Skip to content

Commit 35c1a14

Browse files
timothywarnertimothywarner
committed
Add vuln testing apps
1 parent 5d35ab8 commit 35c1a14

1,532 files changed

Lines changed: 174021 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎NodeGoat/.dockerignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Dockerfile
2+
docker-compose.yml
3+
.dockerignore
4+
.git
5+
.github
6+
.gitignore

‎NodeGoat/.github/workflows/e2e-test.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: E2E Test
2+
on: [push, pull_request]
3+
4+
jobs:
5+
e2e-test:
6+
name: Node.js
7+
runs-on: ubuntu-latest
8+
9+
strategy:
10+
fail-fast: false
11+
matrix:
12+
node-version: ["10.x", "12.x", "14.x"]
13+
14+
steps:
15+
- name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
16+
uses: actions/checkout@v2
17+
with:
18+
persist-credentials: false
19+
20+
- name: Set up Node.js ${{ matrix.node-version }}
21+
uses: actions/setup-node@v1
22+
with:
23+
node-version: ${{ matrix.node-version }}
24+
25+
- name: Use cache
26+
uses: actions/cache@v2
27+
with:
28+
path: |
29+
~/.npm
30+
~/.cache
31+
key: ${{ runner.os }}-node${{ matrix.node-version }}-E2E-${{ hashFiles('package-lock.json') }}
32+
33+
- name: Install dependencies
34+
run: |
35+
npm ci
36+
npm run cy:verify
37+
38+
- name: Start MongoDB
39+
run: |
40+
docker run -d -p 27017:27017 mongo:4.0
41+
timeout 60s bash -c 'until nc -z -w 2 localhost 27017 && echo MongoDB ready; do sleep 2; done'
42+
43+
- name: Run E2E test suite
44+
id: test-suite
45+
run: |
46+
NODE_ENV=test npm start -- --silent &
47+
npm run test:ci -- --config video=true
48+
49+
- name: Prepare cypress artifacts
50+
if: failure() && (steps.test-suite.outcome == 'failure')
51+
working-directory: ./test/e2e
52+
run: >
53+
mkdir -p "screenshots" && find "screenshots" -mindepth 1 -maxdepth 1 -type d
54+
-exec sh -c 'mv -- "videos/$(basename "$1").mp4" "$1"' _ {} \;
55+
56+
- name: Upload cypress artifacts
57+
if: failure() && (steps.test-suite.outcome == 'failure')
58+
uses: actions/upload-artifact@v2
59+
with:
60+
name: cypress-artifacts-node${{ matrix.node-version }}
61+
path: test/e2e/screenshots

‎NodeGoat/.github/workflows/lint.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Lint
2+
on: [push, pull_request]
3+
4+
jobs:
5+
lint:
6+
name: Node.js
7+
runs-on: ubuntu-latest
8+
9+
strategy:
10+
fail-fast: false
11+
matrix:
12+
node-version: ["14.x"]
13+
14+
steps:
15+
- name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
16+
uses: actions/checkout@v2
17+
with:
18+
persist-credentials: false
19+
20+
- name: Set up Node.js ${{ matrix.node-version }}
21+
uses: actions/setup-node@v1
22+
with:
23+
node-version: ${{ matrix.node-version }}
24+
25+
- name: Run linter
26+
run: npx --no-install jshint@2.12.0 .

‎NodeGoat/.gitignore‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Node modules
2+
node_modules
3+
4+
# Logs and databases
5+
*.log
6+
*.db
7+
8+
# OS files
9+
.DS_Store
10+
.DS_Store?
11+
._*
12+
.Spotlight-V100
13+
.Trashes
14+
Icon?
15+
16+
# Idea stuff
17+
.idea/**
18+
19+
# Zap output
20+
report*.html
21+
22+
# e2e
23+
test/e2e/screenshots/
24+
test/e2e/videos/
25+
26+
# ignore sensitive files
27+
.env.local
28+
.env
29+
30+
# ignore Snyk Code scanner files
31+
.dccache

‎NodeGoat/.jshintignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
node_modules/
2+
app/assets/vendor/

‎NodeGoat/.jshintrc‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"node": true, // Enable globals available when code is running inside of the NodeJS runtime environment.
3+
"browser": true, // Standard browser globals e.g. `window`, `document`.
4+
"esversion": 9, // Allow EcmaScript 9 syntax.
5+
"bitwise": false, // Prohibit bitwise operators (&, |, ^, etc.).
6+
"camelcase": true, // Permit only camelcase for `var` and `object indexes`.
7+
"curly": false, // Require {} for every new block or scope.
8+
"eqeqeq": true, // Require triple equals i.e. `===`.
9+
"immed": true, // Require immediate invocations to be wrapped in parens e.g. `( function(){}() );`.
10+
"latedef": true, // Prohibit variable use before definition.
11+
"newcap": true, // Require capitalization of all constructor functions e.g. `new F()`.
12+
"noarg": true, // Prohibit use of `arguments.caller` and `arguments.callee`.
13+
"quotmark": "double", // Define quotes to string values.
14+
"regexp": true, // Prohibit `.` and `[^...]` in regular expressions.
15+
"undef": true, // Require all non-global variables be declared before they are used.
16+
"unused": false, // Warn unused variables.
17+
"strict": true, // Require `use strict` pragma in every file.
18+
"trailing": true, // Prohibit trailing whitespaces.
19+
"smarttabs": false, // Suppresses warnings about mixed tabs and spaces.
20+
"indent": 4, // Specify indentation spacing.
21+
"maxlen": 120, // Max line length.
22+
"devel": false, // Allow development statements e.g. `console.log();`.
23+
"noempty": true, // Prohibit use of empty blocks.
24+
"overrides": {
25+
"test/e2e/**": {
26+
"globals": {
27+
"cy": false,
28+
"Cypress": false,
29+
"it": false,
30+
"describe": false,
31+
"before": false,
32+
"after": false,
33+
"beforeEach": false,
34+
"afterEach": false,
35+
"expect": false
36+
}
37+
}
38+
}
39+
}

‎NodeGoat/.travis.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
os: linux
2+
dist: xenial
3+
language: node_js
4+
services:
5+
- docker
6+
- xvfb
7+
node_js:
8+
- v8
9+
- v10
10+
- v12
11+
12+
## Missing dependency for Cypress https://github.com/cypress-io/cypress/issues/4069
13+
addons:
14+
apt:
15+
packages:
16+
- libgconf-2-4
17+
18+
19+
## Cache NPM folder and Cypress binary
20+
## to avoid downloading Cypress again and again
21+
cache:
22+
directories:
23+
- ~/.npm
24+
- ~/.cache
25+
26+
before_script:
27+
## we use the '&' ampersand which tells
28+
## travis to run this process in the background
29+
## else it would block execution and hang travis
30+
- docker run -d -p 27017:27017 mongo:4.0
31+
- docker ps -a
32+
- NODE_ENV=test npm start -- --silent &
33+
34+
script:
35+
- npm run test:ci
36+

‎NodeGoat/CODE_OF_CONDUCT.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to make participation in our project and
7+
our community a harassment-free experience for everyone, regardless of age, body
8+
size, disability, ethnicity, sex characteristics, gender identity and expression,
9+
level of experience, education, socio-economic status, nationality, personal
10+
appearance, race, religion, or sexual identity and orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to creating a positive environment
15+
include:
16+
17+
* Using welcoming and inclusive language
18+
* Being respectful of differing viewpoints and experiences
19+
* Gracefully accepting constructive criticism
20+
* Focusing on what is best for the community
21+
* Showing empathy towards other community members
22+
23+
Examples of unacceptable behavior by participants include:
24+
25+
* The use of sexualized language or imagery and unwelcome sexual attention or
26+
advances
27+
* Trolling, insulting/derogatory comments, and personal or political attacks
28+
* Public or private harassment
29+
* Publishing others' private information, such as a physical or electronic
30+
address, without explicit permission
31+
* Other conduct which could reasonably be considered inappropriate in a
32+
professional setting
33+
34+
## Our Responsibilities
35+
36+
Project maintainers are responsible for clarifying the standards of acceptable
37+
behavior and are expected to take appropriate and fair corrective action in
38+
response to any instances of unacceptable behavior.
39+
40+
Project maintainers have the right and responsibility to remove, edit, or
41+
reject comments, commits, code, wiki edits, issues, and other contributions
42+
that are not aligned to this Code of Conduct, or to ban temporarily or
43+
permanently any contributor for other behaviors that they deem inappropriate,
44+
threatening, offensive, or harmful.
45+
46+
## Scope
47+
48+
This Code of Conduct applies within all project spaces, and it also applies when
49+
an individual is representing the project or its community in public spaces.
50+
Examples of representing a project or community include using an official
51+
project e-mail address, posting via an official social media account, or acting
52+
as an appointed representative at an online or offline event. Representation of
53+
a project may be further defined and clarified by project maintainers.
54+
55+
## Enforcement
56+
57+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
58+
reported by contacting the project team at chetan.karande@owasp.org. All
59+
complaints will be reviewed and investigated and will result in a response that
60+
is deemed necessary and appropriate to the circumstances. The project team is
61+
obligated to maintain confidentiality with regard to the reporter of an incident.
62+
Further details of specific enforcement policies may be posted separately.
63+
64+
Project maintainers who do not follow or enforce the Code of Conduct in good
65+
faith may face temporary or permanent repercussions as determined by other
66+
members of the project's leadership.
67+
68+
## Attribution
69+
70+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
71+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
72+
73+
[homepage]: https://www.contributor-covenant.org
74+
75+
For answers to common questions about this code of conduct, see
76+
https://www.contributor-covenant.org/faq

‎NodeGoat/CONTRIBUTING.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
## Contributing
2+
3+
Contributions from community are key to make NodeGoat a high quality comprehensive resource. Lets make NodeGoat awesome together!
4+
5+
### Ways to Contribute
6+
Depending on your preference, you can contribute in various ways. Here are tasks planned for [upcoming release](https://github.com/OWASP/NodeGoat/milestones).
7+
You can also open an issue, sending a PR, or get in touch on [Gitter Chat](https://gitter.im/OWASP/NodeGoat) or [Slack](https://owasp.slack.com/messages/project-nodegoat/)
8+
9+
If sending PR, once code is ready to commit, run:
10+
```
11+
npm run precommit
12+
```
13+
This command uses `js-beautifier` to indent the code and verifies these [coding standards](https://github.com/OWASP/NodeGoat/blob/master/.jshintrc) using `jsHint`. Please resolve all `jsHint` errors before committing the code.

‎NodeGoat/Dockerfile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
FROM node:12-alpine
2+
ENV WORKDIR /usr/src/app/
3+
WORKDIR $WORKDIR
4+
COPY package*.json $WORKDIR
5+
RUN npm install --production --no-cache
6+
7+
FROM node:12-alpine
8+
ENV USER node
9+
ENV WORKDIR /home/$USER/app
10+
WORKDIR $WORKDIR
11+
COPY --from=0 /usr/src/app/node_modules node_modules
12+
RUN chown $USER:$USER $WORKDIR
13+
COPY --chown=node . $WORKDIR
14+
# In production environment uncomment the next line
15+
#RUN chown -R $USER:$USER /home/$USER && chmod -R g-s,o-rx /home/$USER && chmod -R o-wrx $WORKDIR
16+
# Then all further actions including running the containers should be done under non-root user.
17+
USER $USER
18+
EXPOSE 4000

0 commit comments

Comments
 (0)