forked from juice-shop/juice-shop
-
Notifications
You must be signed in to change notification settings - Fork 0
/
dataErasure.ts
87 lines (78 loc) · 2.67 KB
/
dataErasure.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
/*
* Copyright (c) 2014-2022 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/
import express, { NextFunction, Request, Response } from 'express'
import insecurity from '../lib/insecurity'
import path from 'path'
import models = require('../models/index')
const challenges = require('../data/datacache').challenges
const utils = require('../lib/utils')
const router = express.Router()
// eslint-disable-next-line @typescript-eslint/no-misused-promises
router.get('/', async (req: Request, res: Response, next: NextFunction): Promise<void> => {
const loggedInUser = insecurity.authenticatedUsers.get(req.cookies.token)
if (!loggedInUser) {
next(new Error('Blocked illegal activity by ' + req.connection.remoteAddress))
return
}
const email = loggedInUser.data.email
try {
const answer = await models.SecurityAnswer.findOne({
include: [{
model: models.User,
where: { email }
}]
})
const question = await models.SecurityQuestion.findByPk(answer.SecurityQuestionId)
res.render('dataErasureForm', { userEmail: email, securityQuestion: question.dataValues.question })
} catch (error) {
next(error)
}
})
interface DataErasureRequestParams {
layout?: string
email: string
securityAnswer: string
}
// eslint-disable-next-line @typescript-eslint/no-misused-promises
router.post('/', async (req: Request<{}, {}, DataErasureRequestParams>, res: Response, next: NextFunction): Promise<void> => {
const loggedInUser = insecurity.authenticatedUsers.get(req.cookies.token)
if (!loggedInUser) {
next(new Error('Blocked illegal activity by ' + req.connection.remoteAddress))
return
}
try {
await models.PrivacyRequest.create({
UserId: loggedInUser.data.id,
deletionRequested: true
})
res.clearCookie('token')
if (req.body.layout !== undefined) {
const filePath: string = path.resolve(req.body.layout).toLowerCase()
const isForbiddenFile: boolean = (filePath.includes('ftp') || filePath.includes('ctf.key') || filePath.includes('encryptionkeys'))
if (!isForbiddenFile) {
res.render('dataErasureResult', {
...req.body
}, (error, html) => {
if (!html || error) {
next(new Error(error))
} else {
const sendlfrResponse: string = html.slice(0, 100) + '......'
res.send(sendlfrResponse)
utils.solve(challenges.lfrChallenge)
}
})
} else {
next(new Error('File access not allowed'))
}
} else {
res.render('dataErasureResult', {
...req.body
})
}
} catch (error) {
next(error)
}
})
export default router