thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/python/seed-027 2.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})

package/packages/crucible/seeds/python/seed-027.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: high
-# language: python
-# expected: command injection via paramiko exec_command with user-controlled command string
-
-import paramiko
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def get_ssh_client(host: str) -> paramiko.SSHClient:
-    client = paramiko.SSHClient()
-    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    client.connect(host, username="deploy", key_filename="/home/deploy/.ssh/id_rsa")
-    return client
-
-
-@app.route("/ssh/run", methods=["POST"])
-def run_remote_command():
-    data = request.get_json()
-    host = data.get("host", "")
-    # command from user — attacker appends malicious commands
-    command = data.get("command", "")
-    allowed_hosts = ["web-01.internal", "web-02.internal"]
-    if host not in allowed_hosts:
-        return jsonify({"error": "Host not allowed"}), 403
-
-    client = get_ssh_client(host)
-    # command not validated — attacker sends "ls; cat /etc/shadow"
-    stdin, stdout, stderr = client.exec_command(command)
-    output = stdout.read().decode()
-    client.close()
-    return jsonify({"output": output})

package/packages/crucible/seeds/python/seed-028 2.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/packages/crucible/seeds/python/seed-028.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: command_injection
-# severity: critical
-# language: python
-# expected: command injection via subprocess.run with shell=True and user-controlled git operation
-
-import subprocess
-from dataclasses import dataclass
-
-
-@dataclass
-class GitConfig:
-    repo_path: str
-    branch: str      # user-controlled
-    remote: str = "origin"
-
-
-class GitService:
-    def clone(self, repo_url: str, target: str) -> str:
-        # repo_url from user — injection possible
-        result = subprocess.run(
-            f"git clone {repo_url} {target}", shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def checkout(self, cfg: GitConfig) -> str:
-        # cfg.branch from user — "main; cat /etc/passwd > /tmp/leak"
-        result = subprocess.run(
-            f"git -C {cfg.repo_path} checkout {cfg.branch}",
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def tag(self, repo: str, tag_name: str, message: str) -> str:
-        result = subprocess.run(
-            f'git -C {repo} tag -a {tag_name} -m "{message}"',
-            shell=True, capture_output=True, text=True
-        )
-        return result.stdout
-
-    def archive(self, repo: str, branch: str, output_file: str) -> None:
-        subprocess.run(f"git -C {repo} archive {branch} > {output_file}", shell=True)

package/packages/crucible/seeds/python/seed-029.py

@@ -1,42 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via open() with unvalidated user-supplied file path
-
-import os
-from flask import Flask, request, send_file, abort
-
-app = Flask(__name__)
-
-BASE_DIR = "/var/app/public/files"
-
-
-@app.route("/files/<path:filename>")
-def serve_file(filename: str):
-    # path.join does NOT prevent traversal — "../../etc/passwd" resolves outside BASE_DIR
-    file_path = os.path.join(BASE_DIR, filename)
-    try:
-        with open(file_path, "rb") as f:
-            return f.read()
-    except FileNotFoundError:
-        abort(404)
-
-
-@app.route("/download")
-def download():
-    file_path = request.args.get("path", "")
-    # Completely unvalidated path — reads arbitrary files
-    try:
-        with open(file_path, "r") as f:
-            return f.read()
-    except Exception as e:
-        return str(e), 400
-
-
-@app.route("/logs/view")
-def view_log():
-    log_name = request.args.get("log", "app.log")
-    log_path = f"/var/log/app/{log_name}"
-    with open(log_path, "r") as f:
-        return f.read()

package/packages/crucible/seeds/python/seed-030 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())

package/packages/crucible/seeds/python/seed-030.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal in Django view via user-controlled filename parameter
-
-import os
-from django.http import FileResponse, Http404, HttpResponse
-from django.conf import settings
-
-
-def serve_user_file(request, user_id: str):
-    filename = request.GET.get("file", "")
-    # No normalization — filename can be "../../../etc/passwd"
-    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
-    try:
-        return FileResponse(open(file_path, "rb"))
-    except FileNotFoundError:
-        raise Http404("File not found")
-
-
-def export_report(request):
-    report_name = request.GET.get("report", "monthly")
-    locale = request.GET.get("locale", "en")
-    # Both report_name and locale inserted into path — traversal possible
-    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
-    if not os.path.exists(path):
-        raise Http404
-    with open(path, "rb") as f:
-        return HttpResponse(f.read(), content_type="application/pdf")
-
-
-def read_template(request):
-    template = request.GET.get("template", "welcome")
-    path = f"{settings.TEMPLATES_DIR}/{template}.html"
-    with open(path) as f:
-        return HttpResponse(f.read())

package/packages/crucible/seeds/python/seed-031 2.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()

package/packages/crucible/seeds/python/seed-031.py

@@ -1,34 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via zipfile extraction without entry path validation (zip-slip)
-
-import os
-import zipfile
-
-
-EXTRACT_BASE = "/var/app/uploads/extracted"
-
-
-def extract_archive(zip_bytes: bytes, user_id: str) -> list:
-    import io
-    extracted = []
-    with zipfile.ZipFile(io.BytesIO(zip_bytes)) as zf:
-        for entry in zf.infolist():
-            # entry.filename can contain "../" — writes outside EXTRACT_BASE
-            output_path = os.path.join(EXTRACT_BASE, user_id, entry.filename)
-            if entry.is_dir():
-                os.makedirs(output_path, exist_ok=True)
-            else:
-                os.makedirs(os.path.dirname(output_path), exist_ok=True)
-                with zf.open(entry) as src, open(output_path, "wb") as dst:
-                    dst.write(src.read())
-                extracted.append(output_path)
-    return extracted
-
-
-def get_extracted_file(user_id: str, relative_path: str) -> bytes:
-    full_path = os.path.join(EXTRACT_BASE, user_id, relative_path)
-    with open(full_path, "rb") as f:
-        return f.read()

package/packages/crucible/seeds/python/seed-032.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: medium
-# language: python
-# expected: path traversal via Flask send_from_directory with user-controlled subdirectory
-
-import os
-from flask import Flask, request, send_from_directory, abort
-
-app = Flask(__name__)
-
-UPLOADS_ROOT = "/var/uploads"
-
-
-@app.route("/uploads/<user_id>/files")
-def list_files(user_id: str):
-    subdir = request.args.get("folder", "")
-    # user_id and subdir can include "../" to escape UPLOADS_ROOT
-    target_dir = os.path.join(UPLOADS_ROOT, user_id, subdir)
-    try:
-        files = os.listdir(target_dir)
-        return {"files": files}
-    except FileNotFoundError:
-        abort(404)
-
-
-@app.route("/uploads/<user_id>/get")
-def get_file(user_id: str):
-    filename = request.args.get("name", "")
-    directory = request.args.get("dir", "")
-    # send_from_directory with user-controlled directory + filename
-    full_dir = os.path.join(UPLOADS_ROOT, user_id, directory)
-    return send_from_directory(full_dir, filename)

package/packages/crucible/seeds/python/seed-033.py

@@ -1,32 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: path_traversal
-# severity: high
-# language: python
-# expected: path traversal via FastAPI file endpoint with unvalidated path parameter
-
-import os
-from fastapi import FastAPI, Query
-from fastapi.responses import FileResponse, PlainTextResponse
-
-app = FastAPI()
-
-STATIC_ROOT = "/var/app/static"
-
-
-@app.get("/static/{file_path:path}")
-async def serve_static(file_path: str):
-    # file_path can be "../../etc/passwd" — no normalization or boundary check
-    full_path = os.path.join(STATIC_ROOT, file_path)
-    if not os.path.isfile(full_path):
-        return PlainTextResponse("Not found", status_code=404)
-    return FileResponse(full_path)
-
-
-@app.get("/config/view")
-async def view_config(name: str = Query(...)):
-    config_path = f"/etc/myapp/{name}.conf"
-    try:
-        with open(config_path) as f:
-            return {"content": f.read()}
-    except FileNotFoundError:
-        return {"error": "Config not found"}, 404

package/packages/crucible/seeds/python/seed-034.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for password hashing
-
-import hashlib
-import psycopg2
-
-
-def get_db():
-    return psycopg2.connect(host="localhost", dbname="app", user="app", password="app")
-
-
-def hash_password(password: str) -> str:
-    # MD5 is cryptographically broken — must not be used for passwords
-    return hashlib.md5(password.encode()).hexdigest()
-
-
-def register_user(email: str, password: str) -> None:
-    conn = get_db()
-    cur = conn.cursor()
-    pw_hash = hash_password(password)
-    cur.execute("INSERT INTO users (email, password_hash) VALUES (%s, %s)", (email, pw_hash))
-    conn.commit()
-
-
-def login_user(email: str, password: str) -> bool:
-    conn = get_db()
-    cur = conn.cursor()
-    pw_hash = hash_password(password)
-    cur.execute("SELECT id FROM users WHERE email = %s AND password_hash = %s", (email, pw_hash))
-    return cur.fetchone() is not None
-
-
-def hash_file(file_path: str) -> str:
-    with open(file_path, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()

package/packages/crucible/seeds/python/seed-035.py

@@ -1,35 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: SHA1 used for password hashing and random.random() for token generation
-
-import hashlib
-import random
-import time
-
-
-def hash_password(password: str, salt: str = "") -> str:
-    # SHA-1 is deprecated for security-sensitive hashing
-    return hashlib.sha1((salt + password).encode()).hexdigest()
-
-
-def generate_session_token() -> str:
-    # random.random() is not cryptographically secure
-    return hex(int(random.random() * 10**18))[2:]
-
-
-def generate_reset_token(user_id: int) -> str:
-    # Predictable — only uses timestamp and non-secure random
-    return hashlib.sha1(f"{user_id}-{time.time()}-{random.randint(0, 999999)}".encode()).hexdigest()
-
-
-def create_api_key(user_id: str) -> str:
-    # Weak entropy source — easily guessable
-    rand = random.getrandbits(32)
-    return hashlib.md5(f"{user_id}{rand}".encode()).hexdigest()
-
-
-def generate_otp() -> str:
-    # random.randint is predictable — use secrets.randbelow instead
-    return str(random.randint(100000, 999999))

package/packages/crucible/seeds/python/seed-036 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()

package/packages/crucible/seeds/python/seed-036.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: DES cipher usage and AES-ECB mode with static key
-
-from Crypto.Cipher import DES, AES
-import base64
-
-DES_KEY = b"weakkey!"  # 8 bytes — DES is broken
-AES_KEY = b"0123456789abcdef"  # 16 bytes
-
-
-def des_encrypt(data: str) -> str:
-    # DES has only 56-bit effective key length — trivially brute-forced
-    padded = data + " " * (8 - len(data) % 8)
-    cipher = DES.new(DES_KEY, DES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded.encode())).decode()
-
-
-def aes_ecb_encrypt(data: str) -> str:
-    # ECB mode: identical plaintext blocks produce identical ciphertext blocks
-    pad_len = 16 - len(data) % 16
-    padded = (data + chr(pad_len) * pad_len).encode()
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    return base64.b64encode(cipher.encrypt(padded)).decode()
-
-
-def aes_ecb_decrypt(ciphertext: str) -> str:
-    cipher = AES.new(AES_KEY, AES.MODE_ECB)
-    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
-    pad_len = decrypted[-1]
-    return decrypted[:-pad_len].decode()

package/packages/crucible/seeds/python/seed-037 2.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True

package/packages/crucible/seeds/python/seed-037.py

@@ -1,41 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: medium
-# language: python
-# expected: timing attack via string comparison of HMAC signatures, low-iteration PBKDF2
-
-import hmac
-import hashlib
-
-
-WEBHOOK_SECRET = b"static-webhook-secret-2024"
-
-
-def compute_signature(payload: bytes) -> str:
-    return hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).hexdigest()
-
-
-def verify_signature(payload: bytes, received_sig: str) -> bool:
-    expected = compute_signature(payload)
-    # String comparison leaks timing info — use hmac.compare_digest instead
-    return expected == received_sig
-
-
-def verify_api_key(provided: str, stored: str) -> bool:
-    # Direct equality — timing side-channel attack possible
-    return provided == stored
-
-
-def derive_key(password: str) -> bytes:
-    # Only 1000 iterations — far below NIST recommendation of 600,000+
-    return hashlib.pbkdf2_hmac("sha1", password.encode(), b"static-salt", 1000)
-
-
-def check_token(token_a: str, token_b: str) -> bool:
-    # Char-by-char comparison leaks prefix matches
-    if len(token_a) != len(token_b):
-        return False
-    for a, b in zip(token_a, token_b):
-        if a != b:
-            return False
-    return True

package/packages/crucible/seeds/python/seed-038 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)