thuban 0.4.9 → 0.4.11

package/dist/packages/crucible/seeds/rust/seed-026 2.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: rust
+// expected: File write to user-controlled path without restricting to base directory
+
+use std::fs;
+
+pub fn write_report(report_name: &str, content: &str) -> Result<(), std::io::Error> {
+    let path = format!("/var/reports/{}", report_name);
+    fs::write(&path, content)?;
+    Ok(())
+}
+
+pub fn save_template(template_id: &str, subdir: &str, data: &[u8]) -> bool {
+    let full_path = format!("/app/templates/{}/{}.tmpl", subdir, template_id);
+    fs::write(&full_path, data).is_ok()
+}
+
+pub fn cache_response(cache_key: &str, data: &str) -> bool {
+    let path = format!("/tmp/cache/{}", cache_key);
+    fs::write(path, data).is_ok()
+}

package/dist/packages/crucible/seeds/rust/seed-026.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: rust
+// expected: File write to user-controlled path without restricting to base directory
+
+use std::fs;
+
+pub fn write_report(report_name: &str, content: &str) -> Result<(), std::io::Error> {
+    let path = format!("/var/reports/{}", report_name);
+    fs::write(&path, content)?;
+    Ok(())
+}
+
+pub fn save_template(template_id: &str, subdir: &str, data: &[u8]) -> bool {
+    let full_path = format!("/app/templates/{}/{}.tmpl", subdir, template_id);
+    fs::write(&full_path, data).is_ok()
+}
+
+pub fn cache_response(cache_key: &str, data: &str) -> bool {
+    let path = format!("/tmp/cache/{}", cache_key);
+    fs::write(path, data).is_ok()
+}

package/dist/packages/crucible/seeds/rust/seed-027 2.rs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: rust
+// expected: Config file loaded from user-controlled path — arbitrary file read
+
+use std::fs;
+use serde_json::Value;
+
+pub fn load_config(config_name: &str) -> Value {
+    let path = format!("/etc/app/configs/{}", config_name);
+    let content = fs::read_to_string(&path).unwrap_or_else(|_| "{}".to_string());
+    serde_json::from_str(&content).unwrap_or(Value::Null)
+}
+
+pub fn load_plugin_manifest(plugin_id: &str) -> String {
+    let manifest_path = format!("./plugins/{}/manifest.json", plugin_id);
+    fs::read_to_string(manifest_path).unwrap_or_default()
+}
+
+pub fn read_user_template(user_id: &str, template_name: &str) -> String {
+    let path = format!("/data/users/{}/templates/{}", user_id, template_name);
+    fs::read_to_string(path).unwrap_or_default()
+}

package/dist/packages/crucible/seeds/rust/seed-027.rs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: rust
+// expected: Config file loaded from user-controlled path — arbitrary file read
+
+use std::fs;
+use serde_json::Value;
+
+pub fn load_config(config_name: &str) -> Value {
+    let path = format!("/etc/app/configs/{}", config_name);
+    let content = fs::read_to_string(&path).unwrap_or_else(|_| "{}".to_string());
+    serde_json::from_str(&content).unwrap_or(Value::Null)
+}
+
+pub fn load_plugin_manifest(plugin_id: &str) -> String {
+    let manifest_path = format!("./plugins/{}/manifest.json", plugin_id);
+    fs::read_to_string(manifest_path).unwrap_or_default()
+}
+
+pub fn read_user_template(user_id: &str, template_name: &str) -> String {
+    let path = format!("/data/users/{}/templates/{}", user_id, template_name);
+    fs::read_to_string(path).unwrap_or_default()
+}

package/dist/packages/crucible/seeds/rust/seed-028 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: rust
+// expected: Directory listing served from user-controlled subdirectory
+
+use std::fs;
+
+pub fn list_directory(base: &str, subdir: &str) -> Vec<String> {
+    let path = format!("{}/{}", base, subdir);
+    match fs::read_dir(&path) {
+        Ok(entries) => entries
+            .filter_map(|e| e.ok())
+            .map(|e| e.file_name().to_string_lossy().to_string())
+            .collect(),
+        Err(_) => vec![],
+    }
+}
+
+pub fn serve_directory(root: &str, user_path: &str) -> String {
+    let full = format!("{}/{}", root, user_path);
+    fs::read_dir(&full)
+        .map(|rd| rd.count().to_string())
+        .unwrap_or_else(|e| e.to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-028.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: rust
+// expected: Directory listing served from user-controlled subdirectory
+
+use std::fs;
+
+pub fn list_directory(base: &str, subdir: &str) -> Vec<String> {
+    let path = format!("{}/{}", base, subdir);
+    match fs::read_dir(&path) {
+        Ok(entries) => entries
+            .filter_map(|e| e.ok())
+            .map(|e| e.file_name().to_string_lossy().to_string())
+            .collect(),
+        Err(_) => vec![],
+    }
+}
+
+pub fn serve_directory(root: &str, user_path: &str) -> String {
+    let full = format!("{}/{}", root, user_path);
+    fs::read_dir(&full)
+        .map(|rd| rd.count().to_string())
+        .unwrap_or_else(|e| e.to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-029 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Explicit unchecked arithmetic that wraps on overflow in release mode
+
+pub fn calculate_offset(index: usize, stride: usize) -> usize {
+    index * stride
+}
+
+pub fn buffer_size(width: u32, height: u32, channels: u32) -> u32 {
+    width * height * channels
+}
+
+pub fn total_price(unit_price: u32, quantity: u32) -> u32 {
+    unit_price * quantity
+}
+
+pub fn encode_coords(x: i32, y: i32) -> i64 {
+    (x as i64) * 100000 + (y as i64)
+}
+
+pub fn as_usize_unchecked(n: i64) -> usize {
+    n as usize
+}

package/dist/packages/crucible/seeds/rust/seed-029.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Explicit unchecked arithmetic that wraps on overflow in release mode
+
+pub fn calculate_offset(index: usize, stride: usize) -> usize {
+    index * stride
+}
+
+pub fn buffer_size(width: u32, height: u32, channels: u32) -> u32 {
+    width * height * channels
+}
+
+pub fn total_price(unit_price: u32, quantity: u32) -> u32 {
+    unit_price * quantity
+}
+
+pub fn encode_coords(x: i32, y: i32) -> i64 {
+    (x as i64) * 100000 + (y as i64)
+}
+
+pub fn as_usize_unchecked(n: i64) -> usize {
+    n as usize
+}

package/dist/packages/crucible/seeds/rust/seed-030 2.rs

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Cast truncation — u64 to u32/u16/u8 silently drops high bits
+
+pub fn truncate_to_u8(val: u64) -> u8 {
+    val as u8
+}
+
+pub fn truncate_to_u16(val: u64) -> u16 {
+    val as u16
+}
+
+pub fn index_from_user_input(input: i64) -> usize {
+    input as usize
+}
+
+pub fn packet_len_from_i32(len: i32) -> usize {
+    len as usize
+}
+
+pub fn compress_timestamp(ts: u64) -> u32 {
+    ts as u32
+}
+
+pub fn negate_unsigned(n: u32) -> u32 {
+    let signed = n as i32;
+    (-signed) as u32
+}

package/dist/packages/crucible/seeds/rust/seed-030.rs

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Cast truncation — u64 to u32/u16/u8 silently drops high bits
+
+pub fn truncate_to_u8(val: u64) -> u8 {
+    val as u8
+}
+
+pub fn truncate_to_u16(val: u64) -> u16 {
+    val as u16
+}
+
+pub fn index_from_user_input(input: i64) -> usize {
+    input as usize
+}
+
+pub fn packet_len_from_i32(len: i32) -> usize {
+    len as usize
+}
+
+pub fn compress_timestamp(ts: u64) -> u32 {
+    ts as u32
+}
+
+pub fn negate_unsigned(n: u32) -> u32 {
+    let signed = n as i32;
+    (-signed) as u32
+}

package/dist/packages/crucible/seeds/rust/seed-031 2.rs

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Allocation size computed from untrusted user input — potential OOM / overflow
+
+use std::alloc::{alloc, Layout};
+
+pub fn allocate_buffer(user_size: u32, element_size: u32) -> Vec<u8> {
+    let total = (user_size * element_size) as usize;
+    vec![0u8; total]
+}
+
+pub unsafe fn raw_alloc(count: usize, item_size: usize) -> *mut u8 {
+    let size = count * item_size;
+    let layout = Layout::from_size_align_unchecked(size, 8);
+    alloc(layout)
+}
+
+pub fn string_repeat(s: &str, n: u32) -> String {
+    s.repeat(n as usize)
+}

package/dist/packages/crucible/seeds/rust/seed-031.rs

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Allocation size computed from untrusted user input — potential OOM / overflow
+
+use std::alloc::{alloc, Layout};
+
+pub fn allocate_buffer(user_size: u32, element_size: u32) -> Vec<u8> {
+    let total = (user_size * element_size) as usize;
+    vec![0u8; total]
+}
+
+pub unsafe fn raw_alloc(count: usize, item_size: usize) -> *mut u8 {
+    let size = count * item_size;
+    let layout = Layout::from_size_align_unchecked(size, 8);
+    alloc(layout)
+}
+
+pub fn string_repeat(s: &str, n: u32) -> String {
+    s.repeat(n as usize)
+}

package/dist/packages/crucible/seeds/rust/seed-032 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: medium
+// language: rust
+// expected: Signed integer arithmetic without overflow check — negative length risk
+
+pub fn calculate_remaining(total: i32, used: i32) -> i32 {
+    total - used
+}
+
+pub fn chunk_count(data_len: i32, chunk_size: i32) -> i32 {
+    (data_len + chunk_size - 1) / chunk_size
+}
+
+pub fn ring_buffer_advance(pos: u32, step: u32, capacity: u32) -> u32 {
+    (pos + step) % capacity
+}
+
+pub fn decode_delta(base: u32, delta: i32) -> u32 {
+    (base as i32 + delta) as u32
+}
+
+pub fn safe_subtract(a: u32, b: u32) -> u32 {
+    a - b
+}

package/dist/packages/crucible/seeds/rust/seed-032.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: medium
+// language: rust
+// expected: Signed integer arithmetic without overflow check — negative length risk
+
+pub fn calculate_remaining(total: i32, used: i32) -> i32 {
+    total - used
+}
+
+pub fn chunk_count(data_len: i32, chunk_size: i32) -> i32 {
+    (data_len + chunk_size - 1) / chunk_size
+}
+
+pub fn ring_buffer_advance(pos: u32, step: u32, capacity: u32) -> u32 {
+    (pos + step) % capacity
+}
+
+pub fn decode_delta(base: u32, delta: i32) -> u32 {
+    (base as i32 + delta) as u32
+}
+
+pub fn safe_subtract(a: u32, b: u32) -> u32 {
+    a - b
+}

package/dist/packages/crucible/seeds/rust/seed-033 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Array index from user input without bounds check — potential panic or OOM
+
+pub fn get_element(data: &[u8], index: usize) -> u8 {
+    data[index]
+}
+
+pub fn set_element(data: &mut Vec<u8>, index: usize, value: u8) {
+    data[index] = value;
+}
+
+pub fn read_matrix(matrix: &[Vec<i32>], row: usize, col: usize) -> i32 {
+    matrix[row][col]
+}
+
+pub fn sum_range(data: &[i64], start: usize, end: usize) -> i64 {
+    data[start..end].iter().sum()
+}
+
+pub fn nth_element(data: &[String], n: usize) -> &str {
+    &data[n]
+}

package/dist/packages/crucible/seeds/rust/seed-033.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: integer_overflow
+// severity: high
+// language: rust
+// expected: Array index from user input without bounds check — potential panic or OOM
+
+pub fn get_element(data: &[u8], index: usize) -> u8 {
+    data[index]
+}
+
+pub fn set_element(data: &mut Vec<u8>, index: usize, value: u8) {
+    data[index] = value;
+}
+
+pub fn read_matrix(matrix: &[Vec<i32>], row: usize, col: usize) -> i32 {
+    matrix[row][col]
+}
+
+pub fn sum_range(data: &[i64], start: usize, end: usize) -> i64 {
+    data[start..end].iter().sum()
+}
+
+pub fn nth_element(data: &[String], n: usize) -> &str {
+    &data[n]
+}

package/dist/packages/crucible/seeds/rust/seed-034 2.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: reqwest::get called with user-controlled URL — SSRF
+
+use reqwest;
+
+pub async fn fetch_url(user_url: &str) -> Result<String, reqwest::Error> {
+    let response = reqwest::get(user_url).await?;
+    let body = response.text().await?;
+    Ok(body)
+}
+
+pub async fn proxy_request(target: &str) -> String {
+    reqwest::get(target)
+        .await
+        .and_then(|r| async { r.text().await }.await.map_err(Into::into))
+        .unwrap_or_default()
+}

package/dist/packages/crucible/seeds/rust/seed-034.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: reqwest::get called with user-controlled URL — SSRF
+
+use reqwest;
+
+pub async fn fetch_url(user_url: &str) -> Result<String, reqwest::Error> {
+    let response = reqwest::get(user_url).await?;
+    let body = response.text().await?;
+    Ok(body)
+}
+
+pub async fn proxy_request(target: &str) -> String {
+    reqwest::get(target)
+        .await
+        .and_then(|r| async { r.text().await }.await.map_err(Into::into))
+        .unwrap_or_default()
+}

package/dist/packages/crucible/seeds/rust/seed-035 2.rs

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: Axum endpoint fetches user-supplied URL server-side — open proxy / SSRF
+
+use axum::{extract::Query, response::IntoResponse};
+use reqwest::Client;
+use std::collections::HashMap;
+
+pub async fn proxy_endpoint(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let url = params.get("url").cloned().unwrap_or_default();
+    let client = Client::new();
+    match client.get(&url).send().await {
+        Ok(resp) => resp.text().await.unwrap_or_default(),
+        Err(e) => format!("Error: {}", e),
+    }
+}
+
+pub async fn webhook_relay(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let callback = params.get("callback").cloned().unwrap_or_default();
+    let _ = Client::new()
+        .post(&callback)
+        .json(&serde_json::json!({"status": "ok"}))
+        .send()
+        .await;
+    "Triggered"
+}

package/dist/packages/crucible/seeds/rust/seed-035.rs

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: Axum endpoint fetches user-supplied URL server-side — open proxy / SSRF
+
+use axum::{extract::Query, response::IntoResponse};
+use reqwest::Client;
+use std::collections::HashMap;
+
+pub async fn proxy_endpoint(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let url = params.get("url").cloned().unwrap_or_default();
+    let client = Client::new();
+    match client.get(&url).send().await {
+        Ok(resp) => resp.text().await.unwrap_or_default(),
+        Err(e) => format!("Error: {}", e),
+    }
+}
+
+pub async fn webhook_relay(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let callback = params.get("callback").cloned().unwrap_or_default();
+    let _ = Client::new()
+        .post(&callback)
+        .json(&serde_json::json!({"status": "ok"}))
+        .send()
+        .await;
+    "Triggered"
+}

package/dist/packages/crucible/seeds/rust/seed-036 2.rs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: URL constructed from user-supplied hostname and path — SSRF
+
+use reqwest::Client;
+
+pub async fn check_endpoint(host: &str, port: u16, path: &str) -> bool {
+    let url = format!("http://{}:{}{}", host, port, path);
+    Client::new().get(&url).send().await.is_ok()
+}
+
+pub async fn fetch_avatar(base_url: &str, user_id: &str) -> Vec<u8> {
+    let url = format!("{}/avatars/{}.png", base_url, user_id);
+    reqwest::get(&url)
+        .await
+        .and_then(|r| async { r.bytes().await }.await.map_err(Into::into))
+        .map(|b| b.to_vec())
+        .unwrap_or_default()
+}
+
+pub async fn import_data(source_url: &str) -> serde_json::Value {
+    let text = reqwest::get(source_url).await.unwrap().text().await.unwrap();
+    serde_json::from_str(&text).unwrap_or(serde_json::Value::Null)
+}

package/dist/packages/crucible/seeds/rust/seed-036.rs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: URL constructed from user-supplied hostname and path — SSRF
+
+use reqwest::Client;
+
+pub async fn check_endpoint(host: &str, port: u16, path: &str) -> bool {
+    let url = format!("http://{}:{}{}", host, port, path);
+    Client::new().get(&url).send().await.is_ok()
+}
+
+pub async fn fetch_avatar(base_url: &str, user_id: &str) -> Vec<u8> {
+    let url = format!("{}/avatars/{}.png", base_url, user_id);
+    reqwest::get(&url)
+        .await
+        .and_then(|r| async { r.bytes().await }.await.map_err(Into::into))
+        .map(|b| b.to_vec())
+        .unwrap_or_default()
+}
+
+pub async fn import_data(source_url: &str) -> serde_json::Value {
+    let text = reqwest::get(source_url).await.unwrap().text().await.unwrap();
+    serde_json::from_str(&text).unwrap_or(serde_json::Value::Null)
+}

package/dist/packages/crucible/seeds/rust/seed-037 2.rs

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: rust
+// expected: Image URL fetched server-side from user POST body — SSRF via metadata endpoint
+
+use reqwest::Client;
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+pub struct ImageRequest {
+    pub url: String,
+    pub format: String,
+}
+
+pub async fn download_and_process(req: ImageRequest) -> Vec<u8> {
+    let client = Client::new();
+    let bytes = client
+        .get(&req.url)
+        .send()
+        .await
+        .unwrap()
+        .bytes()
+        .await
+        .unwrap();
+    bytes.to_vec()
+}
+
+pub async fn get_og_metadata(page_url: &str) -> String {
+    reqwest::get(page_url).await.unwrap().text().await.unwrap()
+}

package/dist/packages/crucible/seeds/rust/seed-037.rs

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: rust
+// expected: Image URL fetched server-side from user POST body — SSRF via metadata endpoint
+
+use reqwest::Client;
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+pub struct ImageRequest {
+    pub url: String,
+    pub format: String,
+}
+
+pub async fn download_and_process(req: ImageRequest) -> Vec<u8> {
+    let client = Client::new();
+    let bytes = client
+        .get(&req.url)
+        .send()
+        .await
+        .unwrap()
+        .bytes()
+        .await
+        .unwrap();
+    bytes.to_vec()
+}
+
+pub async fn get_og_metadata(page_url: &str) -> String {
+    reqwest::get(page_url).await.unwrap().text().await.unwrap()
+}

package/dist/packages/crucible/seeds/rust/seed-038 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: critical
+// language: rust
+// expected: DNS rebinding-vulnerable health check using user-supplied host
+
+use reqwest::Client;
+use std::time::Duration;
+
+pub async fn health_check(host: &str) -> serde_json::Value {
+    let url = format!("http://{}/health", host);
+    let client = Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    match client.get(&url).send().await {
+        Ok(resp) => resp.json().await.unwrap_or(serde_json::Value::Null),
+        Err(_) => serde_json::json!({"status": "unreachable"}),
+    }
+}
+
+pub async fn resolve_and_fetch(domain: &str, endpoint: &str) -> String {
+    let url = format!("https://{}{}", domain, endpoint);
+    reqwest::get(&url).await.unwrap().text().await.unwrap()
+}