Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
69 commits
Select commit Hold shift + click to select a range
bb07586
fix: startup logs stringified objects incorrectly
lirantal Jul 9, 2020
7c293e7
fix: example of xss in bad context using a dedicated profile field
lirantal Jul 9, 2020
38de373
Fix NoSQL injection solution
karlhorky Jul 9, 2020
58cbbe2
Merge pull request #204 from karlhorky/patch-1
lirantal Jul 9, 2020
a51149e
Merge pull request #202 from lirantal/fix/startup-logs
lirantal Aug 3, 2020
a512124
Merge pull request #203 from lirantal/fix/xss-context
lirantal Aug 3, 2020
5b6a307
test: update broken build in commit 7c293e721bd1e95be6f82475d295b9b10…
lirantal Aug 5, 2020
21d5740
Fix "Cannot read property 'seq' of null" error
rcowsill Sep 24, 2020
d1d5657
Fix database URI under docker-compose
rcowsill Sep 25, 2020
ec40213
Bypass livereload script in cypress tests
rcowsill Sep 26, 2020
fe5b12b
Faster deploy to Heroku
rcowsill Oct 10, 2020
12fa8fa
Replace mongolab addon with MONGODB_URI env var
rcowsill Oct 10, 2020
1af3c64
Remove MONGOLAB_URI and mlab connection string
rcowsill Oct 10, 2020
aec7782
Adjustments to livereload to stop (timeout) in prod
binarymist Oct 22, 2020
ddca594
Update instructions
rcowsill Nov 1, 2020
1ede1df
Add detail to MONGODB_URI instructions
rcowsill Nov 2, 2020
3d77c3d
Add note about MongoDB Atlas M0
rcowsill Nov 2, 2020
c44bbd6
Merge pull request #215 from rcowsill/fix/heroku-db
ckarande Nov 10, 2020
57817e3
Changed livereload script and put it in test env only
binarymist Nov 10, 2020
5ab0088
add atlas db url
ckarande Nov 10, 2020
dcd2a1d
Merge pull request #216 from binarymist/livereload-refactor
ckarande Nov 10, 2020
3137d3c
Add cross-env to package-lock.json
karlhorky Nov 13, 2020
b8d031d
Add cross-env for Windows scripts compatibility
karlhorky Nov 13, 2020
a8327fc
Merge pull request #217 from karlhorky/patch-2
lirantal Nov 13, 2020
1957f9a
Local DB only - if no DB URI present
Jan 13, 2021
96f1fac
Review suggestion/atlas or localdb only
Jan 14, 2021
f2514a5
Merge pull request #222 from doublethink/insecure_defaultconnection_s…
ckarande Jan 14, 2021
616f739
Fix Travis config warnings
rcowsill Nov 16, 2020
38f7011
Fix repeated dbResets so tests run faster
rcowsill Nov 16, 2020
c57fd29
Add Github Actions "E2E Test" workflow
rcowsill Jan 17, 2021
9681a4c
Merge pull request #223 from rcowsill/fix/travis-warnings
ckarande Jan 24, 2021
c5e2dcb
Merge pull request #218 from rcowsill/fix/repeated-dbreset
ckarande Jan 24, 2021
812bfd7
Merge pull request #224 from rcowsill/feature/actions-ci
ckarande Jan 24, 2021
b9e2c49
Fix jshint warnings
rcowsill Jan 26, 2021
4a4d1db
Fix TypeError when server-side request fails
rcowsill Jan 26, 2021
4b7437f
Add lint workflow using jshint@2.12.0
rcowsill Jan 27, 2021
f7fed57
Update jshint config to fix spurious errors
rcowsill Jan 27, 2021
61bac7e
Fix doublequote and semicolon lint errors
rcowsill Jan 27, 2021
0ce31db
Add missing "use strict" directives
rcowsill Jan 27, 2021
3d1d9fe
Split up lines that are too long
rcowsill Jan 27, 2021
e2dffdb
Merge pull request #226 from rcowsill/fix/225-research-dos
ckarande Feb 7, 2021
a9e3703
E2E CI: Enable video recording, upload on failure
rcowsill Feb 26, 2021
719cb17
Update links in description
rcowsill Apr 5, 2021
76a4361
docs: README file cleanup
lirantal Jun 11, 2022
a3c66c1
Merge pull request #254 from lirantal/master
ckarande Jun 11, 2022
1f05200
chore: update gitignore
lirantal Jun 27, 2022
88e6e2b
Fix Mongo version to before OP_QUERY deprecation
steverify Sep 30, 2022
5848aad
fix: revert marked changes back to make sure we use the vulnerable ve…
lirantal Mar 6, 2023
f27549d
Merge pull request #281 from OWASP/fix/marked-needs-to-be-vuln
lirantal Mar 6, 2023
d0e3b77
Merge pull request #265 from steverify/revert-mongo
lirantal Mar 6, 2023
b638f5d
Merge pull request #259 from lirantal/test/pathc-1
lirantal Mar 6, 2023
55bf170
Merge pull request #235 from rcowsill/fix/a9-tutorial-links
lirantal Mar 6, 2023
687ef2f
Merge branch 'master' into feature/upload-cypress-errors
lirantal Mar 6, 2023
cdf0f7f
Merge pull request #230 from rcowsill/feature/upload-cypress-errors
lirantal Mar 6, 2023
8d4c9cc
Merge pull request #227 from rcowsill/feature/lint-workflow
lirantal Mar 6, 2023
a47594e
fix: update instructions about tutorial
lirantal Mar 6, 2023
91d8adb
Merge pull request #282 from OWASP/fix/tutorial-instructions
lirantal Mar 6, 2023
9336e34
fix: sync lockfile
lirantal Mar 6, 2023
4cabb56
docs: minor update for inline code style
lirantal Mar 6, 2023
b2f0686
fix: mongodb 4.4 is compatible
lirantal Mar 6, 2023
e7407a1
Merge pull request #283 from OWASP/fix/update-mongodb-v
lirantal Mar 6, 2023
ea58b51
fix: spelling on the app page
lirantal Mar 6, 2023
ea13d3f
doc: annotate server.js with extra info regarding session and static …
cfabianski Mar 17, 2023
b2aed38
Merge pull request #286 from cfabianski/patch-1
lirantal Mar 18, 2023
636cf83
Move tutorial into a separate router
rcowsill Mar 13, 2021
69e3d0d
Fix path traversal vulnerability
rcowsill Mar 14, 2021
5e71697
fix: travel path vulnerability on tutorial pages, merge pull request …
lirantal May 28, 2023
9f9513e
Add blank space after strong tag
za Jun 20, 2023
c5cb68a
Merge pull request #290 from za/add-blank-space
lirantal Jun 21, 2023
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@ Dockerfile
docker-compose.yml
.dockerignore
.git
.github
.gitignore
61 changes: 61 additions & 0 deletions .github/workflows/e2e-test.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
name: E2E Test
on: [push, pull_request]

jobs:
e2e-test:
name: Node.js
runs-on: ubuntu-latest

strategy:
fail-fast: false
matrix:
node-version: ["10.x", "12.x", "14.x"]

steps:
- name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
uses: actions/checkout@v2
with:
persist-credentials: false

- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v1
with:
node-version: ${{ matrix.node-version }}

- name: Use cache
uses: actions/cache@v2
with:
path: |
~/.npm
~/.cache
key: ${{ runner.os }}-node${{ matrix.node-version }}-E2E-${{ hashFiles('package-lock.json') }}

- name: Install dependencies
run: |
npm ci
npm run cy:verify

- name: Start MongoDB
run: |
docker run -d -p 27017:27017 mongo:4.0
timeout 60s bash -c 'until nc -z -w 2 localhost 27017 && echo MongoDB ready; do sleep 2; done'

- name: Run E2E test suite
id: test-suite
run: |
NODE_ENV=test npm start -- --silent &
npm run test:ci -- --config video=true

- name: Prepare cypress artifacts
if: failure() && (steps.test-suite.outcome == 'failure')
working-directory: ./test/e2e
run: >
mkdir -p "screenshots" && find "screenshots" -mindepth 1 -maxdepth 1 -type d
-exec sh -c 'mv -- "videos/$(basename "$1").mp4" "$1"' _ {} \;

- name: Upload cypress artifacts
if: failure() && (steps.test-suite.outcome == 'failure')
uses: actions/upload-artifact@v2
with:
name: cypress-artifacts-node${{ matrix.node-version }}
path: test/e2e/screenshots
26 changes: 26 additions & 0 deletions .github/workflows/lint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: Lint
on: [push, pull_request]

jobs:
lint:
name: Node.js
runs-on: ubuntu-latest

strategy:
fail-fast: false
matrix:
node-version: ["14.x"]

steps:
- name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
uses: actions/checkout@v2
with:
persist-credentials: false

- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v1
with:
node-version: ${{ matrix.node-version }}

- name: Run linter
run: npx --no-install jshint@2.12.0 .
10 changes: 9 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,12 @@ Icon?
report*.html

# e2e
test/e2e/screenshots/
test/e2e/screenshots/
test/e2e/videos/

# ignore sensitive files
.env.local
.env

# ignore Snyk Code scanner files
.dccache
2 changes: 2 additions & 0 deletions .jshintignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
node_modules/
app/assets/vendor/
47 changes: 22 additions & 25 deletions .jshintrc
Original file line number Diff line number Diff line change
@@ -1,13 +1,12 @@
{
"node": true, // Enable globals available when code is running inside of the NodeJS runtime environment.
"browser": true, // Standard browser globals e.g. `window`, `document`.
"es5": false, // Allow EcmaScript 5 syntax.
"esnext": true, // Allow ES.next specific features such as `const` and `let`.
"esversion": 9, // Allow EcmaScript 9 syntax.
"bitwise": false, // Prohibit bitwise operators (&, |, ^, etc.).
"camelcase": true, // Permit only camelcase for `var` and `object indexes`.
"curly": false, // Require {} for every new block or scope.
"eqeqeq": true, // Require triple equals i.e. `===`.
"immed": true, // Require immediate invocations to be wrapped in parens e.g. `( function(){}() );`
"immed": true, // Require immediate invocations to be wrapped in parens e.g. `( function(){}() );`.
"latedef": true, // Prohibit variable use before definition.
"newcap": true, // Require capitalization of all constructor functions e.g. `new F()`.
"noarg": true, // Prohibit use of `arguments.caller` and `arguments.callee`.
Expand All @@ -17,26 +16,24 @@
"unused": false, // Warn unused variables.
"strict": true, // Require `use strict` pragma in every file.
"trailing": true, // Prohibit trailing whitespaces.
"smarttabs": false, // Suppresses warnings about mixed tabs and spaces
"globals": { // Globals variables.
},
"predef": [ // Extra globals.
"define",
"require",
"exports",
"module",
"describe",
"before",
"beforeEach",
"after",
"afterEach",
"it",
"$",
"Morris",
"Tour"
],
"indent": 4, // Specify indentation spacing
"maxlen": 120, // Max line lenght
"smarttabs": false, // Suppresses warnings about mixed tabs and spaces.
"indent": 4, // Specify indentation spacing.
"maxlen": 120, // Max line length.
"devel": false, // Allow development statements e.g. `console.log();`.
"noempty": true // Prohibit use of empty blocks.
}
"noempty": true, // Prohibit use of empty blocks.
"overrides": {
"test/e2e/**": {
"globals": {
"cy": false,
"Cypress": false,
"it": false,
"describe": false,
"before": false,
"after": false,
"beforeEach": false,
"afterEach": false,
"expect": false
}
}
}
}
8 changes: 2 additions & 6 deletions .travis.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
sudo: required
os: linux
dist: xenial
language: node_js
services:
- docker
Expand All @@ -22,11 +23,6 @@ cache:
- ~/.npm
- ~/.cache

override:
# use the new "ci" command for fastest installs on CI
- npm ci
- npm run cy:verify

before_script:
## we use the '&' ampersand which tells
## travis to run this process in the background
Expand Down
14 changes: 11 additions & 3 deletions Gruntfile.js
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,31 @@

var exec = require("child_process").exec;

var JS_FILES = ["Gruntfile.js", "app/assets/js/**", "config/config.js", "app/data/**/*.js",
"app/routes/**/*.js", "server.js", "test/**/*.js"
var APP_JS_FILES = ["app/assets/js/**/*.js", "config/**/*.js", "app/data/**/*.js",
"app/routes/**/*.js", "server.js"
];

var SUPPORT_JS_FILES = ["Gruntfile.js", "artifacts/**/*.js", "test/**/*.js"];

var JS_FILES = APP_JS_FILES.concat(SUPPORT_JS_FILES);


module.exports = function(grunt) {
// Project Configuration
grunt.initConfig({
pkg: grunt.file.readJSON("package.json"),
watch: {
js: {
files: JS_FILES,
files: APP_JS_FILES,
tasks: ["jshint"],
options: {
livereload: true
}
},
support: {
files: SUPPORT_JS_FILES,
tasks: ["jshint"]
},
html: {
files: ["app/views/**"],
options: {
Expand Down
Loading