juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import fs = require('fs')
7
import { type Request, type Response, type NextFunction } from 'express'
8
import { challenges } from '../data/datacache'
9

10
import { UserModel } from '../models/user'
11
import challengeUtils = require('../lib/challengeUtils')
12
import config from 'config'
13
import * as utils from '../lib/utils'
14
import { AllHtmlEntities as Entities } from 'html-entities'
15
const security = require('../lib/insecurity')
16
const pug = require('pug')
17
const themes = require('../views/themes/themes').themes
18
const entities = new Entities()
19

20
module.exports = function getUserProfile () {
21
  return (req: Request, res: Response, next: NextFunction) => {
22
    fs.readFile('views/userProfile.pug', function (err, buf) {
23
      if (err != null) throw err
24
      const loggedInUser = security.authenticatedUsers.get(req.cookies.token)
25
      if (loggedInUser) {
26
        UserModel.findByPk(loggedInUser.data.id).then((user: UserModel | null) => {
27
          let template = buf.toString()
28
          let username = user?.username
29
          if (username?.match(/#{(.*)}/) !== null && utils.isChallengeEnabled(challenges.usernameXssChallenge)) {
30
            req.app.locals.abused_ssti_bug = true
31
            const code = username?.substring(2, username.length - 1)
32
            try {
33
              if (!code) {
34
                throw new Error('Username is null')
35
              }
36
              username = eval(code) // eslint-disable-line no-eval
37
            } catch (err) {
38
              username = '\\' + username
39
            }
40
          } else {
41
            username = '\\' + username
42
          }
43
          const theme = themes[config.get<string>('application.theme')]
44
          if (username) {
45
            template = template.replace(/_username_/g, username)
46
          }
47
          template = template.replace(/_emailHash_/g, security.hash(user?.email))
48
          template = template.replace(/_title_/g, entities.encode(config.get<string>('application.name')))
49
          template = template.replace(/_favicon_/g, favicon())
50
          template = template.replace(/_bgColor_/g, theme.bgColor)
51
          template = template.replace(/_textColor_/g, theme.textColor)
52
          template = template.replace(/_navColor_/g, theme.navColor)
53
          template = template.replace(/_primLight_/g, theme.primLight)
54
          template = template.replace(/_primDark_/g, theme.primDark)
55
          template = template.replace(/_logo_/g, utils.extractFilename(config.get('application.logo')))
56
          const fn = pug.compile(template)
57
          const CSP = `img-src 'self' ${user?.profileImage}; script-src 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com`
58
          // @ts-expect-error FIXME type issue with string vs. undefined for username
59
          challengeUtils.solveIf(challenges.usernameXssChallenge, () => { return user?.profileImage.match(/;[ ]*script-src(.)*'unsafe-inline'/g) !== null && utils.contains(username, '<script>alert(`xss`)</script>') })
60

61
          res.set({
62
            'Content-Security-Policy': CSP
63
          })
64

65
          res.send(fn(user))
66
        }).catch((error: Error) => {
67
          next(error)
68
        })
69
      } else {
70
        next(new Error('Blocked illegal activity by ' + req.socket.remoteAddress))
71
      }
72
    })
73
  }
74

75
  function favicon () {
76
    return utils.extractFilename(config.get('application.favicon'))
77
  }
78
}
79