thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/ts/seed-020 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: typescript
-// expected: XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
-
-import { GetServerSideProps, NextPage } from 'next';
-
-interface PageProps {
-  name: string;
-  description: string;
-}
-
-const ProfilePage: NextPage<PageProps> = ({ name, description }) => {
-  return (
-    <div>
-      <h1>Profile: {name}</h1>
-      {/* description from query string — dangerouslySetInnerHTML without sanitization */}
-      <div dangerouslySetInnerHTML={{ __html: description }} />
-    </div>
-  );
-};
-
-export const getServerSideProps: GetServerSideProps = async ({ query }) => {
-  return {
-    props: {
-      name: query.name as string ?? 'Unknown',
-      description: query.description as string ?? '',
-    },
-  };
-};
-
-export default ProfilePage;

package/packages/crucible/seeds/ts/seed-020.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: typescript
-// expected: XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
-
-import { GetServerSideProps, NextPage } from 'next';
-
-interface PageProps {
-  name: string;
-  description: string;
-}
-
-const ProfilePage: NextPage<PageProps> = ({ name, description }) => {
-  return (
-    <div>
-      <h1>Profile: {name}</h1>
-      {/* description from query string — dangerouslySetInnerHTML without sanitization */}
-      <div dangerouslySetInnerHTML={{ __html: description }} />
-    </div>
-  );
-};
-
-export const getServerSideProps: GetServerSideProps = async ({ query }) => {
-  return {
-    props: {
-      name: query.name as string ?? 'Unknown',
-      description: query.description as string ?? '',
-    },
-  };
-};
-
-export default ProfilePage;

package/packages/crucible/seeds/ts/seed-021 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Vue.js v-html directive with user-supplied content
-
-import { defineComponent, ref, onMounted } from 'vue';
-import axios from 'axios';
-
-export default defineComponent({
-  name: 'ArticleViewer',
-  props: {
-    articleId: { type: String, required: true },
-  },
-  setup(props) {
-    const article = ref<{ title: string; content: string; authorBio: string } | null>(null);
-
-    onMounted(async () => {
-      const { data } = await axios.get(`/api/articles/${props.articleId}`);
-      article.value = data;
-    });
-
-    return { article };
-  },
-  // v-html renders raw HTML — XSS if content contains malicious script tags
-  template: `
-    <div class="article" v-if="article">
-      <h1>{{ article.title }}</h1>
-      <div class="content" v-html="article.content"></div>
-      <aside class="author-bio" v-html="article.authorBio"></aside>
-    </div>
-  `,
-});

package/packages/crucible/seeds/ts/seed-021.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Vue.js v-html directive with user-supplied content
-
-import { defineComponent, ref, onMounted } from 'vue';
-import axios from 'axios';
-
-export default defineComponent({
-  name: 'ArticleViewer',
-  props: {
-    articleId: { type: String, required: true },
-  },
-  setup(props) {
-    const article = ref<{ title: string; content: string; authorBio: string } | null>(null);
-
-    onMounted(async () => {
-      const { data } = await axios.get(`/api/articles/${props.articleId}`);
-      article.value = data;
-    });
-
-    return { article };
-  },
-  // v-html renders raw HTML — XSS if content contains malicious script tags
-  template: `
-    <div class="article" v-if="article">
-      <h1>{{ article.title }}</h1>
-      <div class="content" v-html="article.content"></div>
-      <aside class="author-bio" v-html="article.authorBio"></aside>
-    </div>
-  `,
-});

package/packages/crucible/seeds/ts/seed-022 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Marked.js rendering user markdown without sanitization
-
-import marked from 'marked';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface MarkdownRequest {
-  markdown: string;
-  title?: string;
-}
-
-router.post('/preview', (req: Request, res: Response) => {
-  const { markdown, title } = req.body as MarkdownRequest;
-
-  // marked() renders to HTML without XSS protection — <script> tags in markdown execute
-  const renderedHtml = marked(markdown);
-
-  res.send(`
-    <html>
-      <head><title>${title ?? 'Preview'}</title></head>
-      <body>
-        <h1>${title}</h1>
-        <div class="content">${renderedHtml}</div>
-      </body>
-    </html>
-  `);
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-022.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: typescript
-// expected: XSS via Marked.js rendering user markdown without sanitization
-
-import marked from 'marked';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface MarkdownRequest {
-  markdown: string;
-  title?: string;
-}
-
-router.post('/preview', (req: Request, res: Response) => {
-  const { markdown, title } = req.body as MarkdownRequest;
-
-  // marked() renders to HTML without XSS protection — <script> tags in markdown execute
-  const renderedHtml = marked(markdown);
-
-  res.send(`
-    <html>
-      <head><title>${title ?? 'Preview'}</title></head>
-      <body>
-        <h1>${title}</h1>
-        <div class="content">${renderedHtml}</div>
-      </body>
-    </html>
-  `);
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-023 2.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via child_process.exec with typed but unsanitized user input
-
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { Request, Response, Router } from 'express';
-
-const execAsync = promisify(exec);
-const router = Router();
-
-interface PingRequest {
-  host: string;
-  count?: number;
-}
-
-router.post('/tools/ping', async (req: Request, res: Response) => {
-  const { host, count = 4 } = req.body as PingRequest;
-  // TypeScript types don't prevent injection — host can be "8.8.8.8; id"
-  const cmd = `ping -c ${count} ${host}`;
-  const { stdout, stderr } = await execAsync(cmd);
-  res.json({ output: stdout, errors: stderr });
-});
-
-router.post('/tools/traceroute', async (req: Request, res: Response) => {
-  const target: string = req.body.target;
-  const { stdout } = await execAsync(`traceroute ${target}`);
-  res.json({ hops: stdout });
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-023.ts

@@ -1,33 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via child_process.exec with typed but unsanitized user input
-
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { Request, Response, Router } from 'express';
-
-const execAsync = promisify(exec);
-const router = Router();
-
-interface PingRequest {
-  host: string;
-  count?: number;
-}
-
-router.post('/tools/ping', async (req: Request, res: Response) => {
-  const { host, count = 4 } = req.body as PingRequest;
-  // TypeScript types don't prevent injection — host can be "8.8.8.8; id"
-  const cmd = `ping -c ${count} ${host}`;
-  const { stdout, stderr } = await execAsync(cmd);
-  res.json({ output: stdout, errors: stderr });
-});
-
-router.post('/tools/traceroute', async (req: Request, res: Response) => {
-  const target: string = req.body.target;
-  const { stdout } = await execAsync(`traceroute ${target}`);
-  res.json({ hops: stdout });
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-024 2.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execSync in typed file processing service
-
-import { execSync } from 'child_process';
-import * as path from 'path';
-
-interface ConversionOptions {
-  inputPath: string;  // user-controlled filename
-  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
-  quality?: number;
-}
-
-export class FileConverter {
-  private readonly outputDir: string;
-
-  constructor(outputDir: string) {
-    this.outputDir = outputDir;
-  }
-
-  convert(opts: ConversionOptions): string {
-    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
-    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
-    // opts.inputPath is user-controlled — no sanitization before execSync
-    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
-    execSync(cmd, { timeout: 30000 });
-    return outputPath;
-  }
-
-  extractText(pdfPath: string): string {
-    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
-  }
-}

package/packages/crucible/seeds/ts/seed-024.ts

@@ -1,35 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execSync in typed file processing service
-
-import { execSync } from 'child_process';
-import * as path from 'path';
-
-interface ConversionOptions {
-  inputPath: string;  // user-controlled filename
-  outputFormat: 'pdf' | 'png' | 'jpg' | 'webp';
-  quality?: number;
-}
-
-export class FileConverter {
-  private readonly outputDir: string;
-
-  constructor(outputDir: string) {
-    this.outputDir = outputDir;
-  }
-
-  convert(opts: ConversionOptions): string {
-    const outputName = path.basename(opts.inputPath, path.extname(opts.inputPath));
-    const outputPath = path.join(this.outputDir, `${outputName}.${opts.outputFormat}`);
-    // opts.inputPath is user-controlled — no sanitization before execSync
-    const cmd = `convert "${opts.inputPath}" -quality ${opts.quality ?? 85} "${outputPath}"`;
-    execSync(cmd, { timeout: 30000 });
-    return outputPath;
-  }
-
-  extractText(pdfPath: string): string {
-    return execSync(`pdftotext ${pdfPath} -`, { encoding: 'utf8' });
-  }
-}

package/packages/crucible/seeds/ts/seed-025 2.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via spawn with shell:true and user-controlled arguments
-
-import { spawn } from 'child_process';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function runCommand(cmd: string, args: string[]): Promise<string> {
-  return new Promise((resolve, reject) => {
-    // shell: true means the full command string is interpreted by /bin/sh
-    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
-    let output = '';
-    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
-    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
-    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-
-router.post('/scripts/run', async (req: Request, res: Response) => {
-  const { script, params }: { script: string; params: string[] } = req.body;
-  const result = await runCommand(`node scripts/${script}`, params);
-  res.json({ output: result });
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-025.ts

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via spawn with shell:true and user-controlled arguments
-
-import { spawn } from 'child_process';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-function runCommand(cmd: string, args: string[]): Promise<string> {
-  return new Promise((resolve, reject) => {
-    // shell: true means the full command string is interpreted by /bin/sh
-    const proc = spawn(`${cmd} ${args.join(' ')}`, { shell: true, timeout: 15000 });
-    let output = '';
-    proc.stdout.on('data', (d: Buffer) => (output += d.toString()));
-    proc.stderr.on('data', (d: Buffer) => (output += d.toString()));
-    proc.on('close', (code: number) => (code === 0 ? resolve(output) : reject(new Error(output))));
-  });
-}
-
-router.post('/scripts/run', async (req: Request, res: Response) => {
-  const { script, params }: { script: string; params: string[] } = req.body;
-  const result = await runCommand(`node scripts/${script}`, params);
-  res.json({ output: result });
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-026 2.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection via git operations with user-controlled branch/tag names
-
-import { execSync } from 'child_process';
-
-interface GitOptions {
-  repoPath: string;
-  branch: string;    // user-controlled
-  remote?: string;
-}
-
-export class GitService {
-  clone(repoUrl: string, targetDir: string): void {
-    // repoUrl from user — can include shell metacharacters
-    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
-  }
-
-  checkout(opts: GitOptions): string {
-    // opts.branch may be "main; cat /etc/shadow"
-    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
-  }
-
-  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
-    return execSync(
-      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
-      { encoding: 'utf8' }
-    );
-  }
-
-  tag(repoPath: string, tagName: string, message: string): string {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-}

package/packages/crucible/seeds/ts/seed-026.ts

@@ -1,36 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection via git operations with user-controlled branch/tag names
-
-import { execSync } from 'child_process';
-
-interface GitOptions {
-  repoPath: string;
-  branch: string;    // user-controlled
-  remote?: string;
-}
-
-export class GitService {
-  clone(repoUrl: string, targetDir: string): void {
-    // repoUrl from user — can include shell metacharacters
-    execSync(`git clone ${repoUrl} ${targetDir}`, { encoding: 'utf8', stdio: 'pipe' });
-  }
-
-  checkout(opts: GitOptions): string {
-    // opts.branch may be "main; cat /etc/shadow"
-    return execSync(`git -C ${opts.repoPath} checkout ${opts.branch}`, { encoding: 'utf8' });
-  }
-
-  createBranch(repoPath: string, branchName: string, fromBranch: string): string {
-    return execSync(
-      `git -C ${repoPath} checkout -b ${branchName} origin/${fromBranch}`,
-      { encoding: 'utf8' }
-    );
-  }
-
-  tag(repoPath: string, tagName: string, message: string): string {
-    return execSync(`git -C ${repoPath} tag -a ${tagName} -m "${message}"`, { encoding: 'utf8' });
-  }
-}

package/packages/crucible/seeds/ts/seed-027 2.ts

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection in NestJS service using exec with user-provided report parameters
-
-import { Injectable } from '@nestjs/common';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-
-const execAsync = promisify(exec);
-
-interface ReportParams {
-  format: string;       // user-controlled
-  dateRange: string;    // user-controlled
-  recipient: string;    // user-controlled email
-}
-
-@Injectable()
-export class ReportingService {
-  async generateAndSendReport(params: ReportParams): Promise<void> {
-    const { format, dateRange, recipient } = params;
-    // All three params go directly into shell command
-    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
-    const { stdout: reportPath } = await execAsync(generateCmd);
-
-    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
-    await execAsync(sendCmd);
-  }
-}

package/packages/crucible/seeds/ts/seed-027.ts

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: high
-// language: typescript
-// expected: command injection in NestJS service using exec with user-provided report parameters
-
-import { Injectable } from '@nestjs/common';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-
-const execAsync = promisify(exec);
-
-interface ReportParams {
-  format: string;       // user-controlled
-  dateRange: string;    // user-controlled
-  recipient: string;    // user-controlled email
-}
-
-@Injectable()
-export class ReportingService {
-  async generateAndSendReport(params: ReportParams): Promise<void> {
-    const { format, dateRange, recipient } = params;
-    // All three params go directly into shell command
-    const generateCmd = `python3 /scripts/gen_report.py --format ${format} --range ${dateRange}`;
-    const { stdout: reportPath } = await execAsync(generateCmd);
-
-    const sendCmd = `sendmail -s "Your Report" ${recipient.trim()} < ${reportPath.trim()}`;
-    await execAsync(sendCmd);
-  }
-}

package/packages/crucible/seeds/ts/seed-028 2.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execa with shell:true and template literal from user data
-
-import execa from 'execa';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScanRequest {
-  target: string;   // IP or hostname — user-controlled
-  ports?: string;   // port range — user-controlled
-  flags?: string;   // nmap flags — user-controlled
-}
-
-router.post('/security/scan', async (req: Request, res: Response) => {
-  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
-  try {
-    // All fields from user body — injection via shell metacharacters
-    const { stdout } = await execa.command(
-      `nmap ${flags} -p ${ports} ${target}`,
-      { shell: true, timeout: 60000 }
-    );
-    res.json({ results: stdout });
-  } catch (err: any) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-028.ts

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: typescript
-// expected: command injection via execa with shell:true and template literal from user data
-
-import execa from 'execa';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-
-interface ScanRequest {
-  target: string;   // IP or hostname — user-controlled
-  ports?: string;   // port range — user-controlled
-  flags?: string;   // nmap flags — user-controlled
-}
-
-router.post('/security/scan', async (req: Request, res: Response) => {
-  const { target, ports = '1-1000', flags = '' } = req.body as ScanRequest;
-  try {
-    // All fields from user body — injection via shell metacharacters
-    const { stdout } = await execa.command(
-      `nmap ${flags} -p ${ports} ${target}`,
-      { shell: true, timeout: 60000 }
-    );
-    res.json({ results: stdout });
-  } catch (err: any) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-029 2.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via unvalidated user path in fs.readFile
-
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
-
-router.get('/static/:file', async (req: Request, res: Response) => {
-  const requestedFile: string = req.params.file;
-  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
-  const filePath = path.join(PUBLIC_DIR, requestedFile);
-
-  try {
-    const data = await fs.readFile(filePath, 'utf-8');
-    res.type('text/plain').send(data);
-  } catch {
-    res.status(404).send('Not found');
-  }
-});
-
-router.get('/download', async (req: Request, res: Response) => {
-  const file = req.query.file as string;
-  // Completely unvalidated — reads arbitrary path on filesystem
-  const content = await fs.readFile(file);
-  res.send(content);
-});
-
-export default router;

package/packages/crucible/seeds/ts/seed-029.ts

@@ -1,34 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: typescript
-// expected: path traversal via unvalidated user path in fs.readFile
-
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { Request, Response, Router } from 'express';
-
-const router = Router();
-const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
-
-router.get('/static/:file', async (req: Request, res: Response) => {
-  const requestedFile: string = req.params.file;
-  // path.join does NOT prevent traversal — "../../etc/passwd" resolves outside PUBLIC_DIR
-  const filePath = path.join(PUBLIC_DIR, requestedFile);
-
-  try {
-    const data = await fs.readFile(filePath, 'utf-8');
-    res.type('text/plain').send(data);
-  } catch {
-    res.status(404).send('Not found');
-  }
-});
-
-router.get('/download', async (req: Request, res: Response) => {
-  const file = req.query.file as string;
-  // Completely unvalidated — reads arbitrary path on filesystem
-  const content = await fs.readFile(file);
-  res.send(content);
-});
-
-export default router;