thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/java/seed-008.java

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: java
-// expected: Hardcoded OAuth2 client secret in Spring Security configuration
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.AuthorizationGrantType;
-
-@Configuration
-public class OAuth2Config {
-    private static final String CLIENT_ID     = "my-app-client-id-prod";
-    private static final String CLIENT_SECRET = "oauth2-client-secret-xK9mP2qR7wZ4";
-
-    @Bean
-    public ClientRegistration googleClientRegistration() {
-        return ClientRegistration.withRegistrationId("google")
-            .clientId(CLIENT_ID)
-            .clientSecret(CLIENT_SECRET)
-            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
-            .scope("openid", "profile", "email")
-            .authorizationUri("https://accounts.google.com/o/oauth2/auth")
-            .tokenUri("https://oauth2.googleapis.com/token")
-            .build();
-    }
-}

package/packages/crucible/seeds/java/seed-009.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection via string concatenation in executeQuery
-
-import java.sql.*;
-
-public class UserRepository {
-    private Connection conn;
-
-    public ResultSet findByUsername(String username) throws SQLException {
-        // Vulnerable: direct string concatenation into SQL
-        String query = "SELECT * FROM users WHERE username = '" + username + "'";
-        Statement stmt = conn.createStatement();
-        return stmt.executeQuery(query);
-    }
-
-    public boolean deleteUser(String userId) throws SQLException {
-        String sql = "DELETE FROM users WHERE id = " + userId;
-        Statement stmt = conn.createStatement();
-        return stmt.executeUpdate(sql) > 0;
-    }
-}

package/packages/crucible/seeds/java/seed-010.java

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection via string concatenation in login query
-
-import java.sql.*;
-import javax.servlet.http.*;
-
-public class LoginServlet extends HttpServlet {
-    private Connection conn;
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        String user = req.getParameter("username");
-        String pass = req.getParameter("password");
-
-        // Vulnerable: both parameters concatenated directly
-        String sql = "SELECT id FROM accounts WHERE username='" + user +
-                     "' AND password='" + pass + "'";
-        Statement st = conn.createStatement();
-        ResultSet rs = st.executeQuery(sql);
-        if (rs.next()) {
-            req.getSession().setAttribute("userId", rs.getInt("id"));
-            resp.sendRedirect("/dashboard");
-        } else {
-            resp.sendRedirect("/login?error=1");
-        }
-    }
-}

package/packages/crucible/seeds/java/seed-011.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection via String.format building ORDER BY clause
-
-import java.sql.*;
-import java.util.ArrayList;
-import java.util.List;
-
-public class ProductSearch {
-    private Connection conn;
-
-    public List<String> searchProducts(String keyword, String sortColumn) throws SQLException {
-        // Vulnerable: sortColumn injected into ORDER BY without validation
-        String sql = String.format(
-            "SELECT name FROM products WHERE name LIKE '%%%s%%' ORDER BY %s",
-            keyword, sortColumn);
-        Statement stmt = conn.createStatement();
-        ResultSet rs = stmt.executeQuery(sql);
-        List<String> results = new ArrayList<>();
-        while (rs.next()) results.add(rs.getString("name"));
-        return results;
-    }
-}

package/packages/crucible/seeds/java/seed-012.java

@@ -1,20 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection through dynamic table name construction
-
-import java.sql.*;
-
-public class ReportGenerator {
-    private Connection conn;
-
-    public ResultSet generateReport(String reportType, String startDate, String endDate)
-            throws SQLException {
-        // Vulnerable: reportType used as table name without sanitization
-        String query = "SELECT * FROM " + reportType +
-                       " WHERE created_at BETWEEN '" + startDate + "' AND '" + endDate + "'";
-        Statement stmt = conn.createStatement();
-        return stmt.executeQuery(query);
-    }
-}

package/packages/crucible/seeds/java/seed-013.java

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection in search with multiple concatenated parameters
-
-import java.sql.*;
-import javax.servlet.http.*;
-
-public class SearchServlet extends HttpServlet {
-    private Connection conn;
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        String name  = req.getParameter("name");
-        String email = req.getParameter("email");
-        String role  = req.getParameter("role");
-
-        // Vulnerable: three user params concatenated
-        String query = "SELECT * FROM employees WHERE name LIKE '%" + name +
-                       "%' AND email = '" + email + "' AND role = '" + role + "'";
-        Statement stmt = conn.createStatement();
-        ResultSet rs = stmt.executeQuery(query);
-        // ... render results
-    }
-}

package/packages/crucible/seeds/java/seed-014.java

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection via stored procedure call with string concatenation
-
-import java.sql.*;
-
-public class AuditLogger {
-    private Connection conn;
-
-    public void logEvent(String userId, String action, String detail) throws SQLException {
-        // Vulnerable: detail field concatenated into EXEC call
-        String sql = "EXEC sp_log_audit '" + userId + "', '" + action + "', '" + detail + "'";
-        Statement stmt = conn.createStatement();
-        stmt.execute(sql);
-    }
-
-    public ResultSet getAuditTrail(String fromDate) throws SQLException {
-        String query = "SELECT * FROM audit_log WHERE event_time >= '" + fromDate + "'";
-        return conn.createStatement().executeQuery(query);
-    }
-}

package/packages/crucible/seeds/java/seed-015.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: java
-// expected: SQL injection via IN clause built with user-supplied comma-separated IDs
-
-import java.sql.*;
-import java.util.List;
-
-public class BatchProcessor {
-    private Connection conn;
-
-    public ResultSet getOrdersByIds(String rawIds) throws SQLException {
-        // Vulnerable: rawIds (e.g. "1,2,3") injected directly into IN clause
-        String sql = "SELECT * FROM orders WHERE id IN (" + rawIds + ")";
-        Statement stmt = conn.createStatement();
-        return stmt.executeQuery(sql);
-    }
-
-    public int bulkUpdateStatus(String idList, String status) throws SQLException {
-        String sql = "UPDATE orders SET status='" + status +
-                     "' WHERE id IN (" + idList + ")";
-        return conn.createStatement().executeUpdate(sql);
-    }
-}

package/packages/crucible/seeds/java/seed-016.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via PrintWriter writing unescaped request parameter to response
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class GreetingServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        String name = req.getParameter("name");
-        // Vulnerable: name reflected directly into HTML without encoding
-        out.println("<html><body>");
-        out.println("<h1>Hello, " + name + "!</h1>");
-        out.println("<p>Welcome back to our portal.</p>");
-        out.println("</body></html>");
-    }
-}

package/packages/crucible/seeds/java/seed-017.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via response.getWriter writing unescaped search query into page
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class SearchResultsServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String query = req.getParameter("q");
-        PrintWriter pw = resp.getWriter();
-        resp.setContentType("text/html; charset=UTF-8");
-        // Vulnerable: raw query injected into meta and visible output
-        pw.write("<!DOCTYPE html><html><head>");
-        pw.write("<meta name=\"description\" content=\"Results for: " + query + "\">");
-        pw.write("</head><body>");
-        pw.write("<h2>Search results for: <em>" + query + "</em></h2>");
-        pw.write("<div id=\"results\"><!-- results here --></div>");
-        pw.write("</body></html>");
-    }
-}

package/packages/crucible/seeds/java/seed-018.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via JSP-style out.print with unescaped error message from request
-
-import java.io.*;
-import javax.servlet.http.*;
-import javax.servlet.*;
-
-public class ErrorPageServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, ServletException {
-        String errorMsg = req.getParameter("message");
-        String code     = req.getParameter("code");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        // Vulnerable: both parameters written without sanitization
-        out.print("<div class=\"alert alert-danger\">");
-        out.print("Error " + code + ": " + errorMsg);
-        out.print("</div>");
-        out.print("<a href=\"/\">Return home</a>");
-    }
-}

package/packages/crucible/seeds/java/seed-019.java

@@ -1,38 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: Stored XSS — user-supplied comment written to DB then reflected without escaping
-
-import java.io.*;
-import java.sql.*;
-import javax.servlet.http.*;
-
-public class CommentServlet extends HttpServlet {
-    private Connection conn;
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, SQLException {
-        String comment  = req.getParameter("comment");
-        String username = req.getParameter("username");
-        // Store raw (vulnerable: no sanitization before storage)
-        PreparedStatement ps = conn.prepareStatement(
-            "INSERT INTO comments(username, body) VALUES (?, ?)");
-        ps.setString(1, username);
-        ps.setString(2, comment);
-        ps.executeUpdate();
-        resp.sendRedirect("/comments");
-    }
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, SQLException {
-        PrintWriter out = resp.getWriter();
-        ResultSet rs = conn.createStatement().executeQuery(
-            "SELECT username, body FROM comments ORDER BY id DESC LIMIT 20");
-        while (rs.next()) {
-            // Vulnerable: stored comment reflected without escaping
-            out.println("<div><b>" + rs.getString("username") + "</b>: "
-                + rs.getString("body") + "</div>");
-        }
-    }
-}

package/packages/crucible/seeds/java/seed-020.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via JSON response that directly embeds user input in HTML script block
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ProfileServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String username    = req.getParameter("user");
-        String redirectUrl = req.getParameter("next");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        // Vulnerable: user input injected into inline JS
-        out.println("<script>");
-        out.println("var currentUser = \"" + username + "\";");
-        out.println("var nextUrl = \"" + redirectUrl + "\";");
-        out.println("window.location = nextUrl;");
-        out.println("</script>");
-    }
-}

package/packages/crucible/seeds/java/seed-021.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: java
-// expected: XSS via setAttribute building HTML string with user input
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class BadgeServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String label = req.getParameter("label");
-        String color = req.getParameter("color");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        // Vulnerable: color and label injected into style/text attributes
-        String html = "<span style=\"background-color:" + color +
-                      "; padding:4px; border-radius:3px;\">" + label + "</span>";
-        out.println("<html><body>" + html + "</body></html>");
-    }
-}

package/packages/crucible/seeds/java/seed-022.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: java
-// expected: XSS via HttpServletResponse writer echoing HTTP Referer header
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ReferrerLogServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: Referer header reflected directly into HTML
-        String referer = req.getHeader("Referer");
-        resp.setContentType("text/html");
-        PrintWriter out = resp.getWriter();
-        out.println("<!DOCTYPE html><html><body>");
-        out.println("<p>You came from: " + referer + "</p>");
-        out.println("<p>Thank you for visiting us!</p>");
-        out.println("</body></html>");
-    }
-}

package/packages/crucible/seeds/java/seed-023.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-supplied filename
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileProcessorServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("filename");
-        // Vulnerable: filename injected into shell command via Runtime.exec
-        String cmd = "convert /uploads/" + filename + " /processed/" + filename + ".pdf";
-        Process proc = Runtime.getRuntime().exec(cmd);
-        int exitCode;
-        try { exitCode = proc.waitFor(); } catch (InterruptedException e) { exitCode = -1; }
-        PrintWriter out = resp.getWriter();
-        out.println("Exit: " + exitCode);
-    }
-}

package/packages/crucible/seeds/java/seed-024.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec array form with unsanitized user argument
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class PingServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String host = req.getParameter("host");
-        // Vulnerable: passing through shell with -c allows injection
-        String[] cmd = {"/bin/sh", "-c", "ping -c 4 " + host};
-        Process proc = Runtime.getRuntime().exec(cmd);
-        BufferedReader reader = new BufferedReader(
-            new InputStreamReader(proc.getInputStream()));
-        PrintWriter out = resp.getWriter();
-        String line;
-        while ((line = reader.readLine()) != null) {
-            out.println(line + "<br>");
-        }
-    }
-}

package/packages/crucible/seeds/java/seed-025.java

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via ProcessBuilder with user-controlled arguments
-
-import java.io.*;
-import java.util.Arrays;
-import javax.servlet.http.*;
-
-public class ImageResizerServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String inputFile  = req.getParameter("input");
-        String width      = req.getParameter("width");
-        String height     = req.getParameter("height");
-        // Vulnerable: width/height not validated, passed to shell via ProcessBuilder
-        ProcessBuilder pb = new ProcessBuilder(
-            "/bin/sh", "-c",
-            "ffmpeg -i " + inputFile + " -vf scale=" + width + ":" + height + " out.mp4");
-        pb.redirectErrorStream(true);
-        Process p = pb.start();
-        PrintWriter out = resp.getWriter();
-        new BufferedReader(new InputStreamReader(p.getInputStream()))
-            .lines().forEach(l -> out.println(l));
-    }
-}

package/packages/crucible/seeds/java/seed-026.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-supplied email address
-
-import java.io.*;
-
-public class MailSender {
-    public void sendReport(String email, String reportPath) throws IOException {
-        // Vulnerable: email address concatenated directly into sendmail command
-        String command = "sendmail -v " + email + " < " + reportPath;
-        Process proc = Runtime.getRuntime().exec(
-            new String[]{"/bin/sh", "-c", command});
-        try {
-            proc.waitFor();
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-        }
-    }
-
-    public static void main(String[] args) throws IOException {
-        new MailSender().sendReport(args[0], "/reports/monthly.txt");
-    }
-}

package/packages/crucible/seeds/java/seed-027.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec with user-controlled zip archive name
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ArchiveServlet extends HttpServlet {
-    private static final String ARCHIVE_DIR = "/var/archives/";
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String archiveName = req.getParameter("name");
-        String targetDir   = req.getParameter("dir");
-        // Vulnerable: both parameters injected into unzip command
-        String cmd = "unzip " + ARCHIVE_DIR + archiveName + " -d " + targetDir;
-        Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
-        resp.getWriter().println("Extracting archive...");
-    }
-}

package/packages/crucible/seeds/java/seed-028.java

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: java
-// expected: Command injection via Runtime.exec nslookup with user-supplied domain
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class DnsLookupServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String domain = req.getParameter("domain");
-        // Vulnerable: domain not sanitized before exec
-        Process proc = Runtime.getRuntime().exec("nslookup " + domain);
-        InputStream is = proc.getInputStream();
-        byte[] buf = is.readAllBytes();
-        resp.setContentType("text/plain");
-        resp.getWriter().write(new String(buf));
-    }
-}

package/packages/crucible/seeds/java/seed-029.java

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via new File(basePath + userInput) without normalization
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileDownloadServlet extends HttpServlet {
-    private static final String BASE_DIR = "/var/app/uploads/";
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("file");
-        // Vulnerable: no normalization or containment check
-        File file = new File(BASE_DIR + filename);
-        resp.setContentType("application/octet-stream");
-        resp.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");
-        try (FileInputStream fis = new FileInputStream(file)) {
-            byte[] buf = new byte[4096];
-            int n;
-            while ((n = fis.read(buf)) != -1) {
-                resp.getOutputStream().write(buf, 0, n);
-            }
-        }
-    }
-}

package/packages/crucible/seeds/java/seed-030.java

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via FileInputStream constructed from user-supplied path
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ConfigViewerServlet extends HttpServlet {
-    private static final String CONFIG_ROOT = "/etc/app/configs/";
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String configName = req.getParameter("config");
-        // Vulnerable: traversal allows reading arbitrary files (e.g. ../../etc/passwd)
-        FileInputStream fis = new FileInputStream(CONFIG_ROOT + configName);
-        BufferedReader reader = new BufferedReader(new InputStreamReader(fis));
-        PrintWriter out = resp.getWriter();
-        resp.setContentType("text/plain");
-        String line;
-        while ((line = reader.readLine()) != null) {
-            out.println(line);
-        }
-        fis.close();
-    }
-}

package/packages/crucible/seeds/java/seed-031.java

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via Paths.get with user input enabling directory escape
-
-import java.io.*;
-import java.nio.file.*;
-import javax.servlet.http.*;
-
-public class TemplateServlet extends HttpServlet {
-    private static final Path TEMPLATE_DIR = Paths.get("/opt/app/templates");
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String templateName = req.getParameter("template");
-        // Vulnerable: resolve without startsWith check allows traversal
-        Path templatePath = TEMPLATE_DIR.resolve(templateName);
-        byte[] content = Files.readAllBytes(templatePath);
-        resp.setContentType("text/html");
-        resp.getOutputStream().write(content);
-    }
-}

package/packages/crucible/seeds/java/seed-032.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal in file delete endpoint with user-controlled filename
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FileManagerServlet extends HttpServlet {
-    private static final String UPLOAD_DIR = "/var/uploads/";
-
-    protected void doDelete(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String filename = req.getParameter("name");
-        // Vulnerable: attacker can delete arbitrary files via ../
-        File target = new File(UPLOAD_DIR + filename);
-        boolean deleted = target.delete();
-        resp.setContentType("application/json");
-        resp.getWriter().println("{\"deleted\":" + deleted + "}");
-    }
-}