-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add csurf middleware to mitigate vulnerability fix #140
- Loading branch information
1 parent
6eb4e2d
commit ef71ec4
Showing
5 changed files
with
111 additions
and
7 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -55,7 +55,4 @@ class AppFactory { | |
} | ||
} | ||
|
||
module.exports = { | ||
AppFactory: AppFactory, | ||
app: app | ||
} | ||
module.exports = AppFactory |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
const chai = require('chai') | ||
const assert = chai.assert | ||
const rewire = require('rewire') | ||
const appFactoryRewire = rewire('../server/app-factory.js') | ||
const sinon = require('sinon') | ||
|
||
/** | ||
* Helper: Returns the argument call number with matching args | ||
* If none found, returns undefined | ||
* @param {*} spyFn sinon.Spy function | ||
* @param {*} argFn callback / function param | ||
*/ | ||
function getCallWithArgs (spyFn, argFn) { | ||
const calls = spyFn.getCalls() | ||
const argFnString = argFn.toString() | ||
let foundCall | ||
for (const call in calls) { | ||
const arg = spyFn.getCall(call).args[0] | ||
if (arg.toString() === argFnString) { | ||
foundCall = spyFn.getCall(call) | ||
} | ||
} | ||
return foundCall | ||
} | ||
|
||
describe('csurf middleware', () => { | ||
const rewiredCsurf = appFactoryRewire.__get__('csurf') | ||
|
||
it('should exist', () => { | ||
assert.exists(rewiredCsurf) | ||
}) | ||
|
||
it('should be a function', () => { | ||
assert.isFunction(rewiredCsurf) | ||
}) | ||
|
||
it('should be equal csurf module', () => { | ||
assert.strictEqual(rewiredCsurf, require('csurf')) | ||
}) | ||
|
||
it('should be called once as app.use arg', () => { | ||
const csurf = require('csurf') | ||
const app = appFactoryRewire.__get__('app') | ||
const AppFactory = appFactoryRewire.__get__('AppFactory') | ||
const appUseSpy = sinon.spy(app, 'use') | ||
const appInstance = new AppFactory() | ||
|
||
appInstance.createApp() | ||
|
||
const call = getCallWithArgs(appUseSpy, csurf({ cookie: true })) | ||
const arg = call.args[0] | ||
assert(arg.toString === csurf({ cookie: true }).toString) | ||
|
||
sinon.restore() | ||
}) | ||
}) |