Skip to content

Commit 155efeb

Browse files
kenduckkenduck
committed
Updated tests to use test projects. We need further tests for sufficient coverage.
1 parent c63eec6 commit 155efeb

File tree

3 files changed

+18
-264
lines changed

3 files changed

+18
-264
lines changed

‎test_data/bower.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
"description": "A demo bower.json for audit.js.",
55
"license": "MIT",
66
"dependencies": {
7-
"angular": "~1.4.3"
7+
"vor-test-project-bower-please-ignore-1": "2.0.0"
88
}
99
}

‎test_data/expected_reports/bower.xml

+8-114
Original file line numberDiff line numberDiff line change
@@ -1,125 +1,19 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<testsuite name="auditjs.security.bower" errors="0" tests="1" package="test" id="" skipped="0" failures="1"><testcase name="angular"><failure message="Found 8 vulnerabilities. See stacktrace for details.">Details:
2+
<testsuite name="auditjs.security.bower" errors="0" tests="1" package="test" id="" skipped="0" failures="1"><testcase name="vor-test-project-bower-please-ignore-1"><failure message="Found 1 vulnerabilities. See stacktrace for details.">Details:
33

44
[
55
{
6-
"id": 8398878757,
7-
"title": "Cross Site Scripting (XSS) in JSONP",
8-
"description": "JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.",
6+
"id": 8402907551,
7+
"title": "Test vulnerability, please ignore",
8+
"description": "This is a test vulnerability for a test project",
99
"versions": [
10-
"&lt;1.6.0-rc.0"
10+
"&lt;=2.0.0"
1111
],
1212
"references": [
13-
"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4",
14-
"https://github.com/angular/angular.js/issues/11352",
15-
"https://snyk.io/vuln/npm:angular:20150315"
13+
"https://vorsecurity.com/3"
1614
],
17-
"published": 0,
18-
"updated": 1493261505026
19-
},
20-
{
21-
"id": 8399952532,
22-
"title": "Possible security hold with usemap attribute",
23-
"description": "The attribute usemap has been blacklisted as it can be used as a security exploit.",
24-
"versions": [
25-
"&lt;1.5.0-rc.2"
26-
],
27-
"references": [
28-
"https://github.com/angular/angular.js/blob/master/CHANGELOG.md#1"
29-
],
30-
"published": 1469727878777,
31-
"updated": 1469727878777
32-
},
33-
{
34-
"id": 8399952533,
35-
"title": "UI Redress Attack Through Improper Sanitization Of SVG Elements",
36-
"description": "angular is susceptible to UI redress attacks. The vulnerability is due to the lack of proper sanitisation of an html input string by stripping all potentially dangerous tokens. So, an attacker can place svg elements outside of the containing element, leading to rendering it over other elements on the page (example: a login link).",
37-
"versions": [
38-
"&lt;1.5.0-beta.2"
39-
],
40-
"references": [
41-
"https://github.com/angular/angular.js/commit/181fc567d873df065f1e84af7225deb70a8d2eb9",
42-
"https://github.com/angular/angular.js/pull/12524",
43-
"https://srcclr.com/security/ui-redress-attack-through-improper/javascript/s-2252"
44-
],
45-
"published": 1469728183493,
46-
"updated": 1469728183493
47-
},
48-
{
49-
"id": 8399952534,
50-
"title": "Arbitrary Code Execution",
51-
"description": "SVG animations tags are not being sanitized properly, resulting in possible arbitrary code execution.",
52-
"versions": [
53-
"&lt;1.5.0-beta.2"
54-
],
55-
"references": [
56-
"https://cwe.mitre.org/data/definitions/78.html",
57-
"https://github.com/angular/angular.js/commit/67688d5ca00f6de4c7fe6084e2fa762a00d25610",
58-
"https://github.com/angular/angular.js/pull/11290",
59-
"https://snyk.io/vuln/npm:angular:20150310",
60-
"https://srcclr.com/security/arbitrary-code-execution-through-svg/javascript/s-2253"
61-
],
62-
"published": 1469728274567,
63-
"updated": 1486325942923
64-
},
65-
{
66-
"id": 8402281303,
67-
"title": "Cross Site Scripting (XSS) through use elements referencing external SVG",
68-
"description": "> The use element can reference external svg's (same origin) and can include\nxlink javascript urls or foreign object that can execute xss.\n> \n> -- [github.com](https://github.com/angular/angular.js/pull/13453)",
69-
"versions": [
70-
"&lt;1.5.0"
71-
],
72-
"references": [
73-
"https://cwe.mitre.org/data/definitions/79.html",
74-
"https://github.com/angular/angular.js/issues/13453"
75-
],
76-
"published": 1483077792740,
77-
"updated": 1483078107273
78-
},
79-
{
80-
"id": 8402384794,
81-
"title": "Cross-site Scripting (XSS)",
82-
"description": "> Affected versions of the package are vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.\n> \n> -- [snyk.io](https://snyk.io/vuln/npm:angular:20150807)",
83-
"versions": [
84-
"&lt;1.5.0-beta.0 >=1.0.0"
85-
],
86-
"references": [
87-
"https://github.com/angular/angular.js/commit/f33ce173c90736e349cf594df717ae3ee41e0f7a",
88-
"https://github.com/angular/angular.js/pull/12524",
89-
"https://snyk.io/vuln/npm:angular:20150807"
90-
],
91-
"published": 1485900514365,
92-
"updated": 1485931408807
93-
},
94-
{
95-
"id": 8402384796,
96-
"title": "Cross-site Scripting (XSS)",
97-
"description": "> Affected versions of the package are vulnerable to Mutation Cross-site Scripting (mXSS).\n> \n> -- [snyk.io](https://snyk.io/vuln/npm:angular:20150909)",
98-
"versions": [
99-
"&lt;1.5.0-beta.2"
100-
],
101-
"references": [
102-
"https://github.com/angular/angular.js/commit/bc0d8c4eea9a34bff5e29dd492dcdd668251be40",
103-
"https://github.com/angular/angular.js/pull/12524",
104-
"https://snyk.io/vuln/npm:angular:20150909"
105-
],
106-
"published": 1485901294649,
107-
"updated": 1485931425201
108-
},
109-
{
110-
"id": 8402385510,
111-
"title": "Cross-site Scripting (XSS)",
112-
"description": "> Affected versions of the package are vulnerable to Cross-site Scripting (XSS) attacks involving assignment on constructor properties.\n> \n> -- [snyk](https://snyk.io/vuln/npm:angular:20151130)",
113-
"versions": [
114-
"&lt;1.4.10"
115-
],
116-
"references": [
117-
"https://github.com/angular/angular.js/commit/5a674f3bb9d1118d11b333e3b966c01a571c09e6",
118-
"https://github.com/angular/angular.js/pull/13417",
119-
"https://snyk.io/vuln/npm:angular:20151130"
120-
],
121-
"published": 1485949862562,
122-
"updated": 1485964583864
15+
"published": 1493874212256,
16+
"updated": 1493874464883
12317
}
12418
]
12519

‎test_data/expected_reports/package.xml

+9-149
Original file line numberDiff line numberDiff line change
@@ -1,156 +1,16 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<testsuite name="auditjs.security.package" errors="0" tests="9" package="test" id="" skipped="0" failures="1"><testcase name="requirejs"/><testcase name="requirejs-plugins"/><testcase name="bootswatch-scss"/><testcase name="angular"><failure message="Found 10 vulnerabilities. See stacktrace for details.">[
2+
<testsuite name="auditjs.security.package" errors="0" tests="1" package="test" id="" skipped="0" failures="1"><testcase name="vor-test-project-npm-please-ignore-1"><failure message="Found 1 vulnerabilities. See stacktrace for details.">[
33
{
4-
"id": 8398878757,
5-
"title": "Cross Site Scripting (XSS) in JSONP",
6-
"description": "JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.",
4+
"id": 8402907551,
5+
"title": "Test vulnerability, please ignore",
6+
"description": "This is a test vulnerability for a test project",
77
"versions": [
8-
"&lt;1.6.0-rc.0"
8+
"&lt;=2.0.0"
99
],
1010
"references": [
11-
"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4",
12-
"https://github.com/angular/angular.js/issues/11352",
13-
"https://snyk.io/vuln/npm:angular:20150315"
11+
"https://vorsecurity.com/3"
1412
],
15-
"published": 0,
16-
"updated": 1493261505026
17-
},
18-
{
19-
"id": 8399952532,
20-
"title": "Possible security hold with usemap attribute",
21-
"description": "The attribute usemap has been blacklisted as it can be used as a security exploit.",
22-
"versions": [
23-
"&lt;1.5.0-rc.2"
24-
],
25-
"references": [
26-
"https://github.com/angular/angular.js/blob/master/CHANGELOG.md#1"
27-
],
28-
"published": 1469727878777,
29-
"updated": 1469727878777
30-
},
31-
{
32-
"id": 8399952533,
33-
"title": "UI Redress Attack Through Improper Sanitization Of SVG Elements",
34-
"description": "angular is susceptible to UI redress attacks. The vulnerability is due to the lack of proper sanitisation of an html input string by stripping all potentially dangerous tokens. So, an attacker can place svg elements outside of the containing element, leading to rendering it over other elements on the page (example: a login link).",
35-
"versions": [
36-
"&lt;1.5.0-beta.2"
37-
],
38-
"references": [
39-
"https://github.com/angular/angular.js/commit/181fc567d873df065f1e84af7225deb70a8d2eb9",
40-
"https://github.com/angular/angular.js/pull/12524",
41-
"https://srcclr.com/security/ui-redress-attack-through-improper/javascript/s-2252"
42-
],
43-
"published": 1469728183493,
44-
"updated": 1469728183493
45-
},
46-
{
47-
"id": 8399952534,
48-
"title": "Arbitrary Code Execution",
49-
"description": "SVG animations tags are not being sanitized properly, resulting in possible arbitrary code execution.",
50-
"versions": [
51-
"&lt;1.5.0-beta.2"
52-
],
53-
"references": [
54-
"https://cwe.mitre.org/data/definitions/78.html",
55-
"https://github.com/angular/angular.js/commit/67688d5ca00f6de4c7fe6084e2fa762a00d25610",
56-
"https://github.com/angular/angular.js/pull/11290",
57-
"https://snyk.io/vuln/npm:angular:20150310",
58-
"https://srcclr.com/security/arbitrary-code-execution-through-svg/javascript/s-2253"
59-
],
60-
"published": 1469728274567,
61-
"updated": 1486325942923
62-
},
63-
{
64-
"id": 8402281289,
65-
"title": "Cross Site Scripting (XSS) when loaded from an extension",
66-
"description": "> Extension URIs (`resource://...`) bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an extension installed that uses Angular, an attacke[r] can load Angular from the extension, and Angular's auto-bootstrapping can be used to bypass the victim site's CSP protection.\n> \n> -- [github.com](https://github.com/angular/angular.js/pull/15346)",
67-
"versions": [
68-
">=1.5.0 &lt;1.5.9"
69-
],
70-
"references": [
71-
"https://cwe.mitre.org/data/definitions/79.html",
72-
"https://github.com/angular/angular.js/commit/0ff10e1b56c6b7c4ac465e35c96a5886e294bac5",
73-
"https://github.com/angular/angular.js/issues/15346",
74-
"https://github.com/angular/angular.js/pull/15346",
75-
"https://snyk.io/vuln/npm:angular:20161101"
76-
],
77-
"published": 1483077559265,
78-
"updated": 1485951529425
79-
},
80-
{
81-
"id": 8402281303,
82-
"title": "Cross Site Scripting (XSS) through use elements referencing external SVG",
83-
"description": "> The use element can reference external svg's (same origin) and can include\nxlink javascript urls or foreign object that can execute xss.\n> \n> -- [github.com](https://github.com/angular/angular.js/pull/13453)",
84-
"versions": [
85-
"&lt;1.5.0"
86-
],
87-
"references": [
88-
"https://cwe.mitre.org/data/definitions/79.html",
89-
"https://github.com/angular/angular.js/issues/13453"
90-
],
91-
"published": 1483077792740,
92-
"updated": 1483078107273
93-
},
94-
{
95-
"id": 8402384794,
96-
"title": "Cross-site Scripting (XSS)",
97-
"description": "> Affected versions of the package are vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.\n> \n> -- [snyk.io](https://snyk.io/vuln/npm:angular:20150807)",
98-
"versions": [
99-
"&lt;1.5.0-beta.0 >=1.0.0"
100-
],
101-
"references": [
102-
"https://github.com/angular/angular.js/commit/f33ce173c90736e349cf594df717ae3ee41e0f7a",
103-
"https://github.com/angular/angular.js/pull/12524",
104-
"https://snyk.io/vuln/npm:angular:20150807"
105-
],
106-
"published": 1485900514365,
107-
"updated": 1485931408807
108-
},
109-
{
110-
"id": 8402384796,
111-
"title": "Cross-site Scripting (XSS)",
112-
"description": "> Affected versions of the package are vulnerable to Mutation Cross-site Scripting (mXSS).\n> \n> -- [snyk.io](https://snyk.io/vuln/npm:angular:20150909)",
113-
"versions": [
114-
"&lt;1.5.0-beta.2"
115-
],
116-
"references": [
117-
"https://github.com/angular/angular.js/commit/bc0d8c4eea9a34bff5e29dd492dcdd668251be40",
118-
"https://github.com/angular/angular.js/pull/12524",
119-
"https://snyk.io/vuln/npm:angular:20150909"
120-
],
121-
"published": 1485901294649,
122-
"updated": 1485931425201
123-
},
124-
{
125-
"id": 8402385510,
126-
"title": "Cross-site Scripting (XSS)",
127-
"description": "> Affected versions of the package are vulnerable to Cross-site Scripting (XSS) attacks involving assignment on constructor properties.\n> \n> -- [snyk](https://snyk.io/vuln/npm:angular:20151130)",
128-
"versions": [
129-
"&lt;1.4.10"
130-
],
131-
"references": [
132-
"https://github.com/angular/angular.js/commit/5a674f3bb9d1118d11b333e3b966c01a571c09e6",
133-
"https://github.com/angular/angular.js/pull/13417",
134-
"https://snyk.io/vuln/npm:angular:20151130"
135-
],
136-
"published": 1485949862562,
137-
"updated": 1485964583864
138-
},
139-
{
140-
"id": 8402905897,
141-
"title": "Cross Site Scripting (XSS)",
142-
"description": "> Affected versions of the package are vulnerable to Cross-site Scripting (XSS) due to the usemap attribute not being blacklisted.\n> \n> -- [snyk.io](https://snyk.io/vuln/npm:angular:20160122)",
143-
"versions": [
144-
">=1.3.0 &lt;1.5.0-rc.2"
145-
],
146-
"references": [
147-
"https://cwe.mitre.org/data/definitions/79.html",
148-
"https://github.com/angular/angular.js/blob/master/CHANGELOG.md#150-rc2-controller-requisition-2016-01-28",
149-
"https://github.com/angular/angular.js/commit/234053fc9ad90e0d05be7e8359c6af66be94c094",
150-
"https://github.com/angular/angular.js/pull/13826",
151-
"https://snyk.io/vuln/npm:angular:20160122"
152-
],
153-
"published": 1493786539513,
154-
"updated": 1493790769282
13+
"published": 1493874212256,
14+
"updated": 1493874464883
15515
}
156-
]</failure></testcase><testcase name="angular-mocks"/><testcase name="angular-sanitize"/><testcase name="angular-route"/><testcase name="jquery"/><testcase name="moment"/></testsuite>
16+
]</failure></testcase></testsuite>

0 commit comments

Comments
 (0)