juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import frisby = require('frisby')
7
import config from 'config'
8

9
const API_URL = 'http://localhost:3000/api'
10
const REST_URL = 'http://localhost:3000/rest'
11

12
const jsonHeader = { 'content-type': 'application/json' }
13

14
describe('/rest/user/change-password', () => {
15
  it('GET password change for newly created user with recognized token as Authorization header', () => {
16
    return frisby.post(API_URL + '/Users', {
17
      headers: jsonHeader,
18
      body: {
19
        email: 'kuni@be.rt',
20
        password: 'kunigunde'
21
      }
22
    })
23
      .expect('status', 201)
24
      .then(() => {
25
        return frisby.post(REST_URL + '/user/login', {
26
          headers: jsonHeader,
27
          body: {
28
            email: 'kuni@be.rt',
29
            password: 'kunigunde'
30
          }
31
        })
32
          .expect('status', 200)
33
          .then(({ json }) => {
34
            return frisby.get(REST_URL + '/user/change-password?current=kunigunde&new=foo&repeat=foo', {
35
              headers: { Authorization: 'Bearer ' + json.authentication.token }
36
            })
37
              .expect('status', 200)
38
          })
39
      })
40
  })
41

42
  it('GET password change with passing wrong current password', () => {
43
    return frisby.post(REST_URL + '/user/login', {
44
      headers: jsonHeader,
45
      body: {
46
        email: 'bjoern@' + config.get<string>('application.domain'),
47
        password: 'monkey summer birthday are all bad passwords but work just fine in a long passphrase'
48
      }
49
    })
50
      .expect('status', 200)
51
      .then(({ json }) => {
52
        return frisby.get(REST_URL + '/user/change-password?current=definetely_wrong&new=blubb&repeat=blubb', {
53
          headers: { Authorization: 'Bearer ' + json.authentication.token }
54
        })
55
          .expect('status', 401)
56
          .expect('bodyContains', 'Current password is not correct')
57
      })
58
  })
59

60
  it('GET password change without passing any passwords', () => {
61
    return frisby.get(REST_URL + '/user/change-password')
62
      .expect('status', 401)
63
      .expect('bodyContains', 'Password cannot be empty')
64
  })
65

66
  it('GET password change with passing wrong repeated password', () => {
67
    return frisby.get(REST_URL + '/user/change-password?new=foo&repeat=bar')
68
      .expect('status', 401)
69
      .expect('bodyContains', 'New and repeated password do not match')
70
  })
71

72
  it('GET password change without passing an authorization token', () => {
73
    return frisby.get(REST_URL + '/user/change-password?new=foo&repeat=foo')
74
      .expect('status', 500)
75
      .expect('header', 'content-type', /text\/html/)
76
      .expect('bodyContains', '<h1>' + config.get<string>('application.name') + ' (Express')
77
      .expect('bodyContains', 'Error: Blocked illegal activity')
78
  })
79

80
  it('GET password change with passing unrecognized authorization token', () => {
81
    return frisby.get(REST_URL + '/user/change-password?new=foo&repeat=foo', { headers: { Authorization: 'Bearer unknown' } })
82
      .expect('status', 500)
83
      .expect('header', 'content-type', /text\/html/)
84
      .expect('bodyContains', '<h1>' + config.get<string>('application.name') + ' (Express')
85
      .expect('bodyContains', 'Error: Blocked illegal activity')
86
  })
87

88
  it('GET password change for Bender without current password using GET request', () => {
89
    return frisby.post(REST_URL + '/user/login', {
90
      headers: jsonHeader,
91
      body: {
92
        email: 'bender@' + config.get<string>('application.domain'),
93
        password: 'OhG0dPlease1nsertLiquor!'
94
      }
95
    })
96
      .expect('status', 200)
97
      .then(({ json }) => {
98
        return frisby.get(REST_URL + '/user/change-password?new=slurmCl4ssic&repeat=slurmCl4ssic', {
99
          headers: { Authorization: 'Bearer ' + json.authentication.token }
100
        })
101
          .expect('status', 200)
102
      })
103
  })
104
})
105

106
describe('/rest/user/reset-password', () => {
107
  it('POST password reset for Jim with correct answer to his security question', () => {
108
    return frisby.post(REST_URL + '/user/reset-password', {
109
      headers: jsonHeader,
110
      body: {
111
        email: 'jim@' + config.get<string>('application.domain'),
112
        answer: 'Samuel',
113
        new: 'ncc-1701',
114
        repeat: 'ncc-1701'
115
      }
116
    })
117
      .expect('status', 200)
118
  })
119

120
  it('POST password reset for Bender with correct answer to his security question', () => {
121
    return frisby.post(REST_URL + '/user/reset-password', {
122
      headers: jsonHeader,
123
      body: {
124
        email: 'bender@' + config.get<string>('application.domain'),
125
        answer: 'Stop\'n\'Drop',
126
        new: 'OhG0dPlease1nsertLiquor!',
127
        repeat: 'OhG0dPlease1nsertLiquor!'
128
      }
129
    })
130
      .expect('status', 200)
131
  })
132

133
  it('POST password reset for Bjoern´s internal account with correct answer to his security question', () => {
134
    return frisby.post(REST_URL + '/user/reset-password', {
135
      headers: jsonHeader,
136
      body: {
137
        email: 'bjoern@' + config.get<string>('application.domain'),
138
        answer: 'West-2082',
139
        new: 'monkey summer birthday are all bad passwords but work just fine in a long passphrase',
140
        repeat: 'monkey summer birthday are all bad passwords but work just fine in a long passphrase'
141
      }
142
    })
143
      .expect('status', 200)
144
  })
145

146
  it('POST password reset for Bjoern´s OWASP account with correct answer to his security question', () => {
147
    return frisby.post(REST_URL + '/user/reset-password', {
148
      headers: jsonHeader,
149
      body: {
150
        email: 'bjoern@owasp.org',
151
        answer: 'Zaya',
152
        new: 'kitten lesser pooch karate buffoon indoors',
153
        repeat: 'kitten lesser pooch karate buffoon indoors'
154
      }
155
    })
156
      .expect('status', 200)
157
  })
158

159
  it('POST password reset for Morty with correct answer to his security question', () => {
160
    return frisby.post(REST_URL + '/user/reset-password', {
161
      headers: jsonHeader,
162
      body: {
163
        email: 'morty@' + config.get<string>('application.domain'),
164
        answer: '5N0wb41L',
165
        new: 'iBurri3dMySe1fInTheB4ckyard!',
166
        repeat: 'iBurri3dMySe1fInTheB4ckyard!'
167
      }
168
    })
169
      .expect('status', 200)
170
  })
171

172
  it('POST password reset with wrong answer to security question', () => {
173
    return frisby.post(REST_URL + '/user/reset-password', {
174
      headers: jsonHeader,
175
      body: {
176
        email: 'bjoern@' + config.get<string>('application.domain'),
177
        answer: '25436',
178
        new: '12345',
179
        repeat: '12345'
180
      }
181
    })
182
      .expect('status', 401)
183
      .expect('bodyContains', 'Wrong answer to security question.')
184
  })
185

186
  it('POST password reset without any data is blocked', () => {
187
    return frisby.post(REST_URL + '/user/reset-password')
188
      .expect('status', 500)
189
      .expect('header', 'content-type', /text\/html/)
190
      .expect('bodyContains', '<h1>' + config.get<string>('application.name') + ' (Express')
191
      .expect('bodyContains', 'Error: Blocked illegal activity')
192
  })
193

194
  it('POST password reset without new password throws a 401 error', () => {
195
    return frisby.post(REST_URL + '/user/reset-password', {
196
      headers: jsonHeader,
197
      body: {
198
        email: 'bjoern@' + config.get<string>('application.domain'),
199
        answer: 'W-2082',
200
        repeat: '12345'
201
      }
202
    })
203
      .expect('status', 401)
204
      .expect('bodyContains', 'Password cannot be empty.')
205
  })
206

207
  it('POST password reset with mismatching passwords throws a 401 error', () => {
208
    return frisby.post(REST_URL + '/user/reset-password', {
209
      headers: jsonHeader,
210
      body: {
211
        email: 'bjoern@' + config.get<string>('application.domain'),
212
        answer: 'W-2082',
213
        new: '12345',
214
        repeat: '1234_'
215
      }
216
    })
217
      .expect('status', 401)
218
      .expect('bodyContains', 'New and repeated password do not match.')
219
  })
220

221
  it('POST password reset with no email address throws a 412 error', () => {
222
    return frisby.post(REST_URL + '/user/reset-password', {
223
      header: jsonHeader,
224
      body: {
225
        answer: 'W-2082',
226
        new: 'abcdef',
227
        repeat: 'abcdef'
228
      }
229
    })
230
      .expect('status', 500)
231
      .expect('header', 'content-type', /text\/html/)
232
      .expect('bodyContains', '<h1>' + config.get<string>('application.name') + ' (Express')
233
      .expect('bodyContains', 'Error: Blocked illegal activity')
234
  })
235

236
  it('POST password reset with no answer to the security question throws a 412 error', () => {
237
    return frisby.post(REST_URL + '/user/reset-password', {
238
      header: jsonHeader,
239
      body: {
240
        email: 'bjoern@' + config.get<string>('application.domain'),
241
        new: 'abcdef',
242
        repeat: 'abcdef'
243
      }
244
    })
245
      .expect('status', 500)
246
      .expect('header', 'content-type', /text\/html/)
247
      .expect('bodyContains', '<h1>' + config.get<string>('application.name') + ' (Express')
248
      .expect('bodyContains', 'Error: Blocked illegal activity')
249
  })
250
})
251