juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
/* jslint node: true */
7
import * as utils from '../lib/utils'
8
import * as challengeUtils from '../lib/challengeUtils'
9
import {
10
  Model,
11
  type InferAttributes,
12
  type InferCreationAttributes,
13
  DataTypes,
14
  type CreationOptional,
15
  type Sequelize
16
} from 'sequelize'
17
import { type BasketItemModel } from './basketitem'
18
import { challenges } from '../data/datacache'
19
import * as security from '../lib/insecurity'
20

21
class Product extends Model<
22
InferAttributes<Product>,
23
InferCreationAttributes<Product>
24
> {
25
  declare id: CreationOptional<number>
26
  declare name: string
27
  declare description: string
28
  declare price: number
29
  declare deluxePrice: number
30
  declare image: string
31
  declare BasketItem?: CreationOptional<BasketItemModel> // Note this is optional since it's only populated when explicitly requested in code
32
}
33

34
const ProductModelInit = (sequelize: Sequelize) => {
35
  Product.init(
36
    {
37
      id: {
38
        type: DataTypes.INTEGER,
39
        primaryKey: true,
40
        autoIncrement: true
41
      },
42
      name: DataTypes.STRING,
43
      description: {
44
        type: DataTypes.STRING,
45
        set (description: string) {
46
          if (utils.isChallengeEnabled(challenges.restfulXssChallenge)) {
47
            challengeUtils.solveIf(challenges.restfulXssChallenge, () => {
48
              return utils.contains(
49
                description,
50
                '<iframe src="javascript:alert(`xss`)">'
51
              )
52
            })
53
          } else {
54
            description = security.sanitizeSecure(description)
55
          }
56
          this.setDataValue('description', description)
57
        }
58
      },
59
      price: DataTypes.DECIMAL,
60
      deluxePrice: DataTypes.DECIMAL,
61
      image: DataTypes.STRING
62
    },
63
    {
64
      tableName: 'Products',
65
      sequelize,
66
      paranoid: true
67
    }
68
  )
69
}
70

71
export { Product as ProductModel, ProductModelInit }
72