server-render app moved to new location apps/server-render

OWASP · swapneil · Mar 18, 2020 · Mar 18, 2020 · Mar 18, 2020 · Mar 18, 2020
commit 805d2518fd54b66bcf161e653cdae7ebebf73d31
diff --git a/.dockerignore → apps/server-render/.dockerignore b/.dockerignore → apps/server-render/.dockerignore
diff --git a/.jshintrc → apps/server-render/.jshintrc b/.jshintrc → apps/server-render/.jshintrc
diff --git a/Dockerfile → apps/server-render/Dockerfile b/Dockerfile → apps/server-render/Dockerfile
diff --git a/Gruntfile.js → apps/server-render/Gruntfile.js b/Gruntfile.js → apps/server-render/Gruntfile.js
diff --git a/apps/server-render/README.md b/apps/server-render/README.md
@@ -0,0 +1,119 @@
+# NodeGoat
+
+Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
+
+## Getting Started
+OWASP Top 10 for Node.js web applications:
+
+### Know it!
+[Tutorial Guide](http://nodegoat.herokuapp.com/tutorial) explaining how each of the OWASP Top 10 vulnerabilities can manifest in Node.js web apps and how to prevent it.
+
+### Do it!
+[A Vulnerable Node.js App for Ninjas](http://nodegoat.herokuapp.com/) to exploit, toast, and fix. You may like to [set up your own copy](#how-to-setup-your-copy-of-nodegoat) of the app to fix and test vulnerabilities. Hint: Look for comments in the source code.
+##### Default user accounts
+The database comes pre-populated with these user accounts created as part of the seed data -
+* Admin Account - u:admin p:Admin_123
+* User Accounts (u:user1 p:User1_123), (u:user2 p:User2_123)
+* New users can also be added using the sign-up page.
+
+## How to Setup Your Copy of NodeGoat
+
+### OPTION 1 - One click install on Heroku
+The the quickest way to get running with NodeGoat is to click the button below to deploy it on Heroku.
+
+Even though it is not essential, but recommended that you fork this repository and deploy the forked repo.
+This would allow you to fix vulnerabilities in your own forked version, and deploy and test it on heroku.
+
+[![Deploy](https://www.herokucdn.com/deploy/button.png)](https://heroku.com/deploy)
+
+This Heroku instance uses Free ($0/month) node server and MongoLab add-on.
+
+### OPTION 2 - Run NodeGoat on your machine
+
+If you do not wish to run NodeGoat on Heroku, please follow these steps to setup and run it locally -
+* Install [Node.js](http://nodejs.org/) - NodeGoat requires Node v8 or above
+
+* Clone the github repository
+```
+git clone https://github.com/OWASP/NodeGoat.git
+```
+
+*go to the directory
+```
+cd NodeGoat
+```
+
+* Install node modules
+```
+npm install
+```
+
+* Create Mongo DB:
+    You can create a remote MongoDB instance or use local mongod installation
+    * A. Using Remote MongoDB
+        * Create a sandbox mongoDB instance (free) at [mLab](https://mlab.com/plans/pricing/#plan-sandbox)
+        * Create a new database.
+        * Create a user.
+        * Update the `db` property in file `config/env/development.js` to reflect your DB setup. (in format: `mongodb://<username>:<password>@<databasename>`)
+    * OR B.Using local MongoDB
+        * If using local Mongo DB instance, start [mongod](http://docs.mongodb.org/manual/reference/program/mongod/#bin.mongod).
+        * Update the `db` property in file `config/env/development.js` to reflect your DB setup. (in format: `mongodb://localhost:27017/<databasename>`)
+
+* Populate MongoDB with seed data required for the app
+    * Run the npm-script below to populate the DB with seed data required for the application. Pass the desired environment as argument. If not passed, "development" is the default:
+```
+npm run db:seed
+```
+* Start server, this starts the NodeGoat application at url [http://localhost:4000/](http://localhost:4000/)
+```
+npm start
+```
+
+* Start server with nodemon, this starts the NodeGoat application at url [http://localhost:5000/](http://localhost:5000/)
+```
+npm run dev
+```
+
+### OPTION 3 - Run NodeGoat on Docker
+
+**You need to install [docker](https://docs.docker.com/installation/) and [docker compose](https://docs.docker.com/compose/install/) to be able to use this option**
+
+The repo includes the Dockerfile and docker-compose.yml necessary to setup the app and the db instance then connect them together.
+
+* Change the db config in `config/env/development.js` to point to the respective Docker container.
+```
+db: "mongodb://mongo:27017/nodegoat",
+```
+* Build the images:
+```
+docker-compose build
+```
+* Run the app:
+```
+docker-compose up
+```
+
+
+#### Customizing the Default Application Configuration
+The default application settings (database url, http port, etc.) can be changed by updating the [config file] (https://github.com/OWASP/NodeGoat/blob/master/config/env/all.js).
+
+## Report bugs, Feedback, Comments
+*  Open a new [issue](https://github.com/OWASP/NodeGoat/issues) or contact team by joining chat at [Slack](https://owasp.slack.com/messages/project-nodegoat/) or [![Join the chat at https://gitter.im/OWASP/NodeGoat](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/OWASP/NodeGoat?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+
+## Contributing
+
+Please Follow [the contributing guide](CONTRIBUTING.md)
+
+## Code Of Conduct (CoC)
+
+This project is bound by a [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Contributors
+Here are the amazing [contributors](https://github.com/OWASP/NodeGoat/graphs/contributors) to the NodeGoat project.
+
+## Supports
+- Thanks to JetBrains for providing licenses to fantastic [WebStorm IDE](https://www.jetbrains.com/webstorm/) to build this project.
+
+## License
+Code licensed under the [Apache License v2.0.](http://www.apache.org/licenses/LICENSE-2.0)
diff --git a/app.json → apps/server-render/app.json b/app.json → apps/server-render/app.json
diff --git a/app/assets/favicon.ico → apps/server-render/app/assets/favicon.ico b/app/assets/favicon.ico → apps/server-render/app/assets/favicon.ico
diff --git a/app/assets/images/nodegoat_logo.png → ...ender/app/assets/images/nodegoat_logo.png b/app/assets/images/nodegoat_logo.png → ...ender/app/assets/images/nodegoat_logo.png
diff --git a/app/assets/images/owasplogo.png → ...er-render/app/assets/images/owasplogo.png b/app/assets/images/owasplogo.png → ...er-render/app/assets/images/owasplogo.png
diff --git a/app/assets/js/chart/chart-data-morris.js → .../app/assets/js/chart/chart-data-morris.js b/app/assets/js/chart/chart-data-morris.js → .../app/assets/js/chart/chart-data-morris.js
diff --git a/app/assets/js/tour/redirects-steps.js → ...der/app/assets/js/tour/redirects-steps.js b/app/assets/js/tour/redirects-steps.js → ...der/app/assets/js/tour/redirects-steps.js
diff --git a/...ssets/vendor/bootstrap/bootstrap-tour.css → ...ssets/vendor/bootstrap/bootstrap-tour.css b/...ssets/vendor/bootstrap/bootstrap-tour.css → ...ssets/vendor/bootstrap/bootstrap-tour.css
diff --git a/...assets/vendor/bootstrap/bootstrap-tour.js → ...assets/vendor/bootstrap/bootstrap-tour.js b/...assets/vendor/bootstrap/bootstrap-tour.js → ...assets/vendor/bootstrap/bootstrap-tour.js
diff --git a/app/assets/vendor/bootstrap/bootstrap.css → ...app/assets/vendor/bootstrap/bootstrap.css b/app/assets/vendor/bootstrap/bootstrap.css → ...app/assets/vendor/bootstrap/bootstrap.css
diff --git a/app/assets/vendor/bootstrap/bootstrap.js → .../app/assets/vendor/bootstrap/bootstrap.js b/app/assets/vendor/bootstrap/bootstrap.js → .../app/assets/vendor/bootstrap/bootstrap.js
diff --git a/app/assets/vendor/chart/morris-0.4.3.min.js → ...p/assets/vendor/chart/morris-0.4.3.min.js b/app/assets/vendor/chart/morris-0.4.3.min.js → ...p/assets/vendor/chart/morris-0.4.3.min.js
diff --git a/app/assets/vendor/chart/raphael-min.js → ...er/app/assets/vendor/chart/raphael-min.js b/app/assets/vendor/chart/raphael-min.js → ...er/app/assets/vendor/chart/raphael-min.js
diff --git a/app/assets/vendor/html5shiv.js → ...ver-render/app/assets/vendor/html5shiv.js b/app/assets/vendor/html5shiv.js → ...ver-render/app/assets/vendor/html5shiv.js
diff --git a/app/assets/vendor/jquery.min.js → ...er-render/app/assets/vendor/jquery.min.js b/app/assets/vendor/jquery.min.js → ...er-render/app/assets/vendor/jquery.min.js
diff --git a/...eme/font-awesome/css/font-awesome.min.css → ...eme/font-awesome/css/font-awesome.min.css b/...eme/font-awesome/css/font-awesome.min.css → ...eme/font-awesome/css/font-awesome.min.css
diff --git a/.../theme/font-awesome/fonts/FontAwesome.otf → .../theme/font-awesome/fonts/FontAwesome.otf b/.../theme/font-awesome/fonts/FontAwesome.otf → .../theme/font-awesome/fonts/FontAwesome.otf
diff --git a/...ont-awesome/fonts/fontawesome-webfont.eot → ...ont-awesome/fonts/fontawesome-webfont.eot b/...ont-awesome/fonts/fontawesome-webfont.eot → ...ont-awesome/fonts/fontawesome-webfont.eot
diff --git a/...ont-awesome/fonts/fontawesome-webfont.svg → ...ont-awesome/fonts/fontawesome-webfont.svg b/...ont-awesome/fonts/fontawesome-webfont.svg → ...ont-awesome/fonts/fontawesome-webfont.svg
diff --git a/...ont-awesome/fonts/fontawesome-webfont.ttf → ...ont-awesome/fonts/fontawesome-webfont.ttf b/...ont-awesome/fonts/fontawesome-webfont.ttf → ...ont-awesome/fonts/fontawesome-webfont.ttf
diff --git a/...nt-awesome/fonts/fontawesome-webfont.woff → ...nt-awesome/fonts/fontawesome-webfont.woff b/...nt-awesome/fonts/fontawesome-webfont.woff → ...nt-awesome/fonts/fontawesome-webfont.woff
diff --git a/app/assets/vendor/theme/sb-admin.css → ...nder/app/assets/vendor/theme/sb-admin.css b/app/assets/vendor/theme/sb-admin.css → ...nder/app/assets/vendor/theme/sb-admin.css
diff --git a/app/data/allocations-dao.js → ...server-render/app/data/allocations-dao.js b/app/data/allocations-dao.js → ...server-render/app/data/allocations-dao.js
diff --git a/app/data/benefits-dao.js → apps/server-render/app/data/benefits-dao.js b/app/data/benefits-dao.js → apps/server-render/app/data/benefits-dao.js
diff --git a/app/data/contributions-dao.js → ...rver-render/app/data/contributions-dao.js b/app/data/contributions-dao.js → ...rver-render/app/data/contributions-dao.js
diff --git a/app/data/memos-dao.js → apps/server-render/app/data/memos-dao.js b/app/data/memos-dao.js → apps/server-render/app/data/memos-dao.js
diff --git a/app/data/profile-dao.js → apps/server-render/app/data/profile-dao.js b/app/data/profile-dao.js → apps/server-render/app/data/profile-dao.js
diff --git a/app/data/research-dao.js → apps/server-render/app/data/research-dao.js b/app/data/research-dao.js → apps/server-render/app/data/research-dao.js
diff --git a/app/data/user-dao.js → apps/server-render/app/data/user-dao.js b/app/data/user-dao.js → apps/server-render/app/data/user-dao.js
diff --git a/app/routes/allocations.js → apps/server-render/app/routes/allocations.js b/app/routes/allocations.js → apps/server-render/app/routes/allocations.js
diff --git a/app/routes/benefits.js → apps/server-render/app/routes/benefits.js b/app/routes/benefits.js → apps/server-render/app/routes/benefits.js
diff --git a/app/routes/contributions.js → ...server-render/app/routes/contributions.js b/app/routes/contributions.js → ...server-render/app/routes/contributions.js
diff --git a/app/routes/error.js → apps/server-render/app/routes/error.js b/app/routes/error.js → apps/server-render/app/routes/error.js
diff --git a/app/routes/index.js → apps/server-render/app/routes/index.js b/app/routes/index.js → apps/server-render/app/routes/index.js
diff --git a/app/routes/memos.js → apps/server-render/app/routes/memos.js b/app/routes/memos.js → apps/server-render/app/routes/memos.js
diff --git a/app/routes/profile.js → apps/server-render/app/routes/profile.js b/app/routes/profile.js → apps/server-render/app/routes/profile.js
diff --git a/app/routes/research.js → apps/server-render/app/routes/research.js b/app/routes/research.js → apps/server-render/app/routes/research.js
diff --git a/app/routes/session.js → apps/server-render/app/routes/session.js b/app/routes/session.js → apps/server-render/app/routes/session.js
diff --git a/app/views/allocations.html → .../server-render/app/views/allocations.html b/app/views/allocations.html → .../server-render/app/views/allocations.html
diff --git a/app/views/benefits.html → apps/server-render/app/views/benefits.html b/app/views/benefits.html → apps/server-render/app/views/benefits.html
diff --git a/app/views/contributions.html → ...erver-render/app/views/contributions.html b/app/views/contributions.html → ...erver-render/app/views/contributions.html
diff --git a/app/views/dashboard.html → apps/server-render/app/views/dashboard.html b/app/views/dashboard.html → apps/server-render/app/views/dashboard.html
diff --git a/app/views/error-template.html → ...rver-render/app/views/error-template.html b/app/views/error-template.html → ...rver-render/app/views/error-template.html
diff --git a/app/views/layout.html → apps/server-render/app/views/layout.html b/app/views/layout.html → apps/server-render/app/views/layout.html
diff --git a/app/views/login.html → apps/server-render/app/views/login.html b/app/views/login.html → apps/server-render/app/views/login.html
diff --git a/app/views/memos.html → apps/server-render/app/views/memos.html b/app/views/memos.html → apps/server-render/app/views/memos.html
diff --git a/app/views/profile.html → apps/server-render/app/views/profile.html b/app/views/profile.html → apps/server-render/app/views/profile.html
diff --git a/app/views/research.html → apps/server-render/app/views/research.html b/app/views/research.html → apps/server-render/app/views/research.html
diff --git a/app/views/signup.html → apps/server-render/app/views/signup.html b/app/views/signup.html → apps/server-render/app/views/signup.html
diff --git a/app/views/tutorial/a1.html → .../server-render/app/views/tutorial/a1.html b/app/views/tutorial/a1.html → .../server-render/app/views/tutorial/a1.html
diff --git a/app/views/tutorial/a10.html → ...server-render/app/views/tutorial/a10.html b/app/views/tutorial/a10.html → ...server-render/app/views/tutorial/a10.html
diff --git a/app/views/tutorial/a2.html → .../server-render/app/views/tutorial/a2.html b/app/views/tutorial/a2.html → .../server-render/app/views/tutorial/a2.html
diff --git a/app/views/tutorial/a3.html → .../server-render/app/views/tutorial/a3.html b/app/views/tutorial/a3.html → .../server-render/app/views/tutorial/a3.html
diff --git a/app/views/tutorial/a4.html → .../server-render/app/views/tutorial/a4.html b/app/views/tutorial/a4.html → .../server-render/app/views/tutorial/a4.html
diff --git a/app/views/tutorial/a5.html → .../server-render/app/views/tutorial/a5.html b/app/views/tutorial/a5.html → .../server-render/app/views/tutorial/a5.html
diff --git a/app/views/tutorial/a6.html → .../server-render/app/views/tutorial/a6.html b/app/views/tutorial/a6.html → .../server-render/app/views/tutorial/a6.html
diff --git a/app/views/tutorial/a7.html → .../server-render/app/views/tutorial/a7.html b/app/views/tutorial/a7.html → .../server-render/app/views/tutorial/a7.html
diff --git a/app/views/tutorial/a8.html → .../server-render/app/views/tutorial/a8.html b/app/views/tutorial/a8.html → .../server-render/app/views/tutorial/a8.html
diff --git a/app/views/tutorial/a9.html → .../server-render/app/views/tutorial/a9.html b/app/views/tutorial/a9.html → .../server-render/app/views/tutorial/a9.html
diff --git a/app/views/tutorial/layout.html → ...ver-render/app/views/tutorial/layout.html b/app/views/tutorial/layout.html → ...ver-render/app/views/tutorial/layout.html
diff --git a/app/views/tutorial/redos.html → ...rver-render/app/views/tutorial/redos.html b/app/views/tutorial/redos.html → ...rver-render/app/views/tutorial/redos.html
diff --git a/app/views/tutorial/ssrf.html → ...erver-render/app/views/tutorial/ssrf.html b/app/views/tutorial/ssrf.html → ...erver-render/app/views/tutorial/ssrf.html
diff --git a/artifacts/cert/server.crt → apps/server-render/artifacts/cert/server.crt b/artifacts/cert/server.crt → apps/server-render/artifacts/cert/server.crt
diff --git a/artifacts/cert/server.key → apps/server-render/artifacts/cert/server.key b/artifacts/cert/server.key → apps/server-render/artifacts/cert/server.key
diff --git a/artifacts/db-reset.js → apps/server-render/artifacts/db-reset.js b/artifacts/db-reset.js → apps/server-render/artifacts/db-reset.js
diff --git a/config/config.js → apps/server-render/config/config.js b/config/config.js → apps/server-render/config/config.js
diff --git a/config/env/all.js → apps/server-render/config/env/all.js b/config/env/all.js → apps/server-render/config/env/all.js
diff --git a/config/env/development.js → apps/server-render/config/env/development.js b/config/env/development.js → apps/server-render/config/env/development.js
diff --git a/config/env/production.js → apps/server-render/config/env/production.js b/config/env/production.js → apps/server-render/config/env/production.js
diff --git a/config/env/test.js → apps/server-render/config/env/test.js b/config/env/test.js → apps/server-render/config/env/test.js
diff --git a/cypress.json → apps/server-render/cypress.json b/cypress.json → apps/server-render/cypress.json
diff --git a/docker-compose.yml → apps/server-render/docker-compose.yml b/docker-compose.yml → apps/server-render/docker-compose.yml
diff --git a/nodemon.json → apps/server-render/nodemon.json b/nodemon.json → apps/server-render/nodemon.json
diff --git a/package-lock.json → apps/server-render/package-lock.json b/package-lock.json → apps/server-render/package-lock.json
diff --git a/package.json → apps/server-render/package.json b/package.json → apps/server-render/package.json
diff --git a/server.js → apps/server-render/server.js b/server.js → apps/server-render/server.js
diff --git a/test/e2e/fixtures/users/admin.json → ...render/test/e2e/fixtures/users/admin.json b/test/e2e/fixtures/users/admin.json → ...render/test/e2e/fixtures/users/admin.json
diff --git a/test/e2e/fixtures/users/new_user.json → ...der/test/e2e/fixtures/users/new_user.json b/test/e2e/fixtures/users/new_user.json → ...der/test/e2e/fixtures/users/new_user.json
diff --git a/test/e2e/fixtures/users/user.json → ...-render/test/e2e/fixtures/users/user.json b/test/e2e/fixtures/users/user.json → ...-render/test/e2e/fixtures/users/user.json
diff --git a/test/e2e/integration/allocations_spec.js → .../test/e2e/integration/allocations_spec.js b/test/e2e/integration/allocations_spec.js → .../test/e2e/integration/allocations_spec.js
diff --git a/test/e2e/integration/benefits_spec.js → ...der/test/e2e/integration/benefits_spec.js b/test/e2e/integration/benefits_spec.js → ...der/test/e2e/integration/benefits_spec.js
diff --git a/test/e2e/integration/contributions_spec.js → ...est/e2e/integration/contributions_spec.js b/test/e2e/integration/contributions_spec.js → ...est/e2e/integration/contributions_spec.js
diff --git a/test/e2e/integration/dashboard_spec.js → ...er/test/e2e/integration/dashboard_spec.js b/test/e2e/integration/dashboard_spec.js → ...er/test/e2e/integration/dashboard_spec.js
diff --git a/test/e2e/integration/general_spec.js → ...nder/test/e2e/integration/general_spec.js b/test/e2e/integration/general_spec.js → ...nder/test/e2e/integration/general_spec.js
diff --git a/test/e2e/integration/learn_spec.js → ...render/test/e2e/integration/learn_spec.js b/test/e2e/integration/learn_spec.js → ...render/test/e2e/integration/learn_spec.js
diff --git a/test/e2e/integration/login_spec.js → ...render/test/e2e/integration/login_spec.js b/test/e2e/integration/login_spec.js → ...render/test/e2e/integration/login_spec.js
diff --git a/test/e2e/integration/logout_spec.js → ...ender/test/e2e/integration/logout_spec.js b/test/e2e/integration/logout_spec.js → ...ender/test/e2e/integration/logout_spec.js
diff --git a/test/e2e/integration/memos_spec.js → ...render/test/e2e/integration/memos_spec.js b/test/e2e/integration/memos_spec.js → ...render/test/e2e/integration/memos_spec.js
diff --git a/test/e2e/integration/profile_spec.js → ...nder/test/e2e/integration/profile_spec.js b/test/e2e/integration/profile_spec.js → ...nder/test/e2e/integration/profile_spec.js
diff --git a/test/e2e/integration/research_spec.js → ...der/test/e2e/integration/research_spec.js b/test/e2e/integration/research_spec.js → ...der/test/e2e/integration/research_spec.js
diff --git a/test/e2e/integration/signup_spec.js → ...ender/test/e2e/integration/signup_spec.js b/test/e2e/integration/signup_spec.js → ...ender/test/e2e/integration/signup_spec.js
diff --git a/test/e2e/integration/tutorial_spec.js → ...der/test/e2e/integration/tutorial_spec.js b/test/e2e/integration/tutorial_spec.js → ...der/test/e2e/integration/tutorial_spec.js
diff --git a/test/e2e/plugins/index.js → apps/server-render/test/e2e/plugins/index.js b/test/e2e/plugins/index.js → apps/server-render/test/e2e/plugins/index.js
diff --git a/test/e2e/support/commands.js → ...erver-render/test/e2e/support/commands.js b/test/e2e/support/commands.js → ...erver-render/test/e2e/support/commands.js
diff --git a/test/e2e/support/index.js → apps/server-render/test/e2e/support/index.js b/test/e2e/support/index.js → apps/server-render/test/e2e/support/index.js
diff --git a/test/e2e/tsconfig.json → apps/server-render/test/e2e/tsconfig.json b/test/e2e/tsconfig.json → apps/server-render/test/e2e/tsconfig.json
diff --git a/test/security/profile-test.js → ...rver-render/test/security/profile-test.js b/test/security/profile-test.js → ...rver-render/test/security/profile-test.js