From db567bf9b09c1469a7abadac96d80e43de895da3 Mon Sep 17 00:00:00 2001
From: jeff-cycode <163135025+jeff-cycode@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:12:45 -0400
Subject: [PATCH 1/4] Create sast.ts
---
sast.ts | 193 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 193 insertions(+)
create mode 100644 sast.ts
diff --git a/sast.ts b/sast.ts
new file mode 100644
index 0000000..fc5e33d
--- /dev/null
+++ b/sast.ts
@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import models = require('../models/index')
+import { type Request, type Response, type NextFunction } from 'express'
+import { UserModel } from '../models/user'
+
+import * as utils from '../lib/utils'
+const challengeUtils = require('../lib/challengeUtils')
+const challenges = require('../data/datacache').challenges
+
+class ErrorWithParent extends Error {
+ parent: Error | undefined
+}
+
+// vuln-code-snippet start unionSqlInjectionChallenge dbSchemaChallenge
+module.exports = function searchProducts () {
+ return (req: Request, res: Response, next: NextFunction) => {
+ let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? ''
+ criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200)
+ models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge
+ .then(([products]: any) => {
+ const dataString = JSON.stringify(products)
+ if (challengeUtils.notSolved(challenges.unionSqlInjectionChallenge)) { // vuln-code-snippet hide-start
+ let solved = true
+ UserModel.findAll().then(data => {
+ const users = utils.queryResultToJson(data)
+ if (users.data?.length) {
+ for (let i = 0; i < users.data.length; i++) {
+ solved = solved && utils.containsOrEscaped(dataString, users.data[i].email) && utils.contains(dataString, users.data[i].password)
+ if (!solved) {
+ break
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.unionSqlInjectionChallenge)
+ }
+ }
+ }).catch((error: Error) => {
+ next(error)
+ })
+ }
+ if (challengeUtils.notSolved(challenges.dbSchemaChallenge)) {
+ let solved = true
+ models.sequelize.query('SELECT sql FROM sqlite_master').then(([data]: any) => {
+ const tableDefinitions = utils.queryResultToJson(data)
+ if (tableDefinitions.data?.length) {
+ for (let i = 0; i < tableDefinitions.data.length; i++) {
+ if (tableDefinitions.data[i].sql) {
+ solved = solved && utils.containsOrEscaped(dataString, tableDefinitions.data[i].sql)
+ if (!solved) {
+ break
+ }
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.dbSchemaChallenge)
+ }
+ }
+ })
+ } // vuln-code-snippet hide-end
+ for (let i = 0; i < products.length; i++) {
+ products[i].name = req.__(products[i].name)
+ products[i].description = req.__(products[i].description)
+ }
+ res.json(utils.queryResultToJson(products))
+ }).catch((error: ErrorWithParent) => {
+ next(error.parent)
+ })
+ }
+}
+
+
+// vuln-code-snippet start unionSqlInjectionChallenge dbSchemaChallenge
+module.exports = function searchProducts () {
+ return (req: Request, res: Response, next: NextFunction) => {
+ let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? ''
+ criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200)
+ models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`,
+ { replacements: { criteria: '%' + criteria + '%' }, type: models.sequelize.QueryTypes.SELECT } // use parameterized query
+ )
+ .then(([products]: any) => {
+ const dataString = JSON.stringify(products)
+ if (challengeUtils.notSolved(challenges.unionSqlInjectionChallenge)) { // vuln-code-snippet hide-start
+ let solved = true
+ UserModel.findAll().then(data => {
+ const users = utils.queryResultToJson(data)
+ if (users.data?.length) {
+ for (let i = 0; i < users.data.length; i++) {
+ solved = solved && utils.containsOrEscaped(dataString, users.data[i].email) && utils.contains(dataString, users.data[i].password)
+ if (!solved) {
+ break
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.unionSqlInjectionChallenge)
+ }
+ }
+ }).catch((error: Error) => {
+ next(error)
+ })
+ }
+ if (challengeUtils.notSolved(challenges.dbSchemaChallenge)) {
+ let solved = true
+ models.sequelize.query('SELECT sql FROM sqlite_master').then(([data]: any) => {
+ const tableDefinitions = utils.queryResultToJson(data)
+ if (tableDefinitions.data?.length) {
+ for (let i = 0; i < tableDefinitions.data.length; i++) {
+ if (tableDefinitions.data[i].sql) {
+ solved = solved && utils.containsOrEscaped(dataString, tableDefinitions.data[i].sql)
+ if (!solved) {
+ break
+ }
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.dbSchemaChallenge)
+ }
+ }
+ })
+ } // vuln-code-snippet hide-end
+ for (let i = 0; i < products.length; i++) {
+ products[i].name = req.__(products[i].name)
+ products[i].description = req.__(products[i].description)
+ }
+ res.json(utils.queryResultToJson(products))
+ }).catch((error: ErrorWithParent) => {
+ next(error.parent)
+ })
+ }
+}
+
+
+// vuln-code-snippet start unionSqlInjectionChallenge dbSchemaChallenge
+module.exports = function searchProducts () {
+ return (req: Request, res: Response, next: NextFunction) => {
+ let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? ''
+ criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200)
+ const query = `SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`;
+ const options = { replacements: { criteria: `%${criteria}%` }, type: QueryTypes.SELECT };
+ models.sequelize.query(query, options)
+ .then(([products]: any) => {
+ const dataString = JSON.stringify(products)
+ if (challengeUtils.notSolved(challenges.unionSqlInjectionChallenge)) { // vuln-code-snippet hide-start
+ let solved = true
+ UserModel.findAll().then(data => {
+ const users = utils.queryResultToJson(data)
+ if (users.data?.length) {
+ for (let i = 0; i < users.data.length; i++) {
+ solved = solved && utils.containsOrEscaped(dataString, users.data[i].email) && utils.contains(dataString, users.data[i].password)
+ if (!solved) {
+ break
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.unionSqlInjectionChallenge)
+ }
+ }
+ }).catch((error: Error) => {
+ next(error)
+ })
+ }
+ if (challengeUtils.notSolved(challenges.dbSchemaChallenge)) {
+ let solved = true
+ models.sequelize.query('SELECT sql FROM sqlite_master').then(([data]: any) => {
+ const tableDefinitions = utils.queryResultToJson(data)
+ if (tableDefinitions.data?.length) {
+ for (let i = 0; i < tableDefinitions.data.length; i++) {
+ if (tableDefinitions.data[i].sql) {
+ solved = solved && utils.containsOrEscaped(dataString, tableDefinitions.data[i].sql)
+ if (!solved) {
+ break
+ }
+ }
+ }
+ if (solved) {
+ challengeUtils.solve(challenges.dbSchemaChallenge)
+ }
+ }
+ })
+ } // vuln-code-snippet hide-end
+ for (let i = 0; i < products.length; i++) {
+ products[i].name = req.__(products[i].name)
+ products[i].description = req.__(products[i].description)
+ }
+ res.json(utils.queryResultToJson(products))
+ }).catch((error: ErrorWithParent) => {
+ next(error.parent)
+ })
+ }
+}
From 986426a47e469f3e9ff9ade0f1a4e2e0c41d4118 Mon Sep 17 00:00:00 2001
From: jeff-cycode <163135025+jeff-cycode@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:13:30 -0400
Subject: [PATCH 2/4] Create secret.py
---
secret.py | 1 +
1 file changed, 1 insertion(+)
create mode 100644 secret.py
diff --git a/secret.py b/secret.py
new file mode 100644
index 0000000..5aa7336
--- /dev/null
+++ b/secret.py
@@ -0,0 +1 @@
+password = 'fjdkf7GG@9ikDF5!nZzzz'
From c4ba708127588e303eab7c3054a40a1dd7c36a3b Mon Sep 17 00:00:00 2001
From: jeff-cycode <163135025+jeff-cycode@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:14:08 -0400
Subject: [PATCH 3/4] Update pom.xml
---
java-app/pom.xml | 2 --
1 file changed, 2 deletions(-)
diff --git a/java-app/pom.xml b/java-app/pom.xml
index d9eb4e5..876772a 100644
--- a/java-app/pom.xml
+++ b/java-app/pom.xml
@@ -85,13 +85,11 @@
arquillian-container-impl-base
1.7.0.Alpha12
-
org.jboss.shrinkwrap
shrinkwrap-impl-base
From 8c706ea6acffb9038a769ed025daea976ad65f5c Mon Sep 17 00:00:00 2001
From: scott-es
Date: Wed, 19 Mar 2025 14:53:13 -0400
Subject: [PATCH 4/4] bumping jackson-databind
---
java-app/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/java-app/pom.xml b/java-app/pom.xml
index 876772a..4987e81 100644
--- a/java-app/pom.xml
+++ b/java-app/pom.xml
@@ -88,7 +88,7 @@
com.fasterxml.jackson.core
jackson-databind
- 2.9.10.3
+ 2.9.10.4
org.jboss.shrinkwrap