juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import utils = require('../lib/utils')
7
import challengeUtils = require('../lib/challengeUtils')
8
import { type Request, type Response } from 'express'
9
import * as db from '../data/mongodb'
10
import { challenges } from '../data/datacache'
11

12
module.exports = function trackOrder () {
13
  return (req: Request, res: Response) => {
14
    const id = !utils.isChallengeEnabled(challenges.reflectedXssChallenge) ? String(req.params.id).replace(/[^\w-]+/g, '') : req.params.id
15

16
    challengeUtils.solveIf(challenges.reflectedXssChallenge, () => { return utils.contains(id, '<iframe src="javascript:alert(`xss`)">') })
17
    db.ordersCollection.find({ $where: `this.orderId === '${id}'` }).then((order: any) => {
18
      const result = utils.queryResultToJson(order)
19
      challengeUtils.solveIf(challenges.noSqlOrdersChallenge, () => { return result.data.length > 1 })
20
      if (result.data[0] === undefined) {
21
        result.data[0] = { orderId: id }
22
      }
23
      res.json(result)
24
    }, () => {
25
      res.status(400).json({ error: 'Wrong Param' })
26
    })
27
  }
28
}
29