super-secret-jwt-key-do-not-share-12345";
+
+    public String generateToken(String subject) {
+        return Jwts.builder()
+            .setSubject(subject)
+            .setIssuedAt(new Date())
+            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
+            .signWith(SignatureAlgorithm.HS256, SECRET)
+            .compact();
+    }
+
+    public boolean validateToken(String token) {
+        Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token);
+        return true;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-004.java

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: java
+// expected: Hardcoded Stripe API key in application constant
+
+import com.stripe.Stripe;
+import com.stripe.model.Charge;
+import java.util.HashMap;
+import java.util.Map;
+
+public class PaymentService {
+    private static final String STRIPE_SECRET_KEY = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
+
+    static {
+        Stripe.apiKey = STRIPE_SECRET_KEY;
+    }
+
+    public Charge chargeCard(String token, long amountCents) throws Exception {
+        Map<String, Object> params = new HashMap<>();
+        params.put("amount", amountCents);
+        params.put("currency", "usd");
+        params.put("source", token);
+        return Charge.create(params);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-005.java

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded SMTP password used for email authentication
+
+import java.util.Properties;
+import javax.mail.*;
+import javax.mail.internet.*;
+
+public class EmailNotifier {
+    private static final String SMTP_HOST     = "smtp.company.com";
+    private static final String SMTP_USER     = "notifications@company.com";
+    private static final String SMTP_PASSWORD = "N0tif!c@ti0nP@ss#2024";
+
+    public void sendAlert(String to, String subject, String body) throws MessagingException {
+        Properties props = new Properties();
+        props.put("mail.smtp.auth", "true");
+        props.put("mail.smtp.host", SMTP_HOST);
+        props.put("mail.smtp.port", "587");
+
+        Session session = Session.getInstance(props, new Authenticator() {
+            protected PasswordAuthentication getPasswordAuthentication() {
+                return new PasswordAuthentication(SMTP_USER, SMTP_PASSWORD);
+            }
+        });
+        Message msg = new MimeMessage(session);
+        msg.setRecipients(Message.RecipientType.TO, InternetAddress.parse(to));
+        msg.setSubject(subject);
+        msg.setText(body);
+        Transport.send(msg);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-006.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: java
+// expected: Hardcoded GitHub personal access token in repository client
+
+import java.net.HttpURLConnection;
+import java.net.URL;
+
+public class GitHubClient {
+    private static final String GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345";
+    private static final String API_BASE     = "https://api.github.com";
+
+    public String getRepository(String owner, String repo) throws Exception {
+        URL url = new URL(API_BASE + "/repos/" + owner + "/" + repo);
+        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+        conn.setRequestProperty("Authorization", "token " + GITHUB_TOKEN);
+        conn.setRequestProperty("Accept", "application/vnd.github.v3+json");
+        int status = conn.getResponseCode();
+        return "Status: " + status;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-007.java

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: java
+// expected: Hardcoded Redis password and encryption key in configuration class
+
+public class CacheConfig {
+    public static final String REDIS_HOST       = "redis.internal.prod";
+    public static final int    REDIS_PORT       = 6379;
+    public static final String REDIS_PASSWORD   = "RedisP@$$w0rd#Prod";
+    public static final String ENCRYPTION_KEY   = "AES256KeyForCacheEncryption9876!";
+    public static final String ENCRYPTION_SALT  = "SaltVal!2024";
+
+    public static String getRedisUri() {
+        return String.format("redis://:%s@%s:%d", REDIS_PASSWORD, REDIS_HOST, REDIS_PORT);
+    }
+
+    public static byte[] getEncryptionKeyBytes() {
+        return ENCRYPTION_KEY.getBytes();
+    }
+}