thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/python/seed-038.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: insecure_crypto
-# severity: high
-# language: python
-# expected: MD5 used for file integrity and RSA with insufficient key size
-
-import hashlib
-from Crypto.PublicKey import RSA
-from Crypto.Signature import pkcs1_15
-from Crypto.Hash import MD5
-
-
-def checksum_file(filepath: str) -> str:
-    # MD5 is collision-prone — not suitable for integrity verification
-    with open(filepath, "rb") as f:
-        return hashlib.md5(f.read()).hexdigest()
-
-
-def verify_file_integrity(filepath: str, expected_md5: str) -> bool:
-    return checksum_file(filepath) == expected_md5
-
-
-def generate_rsa_keypair():
-    # 512-bit RSA key — trivially factorable in seconds
-    key = RSA.generate(512)
-    return key.export_key().decode(), key.publickey().export_key().decode()
-
-
-def sign_with_md5(private_key_pem: str, message: bytes) -> bytes:
-    key = RSA.import_key(private_key_pem)
-    # MD5 with RSA — known-weak combination
-    h = MD5.new(message)
-    return pkcs1_15.new(key).sign(h)

package/packages/crucible/seeds/python/seed-039 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval() called with user-controlled expression string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/calculate", methods=["POST"])
-def calculate():
-    data = request.get_json()
-    expression = data.get("expression", "")
-    try:
-        # Attacker sends: "__import__('os').system('id')"
-        result = eval(expression)
-        return jsonify({"result": result})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/filter", methods=["POST"])
-def filter_data():
-    data = request.get_json()
-    records = data.get("records", [])
-    condition = data.get("condition", "True")
-    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
-    filtered = [r for r in records if eval(condition, {"r": r})]
-    return jsonify({"results": filtered})
-
-
-@app.route("/transform", methods=["POST"])
-def transform():
-    expr = request.get_json().get("expr", "x")
-    items = request.get_json().get("items", [1, 2, 3])
-    result = list(map(lambda x: eval(expr), items))
-    return jsonify({"result": result})

package/packages/crucible/seeds/python/seed-039.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval() called with user-controlled expression string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/calculate", methods=["POST"])
-def calculate():
-    data = request.get_json()
-    expression = data.get("expression", "")
-    try:
-        # Attacker sends: "__import__('os').system('id')"
-        result = eval(expression)
-        return jsonify({"result": result})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/filter", methods=["POST"])
-def filter_data():
-    data = request.get_json()
-    records = data.get("records", [])
-    condition = data.get("condition", "True")
-    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
-    filtered = [r for r in records if eval(condition, {"r": r})]
-    return jsonify({"results": filtered})
-
-
-@app.route("/transform", methods=["POST"])
-def transform():
-    expr = request.get_json().get("expr", "x")
-    items = request.get_json().get("items", [1, 2, 3])
-    result = list(map(lambda x: eval(expr), items))
-    return jsonify({"result": result})

package/packages/crucible/seeds/python/seed-040 2.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: exec() called with user-controlled code string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/scripting/run", methods=["POST"])
-def run_script():
-    data = request.get_json()
-    code = data.get("code", "")
-    context = data.get("context", {})
-    local_vars = {"result": None, **context}
-    try:
-        # exec() executes arbitrary Python — no sandboxing
-        exec(code, {"__builtins__": __builtins__}, local_vars)
-        return jsonify({"result": local_vars.get("result")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/hooks/execute", methods=["POST"])
-def execute_hook():
-    hook_code = request.get_json().get("hook", "")
-    event = request.get_json().get("event", {})
-    # User-controlled hook code executed server-side
-    exec(hook_code, {"event": event, "print": print})
-    return jsonify({"executed": True})
-
-
-@app.route("/migration/run", methods=["POST"])
-def run_migration():
-    migration_script = request.get_json().get("script", "")
-    exec(compile(migration_script, "<migration>", "exec"))
-    return jsonify({"status": "done"})

package/packages/crucible/seeds/python/seed-040.py

@@ -1,39 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: exec() called with user-controlled code string
-
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/scripting/run", methods=["POST"])
-def run_script():
-    data = request.get_json()
-    code = data.get("code", "")
-    context = data.get("context", {})
-    local_vars = {"result": None, **context}
-    try:
-        # exec() executes arbitrary Python — no sandboxing
-        exec(code, {"__builtins__": __builtins__}, local_vars)
-        return jsonify({"result": local_vars.get("result")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/hooks/execute", methods=["POST"])
-def execute_hook():
-    hook_code = request.get_json().get("hook", "")
-    event = request.get_json().get("event", {})
-    # User-controlled hook code executed server-side
-    exec(hook_code, {"event": event, "print": print})
-    return jsonify({"executed": True})
-
-
-@app.route("/migration/run", methods=["POST"])
-def run_migration():
-    migration_script = request.get_json().get("script", "")
-    exec(compile(migration_script, "<migration>", "exec"))
-    return jsonify({"status": "done"})

package/packages/crucible/seeds/python/seed-041 2.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() used in Jinja2-like custom template rendering with user template string
-
-import re
-from flask import Flask, request
-
-app = Flask(__name__)
-
-
-def render_template(template: str, context: dict) -> str:
-    """Simple template renderer that evaluates {{ expr }} blocks."""
-    def evaluate(match):
-        expr = match.group(1).strip()
-        # eval with user-controlled expression — attacker injects arbitrary Python
-        return str(eval(expr, {"__builtins__": {}}, context))
-
-    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
-
-
-@app.route("/preview", methods=["POST"])
-def preview():
-    data = request.get_json()
-    template = data.get("template", "Hello {{ name }}!")
-    ctx = data.get("context", {"name": "World"})
-    # Attacker template: "{{ __import__('os').system('id') }}"
-    output = render_template(template, ctx)
-    return output
-
-
-@app.route("/report", methods=["POST"])
-def report():
-    tpl = request.form.get("template", "")
-    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
-    return rendered

package/packages/crucible/seeds/python/seed-041.py

@@ -1,37 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() used in Jinja2-like custom template rendering with user template string
-
-import re
-from flask import Flask, request
-
-app = Flask(__name__)
-
-
-def render_template(template: str, context: dict) -> str:
-    """Simple template renderer that evaluates {{ expr }} blocks."""
-    def evaluate(match):
-        expr = match.group(1).strip()
-        # eval with user-controlled expression — attacker injects arbitrary Python
-        return str(eval(expr, {"__builtins__": {}}, context))
-
-    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)
-
-
-@app.route("/preview", methods=["POST"])
-def preview():
-    data = request.get_json()
-    template = data.get("template", "Hello {{ name }}!")
-    ctx = data.get("context", {"name": "World"})
-    # Attacker template: "{{ __import__('os').system('id') }}"
-    output = render_template(template, ctx)
-    return output
-
-
-@app.route("/report", methods=["POST"])
-def report():
-    tpl = request.form.get("template", "")
-    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
-    return rendered

package/packages/crucible/seeds/python/seed-042 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() in pandas query/eval with user-controlled expression
-
-import pandas as pd
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-# Simulated data store
-DATA = pd.DataFrame({
-    "id": range(1, 101),
-    "amount": [i * 10.5 for i in range(1, 101)],
-    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
-    "active": [True] * 100,
-})
-
-
-@app.route("/data/query", methods=["POST"])
-def query_data():
-    body = request.get_json()
-    filter_expr = body.get("filter", "active == True")
-    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
-    # Attacker: "@__import__('os').system('id')"
-    try:
-        result = DATA.query(filter_expr)
-        return jsonify({"count": len(result), "data": result.to_dict("records")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/data/eval", methods=["POST"])
-def eval_expression():
-    expr = request.get_json().get("expr", "amount * 2")
-    result = DATA.eval(expr)
-    return jsonify({"result": result.tolist()})

package/packages/crucible/seeds/python/seed-042.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: high
-# language: python
-# expected: eval() in pandas query/eval with user-controlled expression
-
-import pandas as pd
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-# Simulated data store
-DATA = pd.DataFrame({
-    "id": range(1, 101),
-    "amount": [i * 10.5 for i in range(1, 101)],
-    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
-    "active": [True] * 100,
-})
-
-
-@app.route("/data/query", methods=["POST"])
-def query_data():
-    body = request.get_json()
-    filter_expr = body.get("filter", "active == True")
-    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
-    # Attacker: "@__import__('os').system('id')"
-    try:
-        result = DATA.query(filter_expr)
-        return jsonify({"count": len(result), "data": result.to_dict("records")})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 400
-
-
-@app.route("/data/eval", methods=["POST"])
-def eval_expression():
-    expr = request.get_json().get("expr", "amount * 2")
-    result = DATA.eval(expr)
-    return jsonify({"result": result.tolist()})

package/packages/crucible/seeds/python/seed-043 2.py

@@ -1,32 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval()/compile() used to execute user-uploaded Python module code
-
-import ast
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def safe_eval(code: str, context: dict) -> object:
-    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
-    try:
-        tree = ast.parse(code, mode="eval")
-        # compile() + eval() of user AST still allows dangerous constructs
-        compiled = compile(tree, "<user-input>", "eval")
-        return eval(compiled, {"__builtins__": __builtins__}, context)
-    except SyntaxError:
-        # Falls back to exec for multi-line code
-        exec(compile(code, "<user-input>", "exec"), context)
-        return context.get("result")
-
-
-@app.route("/plugin/evaluate", methods=["POST"])
-def evaluate_plugin():
-    payload = request.get_json()
-    code = payload.get("code", "")
-    params = payload.get("params", {})
-    result = safe_eval(code, params)
-    return jsonify({"output": result})

package/packages/crucible/seeds/python/seed-043.py

@@ -1,32 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: eval_abuse
-# severity: critical
-# language: python
-# expected: eval()/compile() used to execute user-uploaded Python module code
-
-import ast
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-def safe_eval(code: str, context: dict) -> object:
-    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
-    try:
-        tree = ast.parse(code, mode="eval")
-        # compile() + eval() of user AST still allows dangerous constructs
-        compiled = compile(tree, "<user-input>", "eval")
-        return eval(compiled, {"__builtins__": __builtins__}, context)
-    except SyntaxError:
-        # Falls back to exec for multi-line code
-        exec(compile(code, "<user-input>", "exec"), context)
-        return context.get("result")
-
-
-@app.route("/plugin/evaluate", methods=["POST"])
-def evaluate_plugin():
-    payload = request.get_json()
-    code = payload.get("code", "")
-    params = payload.get("params", {})
-    result = safe_eval(code, params)
-    return jsonify({"output": result})

package/packages/crucible/seeds/python/seed-044 2.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/packages/crucible/seeds/python/seed-044.py

@@ -1,38 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via requests.get with unvalidated user-supplied URL
-
-import requests
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-
-@app.route("/proxy")
-def proxy():
-    target_url = request.args.get("url", "")
-    # No validation — attacker requests: http://169.254.169.254/latest/meta-data/
-    response = requests.get(target_url, timeout=10)
-    return jsonify({
-        "status": response.status_code,
-        "content": response.text[:2000],
-    })
-
-
-@app.route("/webhook/test", methods=["POST"])
-def test_webhook():
-    data = request.get_json()
-    webhook_url = data.get("url", "")
-    payload = data.get("payload", {})
-    # webhook_url from user — attacker targets internal services
-    resp = requests.post(webhook_url, json=payload, timeout=8)
-    return jsonify({"status": resp.status_code, "response": resp.text[:500]})
-
-
-@app.route("/avatar/fetch")
-def fetch_avatar():
-    avatar_url = request.args.get("url", "")
-    resp = requests.get(avatar_url, timeout=5, allow_redirects=True)
-    return resp.content, 200, {"Content-Type": resp.headers.get("content-type", "image/png")}

package/packages/crucible/seeds/python/seed-045 2.py

@@ -1,36 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}

package/packages/crucible/seeds/python/seed-045.py

@@ -1,36 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via httpx.get with user-controlled URL and redirect following
-
-import httpx
-from fastapi import FastAPI, Query
-from fastapi.responses import JSONResponse
-
-app = FastAPI()
-
-
-@app.get("/import/data")
-async def import_data(source: str = Query(...)):
-    # source from user — can be internal URL or cloud metadata endpoint
-    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
-        resp = await client.get(source)
-        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})
-
-
-@app.post("/oembed")
-async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
-    # provider is an oembed endpoint from user — SSRF to internal services
-    oembed_url = f"{provider}?url={url}&format=json"
-    async with httpx.AsyncClient(timeout=8.0) as client:
-        resp = await client.get(oembed_url)
-        return resp.json()
-
-
-@app.get("/link-preview")
-async def link_preview(target: str = Query(...)):
-    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
-        resp = await client.get(target)
-    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
-    return {"title": title, "url": target}

package/packages/crucible/seeds/python/seed-046 2.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})

package/packages/crucible/seeds/python/seed-046.py

@@ -1,33 +0,0 @@
-# [CRUCIBLE-SEED]
-# category: ssrf
-# severity: high
-# language: python
-# expected: SSRF via urllib.request.urlopen with unvalidated user URL
-
-import urllib.request
-import urllib.parse
-from django.http import JsonResponse
-
-
-def fetch_remote_resource(request):
-    """Fetch an external resource on behalf of the client."""
-    url = request.GET.get("url", "")
-
-    # No validation — internal URLs, file://, gopher:// etc. all accepted
-    try:
-        with urllib.request.urlopen(url, timeout=10) as response:
-            content = response.read(4096).decode("utf-8", errors="replace")
-            content_type = response.headers.get("Content-Type", "")
-        return JsonResponse({"content": content, "content_type": content_type})
-    except Exception as e:
-        return JsonResponse({"error": str(e)}, status=400)
-
-
-def check_url_status(request):
-    target = request.POST.get("target", "")
-    try:
-        req = urllib.request.Request(target, headers={"User-Agent": "StatusChecker/1.0"})
-        with urllib.request.urlopen(req, timeout=8) as resp:
-            return JsonResponse({"status": resp.status, "url": target})
-    except urllib.error.HTTPError as e:
-        return JsonResponse({"status": e.code})