Oops! Nothing at', 47 | `${ baseUrl.origin }/no-such-file
`, 48 | '', 49 | '', 50 | ], 51 | logs: { 52 | stderr: '', 53 | stdout: 'GET /no-such-file\n', 54 | }, 55 | statusCode: 404, 56 | }, 57 | }, 58 | ], 59 | }; 60 | -------------------------------------------------------------------------------- /test/end-to-end-lockeddown-test.js: -------------------------------------------------------------------------------- 1 | /** 2 | * @license 3 | * Copyright 2018 Google LLC 4 | * 5 | * Licensed under the Apache License, Version 2.0 (the "License"); 6 | * you may not use this file except in compliance with the License. 7 | * You may obtain a copy of the License at 8 | * 9 | * https://www.apache.org/licenses/LICENSE-2.0 10 | * 11 | * Unless required by applicable law or agreed to in writing, software 12 | * distributed under the License is distributed on an "AS IS" BASIS, 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | * See the License for the specific language governing permissions and 15 | * limitations under the License. 16 | */ 17 | 18 | 'use strict'; 19 | 20 | /** 21 | * @fileoverview 22 | * Runs the same test suite as end-to-end-test, but in a separate process. 23 | * It helps to have both of these. 24 | * 25 | * end-to-end-test tests code coverage and builds the dynamic module graph 26 | * used by scripts/generate-production-source-list.js. 27 | * 28 | * This test checks that we get the same results even when the security 29 | * machinery under lib/framework is in production configuration. 30 | */ 31 | 32 | const { describe } = require('mocha'); 33 | const path = require('path'); 34 | const process = require('process'); 35 | 36 | const runEndToEndCases = require('./end-to-end-common.js'); 37 | 38 | const externalProcessTestServer = require('./external-process-test-server.js'); 39 | const root = path.resolve(path.join(__dirname, '..')); 40 | 41 | // eslint-disable-next-line no-process-env 42 | if (process.env.SOURCE_LIST_UP_TO_DATE !== '0' && !('TRAVIS' in process.env)) { 43 | describe('end-to-end-lockeddown', () => { 44 | const options = { 45 | // We pass NODE_ENV=production. 46 | isProduction: true, 47 | quiet: true, 48 | root, 49 | }; 50 | const externalProcessTest = externalProcessTestServer(root); 51 | runEndToEndCases(externalProcessTest, options); 52 | }); 53 | } 54 | -------------------------------------------------------------------------------- /lib/handlers/index.js: -------------------------------------------------------------------------------- 1 | /** 2 | * @license 3 | * Copyright 2018 Google LLC 4 | * 5 | * Licensed under the Apache License, Version 2.0 (the "License"); 6 | * you may not use this file except in compliance with the License. 7 | * You may obtain a copy of the License at 8 | * 9 | * https://www.apache.org/licenses/LICENSE-2.0 10 | * 11 | * Unless required by applicable law or agreed to in writing, software 12 | * distributed under the License is distributed on an "AS IS" BASIS, 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | * See the License for the specific language governing permissions and 15 | * limitations under the License. 16 | */ 17 | 18 | 'use strict'; 19 | 20 | /** 21 | * @fileoverview 22 | * Displays recent posts visible to the current user. 23 | */ 24 | 25 | const relativeDate = require('tiny-relative-date'); 26 | const template = require('./index.pug'); 27 | const { getPosts } = require('../dbi.js'); 28 | 29 | 30 | exports.handle = (bundle, handleError) => { 31 | const { res, reqUrl, database, currentAccount } = bundle; 32 | 33 | const aid = currentAccount ? currentAccount.aid : null; 34 | const viewAsPublicParam = reqUrl.searchParams.get('viewAsPublic'); 35 | const viewAsPublic = typeof viewAsPublicParam === 'string' && viewAsPublicParam !== 'false'; 36 | // Allow tests to specify "now" so that we can get repeatable test behavior. 37 | const now = new Date(Number(reqUrl.searchParams.get('now')) || Date.now()); 38 | const limit = Number(reqUrl.searchParams.get('count') || 0); 39 | const offset = Number(reqUrl.searchParams.get('offset') || 0); 40 | getPosts(database, viewAsPublic ? null : currentAccount, { limit, offset }).then( 41 | (posts) => { 42 | res.statusCode = 200; 43 | res.end(template(Object.assign( 44 | {}, 45 | bundle, 46 | { 47 | viewAsPublic: viewAsPublic && aid !== null, 48 | posts, 49 | fmtDate(date) { 50 | return relativeDate(date, now); 51 | }, 52 | }))); 53 | }, 54 | handleError); 55 | }; 56 | -------------------------------------------------------------------------------- /test/init-hooks-test.js: -------------------------------------------------------------------------------- 1 | /** 2 | * @license 3 | * Copyright 2018 Google LLC 4 | * 5 | * Licensed under the Apache License, Version 2.0 (the "License"); 6 | * you may not use this file except in compliance with the License. 7 | * You may obtain a copy of the License at 8 | * 9 | * https://www.apache.org/licenses/LICENSE-2.0 10 | * 11 | * Unless required by applicable law or agreed to in writing, software 12 | * distributed under the License is distributed on an "AS IS" BASIS, 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | * See the License for the specific language governing permissions and 15 | * limitations under the License. 16 | */ 17 | 18 | 'use strict'; 19 | 20 | const { expect } = require('chai'); 21 | const { describe, it } = require('mocha'); 22 | 23 | const hook = require('../lib/framework/init-hooks.js'); 24 | const { runHook } = require('./run-hook.js'); 25 | 26 | describe('init-hooks', () => { 27 | it('require child_process', () => { 28 | expect(runHook(hook, 'init-hooks-test.js', 'child_process')) 29 | .to.deep.equals({ 30 | result: require.resolve('../lib/framework/module-hooks/innocuous.js'), 31 | stderr: ( 32 | 'lib/framework/module-hooks/sensitive-module-hook.js:' + 33 | ' Blocking require("child_process") by test/init-hooks-test.js' + 34 | '\n\n\tUse safe/child_process.js instead.\n'), 35 | stdout: '', 36 | }); 37 | }); 38 | it('require package.json', () => { 39 | expect(runHook(hook, 'init-hooks-test.js', '../package.json')) 40 | .to.deep.equals({ 41 | result: '../package.json', 42 | stderr: '', 43 | stdout: '', 44 | }); 45 | }); 46 | it('doppelgangers', () => { 47 | let stringifyCount = 0; 48 | const doppelganger = { 49 | toString() { 50 | return [ '../package.json' ][stringifyCount++] || 'child_process'; 51 | }, 52 | }; 53 | 54 | expect(runHook(hook, 'init-hooks-test.js', doppelganger)) 55 | .to.deep.equals({ 56 | result: '../package.json', 57 | stderr: '', 58 | stdout: '', 59 | }); 60 | expect(stringifyCount).to.equal(1); 61 | }); 62 | }); 63 | -------------------------------------------------------------------------------- /test/cases/end-to-end/echo-case.js: -------------------------------------------------------------------------------- 1 | /** 2 | * @license 3 | * Copyright 2018 Google LLC 4 | * 5 | * Licensed under the Apache License, Version 2.0 (the "License"); 6 | * you may not use this file except in compliance with the License. 7 | * You may obtain a copy of the License at 8 | * 9 | * https://www.apache.org/licenses/LICENSE-2.0 10 | * 11 | * Unless required by applicable law or agreed to in writing, software 12 | * distributed under the License is distributed on an "AS IS" BASIS, 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | * See the License for the specific language governing permissions and 15 | * limitations under the License. 16 | */ 17 | 18 | 'use strict'; 19 | 20 | /* eslint array-element-newline: 0 */ 21 | 22 | const { URL } = require('url'); 23 | 24 | module.exports = { 25 | requests: (baseUrl, { isVulnerable }) => (isVulnerable ? [] : [ 26 | { 27 | req: { 28 | uri: new URL('/echo?a%22=b%27&foo=bar&baz', baseUrl).href, 29 | }, 30 | res: { 31 | body: [ 32 | '', 33 | '', 34 | '', 35 | '| a" | ', 48 | 'foo | ', 49 | 'baz | ', 50 | '
|---|---|---|
| b' | ', 53 | 'bar | ', 54 | '', 55 | ' | ', 56 | '