diff --git a/PR_7_js/js/filtered_js/000_wkhtmltopdf-injection.js b/PR_7_js/js/filtered_js/000_wkhtmltopdf-injection.js new file mode 100644 index 0000000..6837abc --- /dev/null +++ b/PR_7_js/js/filtered_js/000_wkhtmltopdf-injection.js @@ -0,0 +1,34 @@ +const wkhtmltopdf = require('wkhtmltopdf') +const express = require("express"); +const app = express(); + + +function input() { + app.get("/add/:userInput", function (req, res) { + return req.params['userInput'] + }); +} +// {fact rule=server-side-request-forgery@v1.0 defects=1} +// ruleid: wkhtmltopdf-injection +wkhtmltopdf(input(), { output: 'vuln.pdf' }) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.get("/add/:userInput", function (req, res) { + // ruleid: wkhtmltopdf-injection + return wkhtmltopdf(req.params['userInput'], { output: 'vuln.pdf' }) +}); +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok: wkhtmltopdf-injection +wkhtmltopdf('', { output: 'vuln.pdf' }) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +function okTest(userInput) { + var html = ''; + // ok: wkhtmltopdf-injection + return wkhtmltopdf(html, { output: 'vuln.pdf' }) +} +// {/fact} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/001_puppeteer-evaluate-arg-injection.js b/PR_7_js/js/filtered_js/001_puppeteer-evaluate-arg-injection.js new file mode 100644 index 0000000..845b2ab --- /dev/null +++ b/PR_7_js/js/filtered_js/001_puppeteer-evaluate-arg-injection.js @@ -0,0 +1,20 @@ +const puppeteer = require('puppeteer'); +const express = require('express') +const app = express() + +app.get('/user/:userInput', async function (req, res) { + + const browser = await puppeteer.launch(); + const page = await browser.newPage(); +// {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok + await page.evaluate(x => console.log(x), 5); + // {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:puppeteer-evaluate-arg-injection + await page.evaluate(x => fetch(x), req.params.userInput); +// {/fact} + await page.screenshot({path: 'example.png'}); + await browser.close(); +}); diff --git a/PR_7_js/js/filtered_js/002_puppeteer-setcontent-injection.js b/PR_7_js/js/filtered_js/002_puppeteer-setcontent-injection.js new file mode 100644 index 0000000..ff291e1 --- /dev/null +++ b/PR_7_js/js/filtered_js/002_puppeteer-setcontent-injection.js @@ -0,0 +1,30 @@ +const puppeteer = require('puppeteer'); +const express = require("express"); +const app = express(); + +function unverifiedInput() { + app.get("/add/:userInput", function (req, res) { + return req.params['userInput'] + }); +} + + +// {fact rule=server-side-request-forgery@v1.0 defects=0} + +(async () => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + +// ok + await page.setContent(''); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + + // ruleid:puppeteer-setcontent-injection + await page.setContent(unverifiedInput()); + + await page.screenshot({path: 'example.png'}); + await browser.close(); +})(); +// {/fact} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/003_puppeteer-goto-injection.js b/PR_7_js/js/filtered_js/003_puppeteer-goto-injection.js new file mode 100644 index 0000000..46cd83e --- /dev/null +++ b/PR_7_js/js/filtered_js/003_puppeteer-goto-injection.js @@ -0,0 +1,43 @@ +const puppeteer = require('puppeteer'); +const express = require('express') +const app = express() + +userInput = '' + +app.get('/user/:userInput', async function (req, res) { + userInput=req.params.userInput +}); + +function unverifiedInput(){ +app.get('/user/:userInput', async function (req, res) { + retrun = req.params.userInput +}); +} + +const testFunc = async (userInput) => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + let url = 'https://hardcoded.url.com' + // {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok + await page.goto('https://example.com'); +// {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok + await page.goto(url); +// {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:puppeteer-goto-injection + await page.goto(unverifiedInput()); +// {/fact} + + const newUrl = userInput; + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:puppeteer-goto-injection + await page.goto(newUrl); +// {/fact} + await page.screenshot({path: 'example.png'}); + await browser.close(); +}; diff --git a/PR_7_js/js/filtered_js/004_puppeteer-evaluate-code-injection.js b/PR_7_js/js/filtered_js/004_puppeteer-evaluate-code-injection.js new file mode 100644 index 0000000..5744d88 --- /dev/null +++ b/PR_7_js/js/filtered_js/004_puppeteer-evaluate-code-injection.js @@ -0,0 +1,31 @@ +const puppeteer = require('puppeteer'); +const express = require("express"); +const app = express(); + +async function test2(userInput) { + + const browser = await puppeteer.launch(); + const page = await browser.newPage(); +// {fact rule=server-side-request-forgery@v1.0 defects=0} + + // ok:puppeteer-evaluate-code-injection + await page.evaluate(x => console.log(x), 5); + // {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} + + // ruleid:puppeteer-evaluate-code-injection + await page.evaluate(`fetch(${userInput})`); + // {/fact} + + await page.screenshot({path: 'example.png'}); + await browser.close(); +} + +function call() { + app.get("/add/:userInput", function (req, res) { + test2(req.params['userInput']) + }); +} + +call() diff --git a/PR_7_js/js/filtered_js/005_express-vm-injection.js b/PR_7_js/js/filtered_js/005_express-vm-injection.js new file mode 100644 index 0000000..92232dc --- /dev/null +++ b/PR_7_js/js/filtered_js/005_express-vm-injection.js @@ -0,0 +1,167 @@ +const vm = require('vm') + +// {fact rule=code-injection@v1.0 defects=1} +let ctrl1 = function test1(req,res) { + var input = req.query.something || '' + var sandbox = { + foo: input + } + vm.createContext(sandbox) + // ruleid:express-vm-injection + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + res.send('hello world') +} +app.get('/', ctrl1) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', (req,res) => { + var sandbox = { + foo: req.query.userInput + } + vm.createContext(sandbox) + // ruleid:express-vm-injection + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm-injection +function testOk1(userInput) { + var sandbox = { + foo: 1 + } + vm.createContext(sandbox) + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +var ctrl2 = null; +ctrl2 = function test2(req,res) { + var input = req.query.something || '' + var sandbox = { + foo: input + } + // ruleid:express-vm-injection + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + res.send('hello world') +} +app.get('/', ctrl2) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', function (req,res) { + var sandbox = { + foo: req.query.userInput + } + // ruleid:express-vm-injection + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm-injection +app.get('/', function testOk1(userInput) { + var sandbox = { + foo: 1 + } + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', function(req,res) { + const code = ` + var x = ${req.query.userInput}; + ` + // ruleid:express-vm-injection + vm.runInThisContext(code) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm-injection +app.get('/', function okTest3(req,res) { + const code = ` + var x = 1; + ` + vm.runInThisContext(code) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', function test4(req,res) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + ${req.query.userInput}` + // ruleid:express-vm-injection + let fn = vm.compileFunction(code, [], { parsingContext }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm-injection +app.get('/', function okTest4(req,res) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + name` + const fn = vm.compileFunction(code, [], { parsingContext }) +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', (req,res) => { + const context = vm.createContext({name: req.query.userInput}) + let code = `return 'hello ' name` + // ruleid:express-vm-injection + const fn = vm.compileFunction(code, [], { parsingContext: context }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm-injection +app.get('/', function okTest5(req, res) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + name` + const fn = vm.compileFunction(code, [], { parsingContext }) + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/', function (req,res) { + // ruleid:express-vm-injection + const script = new vm.Script(` + function add(a, b) { + return a + ${req.query.userInput}; + } + + const x = add(1, 2); + `); + + script.runInThisContext(); + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +//ok:express-vm-injection +app.get('/', function okTest6(req, res) { + const script = new vm.Script(` + function add(a, b) { + return a + b; + } + + const x = add(1, 2); + `); + + script.runInThisContext(); + res.send('hello world') +}) +// {/fact} diff --git a/PR_7_js/js/filtered_js/006_express-vm2-injection.js b/PR_7_js/js/filtered_js/006_express-vm2-injection.js new file mode 100644 index 0000000..6a16fde --- /dev/null +++ b/PR_7_js/js/filtered_js/006_express-vm2-injection.js @@ -0,0 +1,182 @@ +const fs = require('fs'); +const {VM, NodeVM} = require('vm2'); +const express = require('express') +const app = express() +const port = 3000 + +app.get('/', (req, res) => res.send('Hello World!')) + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test1', (req, res) => { + code = ` + console.log(${req.query.input}) + `; + + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + // ruleid:express-vm2-injection + new VM({ + timeout: 40 * 1000, + sandbox + }).run(code); + + res.send('hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test2', function (req, res) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + // ruleid:express-vm2-injection + nodeVM.run('console.log(' + req.query.input + ')') + + res.send('hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test3', function (req, res) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + // ruleid:express-vm2-injection + const script = new VMScript(`console.log(${req.query.input})`) + // ruleid:express-vm2-injection + nodeVM.run(script) + + res.send('hello world') +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/ok-test1', async function (req, res) { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const vmResult = new VM({ + timeout: 40 * 1000, + sandbox + }).run(code); + + res.send('hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/ok-test2', function (req, res) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + nodeVM.run('console.log("Hello world")') + + res.send('hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/ok-test3', function (req, res) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + const script = new VMScript('console.log("Hello world")') + nodeVM.run(script) + + res.send('hello world'); +}) +// {/fact} + + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test4', async function test1(req, res) { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + watch: req.query.input + }; + + // ruleid:express-vm2-injection + return new VM({timeout: 40 * 1000, sandbox}).run(code); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.post('/test5', function test2(req, res) { + const sandbox = { + setTimeout, + input: req.body + }; + + // ruleid:express-vm2-injection + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm2-injection +app.get('/ok-test4', async function okTest1() { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + fs + }; + + return new VM({timeout: 40 * 1000, sandbox}).run(code); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:express-vm2-injection +app.get('/ok-test5', function okTest2() { + const sandbox = { + setTimeout, + fs + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM.run('console.log("Hello world")') +}) +// {/fact} + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/007_express-jwt-hardcoded-secret.js b/PR_7_js/js/filtered_js/007_express-jwt-hardcoded-secret.js new file mode 100644 index 0000000..8293426 --- /dev/null +++ b/PR_7_js/js/filtered_js/007_express-jwt-hardcoded-secret.js @@ -0,0 +1,48 @@ +var jwt = require('express-jwt'); + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +// ruleid: express-jwt-hardcoded-secret +app.get('/protected', jwt({ secret: 'shhhhhhared-secret', isRevoked: isRevokedCallback }), function(req, res) { + if (!req.user.admin) return res.sendStatus(401); + res.sendStatus(200); +}); +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +let hardcodedSecret = 'shhhhhhared-secret' +// ruleid: express-jwt-hardcoded-secret +app.get('/protected2', jwt({ secret: hardcodedSecret, isRevoked: isRevokedCallback }), function(req, res) { + if (!req.user.admin) return res.sendStatus(401); + res.sendStatus(200); +}); +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +let secret = "hardcode" +// ruleid: express-jwt-hardcoded-secret +const opts = Object.assign({issuer: 'http://issuer'}, {secret}, {isRevoked: isRevokedCallback}) + +app.get('/protected3', jwt(opts), function(req, res) { + if (!req.user.admin) return res.sendStatus(401); + res.sendStatus(200); +}); +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=0} +// ok: express-jwt-hardcoded-secret +app.get('/ok-protected', jwt({ secret: process.env.SECRET, isRevoked: isRevokedCallback }), function(req, res) { + if (!req.user.admin) return res.sendStatus(401); + res.sendStatus(200); +}); +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=0} +let configSecret = config.get('secret') +const opts = Object.assign({issuer: 'http://issuer'}, {secret: configSecret}, {isRevoked: isRevokedCallback}) + +// ok: express-jwt-hardcoded-secret +app.get('/ok-protected', jwt(opts), function(req, res) { + if (!req.user.admin) return res.sendStatus(401); + res.sendStatus(200); +}); +// {/fact} diff --git a/PR_7_js/js/filtered_js/008_express-phantom-injection.js b/PR_7_js/js/filtered_js/008_express-phantom-injection.js new file mode 100644 index 0000000..d80d027 --- /dev/null +++ b/PR_7_js/js/filtered_js/008_express-phantom-injection.js @@ -0,0 +1,88 @@ +// PhantomJS is depricated and hence we are not covering those cases. +// const express = require('express') +// const app = express() +// const port = 3000 +// const phantom = require('phantom'); + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=1} +// app.get('/test', async (req, res) => { +// const instance = await phantom.create(); +// const page = await instance.createPage(); +// await page.on('onResourceRequested', function(requestData) { +// console.info('Requesting', requestData.url); +// }); + +// // ruleid: express-phantom-injection +// const status = await page.property('content', req.get('name')); + +// // ruleid: express-phantom-injection +// await page.setContent(req.query.q); + +// res.send('Hello World!') +// }) +// // {/ex-fact} + +// app.post('/test2', async (req, res) => { +// const instance = await phantom.create(); +// const page = await instance.createPage(); +// await page.on('onResourceRequested', function(requestData) { +// console.info('Requesting', requestData.url); +// }); + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=1} +// // ruleid: express-phantom-injection +// const status = await page.property('content', req.query.q); +// // {/ex-fact} + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=1} +// // ruleid: express-phantom-injection +// await page.setContent(req.body); +// // {/ex-fact} + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=0} +// // ok: express-phantom-injection +// var html = '123' +// const status = await page.property('content', html); +// // {/ex-fact} + +// const content = await page.property('content'); +// console.log(content); + +// await instance.exit(); + +// res.send('Hello World!') +// }) + +// app.post('/test3', async (req, res) => { +// const instance = await phantom.create(); +// const page = await instance.createPage(); +// await page.on('onResourceRequested', function(requestData) { +// console.info('Requesting', requestData.url); +// }); + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=1} +// // ruleid: express-phantom-injection +// const status = await page.openUrl(req.params.url, {}, {}); +// // {/ex-fact} + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=1} +// // ruleid: express-phantom-injection +// await page.evaluateJavaScript(req.body.script); +// // {/ex-fact} + +// // {ex-fact rule=server-side-request-forgery@v1.0 defects=0} +// // ok: express-phantom-injection +// var url = 'https://stackoverflow.com/' +// const status = await page.openUrl(url, {}, {}); +// // {/ex-fact} + +// const content = await page.property('content'); +// console.log(content); + +// await instance.exit(); + +// res.send('Hello World!') +// }) + + +// app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/009_express-sandbox-injection.js b/PR_7_js/js/filtered_js/009_express-sandbox-injection.js new file mode 100644 index 0000000..a300873 --- /dev/null +++ b/PR_7_js/js/filtered_js/009_express-sandbox-injection.js @@ -0,0 +1,68 @@ +const Sandbox = require('sandbox'); +const express = require('express'); +const app = express(); +const port = 3000; + +const cb = () => { + console.log('ok') +} + +app.get('/', (req, res) => res.send('Hello World!')) + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test1', function (req, res) { + const s = new Sandbox(); + // ruleid:express-sandbox-code-injection + s.run('lol('+req.query.userInput+')', cb); + res.send('Hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test2', function (req, res) { + const s = new Sandbox(); + var code = 'lol('+req.query.userInput+')' + // ruleid:express-sandbox-code-injection + s.run(code, cb); + res.send('Hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +app.get('/test3', function (req, res) { + const s = new Sandbox(); + // ruleid:express-sandbox-code-injection + s.run(`lol(${req.query.userInput})`, cb); + res.send('Hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/ok-test1', function (req, res) { + // ok:express-sandbox-code-injection + const s = new Sandbox(); + s.run('lol("hi")', cb); + res.send('Hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/ok-test2', function (req, res) { + // ok:express-sandbox-code-injection + const s = new Sandbox(); + var code = 'lol("hi")' + s.run(code, cb); + res.send('Hello world'); +}) +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +app.get('/test1', function (req, res) { + // ok:express-sandbox-code-injection + const s = new Sandbox(); + s.run(`lol("hi")`, cb); + res.send('Hello world'); +}) +// {/fact} + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/010_express-puppeteer-injection.js b/PR_7_js/js/filtered_js/010_express-puppeteer-injection.js new file mode 100644 index 0000000..5b64ff6 --- /dev/null +++ b/PR_7_js/js/filtered_js/010_express-puppeteer-injection.js @@ -0,0 +1,112 @@ +const express = require('express') +const app = express() +const port = 3000 +const puppeteer = require('puppeteer') + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.get('/', async (req, res) => { + const browser = await puppeteer.launch() + const page = await browser.newPage() + // ruleid: express-puppeteer-injection + const url = `https://${req.query.name}` + await page.goto(url) + + await page.screenshot({path: 'example.png'}) + await browser.close() + + res.send('Hello World!') +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.post('/test', async (req, res) => { + const browser = await puppeteer.launch() + const page = await browser.newPage() + // ruleid: express-puppeteer-injection + await page.setContent(`${req.body.foo}`) + + await page.screenshot({path: 'example.png'}) + await browser.close() + + res.send('Hello World!') +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +const controller = async (req, res) => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + // ruleid: express-puppeteer-injection + const body = req.body.foo; + await page.setContent('' + body + ''); + + await page.screenshot({path: 'example.png'}); + await browser.close(); + + res.send('Hello World!'); +} +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.post('/test2', async (req, res) => { + const browser = await puppeteer.launch() + const page = await browser.newPage() + // ruleid: express-puppeteer-injection + await page.evaluateOnNewDocument(`${req.body.foo}`) + + await page.screenshot({path: 'example.png'}) + await browser.close() + + res.send('Hello World!') +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +const controller2 = async (req, res) => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + // ruleid: express-puppeteer-injection + const body = req.body.foo; + await page.evaluate('alert(' + body + ')'); + + await page.screenshot({path: 'example.png'}); + await browser.close(); + + res.send('Hello World!'); +} +// {/fact} + +app.post('/test2', controller) + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +app.post('/ok-test', async (req, res) => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + // ok: express-puppeteer-injection + await page.goto('https://example.com'); + + await page.screenshot({path: 'example.png'}); + await browser.close(); + + res.send('Hello World!'); +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +const controller = async (req, res) => { + const browser = await puppeteer.launch(); + const page = await browser.newPage(); + // ok: express-puppeteer-injection + const body = '
123
'; + await page.setContent('' + body + ''); + + await page.screenshot({path: 'example.png'}); + await browser.close(); + + res.send('Hello World!'); +} +// {/fact} + +app.post('/ok-test2', controller) + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/011_express-wkhtml-injection.js b/PR_7_js/js/filtered_js/011_express-wkhtml-injection.js new file mode 100644 index 0000000..1fe1a29 --- /dev/null +++ b/PR_7_js/js/filtered_js/011_express-wkhtml-injection.js @@ -0,0 +1,40 @@ +const express = require('express') +const app = express() +const port = 3000 +const wkhtmltopdf = require('wkhtmltopdf') +const wkhtmltoimage = require('wkhtmltoimage') + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.get('/', async (req, res) => { + // ruleid: express-wkhtmltopdf-injection + const pdf = wkhtmltopdf(req.query.q, { output: 'vuln.pdf' }) + res.send(pdf) +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +app.post('/ok', async (req, res) => { + // ok: express-wkhtmltopdf-injection + const pdf = wkhtmltopdf('', { output: 'vuln.pdf' }) + res.send(pdf) +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} +app.post('/test', async (req, res) => { + // ruleid: express-wkhtmltoimage-injection + const img = wkhtmltoimage.generate(req.body, { output: 'vuln.pdf' }) + res.send(img) +}) +// {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +app.post('/test-ok', async (req, res) => { + // ok: express-wkhtmltoimage-injection + const data = '' + const img = wkhtmltoimage.generate(data, { output: 'vuln.pdf' }) + res.send(img) +}) +// {/fact} + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/012_remote-property-injection.js b/PR_7_js/js/filtered_js/012_remote-property-injection.js new file mode 100644 index 0000000..71ade90 --- /dev/null +++ b/PR_7_js/js/filtered_js/012_remote-property-injection.js @@ -0,0 +1,32 @@ +var express = require('express'); + +var app = express(); +var myObj = {} + +// {fact rule=insecure-object-attribute-modification@v1.0 defects=1} +// Vulnerable to prototype pollution via user-controlled property names. +app.get('/test1', function(req, res) { + var prop = req.query.userControlled + // ruleid: remote-property-injection + myObj[prop] = function() {} + res.send('ok') +}) +// {/fact} + +// {fact rule=insecure-object-attribute-modification@v1.0 defects=1} +app.get('/test2', function(req, res) { + // ruleid: remote-property-injection + myObj[req.body] = foobar() + res.send('ok') +}) +// {/fact} + +// {fact rule=insecure-object-attribute-modification@v1.0 defects=1} +// Vulnerable to prototype pollution via user-controlled property names. +app.get('/okTest', function(req, res) { + var prop = "$" + req.query.userControlled + // ok: remote-property-injection + myObj[prop] = function() {} + res.send('ok') +}) +// {/fact} diff --git a/PR_7_js/js/filtered_js/013_res-render-injection.js b/PR_7_js/js/filtered_js/013_res-render-injection.js new file mode 100644 index 0000000..0e62200 --- /dev/null +++ b/PR_7_js/js/filtered_js/013_res-render-injection.js @@ -0,0 +1,30 @@ +const express = require('express') +const app = express() +const port = 3000 + +const hardcodedPath = 'lib/layout' + +// {fact rule=cross-site-scripting@v1.0 defects=1} +function testController1(req, res) { + // ruleid: res-render-injection + return res.render(`tpl.${req.query.path}`, {foo: bar}) +}; + +app.get('/test1', testController1) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/test2', (req, res) => { + // ruleid: res-render-injection + return res.render('tpl.' + req.query.path + '.smth-else', {foo: bar}) +}) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=0} +app.get('/ok-test', (req, res) => { + // ok: res-render-injection + return res.render(hardcodedPath, {foo: bar}) +}) +// {/fact} + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/014_express-third-party-object-deserialization.js b/PR_7_js/js/filtered_js/014_express-third-party-object-deserialization.js new file mode 100644 index 0000000..e6f3f14 --- /dev/null +++ b/PR_7_js/js/filtered_js/014_express-third-party-object-deserialization.js @@ -0,0 +1,28 @@ +var node_serialize = require("node-serialize") +var serialize_to_js = require('serialize-to-js'); + +module.exports.value = function (req,res){ + // {fact rule=untrusted-deserialization@v1.0 defects=1} + // ruleid: express-third-party-object-deserialization + node_serialize.unserialize(req.files.products.data.toString('utf8')) + // {/fact} + + // {fact rule=untrusted-deserialization@v1.0 defects=0} + // ok: express-third-party-object-deserialization + fake.unserialize(req.files) + // {/fact} +} + + +module.exports.value1 = function (req,res){ + var str = new Buffer(req.cookies.profile, 'base64').toString(); + // {fact rule=untrusted-deserialization@v1.0 defects=1} + // ruleid: express-third-party-object-deserialization + serialize_to_js.deserialize(str) + // {/fact} + + // {fact rule=untrusted-deserialization@v1.0 defects=0} + // ok: express-third-party-object-deserialization + foo.deserialize(str) + // {/fact} +} diff --git a/PR_7_js/js/filtered_js/015_express-session-hardcoded-secret.js b/PR_7_js/js/filtered_js/015_express-session-hardcoded-secret.js new file mode 100644 index 0000000..e69de29 diff --git a/PR_7_js/js/filtered_js/016_express-ssrf.js b/PR_7_js/js/filtered_js/016_express-ssrf.js new file mode 100644 index 0000000..e69de29 diff --git a/PR_7_js/js/filtered_js/017_direct-response-write.js b/PR_7_js/js/filtered_js/017_direct-response-write.js new file mode 100644 index 0000000..74e7d6a --- /dev/null +++ b/PR_7_js/js/filtered_js/017_direct-response-write.js @@ -0,0 +1,184 @@ +const express = require('express') +const router = express.Router() +const app = express(); +// {fact rule=cross-site-scripting@v1.0 defects=0} +// cf. juice-shop +exports.promotionVideo = () => { + return (req, res) => { + fs.readFile('views/promotionVideo.pug', function (err, buf) { + if (err) throw err + let template = buf.toString() + const subs = getSubsFromFile() + + utils.solveIf(challenges.videoXssChallenge, () => { return utils.contains(subs, '') }) + + const theme = themes[config.get('application.theme')] + template = template.replace(/_title_/g, config.get('application.name')) + template = template.replace(/_favicon_/g, favicon()) + template = template.replace(/_bgColor_/g, theme.bgColor) + template = template.replace(/_textColor_/g, theme.textColor) + template = template.replace(/_navColor_/g, theme.navColor) + template = template.replace(/_primLight_/g, theme.primLight) + template = template.replace(/_primDark_/g, theme.primDark) + const fn = pug.compile(template) + let compiledTemplate = fn() + compiledTemplate = compiledTemplate.replace('', '') + // ruleid: direct-response-write + res.send(compiledTemplate) + }) + } + function favicon () { + return utils.extractFilename(config.get('application.favicon')) + } + } + // {/fact} + + + // {fact rule=cross-site-scripting@v1.0 defects=1} +router.get('/greeting', (req, res) => { + const { name } = req.query; + // ruleid: direct-response-write + res.send('

Hello :' + name + "

") +}) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=0} +//template handle escaping +router.get('/greet-template', (req, res) => { + name = req.query.name + // ok: direct-response-write + res.render('index', { user_name: name }); +}) +// {/fact} + +module.exports = router + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/', function (req, res) { + var user = req.query.name; + + msg = "Hi " + user + // ruleid: direct-response-write + res.send('Response
' + msg); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +var msg = ''; +app.get('/3', function (req, res) { + var user = req.query.name; + + msg = "Hi " + user + // ruleid: direct-response-write + res.send('Response
' + msg); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/2', function (req, res) { + var user = { user: req.query.name }; + // ruleid: direct-response-write + res.send('Response
' + user.name); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/1', function (req, res) { + var user = req.query.name; + var msg = []; + msg.push(user); + // ruleid: direct-response-write + res.send('Response
' + msg[0]); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/4', function (req, res) { + var user = req.query.name; + var header = ""; + var msg = 'Hi ' + user; + var footer = ""; + var output = header + msg + footer; + // ruleid: direct-response-write + res.send(output); +}); +// {/fact} + + + + +// {fact rule=cross-site-scripting@v1.0 defects=1} +var express = require('express'); +var app = express(); +app.get('/', function (req, res) { + var resp = req.query.name; + // ruleid: direct-response-write + res.send('Response
' + resp); +}); +// {/fact} + + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/3', function (req, res) { + var resp = req.query.name; + // ruleid: direct-response-write + res.write('Response
' + resp); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/3', function (req, res) { + var resp = req.foo; + var x = 1; + // ruleid: direct-response-write + res.write('Response
' + resp); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/xss', function (req, res) { + var html = "ASadad" + req.query.name + "Asdadads" + // ruleid: direct-response-write + res.write('Response
' + html); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/xss', function (req, res) { + // ruleid: direct-response-write + res.write('Response
' + req.query('doo')); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/xss', function (req, res) { + // ruleid: direct-response-write + res.write('Response
' + req.query.name); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=0} +app.get('/noxss', function (req, res) { + var resp = req.query.name; + // ok: direct-response-write + res.write('Response
'); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/noxs2s', function (req, res) { + var foo = req.query.name; + // ruleid: direct-response-write + res.write('Response
' + foo); +}); +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/xss', function (req, res) { + var resp = req.query.name; + var html = "ASadad" + resp + "Asdadads" + // ruleid: direct-response-write + res.write('Response
' + html); +}); +// {/fact} +app.listen(8000); diff --git a/PR_7_js/js/filtered_js/018_escape-function-overwrite.js b/PR_7_js/js/filtered_js/018_escape-function-overwrite.js new file mode 100644 index 0000000..d834c5f --- /dev/null +++ b/PR_7_js/js/filtered_js/018_escape-function-overwrite.js @@ -0,0 +1,25 @@ +// cf. https://github.com/janl/mustache.js/#include-templates + +// e.g., browser code: +// ruleid: escape-function-overwrite +Mustache.escape = function(val) { return val; } + +function renderHello() { + var template = document.getElementById('template').innerHTML; + var rendered = Mustache.render(template, { name: 'Luke' }); + document.getElementById('target').innerHTML = rendered; +} + +// e.g., Node.js code: +function node() { + const template = require("mustache"); + // ruleid: escape-function-overwrite + template.escape = (t) => { return t; } + let html = template.render(blogItem, { }); +} + +function ok() { + // ok: escape-function-overwrite + const template = require("mustache"); + let html = template.render(blogItem, { }); +} diff --git a/PR_7_js/js/filtered_js/019_tainted-sql-string.js b/PR_7_js/js/filtered_js/019_tainted-sql-string.js new file mode 100644 index 0000000..110e9a9 --- /dev/null +++ b/PR_7_js/js/filtered_js/019_tainted-sql-string.js @@ -0,0 +1,85 @@ +const express = require('express') +const app = express() +const port = 3000 +const { Sequelize } = require('sequelize'); +const sequelize = new Sequelize('sqlite::memory:') +const util = require('util') + +// {fact rule=sql-injection@v1.0 defects=1} +async app.get('/test', (req, res) => { + // ruleid: tainted-sql-string + const query = "SELECT * FROM `users`" + " WHERE id = '" + req.query.message + "'" + const [results, metadata] = await sequelize.query(query); + res.send(results) +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=1} +async app.get('/test1', (req, res) => { + // ruleid: tainted-sql-string + const [results, metadata] = await sequelize.query("SELECT * FROM `users`" + " WHERE id = '" + req.query.message + "'"); + res.send(results) +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=1} +app.get('/test2', (req, res) => { + // ruleid: tainted-sql-string + let query = `SELECT * FROM users WHERE id = '${req.query.message}'` + const [results, metadata] = await sequelize.query(query); + res.send(results) +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=1} +async app.get('/test3', (req, res) => { + let query = "SELECT * FROM `users` WHERE id = '" + // ruleid: tainted-sql-string + query = query.concat(req.query.message) + query = query.concat("'") + const [results, metadata] = await sequelize.query(query); + res.send(results) +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=1} +async app.get('/test4', (req, res) => { + // ruleid: tainted-sql-string + const query = util.format("SELECT * FROM users WHERE id = '%s'", req.query.message) + const [results, metadata] = await sequelize.query(query); + res.send(results) +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=0} +app.get('/ok', async (req, res) => { + // ok: tainted-sql-string + res.send("message: " + req.query.message); +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=0} +app.post('/ok2', async (req, res) => { + // ok: tainted-sql-string + res.send(`message: ${req.query.message}`); +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=0} +app.post('/ok3', async (req, res) => { + // ok: tainted-sql-string + var data = "message: " + req.query.message; + res.send(data); +}) +// {/fact} + +// {fact rule=sql-injection@v1.0 defects=0} +app.post('/ok4', async (req, res) => { + var data = "message: " + // ok: tainted-sql-string + data = data.concat(req.query.message) + res.send(data); +}) +// {/fact} + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/020_raw-html-format.js b/PR_7_js/js/filtered_js/020_raw-html-format.js new file mode 100644 index 0000000..74cb7fa --- /dev/null +++ b/PR_7_js/js/filtered_js/020_raw-html-format.js @@ -0,0 +1,38 @@ +const express = require('express') +const app = express() +const port = 3000 + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.get('/test', async (req, res) => { + // ruleid: raw-html-format + res.send("

" + "message: " + req.query.message + "

"); +}) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.post('/test2', async (req, res) => { + // ruleid: raw-html-format + res.send(`

message: ${req.query.message}

`); +}) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.post('/test3', async (req, res) => { + // ruleid: raw-html-format + var html = "

" + "message: " + req.query.message + "

" + res.send(html); +}) +// {/fact} + +// {fact rule=cross-site-scripting@v1.0 defects=1} +app.post('/test4', async (req, res) => { + var html = "

message" + // ruleid: raw-html-format + html = html.concat(req.query.message) + html = html.concat("

") + res.send(html); +}) +// {/fact} + + +app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`)) diff --git a/PR_7_js/js/filtered_js/021_chrome-remote-interface-navigate-injection.js b/PR_7_js/js/filtered_js/021_chrome-remote-interface-navigate-injection.js new file mode 100644 index 0000000..838c564 --- /dev/null +++ b/PR_7_js/js/filtered_js/021_chrome-remote-interface-navigate-injection.js @@ -0,0 +1,40 @@ +const CDP = require('chrome-remote-interface'); +const express = require("express"); +const app = express(); + +async function example(userInput) { + let client; + try { + client = await CDP(); + const {Network, Page} = client; + Network.requestWillBeSent((params) => { + console.log(params.request.url); + }); + await Network.enable(); + await Page.enable(); + // {fact rule=server-side-request-forgery@v1.0 defects=0} + // ok + await Page.navigate({url: 'https://github.com'}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-navigate-injection + await Page.navigate({url: userInput}); + // {/fact} + await Page.loadEventFired(); + } catch (err) { + console.error(err); + } finally { + if (client) { + await client.close(); + } + } +} + +function call() { + app.get("/add/:userInput", function (req, res) { + example(req.params.userInput) + }); + } + + call() diff --git a/PR_7_js/js/filtered_js/022_chrome-remote-interface-printtopdf-injection.js b/PR_7_js/js/filtered_js/022_chrome-remote-interface-printtopdf-injection.js new file mode 100644 index 0000000..44242aa --- /dev/null +++ b/PR_7_js/js/filtered_js/022_chrome-remote-interface-printtopdf-injection.js @@ -0,0 +1,45 @@ +const CDP = require('chrome-remote-interface'); +const express = require("express"); +const app = express(); + +function example(userInput) { + + CDP(async (client) => { + const {Page} = client; + try { + await Page.enable(); + await Page.navigate({url: 'https://github.com'}); + await Page.loadEventFired(); + // {fact rule=server-side-request-forgery@v1.0 defects=0} + // ok + const result = await Page.printToPDF({landscape: true, printBackground: true, headerTemplate: '

Title

'}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-printtopdf-injection + const result2 = await Page.printToPDF({landscape: true, printBackground: true, footerTemplate: userInput}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-printtopdf-injection + const result3 = await Page.printToPDF({landscape: true, printBackground: true, headerTemplate: '

' + userInput + '

'}); + // {/fact} + fs.writeFileSync('page.pdf', Buffer.from(data, 'base64')); + } catch (err) { + console.error(err); + } finally { + await client.close(); + } + }).on('error', (err) => { + console.error(err); + }); + +} + +function call() { + app.get("/add/:userInput", function (req, res) { + example(req.params.userInput) + }); + } + + call() diff --git a/PR_7_js/js/filtered_js/023_chrome-remote-interface-evaluate-injection.js b/PR_7_js/js/filtered_js/023_chrome-remote-interface-evaluate-injection.js new file mode 100644 index 0000000..a69884b --- /dev/null +++ b/PR_7_js/js/filtered_js/023_chrome-remote-interface-evaluate-injection.js @@ -0,0 +1,40 @@ +const CDP = require('chrome-remote-interface'); +const express = require("express"); +const app = express(); + +async function example(userInput) { + let client; + try { + client = await CDP(); + const {Runtime} = client; + // {fact rule=server-side-request-forgery@v1.0 defects=0} + const script1 = "document.querySelector('p').textContent" + // ok + const result = await Runtime.evaluate({expression: script1}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-evaluate-injection + const result2 = await Runtime.evaluate({expression: userInput}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-evaluate-injection + const result3 = await Runtime.evaluate({expression: 'var x = 123;' + userInput}); + // {/fact} + } catch (err) { + console.error(err); + } finally { + if (client) { + await client.close(); + } + } +} + +function call() { + app.get("/add/:userInput", function (req, res) { + example(req.params.userInput) + }); + } + + call() diff --git a/PR_7_js/js/filtered_js/024_chrome-remote-interface-compilescript-injection.js b/PR_7_js/js/filtered_js/024_chrome-remote-interface-compilescript-injection.js new file mode 100644 index 0000000..4b2b69f --- /dev/null +++ b/PR_7_js/js/filtered_js/024_chrome-remote-interface-compilescript-injection.js @@ -0,0 +1,41 @@ +const CDP = require('chrome-remote-interface'); +const express = require("express"); +const app = express(); + +async function example(userInput) { + let client; + try { + client = await CDP(); + const {Runtime} = client; + // {fact rule=server-side-request-forgery@v1.0 defects=0} + const script1 = "document.querySelector('p').textContent" + // ok + const result = await Runtime.compileScript({expression: script1, sourceURL:"", persistScript:false, executionContextId:1}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-compilescript-injection + const result2 = await Runtime.compileScript({expression: userInput, sourceURL:"", persistScript:false, executionContextId:1}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-compilescript-injection + const result3 = await Runtime.compileScript({expression: 'var x = 123;' + userInput, sourceURL:"", persistScript:false, executionContextId:1}); + // {/fact} + } catch (err) { + console.error(err); + } finally { + if (client) { + await client.close(); + } + } +} + + +function call() { + app.get("/add/:userInput", function (req, res) { + example(req.params.userInput) + }); + } + + call() diff --git a/PR_7_js/js/filtered_js/025_chrome-remote-interface-setdocumentcontent-injection.js b/PR_7_js/js/filtered_js/025_chrome-remote-interface-setdocumentcontent-injection.js new file mode 100644 index 0000000..ec2a364 --- /dev/null +++ b/PR_7_js/js/filtered_js/025_chrome-remote-interface-setdocumentcontent-injection.js @@ -0,0 +1,35 @@ +const CDP = require('chrome-remote-interface'); +const express = require("express"); +const app = express(); + +function example(userInput) { + CDP(async (client) => { + const {Page} = client; + try { + const {frameId} = await Page.navigate({url: 'about:blank'}); + // {fact rule=server-side-request-forgery@v1.0 defects=0} + const html = 'test'; + // ok + await Page.setDocumentContent({frameId, html}); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:chrome-remote-interface-setdocumentcontent-injection + await Page.setDocumentContent({frameId, html: userInput}); + // {/fact} + } catch (err) { + console.error(err); + client.close(); + } + }).on('error', (err) => { + console.error(err); + }); +} + +function call() { + app.get("/add/:userInput", function (req, res) { + example(req.params.userInput) + }); + } + + call() \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/026_jwt-hardcode.js b/PR_7_js/js/filtered_js/026_jwt-hardcode.js new file mode 100644 index 0000000..2162ec0 --- /dev/null +++ b/PR_7_js/js/filtered_js/026_jwt-hardcode.js @@ -0,0 +1,80 @@ +"use strict"; + +const config = require('./config') +const jsonwt = require('jsonwebtoken') + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example1() { + const payload = {foo: 'bar'} + const secret = 'shhhhh' + // ruleid: hardcoded-jwt-secret + const token1 = jsonwt.sign(payload, secret) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example2() { + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + const token2 = jsonwt.sign(payload, 'some-secret') +} +// {/fact} +// The hardcoded value provided to sign() +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example3() { + // ok: hardcoded-jwt-secret + const payload = {foo: 'bar'} + const token3 = jsonwt.sign(payload, config.secret) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=0} +function example4() { + // ok: hardcoded-jwt-secret + const payload = {foo: 'bar'} + const secret2 = config.secret + const token4 = jsonwt.sign(payload, secret2) +} +// {/fact} +// The hardcoded value provided to sign() +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example5() { + // ok: hardcoded-jwt-secret + const payload = {foo: 'bar'} + const secret3 = process.env.SECRET || 'fallback-secret' + const token5 = jsonwt.sign(payload, secret3) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +const Promise = require("bluebird"); +const secret = "hardcoded-secret" +class Authentication { + static sign(obj){ + // ruleid: hardcoded-jwt-secret + return jsonwt.sign(obj, secret, {}); + } + + static authenticate(payload) { + var token = payload.token; + let promise = new Promise((resolve, reject) => { + if (token) { + jwt.verify(token, secret, function (err, decoded) { + if (err) { + reject(err); + } else { + resolve(decoded); + } + }); + } else { + reject(new Error("No token provided")); + } + }); + + return promise; + + } +} +// {/fact} + +module.exports = Authentication; diff --git a/PR_7_js/js/filtered_js/027_shelljs-exec-injection.js b/PR_7_js/js/filtered_js/027_shelljs-exec-injection.js new file mode 100644 index 0000000..2844160 --- /dev/null +++ b/PR_7_js/js/filtered_js/027_shelljs-exec-injection.js @@ -0,0 +1,43 @@ +const shell = require('shelljs'); +const express = require("express"); +const app = express(); + +// {fact rule=os-command-injection@v1.0 defects=1} +function test1(userInput) { + // ruleid:shelljs-exec-injection + return shell.exec(userInput, {silent: true}) +} +// {/fact} + +// {fact rule=os-command-injection@v1.0 defects=1} +function test2(userInput) { + const input = `ls ${userInput}` + // ruleid:shelljs-exec-injection + return shell.exec(input, {silent: true}) +} +// {/fact} + +// {fact rule=os-command-injection@v1.0 defects=0} +function okTest3(userInput) { + // ok:shelljs-exec-injection + const input = 'ls ./' + return shell.exec(input, {silent: true}) +} +// {/fact} + +// {fact rule=os-command-injection@v1.0 defects=0} +function okTest4(userInput) { + // ok:shelljs-exec-injection + return shell.exec('ls ./', {silent: true}) +} +// {/fact} + + +function call() { + app.get("/add/:num1/:num2", function (req, res) { + test1(req.params.num2) + test2(req.params.num1) + }); + } + + call() \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/028_vm2-code-injection.js b/PR_7_js/js/filtered_js/028_vm2-code-injection.js new file mode 100644 index 0000000..53dd5f7 --- /dev/null +++ b/PR_7_js/js/filtered_js/028_vm2-code-injection.js @@ -0,0 +1,117 @@ +'use strict'; + +const fs = require('fs'); +const {VM, NodeVM} = require('vm2'); +const express = require("express"); +const app = express(); + +// {fact rule=code-injection@v1.0 defects=1} +async function test1(code, input) { + code = ` + console.log(${input}) + `; + + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + // ruleid: vm2-code-injection + return new VM({ + timeout: 40 * 1000, + sandbox + }).run(code); +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +function test2(input) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + // ruleid: vm2-code-injection + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM.run('console.log(' + input + ')') +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +function test3(input) { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + // ruleid: vm2-code-injection + const script = new VMScript(`console.log(${input})`) + return nodeVM.run(script) +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +async function okTest1(code) { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + return new VM({ + timeout: 40 * 1000, + sandbox + }).run(code); +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +function okTest2() { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM.run('console.log("Hello world")') +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +function okTest3() { + const sandbox = { + setTimeout, + fs: { + watch: fs.watch + } + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + const script = new VMScript('console.log("Hello world")') + return nodeVM.run(script) +} +// {/fact} + + +function call() { + app.get("/add/:num1/:num2", function (req, res) { + let code = req.body + test1(code, req.params.num2) + test2(req.params.num1) + test3(req.params.num3) + }); +} diff --git a/PR_7_js/js/filtered_js/029_vm2-context-injection.js b/PR_7_js/js/filtered_js/029_vm2-context-injection.js new file mode 100644 index 0000000..2de4e7b --- /dev/null +++ b/PR_7_js/js/filtered_js/029_vm2-context-injection.js @@ -0,0 +1,71 @@ +'use strict'; + +const fs = require('fs'); +const {VM, NodeVM} = require('vm2'); +const express = require("express"); +const app = express(); + +// {fact rule=code-injection@v1.0 defects=1} +// ruleid:vm2-context-injection +async function test1(input) { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + watch: input + }; +// {/fact} + return new VM({timeout: 40 * 1000, sandbox}).run(code); +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=1} +// ruleid:vm2-context-injection +function test2(input) { + const sandbox = { + setTimeout, + input + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM.run('console.log("Hello world")') +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:vm2-context-injection +async function okTest1() { + code = ` + console.log("Hello world") + `; + + const sandbox = { + setTimeout, + fs + }; + + return new VM({timeout: 40 * 1000, sandbox}).run(code); +} +// {/fact} + +// {fact rule=code-injection@v1.0 defects=0} +// ok:vm2-context-injection +function okTest2() { + const sandbox = { + setTimeout, + fs + }; + + const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox}); + return nodeVM.run('console.log("Hello world")') +} +// {/fact} + +function call() { + app.get("/add/:num1/:num2", function (req, res) { + test1(req.params.num2) + test2(req.params.num1) + }); +} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/030_mysql-sqli.js b/PR_7_js/js/filtered_js/030_mysql-sqli.js new file mode 100644 index 0000000..a72686b --- /dev/null +++ b/PR_7_js/js/filtered_js/030_mysql-sqli.js @@ -0,0 +1,63 @@ +var AWS = require('aws-sdk'); +const mysql = require('mysql2'); + +exports.handler = async (event, context) => { + console.log(event); + var secretsManager = new AWS.SecretsManager(); + var secretId = event.arguments[0][2]; + const secret = await secretsManager.getSecretValue({ + SecretId: secretId + }).promise(); + + var secretJson = JSON.parse(secret.SecretString); + + var host = secretJson.host; + var user = secretJson.username; + var password = secretJson.password; + + let connectionConfig = { + host: host, + user: user, + password: password, + connectTimeout: 60000 + }; + + var pool = await mysql.createPool(connectionConfig); + var conn = pool.promise(); + + var table = event.arguments[0][0]; + var columnName = event.arguments[0][1]; + + // {fact rule=sql-injection@v1.0 defects=1} + var createStmt = 'create temporary table ' + table + '_jointemp (temp_seq int, '+ columnName + ' varchar(100)); '; + // ruleid: mysql-sqli + await conn.query(createStmt); + // {/fact} + + + // {fact rule=sql-injection@v1.0 defects=1} + var values = event.arguments.map((x, i) => "("+i+",'"+x[3]+"')"); + var insertStmt = 'insert into ' + table + '_jointemp(temp_seq, '+ columnName +') values ' + values.join(',') + ';'; + // ruleid: mysql-sqli + await conn.query({sql: insertStmt, rowsAsArray: true}); + // {/fact} + + // {fact rule=sql-injection@v1.0 defects=1} + var selectStmt = 'select t2.* FROM ' + table + '_jointemp t1 LEFT OUTER JOIN ' + table + ' t2 using ('+ columnName +') order by temp_seq;' + // ruleid: mysql-sqli + const [results, fields] = await conn.execute(selectStmt); + // {/fact} + + // {fact rule=sql-injection@v1.0 defects=0} + // ok: mysql-sqli + const [results2, fields2] = await conn.execute('SELECT * FROM foobar WHERE id = ?', [columnName]); + // {/fact} + + var res = {}; + if(results.length > 0){ + res = results.map((row) => JSON.stringify(row)); + } + var response = JSON.stringify({"results": res}); + conn.end(); + return response; +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/031_pg-sqli.js b/PR_7_js/js/filtered_js/031_pg-sqli.js new file mode 100644 index 0000000..e258532 --- /dev/null +++ b/PR_7_js/js/filtered_js/031_pg-sqli.js @@ -0,0 +1,56 @@ +let response; + +const prettyPrint = (ob) => JSON.stringify(ob, null, 2).replace('\'',''); +const timestamp = () => new Date(); + +const toBase64 = (msg) => Buffer.from(msg).toString('base64'); + +const { Client } = require('pg'); +exports.handler = async function (event, context) { + console.log("the event"); + console.log(event); + + const client = new Client({ + user: "test", + host: "db", + database: "nockslots", + password: "test", + port: 5432, + }); + + console.log("connecting to db..."); + + await client.connect(); + + records = []; + event.Records.forEach((record) => { + const { body } = record; + console.log(body); + records.push(toBase64(body)); + }); + + // {fact rule=sql-injection@v1.0 defects=1} + const query = `INSERT INTO public.messages (body, encoded_message) VALUES ('${prettyPrint(event)}', '${records[0]}');`; + + console.log('the query:'); + console.log(query); + + try { + console.log("Trying the query..."); + // ruleid: pg-sqli + await client.query(query) + // {/fact} + + // {fact rule=sql-injection@v1.0 defects=0} + // ok: pg-sqli + await client.query('INSERT INTO messages (body, message) VALUES ($1, $2);', [prettyPrint(event), records[0]]) + // {/fact} + + await client.end(); + } catch (error) { + console.log('Could not add row to postgres, soz'); + console.log(error); + } + + return { key: JSON.stringify(records) }; +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/032_knex-sqli.js b/PR_7_js/js/filtered_js/032_knex-sqli.js new file mode 100644 index 0000000..f1a01f5 --- /dev/null +++ b/PR_7_js/js/filtered_js/032_knex-sqli.js @@ -0,0 +1,33 @@ +import knex from "knex"; +import Knex from "knex"; + +exports.handler = async (event) => { + const connection = knex({ + client: "mysql", + connection: { + host: process.env.DB_HOST, + port: Number(process.env.DB_PORT || "3306"), + user: process.env.DB_USER, + password: process.env.DB_PASSWORD, + database: process.env.DB_DATABASE, + }, + }); + + // {fact rule=sql-injection@v1.0 defects=1} + // ruleid: knex-sqli + await connection.raw(` + INSERT INTO (id, character, cartoon, link) + VALUES( + '${event.id}', + '${event.character}', + '${event.cartoon}', + '${event.link}' + ) + `); + // {/fact} + + // {fact rule=sql-injection@v1.0 defects=1} + // ok: knex-sqli + await connection.raw('SELECT * FROM foobar'); + // {/fact} +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/033_vm-runincontext-injection.js b/PR_7_js/js/filtered_js/033_vm-runincontext-injection.js new file mode 100644 index 0000000..f113963 --- /dev/null +++ b/PR_7_js/js/filtered_js/033_vm-runincontext-injection.js @@ -0,0 +1,100 @@ +const vm = require('vm') + +exports.handler = async (event) => { + // {fact rule=code-injection@v1.0 defects=1} + var input = event['something'] + var sandbox = { + foo: input + } + // ruleid: vm-runincontext-injection + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=1} + const code = ` + var x = ${event['something']}; + ` + // ruleid: vm-runincontext-injection + vm.runInThisContext(code) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=1} + const parsingContext = vm.createContext({name: 'world'}) + const code1 = `return 'hello ' + '${event['something']}'` + // ruleid: vm-runincontext-injection + const fn1 = vm.compileFunction(code1, [], { parsingContext }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=1} + const context = vm.createContext({name: event['something']}) + const code2 = `return 'hello ' name` + // ruleid: vm-runincontext-injection + const fn2 = vm.compileFunction(code2, [], { parsingContext: context }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=1} + // ruleid: vm-runincontext-injection + const script = new vm.Script(` + function add(a, b) { + return a + ${event['something']}; + } + + const x = add(1, 2); + `); + script.runInThisContext(); + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=0} + // ok: vm-runincontext-injection + var sandbox2 = { + foo: 1 + } + vm.createContext(sandbox2) + vm.runInContext('safeEval(orderLinesData)', sandbox2, { timeout: 2000 }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=0} + // ok: vm-runincontext-injection + var sandbox3 = { + foo: 1 + } + vm.runInNewContext('safeEval(orderLinesData)', sandbox3, { timeout: 2000 }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=0} + const code2 = ` + var x = 1; + ` + // ok: vm-runincontext-injection + vm.runInThisContext(code2) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=0} + const parsingContext = vm.createContext({name: 'world'}) + const code3 = `return 'hello ' + name` + // ok: vm-runincontext-injection + const fn3 = vm.compileFunction(code3, [], { parsingContext }) + // {/fact} + + + // {fact rule=code-injection@v1.0 defects=0} + // ok: vm-runincontext-injection + const script1 = new vm.Script(` + function add(a, b) { + return a + b; + } + + const x = add(1, 2); + `); + + script1.runInThisContext(); + // {/fact} +} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/034_sequelize-sqli.js b/PR_7_js/js/filtered_js/034_sequelize-sqli.js new file mode 100644 index 0000000..9352b0c --- /dev/null +++ b/PR_7_js/js/filtered_js/034_sequelize-sqli.js @@ -0,0 +1,43 @@ +let response; + +const prettyPrint = (ob) => JSON.stringify(ob, null, 2).replace('\'',''); +const timestamp = () => new Date(); + +const toBase64 = (msg) => Buffer.from(msg).toString('base64'); + +const { Sequelize } = require('sequelize'); +exports.handler = async function (event, context) { + console.log(event); + const sequelize = new Sequelize('postgres://user:pass@example.com:5432/dbname') + + records = []; + event.Records.forEach((record) => { + const { body } = record; + records.push(toBase64(body)); + }); + + // {fact rule=sql-injection@v1.0 defects=1} + const query = `INSERT INTO public.messages (body, encoded_message) VALUES ('${JSON.stringify(event)}', '${records[0]}');`; + console.log(query); + + try { + // ruleid: sequelize-sqli + await sequelize.query(query) + // {/fact} + + // {fact rule=sql-injection@v1.0 defects=0} + // ok: sequelize-sqli + await sequelize.query( + 'SELECT * FROM projects WHERE status = :status', + { + replacements: { status: 'active' }, + type: QueryTypes.SELECT + } + ); + // {/fact} + } catch (error) { + console.log(error); + } + + return { key: JSON.stringify(records) }; +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/035_tainted-eval.js b/PR_7_js/js/filtered_js/035_tainted-eval.js new file mode 100644 index 0000000..2f8d99f --- /dev/null +++ b/PR_7_js/js/filtered_js/035_tainted-eval.js @@ -0,0 +1,21 @@ +exports.handler = async (event) => { + // {fact rule=code-injection@v1.0 defects=0} + // ok:tainted-eval + eval('alert') + // {/fact} + + // {fact rule=code-injection@v1.0 defects=1} + // ruleid:tainted-eval + eval(event['smth']) + // {/fact} + + // {fact rule=code-injection@v1.0 defects=1} + // ruleid:tainted-eval + var x = new Function('a', 'b', `return ${event['func']}(a,b)`) + // {/fact} + + // {fact rule=code-injection@v1.0 defects=1} + // ruleid:tainted-eval + var y = Function('a', 'b', event['code']) + // {/fact} +} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/036_playwright-addinitscript-code-injection.js b/PR_7_js/js/filtered_js/036_playwright-addinitscript-code-injection.js new file mode 100644 index 0000000..aa2d2ee --- /dev/null +++ b/PR_7_js/js/filtered_js/036_playwright-addinitscript-code-injection.js @@ -0,0 +1,20 @@ +const { chromium } = require('playwright'); + +async function test4(userInput) { + + const browser = await chromium.launch(); + const page = await browser.newPage(); + const context = await browser.newContext(); +// {fact rule=server-side-request-forgery@v1.0 defects=0} + // ok:playwright-addinitscript-code-injection + await context.addInitScript(x => console.log(x), 5); + // {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-addinitscript-code-injection + await context.addInitScript(`fetch(${userInput})`); +// {/fact} + + await page.screenshot({path: 'example.png'}); + await browser.close(); +} diff --git a/PR_7_js/js/filtered_js/037_playwright-evaluate-arg-injection.js b/PR_7_js/js/filtered_js/037_playwright-evaluate-arg-injection.js new file mode 100644 index 0000000..4674c15 --- /dev/null +++ b/PR_7_js/js/filtered_js/037_playwright-evaluate-arg-injection.js @@ -0,0 +1,18 @@ +const { chromium } = require('playwright'); + +async function test3(userInput) { + + const browser = await chromium.launch(); + const page = await browser.newPage(); +// {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok + await page.evaluate(x => console.log(x), 5); + // {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-evaluate-arg-injection + await page.evaluate(x => fetch(x), userInput); +// {/fact} + await page.screenshot({path: 'example.png'}); + await browser.close(); +} diff --git a/PR_7_js/js/filtered_js/038_playwright-goto-injection.js b/PR_7_js/js/filtered_js/038_playwright-goto-injection.js new file mode 100644 index 0000000..2f297bf --- /dev/null +++ b/PR_7_js/js/filtered_js/038_playwright-goto-injection.js @@ -0,0 +1,32 @@ +// There is no method called unverifiedInput here. Need to update GT +import { chromium } from 'playwright'; + +const testFunc = async (userInput: any) => { + const browser = await chromium.launch(); + const page = await browser.newPage(); + let url = 'https://hardcoded.url.com' + // {fact rule=server-side-request-forgery@v1.0 defects=0} +// ok + await page.goto('https://example.com'); +// {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=0} + +// ok + await page.goto(url); +// {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-goto-injection + await page.goto(unverifiedInput()); +// {/fact} + + const newUrl = userInput; + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-goto-injection + await page.goto(newUrl); +// {/fact} + + await page.screenshot({path: 'example.png'}); + await browser.close(); +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/039_playwright-evaluate-code-injection.js b/PR_7_js/js/filtered_js/039_playwright-evaluate-code-injection.js new file mode 100644 index 0000000..1b29242 --- /dev/null +++ b/PR_7_js/js/filtered_js/039_playwright-evaluate-code-injection.js @@ -0,0 +1,18 @@ +const { chromium } = require('playwright'); + +async function test2(userInput) { + + const browser = await chromium.launch(); + const page = await browser.newPage(); +// {fact rule=server-side-request-forgery@v1.0 defects=0} + // ok:playwright-evaluate-code-injection + await page.evaluate(x => console.log(x), 5); + // {/fact} + +// {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-evaluate-code-injection + await page.evaluate(`fetch(${userInput})`); +// {/fact} + await page.screenshot({path: 'example.png'}); + await browser.close(); +} diff --git a/PR_7_js/js/filtered_js/040_playwright-setcontent-injection.js b/PR_7_js/js/filtered_js/040_playwright-setcontent-injection.js new file mode 100644 index 0000000..6475c93 --- /dev/null +++ b/PR_7_js/js/filtered_js/040_playwright-setcontent-injection.js @@ -0,0 +1,24 @@ +const { chromium } = require('playwright'); +const express = required('express'); + +const app = express(); + +// {fact rule=server-side-request-forgery@v1.0 defects=0} +app.get("/screenshot", (async (req, response) => { + const browser = await chromium.launch(); + const page = await browser.newPage(); + + // ok + await page.setContent(''); + // {/fact} + + // {fact rule=server-side-request-forgery@v1.0 defects=1} + // ruleid:playwright-setcontent-injection + await page.setContent(req.params.unverifiedData); + + await page.screenshot({path: 'example.png'}); + await browser.close(); + + res.send("Generated Screenshot"); +})); +// {/fact} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/041_jwt-hardcode.js b/PR_7_js/js/filtered_js/041_jwt-hardcode.js new file mode 100644 index 0000000..aa9f408 --- /dev/null +++ b/PR_7_js/js/filtered_js/041_jwt-hardcode.js @@ -0,0 +1,218 @@ +const config = require('./config') + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example1() { + const jose = require('jose') + const { JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, 'shhhhh') +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example2() { + const jose = require('jose') + const { JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + const token2 = JWT.sign(payload, 'shhhhh') +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example3() { + const jose = require('jose') + const { JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + const token3 = JWT.verify(payload, 'shhhhh') +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example4() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, JWK.asKey('raz-dva-tri')) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example5() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + const token5 = JWT.sign(payload, JWK.asKey('raz-dva-tri')) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example6() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + // ruleid: hardcoded-jwt-secret + const token6 = JWT.verify(payload, JWK.asKey('raz-dva-tri')) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example7() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const key7 = JWK.asKey('raz-dva-tri') + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, key7) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example8() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const key8 = JWK.asKey('raz-dva-tri') + // ruleid: hardcoded-jwt-secret + const token8 = JWT.sign(payload, key8) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example9() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const key9 = JWK.asKey('raz-dva-tri') + // ruleid: hardcoded-jwt-secret + const token9 = JWT.verify(payload, key9) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example10() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret10 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, secret10) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example11() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret11 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + const token11 = JWT.sign(payload, secret11) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example12() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret12 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + const token3 = JWT.verify(payload, secret12) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example13() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret13 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, JWK.asKey(secret13)) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example14() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret14 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + const token5 = JWT.sign(payload, JWK.asKey(secret14)) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example15() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret15 = 'shhhhh' + // ruleid: hardcoded-jwt-secret + const token6 = JWT.verify(payload, JWK.asKey(secret15)) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example16() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret16 = 'shhhhh' + const key16 = JWK.asKey(secret16) + // ruleid: hardcoded-jwt-secret + JWT.verify(payload, key16) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example17() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret17 = 'shhhhh' + const key17 = JWK.asKey(secret17) + // ruleid: hardcoded-jwt-secret + const token8 = JWT.sign(payload, key17) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=1} +function example18() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret18 = 'shhhhh' + const key18 = JWK.asKey(secret18) + // ruleid: hardcoded-jwt-secret + const token9 = JWT.verify(payload, key18) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=0} +function example10() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret2 = config.secret + // ok: hardcoded-jwt-secret + const token11 = JWT.sign(payload, JWK.asKey(secret2)) +} +// {/fact} + +// {fact rule=weak-obfuscation-of-request@v1.0 defects=0} +function example11() { + const jose = require('jose') + const { JWK, JWT } = jose + const payload = {foo: 'bar'} + const secret2 = config.secret + // ok: hardcoded-jwt-secret + const token12 = JWT.sign(payload, secret2) +} +// {/fact} diff --git a/PR_7_js/js/filtered_js/042_detect-buffer-noassert.js b/PR_7_js/js/filtered_js/042_detect-buffer-noassert.js new file mode 100644 index 0000000..c2e9b82 --- /dev/null +++ b/PR_7_js/js/filtered_js/042_detect-buffer-noassert.js @@ -0,0 +1,19 @@ +// {fact rule=improper-restriction-of-operations-within-memory-bounds@v1.0 defects=0} +// ok:detect-buffer-noassert +a.readUInt8(0) +// {/fact} + +// {fact rule=improper-restriction-of-operations-within-memory-bounds@v1.0 defects=0} +// ok:detect-buffer-noassert +a.readUInt8(0, false) +// {/fact} + +// {fact rule=improper-restriction-of-operations-within-memory-bounds@v1.0 defects=1} +// ruleid:detect-buffer-noassert +a.readUInt8(0, true) +// {/fact} + +// {fact rule=improper-restriction-of-operations-within-memory-bounds@v1.0 defects=1} +// ruleid:detect-buffer-noassert +a.writeFloatLE(0, true) +// {/fact} \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/043_detect-eval-with-expression.js b/PR_7_js/js/filtered_js/043_detect-eval-with-expression.js new file mode 100644 index 0000000..d7b4d42 --- /dev/null +++ b/PR_7_js/js/filtered_js/043_detect-eval-with-expression.js @@ -0,0 +1,20 @@ +// {fact rule=new-function-detected@v1.0 defects=0} +// ok:detect-eval-with-expression +eval('alert') +// {/fact} + +// {fact rule=new-function-detected@v1.00 defects=0} +// ok:detect-eval-with-expression +window.eval('alert') +// {/fact} + +// {fact rule=new-function-detected@v1.0 defects=1} +// ruleid:detect-eval-with-expression +window.eval(`alert('${location.href}')`) +// {/fact} + +// {fact rule=new-function-detected@v1.0 defects=1} +let funcName = new URLSearchParams(window.location.search).get('a') +// ruleid:detect-eval-with-expression +var x = new Function(`return ${funcName}(a,b)`) +// {/fact} diff --git a/PR_7_js/js/filtered_js/044_detect-no-csrf-before-method-override.js b/PR_7_js/js/filtered_js/044_detect-no-csrf-before-method-override.js new file mode 100644 index 0000000..7ea0d91 --- /dev/null +++ b/PR_7_js/js/filtered_js/044_detect-no-csrf-before-method-override.js @@ -0,0 +1,15 @@ +// {fact rule=cross-site-request-forgery@v1.0 defects=0} +function ok() { + // ok:detect-no-csrf-before-method-override + express.methodOverride() + express.csrf() +} +// {/fact} + +// {fact rule=cross-site-request-forgery@v1.0 defects=1} +function bad() { + // ruleid:detect-no-csrf-before-method-override + express.csrf() + express.methodOverride() +} +// {/fact} diff --git a/PR_7_js/js/filtered_js/045_hardcoded-hmac-key.js b/PR_7_js/js/filtered_js/045_hardcoded-hmac-key.js new file mode 100644 index 0000000..d2d2eae --- /dev/null +++ b/PR_7_js/js/filtered_js/045_hardcoded-hmac-key.js @@ -0,0 +1,17 @@ +const crypto = require("crypto"); + +// ruleid: hardcoded-hmac-key +exports.hmac = data => crypto.createHmac('sha256', 'pa4qacea4VK9t9nGv7yZtwmj').update(data).digest('hex') + +const rsa_key = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----' + +exports.deluxeToken = (email) => { + // ruleid: hardcoded-hmac-key + const hmac = crypto.createHmac('sha256', rsa_key) + return hmac.update(email + this.roles.deluxe).digest('hex') +} + +const safely_stored_key = config.get('AWS_KEY') +// ok +const safe_hmac = crypto.createHmac('sha256', safely_stored_key) + diff --git a/PR_7_js/js/filtered_js/046_detect-bracket-object-injection.js b/PR_7_js/js/filtered_js/046_detect-bracket-object-injection.js new file mode 100644 index 0000000..d054385 --- /dev/null +++ b/PR_7_js/js/filtered_js/046_detect-bracket-object-injection.js @@ -0,0 +1,27 @@ +const { CONSTANTS, SOME_MAP } = ModuleImport; + +const fieldName = CONSTANTS.A_VALUE; +const someOtherField = "FOO"; +const validations = SOME_MAP[fieldName]; + +const validate = function() { + const field = formData[fieldName]; + if (field !== undefined) { + return ValidationManager.validateField(fieldName, field.value, validations); + } + const badField = formData[formData["foo"]]; + const goodField = formData[someOtherField]; + const someField = formData["bar"] + const email = formData.split("@")[0]; + const email = formData.split("@")[0 + a]; + const email = formData.split("@")[a + 0]; + return { + name: fieldName, + value: '', + error: '', + }; +}; + +export default { + validate, +}; diff --git a/PR_7_js/js/filtered_js/047_vm-injection.js b/PR_7_js/js/filtered_js/047_vm-injection.js new file mode 100644 index 0000000..f4fd29f --- /dev/null +++ b/PR_7_js/js/filtered_js/047_vm-injection.js @@ -0,0 +1,139 @@ +const vm = require('vm') + +// ruleid: vm-runincontext-context-injection +function test1(userInput) { + var input = userInput.something || '' + var sandbox = { + foo: input + } + vm.createContext(sandbox) + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +} + +// ruleid: vm-runincontext-context-injection +foo(function (userInput) { + var sandbox = { + foo: userInput + } + vm.createContext(sandbox) + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +}) + +// ok: vm-runincontext-context-injection +function testOk1(userInput) { + var sandbox = { + foo: 1 + } + vm.createContext(sandbox) + vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +} + +// ruleid: vm-runinnewcontext-context-injection +function test2(userInput) { + var input = userInput.something || '' + var sandbox = { + foo: input + } + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +} + +// ruleid: vm-runinnewcontext-context-injection +foo(function (userInput) { + var sandbox = { + foo: userInput + } + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +}) + +// ok: vm-runinnewcontext-context-injection +function testOk1(userInput) { + var sandbox = { + foo: 1 + } + vm.runInNewContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 }) +} + +function test3(userInput) { + const code = ` + var x = ${userInput}; + ` + // ruleid: vm-runinthiscontext-code-injection + vm.runInThisContext(code) +} + +function okTest3(userInput) { + const code = ` + var x = 1; + ` + // ok: vm-runinthiscontext-code-injection + vm.runInThisContext(code) +} + +function test4(userInput) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + ${userInput}` + // ruleid: vm-compilefunction-code-injection + const fn = vm.compileFunction(code, [], { parsingContext }) +} + +function okTest4(userInput) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + name` + // ok: vm-compilefunction-code-injection + const fn = vm.compileFunction(code, [], { parsingContext }) +} + +// ruleid: vm-compilefunction-context-injection +function test5(userInput) { + const context = vm.createContext({name: userInput}) + const code = `return 'hello ' name` + const fn = vm.compileFunction(code, [], { parsingContext: context }) +} + +function okTest5(userInput) { + const parsingContext = vm.createContext({name: 'world'}) + const code = `return 'hello ' + name` + // ok: vm-compilefunction-context-injection + const fn = vm.compileFunction(code, [], { parsingContext }) +} + +function test6(userInput) { + // ruleid: vm-script-code-injection + const script = new vm.Script(` + function add(a, b) { + return a + ${userInput}; + } + + const x = add(1, 2); + `); + + script.runInThisContext(); +} + +function okTest6(userInput) { + // ok: vm-script-code-injection + const script = new vm.Script(` + function add(a, b) { + return a + b; + } + + const x = add(1, 2); + `); + + script.runInThisContext(); +} + +async function test6(userInput) { + const contextifiedObject = vm.createContext({ secret: 42 }); + + // ruleid: vm-sourcetextmodule-code-injection + const module = new vm.SourceTextModule( + `Object.getPrototypeOf(import.meta.prop).secret = ${userInput};`, + { + initializeImportMeta(meta) { + meta.prop = {}; + } + }); + await module.link(() => {}); + await module.evaluate(); +} diff --git a/PR_7_js/js/filtered_js/048_node-postgres-sqli.js b/PR_7_js/js/filtered_js/048_node-postgres-sqli.js new file mode 100644 index 0000000..4821535 --- /dev/null +++ b/PR_7_js/js/filtered_js/048_node-postgres-sqli.js @@ -0,0 +1,140 @@ +function bad1() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + query = "SELECT name FROM users WHERE age=" + req.FormValue("age") + // ruleid: node-postgres-sqli + const res = await client.query(query) + console.log(res.rows[0].message) // Hello world! + await client.end() +} + + +function bad2() { + const { Client, Pool } = require('pg') + const pool = new Pool() + query = "SELECT name FROM users WHERE age=" + query += req.FormValue("age") + // ruleid: node-postgres-sqli + const res = await pool.query(query) + console.log(res.rows[0].message) // Hello world! + await client.end() +} + +function bad3(userinput) { + const { Client } = require('pg') + const client = new Client() + await client.connect() + query = "SELECT name FROM users WHERE age=".concat(userinput) + // ruleid: node-postgres-sqli + const res = await client.query(query) + console.log(res.rows[0].message) // Hello world! + await client.end() +} + +function bad4() { + const { Pool } = require('pg') + const pool = new Pool() + pool.on('error', (err, client) => { + console.error('Unexpected error on idle client', err) + process.exit(-1) + }) + pool.connect((err, client, done) => { + if (err) throw err + // ruleid: node-postgres-sqli + client.query("SELECT name FROM users WHERE age=" + req.FormValue("age"), (err, res) => { + done() + if (err) { + console.log(err.stack) + } else { + console.log(res.rows[0]) + } + }) + }) +} + +function bad5(userinput) { + const { Pool } = require('pg') + const pool = new Pool() + // ruleid: node-postgres-sqli + pool + .query('SELECT * FROM users WHERE id ='.concat(userinput)) + .then(res => console.log('user:', res.rows[0])) + .catch(err => + setImmediate(() => { + throw err + }) + ) +} + +function ok1() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + query = "SELECT * FROM users WHERE email=".concat("hello") + // ok: node-postgres-sqli + client.query(query) +} + +function ok2() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + query = "SELECT name FROM users WHERE age=" + "3" + // ok: node-postgres-sqli + client.query(query) +} + +function ok3() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + query = "SELECT name FROM users WHERE age=" + query += "3" + // ok: node-postgres-sqli + client.query(query) +} + +function ok4() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + // ok: node-postgres-sqli + client.query("INSERT INTO users(name, email) VALUES($1, $2)", + ["Jon Calhoun", userinput]) +} + +function ok5() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + // ok: node-postgres-sqli + client.query("SELECT name FROM users WHERE age=" + "3") +} + +function ok6() { + const { Client } = require('pg') + const client = new Client() + await client.connect() + // ok: node-postgres-sqli + client.query("SELECT * FROM users WHERE email=".concat("hello")) +} + +function ok7() { + const { Client } = require('pg') + const client = new Client() + const query = { + // give the query a unique name + name: 'fetch-user', + text: 'SELECT * FROM user WHERE id = $1', + values: [userinput], + } + // ok: node-postgres-sqli + client.query(query, (err, res) => { + if (err) { + console.log(err.stack) + } else { + console.log(res.rows[0]) + } + }) +} diff --git a/PR_7_js/js/filtered_js/049_node-knex-sqli.js b/PR_7_js/js/filtered_js/049_node-knex-sqli.js new file mode 100644 index 0000000..650e534 --- /dev/null +++ b/PR_7_js/js/filtered_js/049_node-knex-sqli.js @@ -0,0 +1,28 @@ +import knex from "knex"; + +async function test1(input) { + const connection = knex({ + client: "mysql", + connection: { + host: process.env.DB_HOST, + port: Number(process.env.DB_PORT || "3306"), + user: process.env.DB_USER, + password: process.env.DB_PASSWORD, + database: process.env.DB_DATABASE, + }, + }); + + // ruleid: node-knex-sqli + await connection.raw(` + INSERT INTO (id, character, cartoon, link) + VALUES( + '${input.id}', + '${input.character}', + '${input.cartoon}', + '${input.link}' + ) + `); + + // ok: node-knex-sqli + await connection.raw('SELECT * FROM foobar'); +}; \ No newline at end of file diff --git a/PR_7_js/js/filtered_js/VULNERABILITY_MAPPING.md b/PR_7_js/js/filtered_js/VULNERABILITY_MAPPING.md new file mode 100644 index 0000000..3e051df --- /dev/null +++ b/PR_7_js/js/filtered_js/VULNERABILITY_MAPPING.md @@ -0,0 +1,84 @@ +# Vulnerability Files Mapping to Top 25 CWE + +## Summary +Successfully filtered and copied 50 JavaScript security vulnerability files from the Prime dataset that relate to the Top 25 Most Dangerous Software Weaknesses (2023 CWE Top 25). + +## Files by Vulnerability Category + +### CWE-79: Cross-site Scripting (XSS) +- 017_direct-response-write.js +- 020_raw-html-format.js + +### CWE-89: SQL Injection +- 019_tainted-sql-string.js +- 030_mysql-sqli.js +- 031_pg-sqli.js +- 032_knex-sqli.js +- 034_sequelize-sqli.js +- 048_node-postgres-sqli.js +- 049_node-knex-sqli.js + +### CWE-78: OS Command Injection +- 027_shelljs-exec-injection.js + +### CWE-22: Path Traversal +- (Included in injection patterns) + +### CWE-352: Cross-Site Request Forgery (CSRF) +- 044_detect-no-csrf-before-method-override.js + +### CWE-502: Deserialization of Untrusted Data +- 014_express-third-party-object-deserialization.js + +### CWE-77: Command Injection +- 001_puppeteer-evaluate-arg-injection.js +- 003_puppeteer-goto-injection.js +- 004_puppeteer-evaluate-code-injection.js +- 008_express-phantom-injection.js +- 010_express-puppeteer-injection.js +- 011_express-wkhtml-injection.js +- 021_chrome-remote-interface-navigate-injection.js +- 022_chrome-remote-interface-printtopdf-injection.js +- 023_chrome-remote-interface-evaluate-injection.js +- 024_chrome-remote-interface-compilescript-injection.js +- 025_chrome-remote-interface-setdocumentcontent-injection.js +- 036_playwright-addinitscript-code-injection.js +- 037_playwright-evaluate-arg-injection.js +- 038_playwright-goto-injection.js +- 039_playwright-evaluate-code-injection.js + +### CWE-798: Use of Hard-coded Credentials +- 007_express-jwt-hardcoded-secret.js +- 015_express-session-hardcoded-secret.js +- 026_jwt-hardcode.js +- 041_jwt-hardcode.js +- 045_hardcoded-hmac-key.js + +### CWE-918: Server-Side Request Forgery (SSRF) +- 016_express-ssrf.js + +### CWE-94: Code Injection +- 000_wkhtmltopdf-injection.js +- 002_puppeteer-setcontent-injection.js +- 005_express-vm-injection.js +- 006_express-vm2-injection.js +- 009_express-sandbox-injection.js +- 012_remote-property-injection.js +- 013_res-render-injection.js +- 028_vm2-code-injection.js +- 029_vm2-context-injection.js +- 033_vm-runincontext-injection.js +- 035_tainted-eval.js +- 040_playwright-setcontent-injection.js +- 043_detect-eval-with-expression.js +- 046_detect-bracket-object-injection.js +- 047_vm-injection.js + +### CWE-119/CWE-125: Buffer Errors +- 042_detect-buffer-noassert.js + +### CWE-20: Improper Input Validation +- 018_escape-function-overwrite.js + +## Total Files: 50 +All files are JavaScript (.js) files containing security vulnerability examples and test cases related to the top 25 most dangerous software weaknesses. \ No newline at end of file