0
Fork 0
mirror of https://github.com/verdaccio/verdaccio.git synced 2024-12-23 22:27:34 -05:00
verdaccio/test/functional/sanity/security.js

70 lines
2 KiB
JavaScript
Raw Normal View History

2017-12-02 05:19:08 -05:00
import assert from 'assert';
2017-04-19 14:15:28 -05:00
2017-12-02 05:19:08 -05:00
export default function(server) {
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
describe('Security', () => {
beforeAll(function () {
return server.addPackage('testpkg-sec');
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('bad pkg #1', () => {
return server.getPackage('package.json')
.status(403)
.body_error(/invalid package/);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('bad pkg #2', () => {
return server.getPackage('__proto__')
.status(403)
.body_error(/invalid package/);
2017-04-19 14:15:28 -05:00
});
2017-12-02 05:19:08 -05:00
test('__proto__, connect stuff', () => {
2017-04-19 14:15:28 -05:00
return server.request({uri: '/testpkg-sec?__proto__=1'})
.then(function (body) {
// test for NOT outputting stack trace
2017-04-19 14:15:28 -05:00
assert(!body || typeof(body) === 'object' || body.indexOf('node_modules') === -1);
2013-12-19 10:11:54 -05:00
// test for NOT crashing
2017-04-19 14:15:28 -05:00
return server.request({uri: '/testpkg-sec'}).status(200);
});
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('do not return package.json as an attachment', () => {
2017-04-19 14:15:28 -05:00
return server.request({uri: '/testpkg-sec/-/package.json'})
.status(403)
.body_error(/invalid filename/);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('silly things - reading #1', () => {
2017-04-19 14:15:28 -05:00
return server.request({uri: '/testpkg-sec/-/../../../../../../../../etc/passwd'})
.status(404);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('silly things - reading #2', () => {
2017-04-19 14:15:28 -05:00
return server.request({uri: '/testpkg-sec/-/%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'})
.status(403)
.body_error(/invalid filename/);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('silly things - writing #1', () => {
return server.putTarball('testpkg-sec', 'package.json', '{}')
.status(403)
.body_error(/invalid filename/);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('silly things - writing #3', () => {
return server.putTarball('testpkg-sec', 'node_modules', '{}')
.status(403)
.body_error(/invalid filename/);
2017-04-19 14:15:28 -05:00
});
2013-12-19 10:11:54 -05:00
2017-12-02 05:19:08 -05:00
test('silly things - writing #4', () => {
return server.putTarball('testpkg-sec', '../testpkg.tgz', '{}')
.status(403)
.body_error(/invalid filename/);
2017-04-19 14:15:28 -05:00
});
});
};
2013-12-19 10:11:54 -05:00