From bde81a7e2c7b19bbc027b7e4a7c1734f25f3ea3b Mon Sep 17 00:00:00 2001 From: Stanley Lau Date: Fri, 20 Jul 2018 07:37:33 +0800 Subject: [PATCH 1/7] =?UTF-8?q?=E5=AE=8C=E6=88=90helmet=E7=AC=AC=E4=B8=80?= =?UTF-8?q?=E5=B0=8F=E8=8A=82=E7=BF=BB=E8=AF=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 06-information-security-and-quality-assurance/helmetjs.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/06-information-security-and-quality-assurance/helmetjs.json b/06-information-security-and-quality-assurance/helmetjs.json index bfc897b..b32d4c5 100644 --- a/06-information-security-and-quality-assurance/helmetjs.json +++ b/06-information-security-and-quality-assurance/helmetjs.json @@ -26,12 +26,12 @@ "id": "587d8247367417b2b2512c37", "title": "Hide Potentially Dangerous Information Using helmet.hidePoweredBy()", "description": [ - "As a reminder, this project is being built upon the following starter project on Glitch, or cloned from GitHub.", - "Hackers can exploit known vulnerabilities in Express/Node if they see that your site is powered by Express. X-Powered-By: Express is sent in every request coming from Express by default. The helmet.hidePoweredBy() middleware will remove the X-Powered-By header. You can also explicitly set the header to something else, to throw people off. e.g. app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))" + "温馨提醒，这个项目是建立在下面这个模版之上的 Glitch模版地址, 你也可以从 GitHub 上克隆。", + "黑客们可能会利用 Express/Node 的安全问题对你的网站做破坏如果他们知道你的网站是用 Express 搭建的. X-Powered-By: Express 默认情况下会被添加到所有响应的头部。不过 helmet.hidePoweredBy() 中间件可以帮你移除 X-Powered-By 头. 你甚至可以把头设置成其它的值。 如 app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))" ], "tests": [ { - "text": "helmet.hidePoweredBy() middleware should be mounted correctly", + "text": "helmet.hidePoweredBy() 中间件应该被正确加载", "testString": "getUserInput => $.get(getUserInput('url') + '/_api/app-info').then(data => { assert.include(data.appStack, 'hidePoweredBy'); assert.notEqual(data.headers['x-powered-by'], 'Express')}, xhr => { throw new Error(xhr.responseText); })" } ], From debea0af6c3509d19a7afd6377902d2b520f9c81 Mon Sep 17 00:00:00 2001 From: Stanley Lau Date: Sun, 22 Jul 2018 13:21:10 +0800 Subject: [PATCH 2/7] Finish 10% --- .idea/challenges.iml | 12 ++ .idea/misc.xml | 6 + .idea/modules.xml | 8 + .idea/vcs.xml | 6 + .idea/workspace.xml | 161 ++++++++++++++++++ .../helmetjs.json | 36 ++-- 6 files changed, 211 insertions(+), 18 deletions(-) create mode 100644 .idea/challenges.iml create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/vcs.xml create mode 100644 .idea/workspace.xml diff --git a/.idea/challenges.iml b/.idea/challenges.iml new file mode 100644 index 0000000..24643cc --- /dev/null +++ b/.idea/challenges.iml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..28a804d --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..9fb8e8b --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml new file mode 100644 index 0000000..a3a63cc --- /dev/null +++ b/.idea/workspace.xml @@ -0,0 +1,161 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + DEFINITION_ORDER + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - 1532235100665 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file From ea30c251a68cc40838bbe8956d6f6396f5546cb3 Mon Sep 17 00:00:00 2001 From: Stanley Lau Date: Wed, 25 Jul 2018 12:31:58 +0800 Subject: [PATCH 4/7] Update according to comments --- .../information-security-with-helmetjs.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/06-information-security-and-quality-assurance/information-security-with-helmetjs.json b/06-information-security-and-quality-assurance/information-security-with-helmetjs.json index 2868edd..6eda557 100644 --- a/06-information-security-and-quality-assurance/information-security-with-helmetjs.json +++ b/06-information-security-and-quality-assurance/information-security-with-helmetjs.json @@ -27,7 +27,7 @@ "title": "Hide Potentially Dangerous Information Using helmet.hidePoweredBy()", "description": [ "温馨提醒，本项目在 这个 Glitch 项目 的基础上进行开发。你也可以从 GitHub 上克隆。", - "如果黑客发现你的网站是用 Express 搭建的，那么他们就可以利用 Express 或 Node 现存的漏洞来攻击你的网站。X-Powered-By: Express 默认情况下会被添加到所有响应的头部。不过 helmet.hidePoweredBy() 中间件可以帮你移除 X-Powered-By 头. 你甚至可以把头设置成其它的值。 如 app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))" + "如果黑客发现你的网站是用 Express 搭建的，那么他们就可以利用 Express 或 Node 现存的漏洞来攻击你的网站。X-Powered-By: Express 默认情况下会被添加到所有响应的头部。不过 helmet.hidePoweredBy() 中间件可以帮你移除 X-Powered-By 头。你甚至可以把头设置成其它的值。 如 app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))" ], "tests": [ { @@ -45,8 +45,8 @@ "title": "Mitigate the Risk of Clickjacking with helmet.frameguard()", "description": [ "温馨提醒，本项目在 这个 Glitch 项目 的基础上进行开发。你也可以从 GitHub 上克隆。", - "你的页面有可能会在未经你允许的情况下被放在 或者