-
Notifications
You must be signed in to change notification settings - Fork 9
Expand file tree
/
Copy pathsecurityQuestionApiSpec.ts
More file actions
87 lines (75 loc) · 3.02 KB
/
Copy pathsecurityQuestionApiSpec.ts
File metadata and controls
87 lines (75 loc) · 3.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/
import frisby = require('frisby')
import config from 'config'
const Joi = frisby.Joi
const security = require('../../lib/insecurity')
const API_URL = 'http://localhost:3000/api'
const REST_URL = 'http://localhost:3000/rest'
const authHeader = { Authorization: `Bearer ${security.authorize()}`, 'content-type': 'application/json' }
describe('/api/SecurityQuestions', () => {
it('GET all security questions ', () => {
return frisby.get(`${API_URL}/SecurityQuestions`)
.expect('status', 200)
.expect('header', 'content-type', /application\/json/)
.expect('jsonTypes', 'data.*', {
id: Joi.number(),
question: Joi.string()
})
})
it('POST new security question is forbidden via public API even when authenticated', () => {
return frisby.post(`${API_URL}/SecurityQuestions`, {
headers: authHeader,
body: {
question: 'Your own first name?'
}
})
.expect('status', 401)
})
})
describe('/api/SecurityQuestions/:id', () => {
it('GET existing security question by id is forbidden via public API even when authenticated', () => {
return frisby.get(`${API_URL}/SecurityQuestions/1`, { headers: authHeader })
.expect('status', 401)
})
it('PUT update existing security question is forbidden via public API even when authenticated', () => {
return frisby.put(`${API_URL}/SecurityQuestions/1`, {
headers: authHeader,
body: {
question: 'Your own first name?'
}
})
.expect('status', 401)
})
it('DELETE existing security question is forbidden via public API even when authenticated', () => {
return frisby.del(`${API_URL}/SecurityQuestions/1`, { headers: authHeader })
.expect('status', 401)
})
})
describe('/rest/user/security-question', () => {
it('GET security question for an existing user\'s email address', () => {
return frisby.get(`${REST_URL}/user/security-question?email=jim@${config.get<string>('application.domain')}`)
.expect('status', 200)
.expect('json', 'question', {
question: 'Your eldest siblings middle name?'
})
})
it('GET security question returns nothing for an unknown email address', () => {
return frisby.get(`${REST_URL}/user/security-question?email=horst@unknown-us.er`)
.expect('status', 200)
.expect('json', {})
})
it('GET security question throws error for missing email address', () => {
return frisby.get(`${REST_URL}/user/security-question`)
.expect('status', 500)
.expect('header', 'content-type', /text\/html/)
.expect('bodyContains', `<h1>${config.get<string>('application.name')} (Express`)
.expect('bodyContains', 'Error: WHERE parameter "email" has invalid "undefined" value')
})
it('GET security question is not susceptible to SQL Injection attacks', () => {
return frisby.get(`${REST_URL}/user/security-question?email=';`)
.expect('status', 200)
})
})