forked from AABoyles/MicrobeTrace
Permalink
Show file tree
Hide file tree
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Added sanitization for XSS attempts
- Loading branch information
Showing
10 changed files
with
151 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Adversarial Tests | ||
|
|
||
| This directory contains a single script (pwn.js) which alerts the user that | ||
| their box has been pwned. | ||
|
|
||
| It also contains a variety of files which attempt XSS attacks by injecting | ||
| script tags through the various sources of input to the DOM. | ||
|
|
||
| To compensate for these, MicrobeTrace scrubs all inputs of anything matching a | ||
| set of dumb regexes that browsers will interpret as tags. Accordingly, any files | ||
| which contain tag-like syntax (e.g. a CSV with a field populated by HTML or XML | ||
| values) will not be loaded completely and correctly. | ||
| THIS IS A FEATURE, NOT A BUG. | ||
|
|
||
| To test MicrobeTrace's security using these files, launch a webserver on port | ||
| 8080 in the MicrobeTrace Root directory. Then, with the server running, launch | ||
| MicrobeTrace and load any of the files in this directory. If you recieve an | ||
| alert that your username has been pwned, it means that somewhere in the program, | ||
| an unsanitized user input has been leaked into the DOM. This is a security bug. | ||
| Please contact nsp3@cdc.gov with a description of how you got the message (which | ||
| file you were using and what part of the program you were interacting with). | ||
| Please do NOT post this as an issue on Github. | ||
|
|
||
| Thank you! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| >1922PL-110-1<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script> | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-2 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-3 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-4 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-5 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-6 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-7 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-8 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA | ||
| >1922PL-110-9 | ||
| GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA |
Oops, something went wrong.