juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
/* jslint node: true */
7
import * as utils from '../lib/utils'
8
import * as challengeUtils from '../lib/challengeUtils'
9
import {
10
  Model,
11
  type InferAttributes,
12
  type InferCreationAttributes,
13
  DataTypes,
14
  type CreationOptional,
15
  type Sequelize
16
} from 'sequelize'
17
import { challenges } from '../data/datacache'
18
import * as security from '../lib/insecurity'
19

20
class Feedback extends Model<
21
InferAttributes<Feedback>,
22
InferCreationAttributes<Feedback>
23
> {
24
  declare UserId: number | null
25
  declare id: CreationOptional<number>
26
  declare comment: string
27
  declare rating: number
28
}
29
const FeedbackModelInit = (sequelize: Sequelize) => {
30
  Feedback.init(
31
    {
32
      UserId: {
33
        type: DataTypes.INTEGER
34
      },
35
      id: {
36
        type: DataTypes.INTEGER,
37
        primaryKey: true,
38
        autoIncrement: true
39
      },
40
      comment: {
41
        type: DataTypes.STRING,
42
        set (comment: string) {
43
          let sanitizedComment: string
44
          if (utils.isChallengeEnabled(challenges.persistedXssFeedbackChallenge)) {
45
            sanitizedComment = security.sanitizeHtml(comment)
46
            challengeUtils.solveIf(challenges.persistedXssFeedbackChallenge, () => {
47
              return utils.contains(
48
                sanitizedComment,
49
                '<iframe src="javascript:alert(`xss`)">'
50
              )
51
            })
52
          } else {
53
            sanitizedComment = security.sanitizeSecure(comment)
54
          }
55
          this.setDataValue('comment', sanitizedComment)
56
        }
57
      },
58
      rating: {
59
        type: DataTypes.INTEGER,
60
        allowNull: false,
61
        set (rating: number) {
62
          this.setDataValue('rating', rating)
63
          challengeUtils.solveIf(challenges.zeroStarsChallenge, () => {
64
            return rating === 0
65
          })
66
        }
67
      }
68
    },
69
    {
70
      tableName: 'Feedbacks',
71
      sequelize
72
    }
73
  )
74
}
75

76
export { Feedback as FeedbackModel, FeedbackModelInit }
77