thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/go/seed-037.go

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: DES encryption used for sensitive data (56-bit key, broken algorithm)
-
-package security
-
-import (
-	"crypto/cipher"
-	"crypto/des"
-)
-
-var desKey = []byte("8byteKey") // Vulnerable: DES key is only 56 bits
-
-func EncryptDES(plaintext []byte) ([]byte, error) {
-	// Vulnerable: DES is broken — brute-forceable since 1999
-	block, err := des.NewCipher(desKey)
-	if err != nil {
-		return nil, err
-	}
-	ciphertext := make([]byte, len(plaintext))
-	iv := desKey // Vulnerable: IV reused from key bytes
-	mode := cipher.NewCBCEncryptor(block, iv)
-	mode.CryptBlocks(ciphertext, plaintext)
-	return ciphertext, nil
-}

package/packages/crucible/seeds/go/seed-038.go

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: Hardcoded AES key with ECB-like block-by-block encryption lacking proper IV
-
-package security
-
-import (
-	"crypto/aes"
-)
-
-// Vulnerable: hardcoded key and manual block-level encryption without IV (ECB-equivalent)
-var aesKey = []byte("1234567890abcdef")
-
-func EncryptBlock(plaintext []byte) ([]byte, error) {
-	block, err := aes.NewCipher(aesKey)
-	if err != nil {
-		return nil, err
-	}
-	// Vulnerable: encrypting single blocks without chaining — identical blocks = identical ciphertext
-	ciphertext := make([]byte, len(plaintext))
-	for i := 0; i < len(plaintext); i += aes.BlockSize {
-		block.Encrypt(ciphertext[i:i+aes.BlockSize], plaintext[i:i+aes.BlockSize])
-	}
-	return ciphertext, nil
-}

package/packages/crucible/seeds/go/seed-039.go

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get fetching user-supplied image URL for thumbnail generation
-
-package handlers
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-)
-
-func ThumbnailHandler(w http.ResponseWriter, r *http.Request) {
-	imageURL := r.URL.Query().Get("image_url")
-	// Vulnerable: server fetches from any URL; internal AWS metadata or Kubernetes API reachable
-	resp, err := http.Get(imageURL)
-	if err != nil {
-		http.Error(w, "Failed to fetch image", 502)
-		return
-	}
-	defer resp.Body.Close()
-	data, _ := io.ReadAll(resp.Body)
-	fmt.Fprintf(w, "Fetched %d bytes from %s", len(data), imageURL)
-}

package/packages/crucible/seeds/go/seed-040.go

@@ -1,37 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: go
-// expected: Path traversal via os.Stat and os.ReadFile with user-controlled archive entry path
-
-package handlers
-
-import (
-	"archive/zip"
-	"net/http"
-	"os"
-	"path/filepath"
-)
-
-const extractBase = "/var/extracted/"
-
-func ZipExtractHandler(w http.ResponseWriter, r *http.Request) {
-	zipPath := r.URL.Query().Get("zip")
-	zr, err := zip.OpenReader(zipPath)
-	if err != nil {
-		http.Error(w, "Cannot open zip", 400)
-		return
-	}
-	defer zr.Close()
-	for _, f := range zr.File {
-		// Vulnerable: f.Name can contain ../ sequences escaping extractBase
-		target := filepath.Join(extractBase, f.Name)
-		os.MkdirAll(filepath.Dir(target), 0755)
-		out, _ := os.Create(target)
-		rc, _  := f.Open()
-		out.ReadFrom(rc)
-		rc.Close()
-		out.Close()
-	}
-	http.Redirect(w, r, "/files", http.StatusFound)
-}

package/packages/crucible/seeds/go/seed-041.go

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: go
-// expected: Weak RSA key size (1024-bit) used for certificate generation
-
-package security
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-)
-
-// Vulnerable: 1024-bit RSA is considered broken; minimum is 2048-bit
-func GenerateWeakRSAKey() (*rsa.PrivateKey, error) {
-	return rsa.GenerateKey(rand.Reader, 1024)
-}
-
-// Vulnerable: also using a fixed exponent of 3 is dangerous in some contexts
-func GenerateVeryWeakRSAKey() (*rsa.PrivateKey, error) {
-	key, err := rsa.GenerateKey(rand.Reader, 512)
-	return key, err
-}

package/packages/crucible/seeds/go/seed-042.go

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect using user-supplied return URL after password reset
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func PasswordResetConfirmHandler(w http.ResponseWriter, r *http.Request) {
-	token     := r.URL.Query().Get("token")
-	returnURL := r.URL.Query().Get("return")
-
-	if !validateResetToken(token) {
-		http.Error(w, "Invalid token", 400)
-		return
-	}
-
-	// Process password reset...
-
-	// Vulnerable: returnURL not validated — open redirect to external site
-	if returnURL != "" {
-		http.Redirect(w, r, returnURL, http.StatusFound)
-	} else {
-		http.Redirect(w, r, "/login?reset=success", http.StatusFound)
-	}
-}
-
-func validateResetToken(t string) bool { return len(t) == 32 }

package/packages/crucible/seeds/go/seed-043.go

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via string comparison of CSRF tokens using == operator
-
-package middleware
-
-import (
-	"net/http"
-)
-
-func CSRFMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "POST" || r.Method == "PUT" || r.Method == "DELETE" {
-			sessionToken := getSessionCSRFToken(r)
-			formToken    := r.FormValue("csrf_token")
-
-			// Vulnerable: == comparison is not constant-time; leaks token via timing
-			if sessionToken != formToken {
-				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
-				return
-			}
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func getSessionCSRFToken(r *http.Request) string {
-	c, err := r.Cookie("csrf_token")
-	if err != nil {
-		return ""
-	}
-	return c.Value
-}

package/packages/crucible/seeds/go/seed-044.go

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get with user-supplied URL parameter
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-)
-
-func ProxyHandler(w http.ResponseWriter, r *http.Request) {
-	targetURL := r.URL.Query().Get("url")
-	// Vulnerable: fetches arbitrary URL including internal services (e.g. http://169.254.169.254)
-	resp, err := http.Get(targetURL)
-	if err != nil {
-		http.Error(w, "Fetch failed", 500)
-		return
-	}
-	defer resp.Body.Close()
-	w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
-	io.Copy(w, resp.Body)
-}

package/packages/crucible/seeds/go/seed-045.go

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Post with user-controlled webhook URL
-
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-)
-
-func WebhookTestHandler(w http.ResponseWriter, r *http.Request) {
-	webhookURL := r.URL.Query().Get("webhook_url")
-	payload    := r.URL.Query().Get("payload")
-	// Vulnerable: server POSTs to attacker-controlled URL
-	resp, err := http.Post(webhookURL, "application/json", strings.NewReader(payload))
-	if err != nil {
-		http.Error(w, "Webhook error: "+err.Error(), 500)
-		return
-	}
-	defer resp.Body.Close()
-	fmt.Fprintf(w, "Webhook responded: %d", resp.StatusCode)
-}

package/packages/crucible/seeds/go/seed-046.go

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.NewRequest with user-controlled base URL for metadata fetch
-
-package handlers
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-)
-
-func MetadataFetchHandler(w http.ResponseWriter, r *http.Request) {
-	endpoint := r.URL.Query().Get("endpoint")
-	// Vulnerable: attacker can supply http://169.254.169.254/latest/meta-data/
-	req, err := http.NewRequest("GET", endpoint, nil)
-	if err != nil {
-		http.Error(w, "Invalid URL", 400)
-		return
-	}
-	req.Header.Set("User-Agent", "MetadataFetcher/1.0")
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		http.Error(w, "Request failed", 500)
-		return
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	w.Header().Set("Content-Type", "text/plain")
-	fmt.Fprintf(w, "%s", body)
-}

package/packages/crucible/seeds/go/seed-047.go

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: go
-// expected: SSRF via http.Get with user-supplied avatar URL for image fetching
-
-package handlers
-
-import (
-	"io"
-	"net/http"
-)
-
-func AvatarProxyHandler(w http.ResponseWriter, r *http.Request) {
-	avatarURL := r.URL.Query().Get("avatar_url")
-	// Vulnerable: server fetches image from any URL; can reach internal services
-	resp, err := http.Get(avatarURL)
-	if err != nil {
-		http.Error(w, "Could not fetch avatar", 502)
-		return
-	}
-	defer resp.Body.Close()
-	contentType := resp.Header.Get("Content-Type")
-	w.Header().Set("Content-Type", contentType)
-	io.Copy(w, resp.Body)
-}

package/packages/crucible/seeds/go/seed-048.go

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect with unvalidated user-controlled URL
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func LoginHandler(w http.ResponseWriter, r *http.Request) {
-	username := r.FormValue("username")
-	password := r.FormValue("password")
-	next     := r.URL.Query().Get("next")
-
-	if authenticate(username, password) {
-		// Vulnerable: 'next' not validated; can redirect to https://evil.com
-		if next == "" {
-			next = "/dashboard"
-		}
-		http.Redirect(w, r, next, http.StatusFound)
-	} else {
-		http.Redirect(w, r, "/login?error=1", http.StatusFound)
-	}
-}
-
-func authenticate(u, p string) bool { return u != "" && p != "" }

package/packages/crucible/seeds/go/seed-049.go

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect using Base64-decoded state parameter
-
-package handlers
-
-import (
-	"encoding/base64"
-	"net/http"
-)
-
-func OAuthCallbackHandler(w http.ResponseWriter, r *http.Request) {
-	state := r.URL.Query().Get("state")
-	// Vulnerable: state decoded and used as redirect target without validation
-	destination, err := base64.StdEncoding.DecodeString(state)
-	if err != nil {
-		http.Error(w, "Invalid state", 400)
-		return
-	}
-	// Exchange code for token... (omitted)
-	http.Redirect(w, r, string(destination), http.StatusFound)
-}

package/packages/crucible/seeds/go/seed-050.go

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: open_redirect
-// severity: medium
-// language: go
-// expected: Open redirect via http.Redirect with Referer header used as redirect destination
-
-package handlers
-
-import (
-	"net/http"
-)
-
-func LogoutHandler(w http.ResponseWriter, r *http.Request) {
-	// Clear session cookie
-	http.SetCookie(w, &http.Cookie{Name: "session", MaxAge: -1})
-
-	returnURL := r.URL.Query().Get("return_url")
-	if returnURL == "" {
-		// Vulnerable: fallback to Referer header — fully attacker-controlled
-		returnURL = r.Header.Get("Referer")
-	}
-	if returnURL == "" {
-		returnURL = "/"
-	}
-	// Vulnerable: redirects to any URL including external sites
-	http.Redirect(w, r, returnURL, http.StatusFound)
-}

package/packages/crucible/seeds/go/seed-051.go

@@ -1,38 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via string equality comparison of API tokens instead of hmac.Equal
-
-package handlers
-
-import (
-	"net/http"
-)
-
-const validAPIToken = "prod-api-token-xK9mP2qRwZ4vBn7"
-
-func APIAuthMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		token := r.Header.Get("X-API-Token")
-		// Vulnerable: == comparison leaks timing information about token correctness
-		if token != validAPIToken {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func verifySignature(expected, actual string) bool {
-	// Also vulnerable: early-exit string comparison
-	if len(expected) != len(actual) {
-		return false
-	}
-	for i := range expected {
-		if expected[i] != actual[i] {
-			return false
-		}
-	}
-	return true
-}

package/packages/crucible/seeds/go/seed-052.go

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: timing_attack
-// severity: medium
-// language: go
-// expected: Timing attack via bytes.Equal comparison of HMAC values instead of hmac.Equal
-
-package security
-
-import (
-	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
-)
-
-func ValidateWebhookSignature(payload []byte, receivedSig, secret string) bool {
-	mac := hmac.New(sha256.New, []byte(secret))
-	mac.Write(payload)
-	expected := mac.Sum(nil)
-	received := []byte(receivedSig)
-	// Vulnerable: bytes.Equal is not constant-time — use hmac.Equal instead
-	return bytes.Equal(expected, received)
-}
-
-func ValidatePasswordHash(storedHash, inputHash string) bool {
-	// Vulnerable: direct string comparison leaks timing information
-	return storedHash == inputHash
-}

package/packages/crucible/seeds/java/seed-001.java

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded database password in constant
-
-import java.sql.Connection;
-import java.sql.DriverManager;
-
-public class DatabaseConfig {
-    private static final String DB_URL      = "jdbc:mysql://prod-db.internal:3306/appdb";
-    private static final String DB_USER     = "app_user";
-    private static final String DB_PASSWORD = "Sup3rS3cr3tP@ssw0rd!";
-
-    public static Connection getConnection() throws Exception {
-        return DriverManager.getConnection(DB_URL, DB_USER, DB_PASSWORD);
-    }
-
-    public static void main(String[] args) throws Exception {
-        Connection conn = getConnection();
-        System.out.println("Connected: " + conn.getMetaData().getURL());
-    }
-}

package/packages/crucible/seeds/java/seed-002.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded AWS access key and secret key in source code
-
-public class AwsClientFactory {
-    private static final String AWS_ACCESS_KEY_ID     = "AKIAIOSFODNN7EXAMPLE";
-    private static final String AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-    private static final String AWS_REGION            = "us-east-1";
-
-    public static software.amazon.awssdk.services.s3.S3Client buildS3Client() {
-        software.amazon.awssdk.auth.credentials.AwsBasicCredentials creds =
-            software.amazon.awssdk.auth.credentials.AwsBasicCredentials.create(
-                AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY);
-        return software.amazon.awssdk.services.s3.S3Client.builder()
-            .credentialsProvider(
-                software.amazon.awssdk.auth.credentials.StaticCredentialsProvider.create(creds))
-            .region(software.amazon.awssdk.regions.Region.of(AWS_REGION))
-            .build();
-    }
-}

package/packages/crucible/seeds/java/seed-003.java

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded JWT signing secret embedded in source
-
-import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.SignatureAlgorithm;
-import java.util.Date;
-
-public class JwtService {
-    // TODO: move to environment variable before deploy
-    private static final String SECRET = "my-super-secret-jwt-key-do-not-share-12345";
-
-    public String generateToken(String subject) {
-        return Jwts.builder()
-            .setSubject(subject)
-            .setIssuedAt(new Date())
-            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
-            .signWith(SignatureAlgorithm.HS256, SECRET)
-            .compact();
-    }
-
-    public boolean validateToken(String token) {
-        Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token);
-        return true;
-    }
-}

package/packages/crucible/seeds/java/seed-004.java

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: java
-// expected: Hardcoded Stripe API key in application constant
-
-import com.stripe.Stripe;
-import com.stripe.model.Charge;
-import java.util.HashMap;
-import java.util.Map;
-
-public class PaymentService {
-    private static final String STRIPE_SECRET_KEY = "sk_live_51HqT4vKZ3VpNm8Yw9fX2rLcD";
-
-    static {
-        Stripe.apiKey = STRIPE_SECRET_KEY;
-    }
-
-    public Charge chargeCard(String token, long amountCents) throws Exception {
-        Map<String, Object> params = new HashMap<>();
-        params.put("amount", amountCents);
-        params.put("currency", "usd");
-        params.put("source", token);
-        return Charge.create(params);
-    }
-}

package/packages/crucible/seeds/java/seed-005.java

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded SMTP password used for email authentication
-
-import java.util.Properties;
-import javax.mail.*;
-import javax.mail.internet.*;
-
-public class EmailNotifier {
-    private static final String SMTP_HOST     = "smtp.company.com";
-    private static final String SMTP_USER     = "notifications@company.com";
-    private static final String SMTP_PASSWORD = "N0tif!c@ti0nP@ss#2024";
-
-    public void sendAlert(String to, String subject, String body) throws MessagingException {
-        Properties props = new Properties();
-        props.put("mail.smtp.auth", "true");
-        props.put("mail.smtp.host", SMTP_HOST);
-        props.put("mail.smtp.port", "587");
-
-        Session session = Session.getInstance(props, new Authenticator() {
-            protected PasswordAuthentication getPasswordAuthentication() {
-                return new PasswordAuthentication(SMTP_USER, SMTP_PASSWORD);
-            }
-        });
-        Message msg = new MimeMessage(session);
-        msg.setRecipients(Message.RecipientType.TO, InternetAddress.parse(to));
-        msg.setSubject(subject);
-        msg.setText(body);
-        Transport.send(msg);
-    }
-}

package/packages/crucible/seeds/java/seed-006.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: java
-// expected: Hardcoded GitHub personal access token in repository client
-
-import java.net.HttpURLConnection;
-import java.net.URL;
-
-public class GitHubClient {
-    private static final String GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345";
-    private static final String API_BASE     = "https://api.github.com";
-
-    public String getRepository(String owner, String repo) throws Exception {
-        URL url = new URL(API_BASE + "/repos/" + owner + "/" + repo);
-        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-        conn.setRequestProperty("Authorization", "token " + GITHUB_TOKEN);
-        conn.setRequestProperty("Accept", "application/vnd.github.v3+json");
-        int status = conn.getResponseCode();
-        return "Status: " + status;
-    }
-}

package/packages/crucible/seeds/java/seed-007.java

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded Redis password and encryption key in configuration class
-
-public class CacheConfig {
-    public static final String REDIS_HOST       = "redis.internal.prod";
-    public static final int    REDIS_PORT       = 6379;
-    public static final String REDIS_PASSWORD   = "RedisP@$$w0rd#Prod";
-    public static final String ENCRYPTION_KEY   = "AES256KeyForCacheEncryption9876!";
-    public static final String ENCRYPTION_SALT  = "SaltVal!2024";
-
-    public static String getRedisUri() {
-        return String.format("redis://:%s@%s:%d", REDIS_PASSWORD, REDIS_HOST, REDIS_PORT);
-    }
-
-    public static byte[] getEncryptionKeyBytes() {
-        return ENCRYPTION_KEY.getBytes();
-    }
-}