juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import frisby = require('frisby')
7
import { expect } from '@jest/globals'
8
import config from 'config'
9
import path from 'path'
10
const fs = require('fs')
11

12
const jsonHeader = { 'content-type': 'application/json' }
13
const REST_URL = 'http://localhost:3000/rest'
14

15
describe('/rest/memories', () => {
16
  it('GET memories via public API', () => {
17
    return frisby.get(REST_URL + '/memories')
18
      .expect('status', 200)
19
  })
20

21
  it('GET memories via a valid authorization token', () => {
22
    return frisby.post(REST_URL + '/user/login', {
23
      headers: jsonHeader,
24
      body: {
25
        email: 'jim@' + config.get<string>('application.domain'),
26
        password: 'ncc-1701'
27
      }
28
    })
29
      .expect('status', 200)
30
      .then(({ json: jsonLogin }) => {
31
        return frisby.get(REST_URL + '/memories', {
32
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' }
33
        })
34
          .expect('status', 200)
35
      })
36
  })
37

38
  it('POST new memory is forbidden via public API', () => {
39
    const file = path.resolve(__dirname, '../files/validProfileImage.jpg')
40
    const form = frisby.formData()
41
    form.append('image', fs.createReadStream(file), 'Valid Image')
42
    form.append('caption', 'Valid Image')
43

44
    return frisby.post(REST_URL + '/memories', {
45
      headers: {
46
        // @ts-expect-error FIXME form.getHeaders() is not found
47
        'Content-Type': form.getHeaders()['content-type']
48
      },
49
      body: form
50
    })
51
      .expect('status', 401)
52
  })
53

54
  it('POST new memory image file invalid type', () => {
55
    const file = path.resolve(__dirname, '../files/invalidProfileImageType.docx')
56
    const form = frisby.formData()
57
    form.append('image', fs.createReadStream(file), 'Valid Image')
58
    form.append('caption', 'Valid Image')
59

60
    return frisby.post(REST_URL + '/user/login', {
61
      headers: jsonHeader,
62
      body: {
63
        email: 'jim@' + config.get<string>('application.domain'),
64
        password: 'ncc-1701'
65
      }
66
    })
67
      .expect('status', 200)
68
      .then(({ json: jsonLogin }) => {
69
        return frisby.post(REST_URL + '/memories', {
70
          headers: {
71
            Authorization: 'Bearer ' + jsonLogin.authentication.token,
72
            // @ts-expect-error FIXME form.getHeaders() is not found
73
            'Content-Type': form.getHeaders()['content-type']
74
          },
75
          body: form
76
        })
77
          .expect('status', 500)
78
      })
79
  })
80

81
  it('POST new memory with valid for JPG format image', () => {
82
    const file = path.resolve(__dirname, '../files/validProfileImage.jpg')
83
    const form = frisby.formData()
84
    form.append('image', fs.createReadStream(file), 'Valid Image')
85
    form.append('caption', 'Valid Image')
86

87
    return frisby.post(REST_URL + '/user/login', {
88
      headers: jsonHeader,
89
      body: {
90
        email: 'jim@' + config.get<string>('application.domain'),
91
        password: 'ncc-1701'
92
      }
93
    })
94
      .expect('status', 200)
95
      .then(({ json: jsonLogin }) => {
96
        return frisby.post(REST_URL + '/memories', {
97
          headers: {
98
            Authorization: 'Bearer ' + jsonLogin.authentication.token,
99
            // @ts-expect-error FIXME form.getHeaders() is not found
100
            'Content-Type': form.getHeaders()['content-type']
101
          },
102
          body: form
103
        })
104
          .expect('status', 200)
105
          .then(({ json }) => {
106
            expect(json.data.caption).toBe('Valid Image')
107
            expect(json.data.UserId).toBe(2)
108
          })
109
      })
110
  })
111

112
  it('Should not crash the node-js server when sending invalid content like described in CVE-2022-24434', () => {
113
    return frisby.post(REST_URL + '/memories', {
114
      headers: {
115
        'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundaryoo6vortfDzBsDiro',
116
        'Content-Length': '145'
117
      },
118
      body: '------WebKitFormBoundaryoo6vortfDzBsDiro\r\n Content-Disposition: form-data; name="bildbeschreibung"\r\n\r\n\r\n------WebKitFormBoundaryoo6vortfDzBsDiro--'
119
    })
120
      .expect('status', 500)
121
      .expect('bodyContains', 'Error: Malformed part header')
122
  })
123
})
124