71 lines
2.2 KiB
JavaScript
71 lines
2.2 KiB
JavaScript
var assert = require('assert')
|
|
|
|
module.exports = function() {
|
|
var server = process.server
|
|
|
|
describe('Security', function() {
|
|
before(function() {
|
|
return server.add_package('testpkg-sec')
|
|
})
|
|
|
|
it('bad pkg #1', function () {
|
|
return server.get_package('package.json')
|
|
.status(403)
|
|
.body_error(/invalid package/)
|
|
})
|
|
|
|
it('bad pkg #2', function () {
|
|
return server.get_package('__proto__')
|
|
.status(403)
|
|
.body_error(/invalid package/)
|
|
})
|
|
|
|
it('__proto__, connect stuff', function () {
|
|
return server.request({ uri: '/testpkg-sec?__proto__=1' })
|
|
.then(function (body) {
|
|
// test for NOT outputting stack trace
|
|
assert(!body || typeof(body) === 'object' || body.indexOf('node_modules') === -1)
|
|
|
|
// test for NOT crashing
|
|
return server.request({ uri: '/testpkg-sec' }).status(200)
|
|
})
|
|
})
|
|
|
|
it('do not return package.json as an attachment', function () {
|
|
return server.request({ uri: '/testpkg-sec/-/package.json' })
|
|
.status(403)
|
|
.body_error(/invalid filename/)
|
|
})
|
|
|
|
it('silly things - reading #1', function () {
|
|
return server.request({ uri: '/testpkg-sec/-/../../../../../../../../etc/passwd' })
|
|
.status(404)
|
|
})
|
|
|
|
it('silly things - reading #2', function () {
|
|
return server.request({ uri: '/testpkg-sec/-/%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' })
|
|
.status(403)
|
|
.body_error(/invalid filename/)
|
|
})
|
|
|
|
it('silly things - writing #1', function () {
|
|
return server.put_tarball('testpkg-sec', 'package.json', '{}')
|
|
.status(403)
|
|
.body_error(/invalid filename/)
|
|
})
|
|
|
|
it('silly things - writing #3', function () {
|
|
return server.put_tarball('testpkg-sec', 'node_modules', '{}')
|
|
.status(403)
|
|
.body_error(/invalid filename/)
|
|
})
|
|
|
|
it('silly things - writing #4', function () {
|
|
return server.put_tarball('testpkg-sec', '../testpkg.tgz', '{}')
|
|
.status(403)
|
|
.body_error(/invalid filename/)
|
|
})
|
|
})
|
|
}
|
|
|