login-security-landscape/TypeScriptCrawler/Dockerfile at main · cispa/login-security-landscape · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
FROM mcr.microsoft.com/playwright:v1.33.0-focal
ENV TZ=Europe/Berlin
ENV DEBIAN_FRONTEND noninteractive
ARG EXPERIMENT

# Set container timezone
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

RUN apt-get update -y
RUN apt-get upgrade -y
RUN apt-get install -y build-essential software-properties-common

# Create directory for crawler source & crawler data path
RUN mkdir -p /typescript-crawler
RUN mkdir -p /typescript-crawler-data
RUN mkdir -p /foxhound

# Install VNC and fluxbox to interact with headfull runs
RUN apt-get install -y x11vnc fluxbox

# Install database client
RUN apt-get install -y postgresql-client

# Install python3 and
RUN apt-get install -y python3.10 python3-pip
# Install dependencies for pmsecurity experiment (pmforce)
RUN pip3 install z3-solver==4.8.7.0 ply

# Install python2
RUN apt-get install -y python2.7 python2.7-dev
# Install dependencies for cxss experiment (exploit generator)
RUN apt-get install -y libxml2-dev libxslt-dev cmake pkg-config
RUN mkdir -p /install
WORKDIR /install
# Install pip for python2 to install exploit generator dependencies later
RUN curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
RUN python2.7 get-pip.py

# Build foxhound if enabled
RUN if [ "$EXPERIMENT" = "cxss" ]; then \
    apt-get install -y wget autoconf2.13 ccache libnspr4-dev software-properties-common git bash findutils gzip libxml2 m4 make perl tar unzip watchman;\
    curl https://sh.rustup.rs -sSf | sh -s -- -y;  \
    ${HOME}/.cargo/bin/rustup install 1.66;\
    ${HOME}/.cargo/bin/rustup default 1.66;\
    ${HOME}/.cargo/bin/rustup override set 1.66;\
    . "$HOME/.cargo/env";\
    mkdir -p /foxhound/build; \
    mkdir -p /foxhound/playwright; \
    git clone --branch v1.33.0 https://github.com/microsoft/playwright.git /foxhound/playwright; \
    GIT_SSL_NO_VERIFY=true git clone https://github.com/SAP/project-foxhound -b main /foxhound/build; \
    cd /foxhound/build; \
    git checkout firefox-release; \
    ./mach --no-interactive bootstrap --application-choice=browser; \
    git checkout 2916e0188bc9; \
    git apply --index --whitespace=nowarn /foxhound/playwright/browser_patches/firefox/patches/*; \
    cp -r /foxhound/playwright/browser_patches/firefox/juggler /foxhound/build/juggler; \
    cp taintfox_mozconfig_ubuntu .mozconfig; \
    sed -i 's/ac_add_options --enable-bootstrap/# ac_add_options --enable-bootstrap/g' .mozconfig; \
    echo "ac_add_options --disable-crashreporter" >> .mozconfig; \
    echo "ac_add_options --disable-backgroundtasks" >> .mozconfig; \
    echo "ac_add_options --enable-release" >> .mozconfig; \
    echo "ac_add_options --without-wasm-sandboxed-libraries" >> .mozconfig; \
    ./mach build; \
    cp /foxhound/playwright/browser_patches/firefox/preferences/00-playwright-prefs.js /foxhound/build/obj-tf-release/dist/bin/browser/defaults/preferences/00-playwright-prefs.js;\
    cp /foxhound/playwright/browser_patches/firefox/preferences/playwright.cfg /foxhound/build/obj-tf-release/dist/bin/playwright.cfg;\
    fi


# Copy project source
COPY ./src/ /typescript-crawler

WORKDIR /typescript-crawler


# Install dependencies for cxss experiment (exploit generator)
WORKDIR /typescript-crawler/snippets/cxss/persistent-clientside-xss/src
RUN pip install -r requirements.txt

# Go back to crawler directory
WORKDIR /typescript-crawler

# Install dependencies of crawler code (npm)
RUN npm install

# Make entrypoint script executable
RUN chmod +x entrypoint.sh

# Make required experiment scripts executable
RUN chmod +x experiment-analysis.sh
RUN chmod +x experiment-stop.sh
RUN chmod +x experiment.sh

RUN chmod +x setup/prepare.sh
RUN chmod +x setup/spawn.sh

# Install dependencies for test server (local testing)
WORKDIR /typescript-crawler/snippets/insecure-webpages
RUN npm install

# Add unprivileged user
RUN useradd -ms /bin/bash typescriptcrawler

# Change ownership of relevant files for crawler to new user
RUN chown -R typescriptcrawler /typescript-crawler
RUN chown -R typescriptcrawler /typescript-crawler-data
RUN chown -R typescriptcrawler /foxhound

USER typescriptcrawler

# Update workdir
WORKDIR /typescript-crawler

# Start entrypoint script, which starts Xvfb and opens VNC session
ENTRYPOINT ["/bin/bash", "/typescript-crawler/entrypoint.sh"]