juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
/* jslint node: true */
7
import config from 'config'
8
import {
9
  type InferAttributes,
10
  type InferCreationAttributes,
11
  Model,
12
  DataTypes,
13
  type CreationOptional,
14
  type Sequelize
15
} from 'sequelize'
16
import * as challengeUtils from '../lib/challengeUtils'
17
import * as utils from '../lib/utils'
18
import { challenges } from '../data/datacache'
19
import * as security from '../lib/insecurity'
20

21
class User extends Model<
22
InferAttributes<User>,
23
InferCreationAttributes<User>
24
> {
25
  declare id: CreationOptional<number>
26
  declare username: string | undefined
27
  declare email: CreationOptional<string>
28
  declare password: CreationOptional<string>
29
  declare role: CreationOptional<string>
30
  declare deluxeToken: CreationOptional<string>
31
  declare lastLoginIp: CreationOptional<string>
32
  declare profileImage: CreationOptional<string>
33
  declare totpSecret: CreationOptional<string>
34
  declare isActive: CreationOptional<boolean>
35
}
36

37
const UserModelInit = (sequelize: Sequelize) => { // vuln-code-snippet start weakPasswordChallenge
38
  User.init(
39
    { // vuln-code-snippet hide-start
40
      id: {
41
        type: DataTypes.INTEGER,
42
        primaryKey: true,
43
        autoIncrement: true
44
      },
45
      username: {
46
        type: DataTypes.STRING,
47
        defaultValue: '',
48
        set (username: string) {
49
          if (utils.isChallengeEnabled(challenges.persistedXssUserChallenge)) {
50
            username = security.sanitizeLegacy(username)
51
          } else {
52
            username = security.sanitizeSecure(username)
53
          }
54
          this.setDataValue('username', username)
55
        }
56
      },
57
      email: {
58
        type: DataTypes.STRING,
59
        unique: true,
60
        set (email: string) {
61
          if (utils.isChallengeEnabled(challenges.persistedXssUserChallenge)) {
62
            challengeUtils.solveIf(challenges.persistedXssUserChallenge, () => {
63
              return utils.contains(
64
                email,
65
                '<iframe src="javascript:alert(`xss`)">'
66
              )
67
            })
68
          } else {
69
            email = security.sanitizeSecure(email)
70
          }
71
          this.setDataValue('email', email)
72
        }
73
      }, // vuln-code-snippet hide-end
74
      password: {
75
        type: DataTypes.STRING,
76
        set (clearTextPassword: string) {
77
          this.setDataValue('password', security.hash(clearTextPassword)) // vuln-code-snippet vuln-line weakPasswordChallenge
78
        }
79
      }, // vuln-code-snippet end weakPasswordChallenge
80
      role: {
81
        type: DataTypes.STRING,
82
        defaultValue: 'customer',
83
        validate: {
84
          isIn: [['customer', 'deluxe', 'accounting', 'admin']]
85
        },
86
        set (role: string) {
87
          const profileImage = this.getDataValue('profileImage')
88
          if (
89
            role === security.roles.admin &&
90
          (!profileImage ||
91
            profileImage === '/assets/public/images/uploads/default.svg')
92
          ) {
93
            this.setDataValue(
94
              'profileImage',
95
              '/assets/public/images/uploads/defaultAdmin.png'
96
            )
97
          }
98
          this.setDataValue('role', role)
99
        }
100
      },
101
      deluxeToken: {
102
        type: DataTypes.STRING,
103
        defaultValue: ''
104
      },
105
      lastLoginIp: {
106
        type: DataTypes.STRING,
107
        defaultValue: '0.0.0.0'
108
      },
109
      profileImage: {
110
        type: DataTypes.STRING,
111
        defaultValue: '/assets/public/images/uploads/default.svg'
112
      },
113
      totpSecret: {
114
        type: DataTypes.STRING,
115
        defaultValue: ''
116
      },
117
      isActive: {
118
        type: DataTypes.BOOLEAN,
119
        defaultValue: true
120
      }
121
    },
122
    {
123
      tableName: 'Users',
124
      paranoid: true,
125
      sequelize
126
    }
127
  )
128

129
  User.addHook('afterValidate', async (user: User) => {
130
    if (
131
      user.email &&
132
    user.email.toLowerCase() ===
133
      `acc0unt4nt@${config.get<string>('application.domain')}`.toLowerCase()
134
    ) {
135
      await Promise.reject(
136
        new Error(
137
          'Nice try, but this is not how the "Ephemeral Accountant" challenge works!'
138
        )
139
      )
140
    }
141
  })
142
}
143

144
export { User as UserModel, UserModelInit }
145