thuban 0.4.9 → 0.4.11

package/dist/packages/crucible/seeds/rust/seed-050.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: critical
+// language: rust
+// expected: User-controlled key used to read arbitrary env var — information disclosure
+
+use std::env;
+use axum::{extract::Query, response::IntoResponse};
+use std::collections::HashMap;
+
+pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let key = params.get("key").cloned().unwrap_or_default();
+    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
+    format!("{}={}", key, value)
+}
+
+pub fn lookup_env(user_key: &str) -> String {
+    env::var(user_key).unwrap_or_default()
+}
+
+pub fn set_env_from_input(name: &str, value: &str) {
+    unsafe { env::set_var(name, value) }
+}

package/dist/packages/crucible/seeds/ts/seed-001 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded AWS credentials in typed config object
+
+import * as AWS from 'aws-sdk';
+
+interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+}
+
+const credentials: AwsCredentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+};
+
+AWS.config.update(credentials);
+
+const s3 = new AWS.S3();
+const sqs = new AWS.SQS();
+
+export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
+  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
+}
+
+export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
+  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
+}

package/dist/packages/crucible/seeds/ts/seed-001.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded AWS credentials in typed config object
+
+import * as AWS from 'aws-sdk';
+
+interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+}
+
+const credentials: AwsCredentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+};
+
+AWS.config.update(credentials);
+
+const s3 = new AWS.S3();
+const sqs = new AWS.SQS();
+
+export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
+  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
+}
+
+export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
+  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
+}

package/dist/packages/crucible/seeds/ts/seed-002 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded JWT secret in typed auth service
+
+import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
+
+interface TokenPayload {
+  userId: string;
+  role: 'admin' | 'user' | 'moderator';
+  email: string;
+}
+
+const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
+const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
+
+const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
+
+export function signAccessToken(payload: TokenPayload): string {
+  return jwt.sign(payload, JWT_SECRET, signOptions);
+}
+
+export function signRefreshToken(userId: string): string {
+  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
+}
+
+export function verifyAccessToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_SECRET) as JwtPayload;
+}
+
+export function verifyRefreshToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
+}

package/dist/packages/crucible/seeds/ts/seed-002.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded JWT secret in typed auth service
+
+import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
+
+interface TokenPayload {
+  userId: string;
+  role: 'admin' | 'user' | 'moderator';
+  email: string;
+}
+
+const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
+const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
+
+const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
+
+export function signAccessToken(payload: TokenPayload): string {
+  return jwt.sign(payload, JWT_SECRET, signOptions);
+}
+
+export function signRefreshToken(userId: string): string {
+  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
+}
+
+export function verifyAccessToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_SECRET) as JwtPayload;
+}
+
+export function verifyRefreshToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
+}

package/dist/packages/crucible/seeds/ts/seed-003 2.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded database credentials in TypeORM DataSource config
+
+import { DataSource } from 'typeorm';
+import { User } from './entities/User';
+import { Order } from './entities/Order';
+
+export const AppDataSource = new DataSource({
+  type: 'postgres',
+  host: 'prod-postgres.internal',
+  port: 5432,
+  username: 'app_user',
+  password: 'Pr0dPassw0rd!@#$',
+  database: 'production_db',
+  synchronize: false,
+  logging: false,
+  ssl: { rejectUnauthorized: false },
+  entities: [User, Order],
+  migrations: ['dist/migrations/*.js'],
+});
+
+export async function initializeDatabase(): Promise<void> {
+  await AppDataSource.initialize();
+  console.log('Database connection established');
+}

package/dist/packages/crucible/seeds/ts/seed-003.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded database credentials in TypeORM DataSource config
+
+import { DataSource } from 'typeorm';
+import { User } from './entities/User';
+import { Order } from './entities/Order';
+
+export const AppDataSource = new DataSource({
+  type: 'postgres',
+  host: 'prod-postgres.internal',
+  port: 5432,
+  username: 'app_user',
+  password: 'Pr0dPassw0rd!@#$',
+  database: 'production_db',
+  synchronize: false,
+  logging: false,
+  ssl: { rejectUnauthorized: false },
+  entities: [User, Order],
+  migrations: ['dist/migrations/*.js'],
+});
+
+export async function initializeDatabase(): Promise<void> {
+  await AppDataSource.initialize();
+  console.log('Database connection established');
+}

package/dist/packages/crucible/seeds/ts/seed-004 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded Stripe secret key and webhook secret in typed service
+
+import Stripe from 'stripe';
+
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
+
+export async function createPaymentIntent(
+  amount: number,
+  currency: string = 'usd',
+  customerId?: string
+): Promise<Stripe.PaymentIntent> {
+  return stripe.paymentIntents.create({
+    amount,
+    currency,
+    customer: customerId,
+    automatic_payment_methods: { enabled: true },
+  });
+}
+
+export function constructWebhookEvent(
+  payload: Buffer,
+  signature: string
+): Stripe.Event {
+  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
+}
+
+export { stripe };

package/dist/packages/crucible/seeds/ts/seed-004.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded Stripe secret key and webhook secret in typed service
+
+import Stripe from 'stripe';
+
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
+
+export async function createPaymentIntent(
+  amount: number,
+  currency: string = 'usd',
+  customerId?: string
+): Promise<Stripe.PaymentIntent> {
+  return stripe.paymentIntents.create({
+    amount,
+    currency,
+    customer: customerId,
+    automatic_payment_methods: { enabled: true },
+  });
+}
+
+export function constructWebhookEvent(
+  payload: Buffer,
+  signature: string
+): Stripe.Event {
+  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
+}
+
+export { stripe };

package/dist/packages/crucible/seeds/ts/seed-005 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}

package/dist/packages/crucible/seeds/ts/seed-005.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}

package/dist/packages/crucible/seeds/ts/seed-006 2.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
+
+import { Octokit } from '@octokit/rest';
+import axios from 'axios';
+
+interface IntegrationConfig {
+  githubToken: string;
+  slackWebhookUrl: string;
+  slackSigningSecret: string;
+}
+
+const config: IntegrationConfig = {
+  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
+  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
+  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
+};
+
+const octokit = new Octokit({ auth: config.githubToken });
+
+export async function postToSlack(text: string): Promise<void> {
+  await axios.post(config.slackWebhookUrl, { text });
+}
+
+export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
+  const { data } = await octokit.issues.create({ owner, repo, title });
+  return data.number;
+}

package/dist/packages/crucible/seeds/ts/seed-006.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
+
+import { Octokit } from '@octokit/rest';
+import axios from 'axios';
+
+interface IntegrationConfig {
+  githubToken: string;
+  slackWebhookUrl: string;
+  slackSigningSecret: string;
+}
+
+const config: IntegrationConfig = {
+  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
+  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
+  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
+};
+
+const octokit = new Octokit({ auth: config.githubToken });
+
+export async function postToSlack(text: string): Promise<void> {
+  await axios.post(config.slackWebhookUrl, { text });
+}
+
+export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
+  const { data } = await octokit.issues.create({ owner, repo, title });
+  return data.number;
+}

package/dist/packages/crucible/seeds/ts/seed-007 2.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded encryption key and static IV in typed crypto utility
+
+import * as crypto from 'crypto';
+
+const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
+const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
+
+export function encrypt(plaintext: string): string {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  return encrypted;
+}
+
+export function decrypt(ciphertext: string): string {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+export function hashToken(token: string): string {
+  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-007.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded encryption key and static IV in typed crypto utility
+
+import * as crypto from 'crypto';
+
+const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
+const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
+
+export function encrypt(plaintext: string): string {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  return encrypted;
+}
+
+export function decrypt(ciphertext: string): string {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+export function hashToken(token: string): string {
+  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-008 2.ts

@@ -0,0 +1,40 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded OAuth2 client credentials and admin API key in typed config
+
+import { Router, Request, Response } from 'express';
+
+interface OAuthConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+}
+
+interface AdminConfig {
+  apiKey: string;
+  adminPassword: string;
+}
+
+const oauthConfig: OAuthConfig = {
+  clientId: 'oauth2-client-production-id-abc123',
+  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
+  redirectUri: 'https://app.company.com/oauth/callback',
+};
+
+const adminConfig: AdminConfig = {
+  apiKey: 'admin-api-key-supersecret-prod-2024',
+  adminPassword: 'AdminP@ssw0rd!#$',
+};
+
+const router = Router();
+
+router.post('/oauth/token', (req: Request, res: Response) => {
+  if (req.body.client_secret !== oauthConfig.clientSecret) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  res.json({ access_token: 'generated', token_type: 'bearer' });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-008.ts

@@ -0,0 +1,40 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded OAuth2 client credentials and admin API key in typed config
+
+import { Router, Request, Response } from 'express';
+
+interface OAuthConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+}
+
+interface AdminConfig {
+  apiKey: string;
+  adminPassword: string;
+}
+
+const oauthConfig: OAuthConfig = {
+  clientId: 'oauth2-client-production-id-abc123',
+  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
+  redirectUri: 'https://app.company.com/oauth/callback',
+};
+
+const adminConfig: AdminConfig = {
+  apiKey: 'admin-api-key-supersecret-prod-2024',
+  adminPassword: 'AdminP@ssw0rd!#$',
+};
+
+const router = Router();
+
+router.post('/oauth/token', (req: Request, res: Response) => {
+  if (req.body.client_secret !== oauthConfig.clientSecret) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  res.json({ access_token: 'generated', token_type: 'bearer' });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-009 2.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: typescript
+// expected: SQL injection via TypeORM query() with string concatenation
+
+import { AppDataSource } from '../data-source';
+
+export async function findUserByUsername(username: string) {
+  // Raw query with direct string interpolation — bypasses parameterization
+  const result = await AppDataSource.query(
+    `SELECT * FROM users WHERE username = '${username}'`
+  );
+  return result[0] ?? null;
+}
+
+export async function searchProducts(term: string, category: string) {
+  const sql = `
+    SELECT p.*, c.name as category_name
+    FROM products p
+    JOIN categories c ON p.category_id = c.id
+    WHERE p.name ILIKE '%` + term + `%'
+    AND c.slug = '` + category + `'
+    ORDER BY p.created_at DESC
+  `;
+  return AppDataSource.query(sql);
+}
+
+export async function deleteUserSessions(userId: string) {
+  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
+}

package/dist/packages/crucible/seeds/ts/seed-009.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: typescript
+// expected: SQL injection via TypeORM query() with string concatenation
+
+import { AppDataSource } from '../data-source';
+
+export async function findUserByUsername(username: string) {
+  // Raw query with direct string interpolation — bypasses parameterization
+  const result = await AppDataSource.query(
+    `SELECT * FROM users WHERE username = '${username}'`
+  );
+  return result[0] ?? null;
+}
+
+export async function searchProducts(term: string, category: string) {
+  const sql = `
+    SELECT p.*, c.name as category_name
+    FROM products p
+    JOIN categories c ON p.category_id = c.id
+    WHERE p.name ILIKE '%` + term + `%'
+    AND c.slug = '` + category + `'
+    ORDER BY p.created_at DESC
+  `;
+  return AppDataSource.query(sql);
+}
+
+export async function deleteUserSessions(userId: string) {
+  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
+}

package/dist/packages/crucible/seeds/ts/seed-010 2.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: typescript
+// expected: SQL injection in TypeORM repository createQueryBuilder with raw where clause
+
+import { Repository } from 'typeorm';
+import { User } from '../entities/User';
+
+export class UserRepository {
+  constructor(private repo: Repository<User>) {}
+
+  async findByEmail(email: string): Promise<User | null> {
+    return this.repo
+      .createQueryBuilder('user')
+      // Direct interpolation into where() — SQL injection
+      .where(`user.email = '${email}'`)
+      .getOne();
+  }
+
+  async searchByName(query: string, role: string): Promise<User[]> {
+    return this.repo
+      .createQueryBuilder('user')
+      .where(`user.name ILIKE '%${query}%' AND user.role = '${role}'`)
+      .orderBy('user.createdAt', 'DESC')
+      .getMany();
+  }
+
+  async getByIds(ids: string[]): Promise<User[]> {
+    const idList = ids.join(', ');
+    return this.repo.query(`SELECT * FROM users WHERE id IN (${idList})`);
+  }
+}