firewall-node/library/helpers/getSourceForUserString.test.ts at 414b347c233238d7f550e803cc56d240d759d01b · AikidoSec/firewall-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
import * as t from "tap";
import { Context } from "../agent/Context";
import { getSourceForUserString } from "./getSourceForUserString";

function createContext(): Context {
  return {
    remoteAddress: "::1",
    method: "POST",
    url: "http://local.aikido.io",
    query: {},
    headers: {},
    body: {
      image: "http://localhost:4000/api/internal",
    },
    cookies: {},
    routeParams: {},
    source: "express",
    route: "/posts/:id",
  };
}

t.test(
  "it returns undefined if the user string cannot be found in the context",
  async () => {
    t.same(getSourceForUserString(createContext(), "unknown"), undefined);
  }
);

t.test(
  "it returns source if the user string is found in the context",
  async () => {
    t.same(
      getSourceForUserString(
        createContext(),
        "http://localhost:4000/api/internal"
      ),
      "body"
    );
  }
);

t.test(
  "it returns 'files' source when the user string is in multipart file metadata",
  async () => {
    const context = createContext();
    context.files = [
      {
        fieldname: "document",
        originalname: "' OR '1'='1",
        encoding: "7bit",
        mimetype: "application/pdf",
      },
    ];
    t.same(getSourceForUserString(context, "' OR '1'='1"), "files");
  }
);

t.test(
  "it returns 'files' source when the user string is in the filename of the second file",
  async () => {
    const context = createContext();
    context.files = [
      {
        fieldname: "photo",
        filename: "benign.jpg",
        encoding: "7bit",
        mimeType: "image/jpeg",
      },
      {
        fieldname: "attachment",
        filename: "../../etc/passwd",
        encoding: "7bit",
        mimeType: "text/plain",
      },
    ];
    t.same(getSourceForUserString(context, "../../etc/passwd"), "files");
  }
);

t.test(
  "it returns 'files' source when the user string matches a mimeType field",
  async () => {
    const context = createContext();
    context.files = [
      {
        fieldname: "upload",
        filename: "safe.txt",
        encoding: "7bit",
        mimeType: "'; DROP TABLE users; --",
      },
    ];
    t.same(getSourceForUserString(context, "'; DROP TABLE users; --"), "files");
  }
);

t.test("it returns undefined when files array is empty", async () => {
  const context = createContext();
  context.files = [];
  t.same(getSourceForUserString(context, "anything"), undefined);
});

t.test(
  "it returns 'files' source when files is a single object (req.file style)",
  async () => {
    const context = createContext();
    context.files = {
      fieldname: "avatar",
      originalname: "; rm -rf /",
      encoding: "7bit",
      mimetype: "image/png",
    };
    t.same(getSourceForUserString(context, "; rm -rf /"), "files");
  }
);