2017-12-02 05:19:08 -05:00
|
|
|
import assert from 'assert';
|
2017-04-19 14:15:28 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
export default function(server) {
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
describe('Security', () => {
|
|
|
|
beforeAll(function () {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.addPackage('testpkg-sec');
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('bad pkg #1', () => {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.getPackage('package.json')
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid package/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('bad pkg #2', () => {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.getPackage('__proto__')
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid package/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2015-03-28 13:25:53 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('__proto__, connect stuff', () => {
|
2017-04-19 14:15:28 -05:00
|
|
|
return server.request({uri: '/testpkg-sec?__proto__=1'})
|
2017-08-06 14:54:15 -05:00
|
|
|
.then(function (body) {
|
2015-04-11 12:11:04 -05:00
|
|
|
// test for NOT outputting stack trace
|
2017-04-19 14:15:28 -05:00
|
|
|
assert(!body || typeof(body) === 'object' || body.indexOf('node_modules') === -1);
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2015-04-11 12:11:04 -05:00
|
|
|
// test for NOT crashing
|
2017-04-19 14:15:28 -05:00
|
|
|
return server.request({uri: '/testpkg-sec'}).status(200);
|
|
|
|
});
|
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('do not return package.json as an attachment', () => {
|
2017-04-19 14:15:28 -05:00
|
|
|
return server.request({uri: '/testpkg-sec/-/package.json'})
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid filename/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('silly things - reading #1', () => {
|
2017-04-19 14:15:28 -05:00
|
|
|
return server.request({uri: '/testpkg-sec/-/../../../../../../../../etc/passwd'})
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(404);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('silly things - reading #2', () => {
|
2017-04-19 14:15:28 -05:00
|
|
|
return server.request({uri: '/testpkg-sec/-/%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'})
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid filename/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('silly things - writing #1', () => {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.putTarball('testpkg-sec', 'package.json', '{}')
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid filename/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('silly things - writing #3', () => {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.putTarball('testpkg-sec', 'node_modules', '{}')
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid filename/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
2013-12-19 10:11:54 -05:00
|
|
|
|
2017-12-02 05:19:08 -05:00
|
|
|
test('silly things - writing #4', () => {
|
2017-06-28 15:56:02 -05:00
|
|
|
return server.putTarball('testpkg-sec', '../testpkg.tgz', '{}')
|
2017-08-06 14:54:15 -05:00
|
|
|
.status(403)
|
|
|
|
.body_error(/invalid filename/);
|
2017-04-19 14:15:28 -05:00
|
|
|
});
|
|
|
|
});
|
2017-12-02 05:20:27 -05:00
|
|
|
}
|