67 |
68 |
--------------------------------------------------------------------------------
/grails-app/views/tutorials/index.gsp:
--------------------------------------------------------------------------------
1 |
2 |
3 |
Welcome to the grails_nV tutorials, indicating which vulnerabilities have been built into this system. Choose a tutorial from the left to get started.
11 |
12 |
--------------------------------------------------------------------------------
/grails-app/views/tutorials/sessiontimeout.gsp:
--------------------------------------------------------------------------------
1 |
2 |
3 |
11 |
12 |
13 |
18 |
19 |
20 | Session Timeout refers to the maximum lifetime a session has when it is not being used. After the session timeout has expired, the browser will destroy the cookie and the server will remove the session from its memory. These timeouts are useful tools in order to prevent attackers from capturing session identifiers to have unlimited permanent access to the target account.
21 |
22 |
23 |
24 |
25 |
26 |
31 |
32 |
33 | What handles sessions for us in Grails?
34 |
35 |
36 |
37 |
38 |
39 |
44 |
45 |
46 | The Grails development server (
grails run-app) internally runs on Tomcat, which reads (among other places) the
src/templates/war/web.xml file for information on cookie lifetime.
47 |
<session-config>
48 | <!-- This is annoying -->
49 | <session-timeout>0</session-timeout>
50 | </session-config>
51 | The session lifespan has been set to 0, indicating it will never expire.
52 |
53 |
54 |
55 |
56 |
57 |
62 |
63 |
64 | To address this, we set the session timeout to a non-zero value. However, it's important to be careful to set it to a value high enough not to disturbt potential users who are attempting to use the site. In this case, we'll use 30 minutes.
65 |
<session-config>
66 | <session-timeout>30</session-timeout>
67 | </session-config>
68 |
69 |
70 |
71 |
72 |
73 |
74 |
--------------------------------------------------------------------------------
/initial-setup.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 |
3 | # Commented out lines only apply if you are using MySQL
4 | # instead of the built-in H2 database
5 |
6 | grails compile
7 | # echo "create database \`grails_nV-dev\`" | mysql -u root
8 | grails dbm-update
9 |
--------------------------------------------------------------------------------
/src/templates/artifacts/Controller.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@class @artifact.name@ {
2 |
3 | def index() { }
4 | }
5 |
--------------------------------------------------------------------------------
/src/templates/artifacts/DomainClass.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@class @artifact.name@ {
2 |
3 | static constraints = {
4 | }
5 | }
6 |
--------------------------------------------------------------------------------
/src/templates/artifacts/Filters.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@class @artifact.name@ {
2 |
3 | def filters = {
4 | all(controller:'*', action:'*') {
5 | before = {
6 |
7 | }
8 | after = { Map model ->
9 |
10 | }
11 | afterView = { Exception e ->
12 |
13 | }
14 | }
15 | }
16 | }
17 |
--------------------------------------------------------------------------------
/src/templates/artifacts/ScaffoldingController.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@class @artifact.name@ {
2 | static scaffold = true
3 | }
4 |
--------------------------------------------------------------------------------
/src/templates/artifacts/Script.groovy:
--------------------------------------------------------------------------------
1 | includeTargets << grailsScript("_GrailsInit")
2 |
3 | target(@gant.target.name@: "The description of the script goes here!") {
4 | // TODO: Implement script here
5 | }
6 |
7 | setDefaultTarget(@gant.target.name@)
8 |
--------------------------------------------------------------------------------
/src/templates/artifacts/Service.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.transaction.Transactional
2 |
3 | @Transactional
4 | class @artifact.name@ {
5 |
6 | def serviceMethod() {
7 |
8 | }
9 | }
10 |
--------------------------------------------------------------------------------
/src/templates/artifacts/TagLib.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@class @artifact.name@ {
2 | static defaultEncodeAs = [taglib:'html']
3 | //static encodeAsForTags = [tagName: [taglib:'html'], otherTagName: [taglib:'none']]
4 | }
5 |
--------------------------------------------------------------------------------
/src/templates/artifacts/Tests.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.*
2 |
3 | class @artifact.name@ extends @artifact.superclass@ {
4 | protected void setUp() {
5 | super.setUp()
6 | }
7 |
8 | protected void tearDown() {
9 | super.tearDown()
10 | }
11 |
12 | void testSomething() {
13 |
14 | }
15 | }
16 |
--------------------------------------------------------------------------------
/src/templates/artifacts/WebTest.groovy:
--------------------------------------------------------------------------------
1 | class @webtest.name.caps@Test extends grails.util.WebTest {
2 |
3 | // Unlike unit tests, functional tests are often sequence dependent.
4 | // Specify that sequence here.
5 | void suite() {
6 | test@webtest.name.caps@ListNewDelete()
7 | // add tests for more operations here
8 | }
9 |
10 | def test@webtest.name.caps@ListNewDelete() {
11 | webtest('@webtest.name.caps@ basic operations: view list, create new entry, view, edit, delete, view') {
12 | invoke(url:'@webtest.name.lower@')
13 | verifyText(text:'Home')
14 |
15 | verifyListPage(0)
16 |
17 | clickLink(label:'New @webtest.name.caps@')
18 | verifyText(text:'Create @webtest.name.caps@')
19 | clickButton(label:'Create')
20 | verifyText(text:'Show @webtest.name.caps@', description:'Detail page')
21 | clickLink(label:'List', description:'Back to list view')
22 |
23 | verifyListPage(1)
24 |
25 | group(description:'edit the one element') {
26 | clickLink(label:'Show', description:'go to detail view')
27 | clickButton(label:'Edit')
28 | verifyText(text:'Edit @webtest.name.caps@')
29 | clickButton(label:'Update')
30 | verifyText(text:'Show @webtest.name.caps@')
31 | clickLink(label:'List', description:'Back to list view')
32 | }
33 |
34 | verifyListPage(1)
35 |
36 | group(description:'delete the only element') {
37 | clickLink(label:'Show', description:'go to detail view')
38 | clickButton(label:'Delete')
39 | verifyXPath(xpath:"//div[@class='message']", text:/@webtest.name.caps@.*deleted./, regex:true)
40 | }
41 |
42 | verifyListPage(0)
43 | }
44 | }
45 |
46 | String ROW_COUNT_XPATH = "count(//td[@class='actionButtons']/..)"
47 |
48 | def verifyListPage(int count) {
49 | ant.group(description:"verify @webtest.name.caps@ list view with $count row(s)") {
50 | verifyText(text:'@webtest.name.caps@ List')
51 | verifyXPath(xpath:ROW_COUNT_XPATH, text:count, description:"$count row(s) of data expected")
52 | }
53 | }
54 | }
--------------------------------------------------------------------------------
/src/templates/scaffolding/Controller.groovy:
--------------------------------------------------------------------------------
1 | <%=packageName ? "package ${packageName}\n\n" : ''%>
2 |
3 | import static org.springframework.http.HttpStatus.*
4 | import grails.transaction.Transactional
5 |
6 | @Transactional(readOnly = true)
7 | class ${className}Controller {
8 |
9 | static allowedMethods = [save: "POST", update: "PUT", delete: "DELETE"]
10 |
11 | def index(Integer max) {
12 | params.max = Math.min(max ?: 10, 100)
13 | respond ${className}.list(params), model:[${propertyName}Count: ${className}.count()]
14 | }
15 |
16 | def show(${className} ${propertyName}) {
17 | respond ${propertyName}
18 | }
19 |
20 | def create() {
21 | respond new ${className}(params)
22 | }
23 |
24 | @Transactional
25 | def save(${className} ${propertyName}) {
26 | if (${propertyName} == null) {
27 | notFound()
28 | return
29 | }
30 |
31 | if (${propertyName}.hasErrors()) {
32 | respond ${propertyName}.errors, view:'create'
33 | return
34 | }
35 |
36 | ${propertyName}.save flush:true
37 |
38 | request.withFormat {
39 | form multipartForm {
40 | flash.message = message(code: 'default.created.message', args: [message(code: '${domainClass.propertyName}.label', default: '${className}'), ${propertyName}.id])
41 | redirect ${propertyName}
42 | }
43 | '*' { respond ${propertyName}, [status: CREATED] }
44 | }
45 | }
46 |
47 | def edit(${className} ${propertyName}) {
48 | respond ${propertyName}
49 | }
50 |
51 | @Transactional
52 | def update(${className} ${propertyName}) {
53 | if (${propertyName} == null) {
54 | notFound()
55 | return
56 | }
57 |
58 | if (${propertyName}.hasErrors()) {
59 | respond ${propertyName}.errors, view:'edit'
60 | return
61 | }
62 |
63 | ${propertyName}.save flush:true
64 |
65 | request.withFormat {
66 | form multipartForm {
67 | flash.message = message(code: 'default.updated.message', args: [message(code: '${className}.label', default: '${className}'), ${propertyName}.id])
68 | redirect ${propertyName}
69 | }
70 | '*'{ respond ${propertyName}, [status: OK] }
71 | }
72 | }
73 |
74 | @Transactional
75 | def delete(${className} ${propertyName}) {
76 |
77 | if (${propertyName} == null) {
78 | notFound()
79 | return
80 | }
81 |
82 | ${propertyName}.delete flush:true
83 |
84 | request.withFormat {
85 | form multipartForm {
86 | flash.message = message(code: 'default.deleted.message', args: [message(code: '${className}.label', default: '${className}'), ${propertyName}.id])
87 | redirect action:"index", method:"GET"
88 | }
89 | '*'{ render status: NO_CONTENT }
90 | }
91 | }
92 |
93 | protected void notFound() {
94 | request.withFormat {
95 | form multipartForm {
96 | flash.message = message(code: 'default.not.found.message', args: [message(code: '${domainClass.propertyName}.label', default: '${className}'), params.id])
97 | redirect action: "index", method: "GET"
98 | }
99 | '*'{ render status: NOT_FOUND }
100 | }
101 | }
102 | }
103 |
--------------------------------------------------------------------------------
/src/templates/scaffolding/RestfulController.groovy:
--------------------------------------------------------------------------------
1 | <%=packageName ? "package ${packageName}\n\n" : ''%>
2 |
3 | import static org.springframework.http.HttpStatus.*
4 | import grails.transaction.Transactional
5 |
6 | @Transactional(readOnly = true)
7 | class ${className}Controller {
8 |
9 | static responseFormats = ['json', 'xml']
10 | static allowedMethods = [save: "POST", update: "PUT", delete: "DELETE"]
11 |
12 | def index(Integer max) {
13 | params.max = Math.min(max ?: 10, 100)
14 | respond ${className}.list(params), [status: OK]
15 | }
16 |
17 | @Transactional
18 | def save(${className} ${propertyName}) {
19 | if (${propertyName} == null) {
20 | render status: NOT_FOUND
21 | return
22 | }
23 |
24 | ${propertyName}.validate()
25 | if (${propertyName}.hasErrors()) {
26 | render status: NOT_ACCEPTABLE
27 | return
28 | }
29 |
30 | ${propertyName}.save flush:true
31 | respond ${propertyName}, [status: CREATED]
32 | }
33 |
34 | @Transactional
35 | def update(${className} ${propertyName}) {
36 | if (${propertyName} == null) {
37 | render status: NOT_FOUND
38 | return
39 | }
40 |
41 | ${propertyName}.validate()
42 | if (${propertyName}.hasErrors()) {
43 | render status: NOT_ACCEPTABLE
44 | return
45 | }
46 |
47 | ${propertyName}.save flush:true
48 | respond ${propertyName}, [status: OK]
49 | }
50 |
51 | @Transactional
52 | def delete(${className} ${propertyName}) {
53 |
54 | if (${propertyName} == null) {
55 | render status: NOT_FOUND
56 | return
57 | }
58 |
59 | ${propertyName}.delete flush:true
60 | render status: NO_CONTENT
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/src/templates/scaffolding/_form.gsp:
--------------------------------------------------------------------------------
1 | <%=packageName%>
2 | <% import grails.persistence.Event %>
3 |
4 | <% excludedProps = Event.allEvents.toList() << 'version' << 'dateCreated' << 'lastUpdated'
5 | persistentPropNames = domainClass.persistentProperties*.name
6 | boolean hasHibernate = pluginManager?.hasGrailsPlugin('hibernate') || pluginManager?.hasGrailsPlugin('hibernate4')
7 | if (hasHibernate) {
8 | def GrailsDomainBinder = getClass().classLoader.loadClass('org.codehaus.groovy.grails.orm.hibernate.cfg.GrailsDomainBinder')
9 | if (GrailsDomainBinder.newInstance().getMapping(domainClass)?.identity?.generator == 'assigned') {
10 | persistentPropNames << domainClass.identifier.name
11 | }
12 | }
13 | props = domainClass.properties.findAll { persistentPropNames.contains(it.name) && !excludedProps.contains(it.name) && (domainClass.constrainedProperties[it.name] ? domainClass.constrainedProperties[it.name].display : true) }
14 | Collections.sort(props, comparator.constructors[0].newInstance([domainClass] as Object[]))
15 | for (p in props) {
16 | if (p.embedded) {
17 | def embeddedPropNames = p.component.persistentProperties*.name
18 | def embeddedProps = p.component.properties.findAll { embeddedPropNames.contains(it.name) && !excludedProps.contains(it.name) }
19 | Collections.sort(embeddedProps, comparator.constructors[0].newInstance([p.component] as Object[]))
20 | %>
<%
25 | } else {
26 | renderFieldForProperty(p, domainClass)
27 | }
28 | }
29 |
30 | private renderFieldForProperty(p, owningClass, prefix = "") {
31 | boolean hasHibernate = pluginManager?.hasGrailsPlugin('hibernate') || pluginManager?.hasGrailsPlugin('hibernate4')
32 | boolean required = false
33 | if (hasHibernate) {
34 | cp = owningClass.constrainedProperties[p.name]
35 | required = (cp ? !(cp.propertyType in [boolean, Boolean]) && !cp.nullable : false)
36 | }
37 | %>
38 |
39 |
40 | * <% } %>
42 |
43 | ${renderEditor(p)}
44 |
45 | <% } %>
46 |
--------------------------------------------------------------------------------
/src/templates/scaffolding/create.gsp:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
<g:message code="default.create.label" args="[entityName]" />
7 |
8 |
9 |
10 |
16 |
17 |
18 |
19 | \${flash.message}
20 |
21 |
22 |
23 |
24 | data-field-id="\${error.field}">
25 |
26 |
27 |
28 |
>
29 |
30 |
32 |
33 |
35 |
36 |
37 |
38 |
39 |
--------------------------------------------------------------------------------
/src/templates/scaffolding/edit.gsp:
--------------------------------------------------------------------------------
1 | <%=packageName%>
2 |
3 |
4 |
5 |
6 |
7 |
<g:message code="default.edit.label" args="[entityName]" />
8 |
9 |
10 |
11 |
18 |
19 |
20 |
21 | \${flash.message}
22 |
23 |
24 |
25 |
26 | data-field-id="\${error.field}">
27 |
28 |
29 |
30 |
>
31 |
33 |
35 |
36 |
38 |
39 |
40 |
41 |
42 |
--------------------------------------------------------------------------------
/src/templates/scaffolding/index.gsp:
--------------------------------------------------------------------------------
1 | <% import grails.persistence.Event %>
2 | <%=packageName%>
3 |
4 |
5 |
6 |
7 |
8 |
<g:message code="default.list.label" args="[entityName]" />
9 |
10 |
11 |
12 |
18 |
19 |
20 |
21 | \${flash.message}
22 |
23 |
24 |
25 |
26 | <% excludedProps = Event.allEvents.toList() << 'id' << 'version'
27 | allowedNames = domainClass.persistentProperties*.name << 'dateCreated' << 'lastUpdated'
28 | props = domainClass.properties.findAll { allowedNames.contains(it.name) && !excludedProps.contains(it.name) && it.type != null && !Collection.isAssignableFrom(it.type) && (domainClass.constrainedProperties[it.name] ? domainClass.constrainedProperties[it.name].display : true) }
29 | Collections.sort(props, comparator.constructors[0].newInstance([domainClass] as Object[]))
30 | props.eachWithIndex { p, i ->
31 | if (i < 6) {
32 | if (p.isAssociation()) { %>
33 |
38 |
39 |
40 |
41 |
42 | <% props.eachWithIndex { p, i ->
43 | if (i == 0) { %>
44 | \${fieldValue(bean: ${propertyName}, field: "${p.name}")} \${fieldValue(bean: ${propertyName}, field: "${p.name}")}
52 | <% } } } %>
53 |
54 |
55 |
56 |
57 |
60 |
61 |
62 |
63 |
--------------------------------------------------------------------------------
/src/templates/testing/CliTests.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.AbstractCliTestCase
2 |
3 | class @artifact.name@ extends AbstractCliTestCase {
4 | protected void setUp() {
5 | super.setUp()
6 | }
7 |
8 | protected void tearDown() {
9 | super.tearDown()
10 | }
11 |
12 | void test@gant.class.name@() {
13 |
14 | execute(["@gant.script.name@"])
15 |
16 | assertEquals 0, waitForProcess()
17 | verifyHeader()
18 | }
19 | }
20 |
--------------------------------------------------------------------------------
/src/templates/testing/Controller.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.TestFor
2 | import spock.lang.Specification
3 |
4 | /**
5 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
6 | */
7 | @TestFor(@artifact.testclass@)
8 | class @artifact.name@ extends Specification {
9 |
10 | def setup() {
11 | }
12 |
13 | def cleanup() {
14 | }
15 |
16 | void "test something"() {
17 | }
18 | }
--------------------------------------------------------------------------------
/src/templates/testing/DomainClass.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.TestFor
2 | import spock.lang.Specification
3 |
4 | /**
5 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
6 | */
7 | @TestFor(@artifact.testclass@)
8 | class @artifact.name@ extends Specification {
9 |
10 | def setup() {
11 | }
12 |
13 | def cleanup() {
14 | }
15 |
16 | void "test something"() {
17 | }
18 | }
--------------------------------------------------------------------------------
/src/templates/testing/Filters.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.Mock
2 | import spock.lang.Specification
3 |
4 | @Mock(@artifact.testclass@)
5 | class @artifact.name@ extends Specification {
6 |
7 | def setup() {
8 | }
9 |
10 | def cleanup() {
11 | }
12 |
13 | void "test something"() {
14 | }
15 | }
--------------------------------------------------------------------------------
/src/templates/testing/Generic.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@
2 | import grails.test.mixin.TestMixin
3 | import grails.test.mixin.support.GrailsUnitTestMixin
4 | import spock.lang.*
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.support.GrailsUnitTestMixin} for usage instructions
8 | */
9 | @TestMixin(GrailsUnitTestMixin)
10 | class @artifact.name@ extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
--------------------------------------------------------------------------------
/src/templates/testing/Integration.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@
2 |
3 | import spock.lang.*
4 |
5 | /**
6 | *
7 | */
8 | class @artifact.name@ extends Specification {
9 |
10 | def setup() {
11 | }
12 |
13 | def cleanup() {
14 | }
15 |
16 | void "test something"() {
17 | }
18 | }
--------------------------------------------------------------------------------
/src/templates/testing/Service.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.TestFor
2 | import spock.lang.Specification
3 |
4 | /**
5 | * See the API for {@link grails.test.mixin.services.ServiceUnitTestMixin} for usage instructions
6 | */
7 | @TestFor(@artifact.testclass@)
8 | class @artifact.name@ extends Specification {
9 |
10 | def setup() {
11 | }
12 |
13 | def cleanup() {
14 | }
15 |
16 | void "test something"() {
17 | }
18 | }
--------------------------------------------------------------------------------
/src/templates/testing/TagLib.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.TestFor
2 | import spock.lang.Specification
3 |
4 | /**
5 | * See the API for {@link grails.test.mixin.web.GroovyPageUnitTestMixin} for usage instructions
6 | */
7 | @TestFor(@artifact.testclass@)
8 | class @artifact.name@ extends Specification {
9 |
10 | def setup() {
11 | }
12 |
13 | def cleanup() {
14 | }
15 |
16 | void "test something"() {
17 | }
18 | }
--------------------------------------------------------------------------------
/src/templates/testing/UnitTest.groovy:
--------------------------------------------------------------------------------
1 | @artifact.package@import grails.test.mixin.TestMixin
2 | import grails.test.mixin.support.GrailsUnitTestMixin
3 | import spock.lang.Specification
4 |
5 | /**
6 | * See the API for {@link grails.test.mixin.support.GrailsUnitTestMixin} for usage instructions
7 | */
8 | @TestMixin(GrailsUnitTestMixin)
9 | class @artifact.name@ extends Specification {
10 |
11 | def setup() {
12 | }
13 |
14 | def cleanup() {
15 | }
16 |
17 | void "test something"() {
18 | }
19 | }
--------------------------------------------------------------------------------
/src/templates/war/web.xml:
--------------------------------------------------------------------------------
1 |
2 |
7 |
8 | /@grails.project.key@
9 |
10 |
11 | contextConfigLocation
12 | /WEB-INF/applicationContext.xml
13 |
14 |
15 |
16 | webAppRootKey
17 | @grails.project.key@
18 |
19 |
20 |
21 | charEncodingFilter
22 | org.springframework.web.filter.DelegatingFilterProxy
23 |
24 | targetBeanName
25 | characterEncodingFilter
26 |
27 |
28 | targetFilterLifecycle
29 | true
30 |
31 |
32 |
33 |
34 | charEncodingFilter
35 | /*
36 |
37 |
38 |
39 | org.codehaus.groovy.grails.web.context.GrailsContextLoaderListener
40 |
41 |
42 |
43 |
44 | grails
45 | org.codehaus.groovy.grails.web.servlet.GrailsDispatcherServlet
46 |
47 | dispatchOptionsRequest
48 | true
49 |
50 | 1
51 | true
52 |
53 |
54 |
55 |
56 | gsp
57 | org.codehaus.groovy.grails.web.pages.GroovyPagesServlet
58 |
59 |
60 |
61 | gsp
62 | *.gsp
63 |
64 |
65 |
66 |
67 |
68 | 0
69 |
70 |
71 |
72 |
76 | index.html
77 | index.jsp
78 | index.gsp
79 |
80 |
81 |
82 |
--------------------------------------------------------------------------------
/test/codenarc/InsecureHashFunctionRule.groovy:
--------------------------------------------------------------------------------
1 | package org.codenarc.rule.security
2 |
3 | import org.codenarc.rule.AbstractAstVisitorRule
4 | import org.codenarc.rule.AbstractAstVisitor
5 | import org.codehaus.groovy.ast.expr.MethodCallExpression
6 |
7 | /**
8 | * Rule that checks for usage of any insecure hash functions
9 | *
10 | * @author Cyrus Malekpour
11 | */
12 | class InsecureHashFunctionRule extends AbstractAstVisitorRule {
13 | String name = 'InsecureHashFunctionRule'
14 | int priority = 2
15 | Class astVisitorClass = InsecureHashFunctionRuleAstVisitor
16 | String description = "Checks for usage of any insecure hash functions"
17 | }
18 |
19 | @SuppressWarnings('NestedBlockDepth')
20 | class InsecureHashFunctionRuleAstVisitor extends AbstractAstVisitor {
21 |
22 | @Override
23 | void visitMethodCallExpression(MethodCallExpression call) {
24 | def methods = ["encodeAsMD5Bytes", "encodeAsMD5", "encodeAsSHA1", "encodeAsSHA1Bytes", "encodeAsSHA256", "encodeAsSHA256Bytes"]
25 | if (isFirstVisit(call) && methods.contains(call.getMethod().getText())) {
26 | addViolation(call, "Possible insecure hash function. This function is a message digest, not a password hash")
27 | }
28 | super.visitMethodCallExpression(call)
29 | }
30 |
31 | }
--------------------------------------------------------------------------------
/test/codenarc/TestRuleSet.groovy:
--------------------------------------------------------------------------------
1 | ruleset {
2 | description 'CodeNarc secure ruleset'
3 |
4 | rule("file:test/codenarc/InsecureRedirectRule.groovy")
5 | rule("file:test/codenarc/InsecureHashFunctionRule.groovy")
6 | rule("file:test/codenarc/InscureGORMQueryRule.groovy")
7 | rule("file:test/codenarc/InsecureMassAssignmentRule.groovy")
8 | }
--------------------------------------------------------------------------------
/test/unit/com/grails.nV/UserSpec.groovy:
--------------------------------------------------------------------------------
1 | package com.grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(User)
10 | class UserSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/CompaniesControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(CompaniesController)
10 | class CompaniesControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/CompanySpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(Company)
10 | class CompanySpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/JobListingSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(JobListing)
10 | class JobListingSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/ListingsControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(ListingsController)
10 | class ListingsControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/LogSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(Log)
10 | class LogSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/LoggingFiltersSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.Mock
4 | import spock.lang.Specification
5 |
6 | @Mock(LoggingFilters)
7 | class LoggingFiltersSpec extends Specification {
8 |
9 | def setup() {
10 | }
11 |
12 | def cleanup() {
13 | }
14 |
15 | void "test something"() {
16 | }
17 | }
18 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/MainControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(MainController)
10 | class MainControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/MessageSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.domain.DomainClassUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(Message)
10 | class MessageSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/MessagesControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(MessagesController)
10 | class MessagesControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/ProfileControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(ProfileController)
10 | class ProfileControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/SessionControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(SessionController)
10 | class SessionControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/SessionFiltersSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.Mock
4 | import spock.lang.Specification
5 |
6 | @Mock(SessionFilters)
7 | class SessionFiltersSpec extends Specification {
8 |
9 | def setup() {
10 | }
11 |
12 | def cleanup() {
13 | }
14 |
15 | void "test something"() {
16 | }
17 | }
18 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/TutorialsControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(TutorialsController)
10 | class TutorialsControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/unit/grails.nV/UserControllerSpec.groovy:
--------------------------------------------------------------------------------
1 | package grails_nV
2 |
3 | import grails.test.mixin.TestFor
4 | import spock.lang.Specification
5 |
6 | /**
7 | * See the API for {@link grails.test.mixin.web.ControllerUnitTestMixin} for usage instructions
8 | */
9 | @TestFor(UserController)
10 | class UserControllerSpec extends Specification {
11 |
12 | def setup() {
13 | }
14 |
15 | def cleanup() {
16 | }
17 |
18 | void "test something"() {
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/web-app/WEB-INF/applicationContext.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
7 | Grails application factory bean
8 |
10 |
11 |
12 | A bean that manages Grails plugins
13 |
16 |
17 |
18 |
19 |
21 |
23 |
24 |
25 |
26 | utf-8
27 |
28 |
29 |
30 |
--------------------------------------------------------------------------------
/web-app/WEB-INF/sitemesh.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
10 |
11 |
12 |
14 |
--------------------------------------------------------------------------------
/web-app/uploads/.gitkeep:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/NetSPI/grails-nV/848f932d4b115313836b1959083ec475e25e57ec/web-app/uploads/.gitkeep
--------------------------------------------------------------------------------
/wrapper/grails-wrapper-runtime-2.4.0.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/NetSPI/grails-nV/848f932d4b115313836b1959083ec475e25e57ec/wrapper/grails-wrapper-runtime-2.4.0.jar
--------------------------------------------------------------------------------
/wrapper/grails-wrapper.properties:
--------------------------------------------------------------------------------
1 | wrapper.dist.url=http://dist.springframework.org.s3.amazonaws.com/release/GRAILS/
2 |
--------------------------------------------------------------------------------
/wrapper/springloaded-1.2.0.RELEASE.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/NetSPI/grails-nV/848f932d4b115313836b1959083ec475e25e57ec/wrapper/springloaded-1.2.0.RELEASE.jar
--------------------------------------------------------------------------------