thuban 0.4.9 → 0.4.11

package/packages/crucible/rules/xxe.json

@@ -1,66 +0,0 @@
-[
-  {
-    "id": "XXE001",
-    "pattern": "XMLReaderFactory|DocumentBuilderFactory|XmlReader.*DtdProcessing",
-    "flags": "",
-    "category": "xxe",
-    "description": "XXE",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE002",
-    "pattern": "DtdProcessing\\s*=\\s*DtdProcessing\\.Parse",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XmlDocument/XmlReader",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE003",
-    "pattern": "XmlResolver\\s*=\\s*new XmlUrlResolver\\s*\\(\\)",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XmlDocument/XmlReader",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE004",
-    "pattern": "new XPathDocument\\s*\\(",
-    "flags": "i",
-    "category": "xxe",
-    "description": "C# XXE: XPathDocument (no resolver set = default unsafe on older .NET)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "XXE005",
-    "pattern": "SAXParserFactory\\.newInstance\\s*\\(\\s*\\)",
-    "flags": "",
-    "category": "xxe",
-    "description": "Java: XXE via SAXParserFactory without secure processing",
-    "language": [
-      "java"
-    ],
-    "severity": "critical"
-  }
-]

package/packages/crucible/rules/yaml-deserialization.json

@@ -1,22 +0,0 @@
-[
-  {
-    "id": "YAMLD001",
-    "pattern": "YAML\\.load\\s*\\(",
-    "flags": "",
-    "category": "yaml_deserialization",
-    "description": "YAML deserialization",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  }
-]

package/packages/crucible/rules/yaml-injection.json

@@ -1,22 +0,0 @@
-[
-  {
-    "id": "YAML001",
-    "pattern": "yaml\\.load\\s*\\((?![^)]*[Ll]oader\\s*=\\s*yaml\\.(?:Safe|Base)Loader)|YAML\\.load\\s*\\(",
-    "flags": "i",
-    "category": "yaml_injection",
-    "description": "YAML injection (yaml.load without safe_load)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  }
-]

package/packages/crucible/seeds/csharp/seed-001.cs

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded SQL Server connection string with plaintext password
-
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class DatabaseConfig
-    {
-        private const string ConnectionString =
-            "Server=prod-sql.internal;Database=AppDb;User Id=sa;Password=Pr0dS@P@ssw0rd!;";
-
-        public static SqlConnection GetConnection()
-        {
-            return new SqlConnection(ConnectionString);
-        }
-
-        public static void TestConnection()
-        {
-            using var conn = GetConnection();
-            conn.Open();
-            System.Console.WriteLine("Connected to: " + conn.DataSource);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-002.cs

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded AWS credentials stored as string constants
-
-using Amazon;
-using Amazon.S3;
-using Amazon.Runtime;
-
-namespace App.Cloud
-{
-    public class AwsClientFactory
-    {
-        private const string AccessKeyId     = "AKIAIOSFODNN7EXAMPLE";
-        private const string SecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-
-        public static AmazonS3Client CreateS3Client()
-        {
-            var credentials = new BasicAWSCredentials(AccessKeyId, SecretAccessKey);
-            return new AmazonS3Client(credentials, RegionEndpoint.USEast1);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-003.cs

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded JWT signing key embedded in authentication middleware
-
-using Microsoft.IdentityModel.Tokens;
-using System.IdentityModel.Tokens.Jwt;
-using System.Text;
-
-namespace App.Auth
-{
-    public class JwtService
-    {
-        // Vulnerable: secret hardcoded — should come from configuration/vault
-        private const string SigningKey = "my-256-bit-super-secret-jwt-key!!";
-
-        public string GenerateToken(string userId)
-        {
-            var key   = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
-            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
-            var token = new JwtSecurityToken(
-                issuer:   "myapp",
-                audience: "myapp-users",
-                expires:  System.DateTime.UtcNow.AddHours(24),
-                signingCredentials: creds);
-            return new JwtSecurityTokenHandler().WriteToken(token);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-004.cs

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: csharp
-// expected: Hardcoded Stripe secret key used for payment processing
-
-using Stripe;
-
-namespace App.Payments
-{
-    public class PaymentService
-    {
-        private const string StripeSecretKey = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
-
-        public PaymentService()
-        {
-            StripeConfiguration.ApiKey = StripeSecretKey;
-        }
-
-        public Charge CreateCharge(string token, long amountCents)
-        {
-            var options = new ChargeCreateOptions
-            {
-                Amount   = amountCents,
-                Currency = "usd",
-                Source   = token
-            };
-            return new ChargeService().Create(options);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-005.cs

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded Azure Storage connection string containing account key
-
-using Azure.Storage.Blobs;
-
-namespace App.Storage
-{
-    public class BlobStorageService
-    {
-        private const string AzureStorageConnectionString =
-            "DefaultEndpointsProtocol=https;AccountName=prodstorageacct;" +
-            "AccountKey=dGhpcyBpcyBhIGZha2Uga2V5IGZvciBkZW1vIHB1cnBvc2VzIG9ubHkh;" +
-            "EndpointSuffix=core.windows.net";
-
-        private readonly BlobServiceClient _client;
-
-        public BlobStorageService()
-        {
-            _client = new BlobServiceClient(AzureStorageConnectionString);
-        }
-
-        public BlobContainerClient GetContainer(string name)
-            => _client.GetBlobContainerClient(name);
-    }
-}

package/packages/crucible/seeds/csharp/seed-006.cs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: csharp
-// expected: Hardcoded SendGrid API key for email sending
-
-using SendGrid;
-using SendGrid.Helpers.Mail;
-
-namespace App.Notifications
-{
-    public class EmailService
-    {
-        private const string SendGridApiKey = "SG.aBcDeFgHiJkLmNoPqRsTuVwXyZ.0123456789abcdefghijklmno";
-
-        public async System.Threading.Tasks.Task SendAsync(string to, string subject, string body)
-        {
-            var client  = new SendGridClient(SendGridApiKey);
-            var from    = new EmailAddress("noreply@company.com", "Company");
-            var toAddr  = new EmailAddress(to);
-            var msg     = MailHelper.CreateSingleEmail(from, toAddr, subject, body, body);
-            await client.SendEmailAsync(msg);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-007.cs

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded encryption key and IV stored as byte array constants
-
-using System.Security.Cryptography;
-
-namespace App.Security
-{
-    public class DataEncryptor
-    {
-        // Vulnerable: hardcoded AES key and IV in source code
-        private static readonly byte[] AesKey = new byte[]
-        {
-            0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
-            0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
-        };
-        private static readonly byte[] AesIv = new byte[]
-        {
-            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
-        };
-
-        public static byte[] Encrypt(byte[] data)
-        {
-            using var aes = Aes.Create();
-            aes.Key = AesKey;
-            aes.IV  = AesIv;
-            using var enc = aes.CreateEncryptor();
-            return enc.TransformFinalBlock(data, 0, data.Length);
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-008.cs

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: csharp
-// expected: Hardcoded GitHub PAT and Slack webhook URL in integration service
-
-namespace App.Integrations
-{
-    public class IntegrationConfig
-    {
-        public const string GitHubToken       = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345";
-        public const string SlackWebhookUrl   = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
-        public const string PagerDutyApiKey   = "pdkey-u-AbCdEfGhIjKlMnOpQrStUv";
-
-        public static System.Net.Http.HttpClient CreateGitHubClient()
-        {
-            var client = new System.Net.Http.HttpClient();
-            client.DefaultRequestHeaders.Add("Authorization", $"token {GitHubToken}");
-            client.DefaultRequestHeaders.Add("User-Agent", "MyApp/1.0");
-            return client;
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-009.cs

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection via string concatenation in SqlCommand
-
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class UserRepository
-    {
-        private readonly string _connectionString;
-
-        public UserRepository(string connectionString) => _connectionString = connectionString;
-
-        public SqlDataReader FindByUsername(string username)
-        {
-            var conn = new SqlConnection(_connectionString);
-            conn.Open();
-            // Vulnerable: direct string concatenation into SQL
-            var cmd = new SqlCommand(
-                "SELECT * FROM Users WHERE Username = '" + username + "'", conn);
-            return cmd.ExecuteReader();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-010.cs

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection via string.Format building WHERE clause
-
-using System;
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class ProductSearch
-    {
-        private readonly string _conn;
-
-        public ProductSearch(string conn) => _conn = conn;
-
-        public SqlDataReader Search(string keyword, string category)
-        {
-            // Vulnerable: string.Format with unsanitized inputs
-            string sql = string.Format(
-                "SELECT * FROM Products WHERE Name LIKE '%{0}%' AND Category = '{1}'",
-                keyword, category);
-            var connection = new SqlConnection(_conn);
-            connection.Open();
-            return new SqlCommand(sql, connection).ExecuteReader();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-011.cs

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection in login via string interpolation in SqlCommand
-
-using System.Data.SqlClient;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class AuthController : ControllerBase
-    {
-        private readonly string _conn;
-
-        public AuthController(string conn) => _conn = conn;
-
-        [HttpPost("login")]
-        public IActionResult Login(string username, string password)
-        {
-            // Vulnerable: C# interpolated string injected into SQL
-            string sql = $"SELECT Id FROM Users WHERE Username='{username}' AND Password='{password}'";
-            using var connection = new SqlConnection(_conn);
-            connection.Open();
-            using var cmd = new SqlCommand(sql, connection);
-            var result = cmd.ExecuteScalar();
-            return result != null ? Ok("Authenticated") : Unauthorized();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-012.cs

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection via dynamic ORDER BY column from user input
-
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class ReportRepository
-    {
-        private readonly string _conn;
-
-        public ReportRepository(string conn) => _conn = conn;
-
-        public SqlDataReader GetSortedReport(string tableName, string sortColumn, string sortDir)
-        {
-            // Vulnerable: all three parameters injected without validation
-            string sql = "SELECT * FROM " + tableName +
-                         " ORDER BY " + sortColumn + " " + sortDir;
-            var connection = new SqlConnection(_conn);
-            connection.Open();
-            return new SqlCommand(sql, connection).ExecuteReader();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-013.cs

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection in stored procedure exec via string concatenation
-
-using System.Data;
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class AuditService
-    {
-        private readonly string _conn;
-
-        public AuditService(string conn) => _conn = conn;
-
-        public void LogEvent(string userId, string action)
-        {
-            // Vulnerable: building EXEC string manually
-            string sql = "EXEC sp_RecordAudit '" + userId + "', '" + action + "'";
-            using var connection = new SqlConnection(_conn);
-            connection.Open();
-            new SqlCommand(sql, connection).ExecuteNonQuery();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-014.cs

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection via string concatenation in WHERE IN clause
-
-using System.Data.SqlClient;
-
-namespace App.Data
-{
-    public class BatchOrderService
-    {
-        private readonly string _conn;
-
-        public BatchOrderService(string conn) => _conn = conn;
-
-        public SqlDataReader GetOrdersByIds(string rawIds)
-        {
-            // Vulnerable: rawIds like "1,2,3" injected into IN clause
-            string sql = $"SELECT * FROM Orders WHERE Id IN ({rawIds})";
-            var connection = new SqlConnection(_conn);
-            connection.Open();
-            return new SqlCommand(sql, connection).ExecuteReader();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-015.cs

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: csharp
-// expected: SQL injection via ADO.NET command text built with user search parameters
-
-using System;
-using System.Data.SqlClient;
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    [ApiController]
-    [Route("api/[controller]")]
-    public class SearchController : ControllerBase
-    {
-        private readonly string _conn;
-
-        public SearchController(string conn) => _conn = conn;
-
-        [HttpGet]
-        public IActionResult Search([FromQuery] string name, [FromQuery] string dept)
-        {
-            // Vulnerable: both query params concatenated into SQL
-            string sql = "SELECT * FROM Employees WHERE Name LIKE '%" + name
-                         + "%' AND Department = '" + dept + "'";
-            using var connection = new SqlConnection(_conn);
-            connection.Open();
-            using var reader = new SqlCommand(sql, connection).ExecuteReader();
-            return Ok("Results fetched");
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-016.cs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via Response.Write with unescaped user input from query string
-
-using System.Web;
-
-namespace App.Handlers
-{
-    public class GreetingHandler : IHttpHandler
-    {
-        public bool IsReusable => false;
-
-        public void ProcessRequest(HttpContext context)
-        {
-            string name = context.Request.QueryString["name"];
-            context.Response.ContentType = "text/html";
-            // Vulnerable: name reflected without HtmlEncode
-            context.Response.Write("<html><body>");
-            context.Response.Write("<h1>Welcome, " + name + "!</h1>");
-            context.Response.Write("</body></html>");
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-017.cs

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via Response.Write with search query reflected into HTML
-
-using System.Web;
-using System.Web.UI;
-
-namespace App.Pages
-{
-    public class SearchPage : Page
-    {
-        protected void Page_Load(object sender, System.EventArgs e)
-        {
-            string q = Request.QueryString["q"];
-            // Vulnerable: writing raw query parameter into page output
-            Response.Write("<h2>Results for: " + q + "</h2>");
-            Response.Write("<meta name=\"description\" content=\"" + q + "\">");
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-018.cs

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via MVC action returning raw HTML with user input embedded
-
-using Microsoft.AspNetCore.Mvc;
-
-namespace App.Controllers
-{
-    public class ProfileController : Controller
-    {
-        [HttpGet("profile")]
-        public ContentResult ShowProfile(string username, string bio)
-        {
-            // Vulnerable: username and bio embedded without encoding
-            string html = $@"
-<html><body>
-  <h1>{username}</h1>
-  <p>{bio}</p>
-  <script>var user = ""{username}"";</script>
-</body></html>";
-            return Content(html, "text/html");
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-019.cs

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via HtmlHelper.Raw embedding user-supplied comment content
-
-using Microsoft.AspNetCore.Html;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.Rendering;
-
-namespace App.Controllers
-{
-    public class CommentController : Controller
-    {
-        [HttpGet("comments")]
-        public IActionResult Index(string comment, string author)
-        {
-            // Vulnerable: Html.Raw allows unsanitized input to render as HTML
-            var rawComment = new HtmlString(
-                $"<div class=\"comment\"><b>{author}</b>: {comment}</div>");
-            ViewBag.Comment = rawComment;
-            return View();
-        }
-    }
-}

package/packages/crucible/seeds/csharp/seed-020.cs

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: csharp
-// expected: XSS via Razor @Html.Raw with user-controlled error message parameter
-
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.RazorPages;
-
-namespace App.Pages
-{
-    public class ErrorModel : PageModel
-    {
-        public string ErrorMessage { get; private set; }
-
-        public void OnGet(string message, string code)
-        {
-            // Vulnerable: message stored as raw HTML to be rendered with @Html.Raw
-            ErrorMessage = $"<b>Error {code}:</b> {message}";
-        }
-    }
-}