From f5fedbfd2a7d60492b61757adc1c11404343cdc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20K=C3=BCrzeder?= Date: Fri, 26 Aug 2022 16:03:08 +0200 Subject: [PATCH 1/4] Added vulnerabilities --- src/DemoAPI/DemoAPI.csproj | 1 + src/DemoFrontend/package-lock.json | 11 +++++++++++ src/DemoFrontend/package.json | 1 + src/DemoFrontend/src/app/app.component.ts | 5 +++++ 4 files changed, 18 insertions(+) diff --git a/src/DemoAPI/DemoAPI.csproj b/src/DemoAPI/DemoAPI.csproj index 4289e82..2d8a3c9 100644 --- a/src/DemoAPI/DemoAPI.csproj +++ b/src/DemoAPI/DemoAPI.csproj @@ -7,6 +7,7 @@ + diff --git a/src/DemoFrontend/package-lock.json b/src/DemoFrontend/package-lock.json index 28f6219..77db562 100644 --- a/src/DemoFrontend/package-lock.json +++ b/src/DemoFrontend/package-lock.json @@ -16,6 +16,7 @@ "@angular/platform-browser": "^14.1.0", "@angular/platform-browser-dynamic": "^14.1.0", "@angular/router": "^14.1.0", + "json-schema": "^0.3.0", "rxjs": "~7.5.0", "tslib": "^2.3.0", "zone.js": "~0.11.4" @@ -6316,6 +6317,11 @@ "dev": true, "license": "MIT" }, + "node_modules/json-schema": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.3.0.tgz", + "integrity": "sha512-TYfxx36xfl52Rf1LU9HyWSLGPdYLL+SQ8/E/0yVyKG8wCCDaSrhPap0vEdlsZWRaS6tnKKLPGiEJGiREVC8kxQ==" + }, "node_modules/json-schema-traverse": { "version": "0.4.1", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz", @@ -14257,6 +14263,11 @@ "version": "2.3.1", "dev": true }, + "json-schema": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.3.0.tgz", + "integrity": "sha512-TYfxx36xfl52Rf1LU9HyWSLGPdYLL+SQ8/E/0yVyKG8wCCDaSrhPap0vEdlsZWRaS6tnKKLPGiEJGiREVC8kxQ==" + }, "json-schema-traverse": { "version": "0.4.1", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz", diff --git a/src/DemoFrontend/package.json b/src/DemoFrontend/package.json index c30d5d4..087a437 100644 --- a/src/DemoFrontend/package.json +++ b/src/DemoFrontend/package.json @@ -18,6 +18,7 @@ "@angular/platform-browser": "^14.1.0", "@angular/platform-browser-dynamic": "^14.1.0", "@angular/router": "^14.1.0", + "json-schema": "^0.3.0", "rxjs": "~7.5.0", "tslib": "^2.3.0", "zone.js": "~0.11.4" diff --git a/src/DemoFrontend/src/app/app.component.ts b/src/DemoFrontend/src/app/app.component.ts index f89a475..541864f 100644 --- a/src/DemoFrontend/src/app/app.component.ts +++ b/src/DemoFrontend/src/app/app.component.ts @@ -7,4 +7,9 @@ import { Component } from '@angular/core'; }) export class AppComponent { title = 'DemoFrontend'; + + endsWith(x: string, y: string) { + let index = x.lastIndexOf(y); + return x.lastIndexOf(y) === x.length - y.length; + } } From 4430d55e5ddd7e3f333a4947a588e34938c3216c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20K=C3=BCrzeder?= Date: Thu, 8 Sep 2022 15:30:38 +0200 Subject: [PATCH 2/4] Added super secret key, please do not steal --- src/DemoFrontend/src/app/app.component.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/src/DemoFrontend/src/app/app.component.ts b/src/DemoFrontend/src/app/app.component.ts index 541864f..f8f5511 100644 --- a/src/DemoFrontend/src/app/app.component.ts +++ b/src/DemoFrontend/src/app/app.component.ts @@ -7,6 +7,7 @@ import { Component } from '@angular/core'; }) export class AppComponent { title = 'DemoFrontend'; + discordApiToken = '8dyfuiRvqFvVc3RRr_edRk-fz__JItpP'; // Todo: Remove this later, this is just for testing purposes endsWith(x: string, y: string) { let index = x.lastIndexOf(y); From 9aeb6b55ec879a5cdb7f2c39ef6d99c523997dcd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20K=C3=BCrzeder?= Date: Tue, 27 Sep 2022 15:16:08 +0200 Subject: [PATCH 3/4] Update client vuln --- src/DemoFrontend/src/app/app.component.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/DemoFrontend/src/app/app.component.ts b/src/DemoFrontend/src/app/app.component.ts index f8f5511..22c10da 100644 --- a/src/DemoFrontend/src/app/app.component.ts +++ b/src/DemoFrontend/src/app/app.component.ts @@ -9,8 +9,14 @@ export class AppComponent { title = 'DemoFrontend'; discordApiToken = '8dyfuiRvqFvVc3RRr_edRk-fz__JItpP'; // Todo: Remove this later, this is just for testing purposes - endsWith(x: string, y: string) { - let index = x.lastIndexOf(y); - return x.lastIndexOf(y) === x.length - y.length; + search(term: string) { + var href = document.location.href, + deflt = href.substring(href.indexOf("term=") + 5); + database.write("recent_searches", deflt); + } + + get_recent_searches() { + var searches = database.get("recent_searches"); + document.write("
Recents Searches: " + searches + "
"); } } From 619dfc37a6a36061d0901cd937114f6fd340bf68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20K=C3=BCrzeder?= Date: Tue, 27 Sep 2022 15:20:16 +0200 Subject: [PATCH 4/4] Update client vuln --- src/DemoFrontend/src/app/app.component.ts | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/src/DemoFrontend/src/app/app.component.ts b/src/DemoFrontend/src/app/app.component.ts index 22c10da..8a615af 100644 --- a/src/DemoFrontend/src/app/app.component.ts +++ b/src/DemoFrontend/src/app/app.component.ts @@ -11,12 +11,7 @@ export class AppComponent { search(term: string) { var href = document.location.href, - deflt = href.substring(href.indexOf("term=") + 5); - database.write("recent_searches", deflt); - } - - get_recent_searches() { - var searches = database.get("recent_searches"); - document.write("
Recents Searches: " + searches + "
"); + searchTerm = href.substring(href.indexOf("term=") + 5); + document.write("
You searched for: " + searchTerm + "
"); } }