-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
52dac04
commit 4006d55
Showing
30 changed files
with
1,511 additions
and
44 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1 @@ | ||
| export * from "./authentication.js"; | ||
| export * from "./authorization.js"; | ||
| export * from "./excessive-use.js"; | ||
| export * from "./file-upload.js"; | ||
| export * from "./vocab/index.js"; |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| export * from "./authentication.js"; | ||
| export * from "./authorization.js"; | ||
| export * from "./excessive-use.js"; | ||
| export * from "./file-upload.js"; | ||
| export * from "./input-validation.js"; | ||
| export * from "./malicious-behavior.js"; | ||
| export * from "./privilege-changes.js"; | ||
| export * from "./sensitive-data-changes.js"; | ||
| export * from "./sequence-errors.js"; | ||
| export * from "./session-management.js"; | ||
| export * from "./system-events.js"; | ||
| export * from "./user-management.js"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| import { describe, expect, it } from "bun:test"; | ||
| import { input_validation_fail } from "./input-validation"; | ||
|
|
||
| describe("input_validation_fail", () => { | ||
| it("should return the correct string", () => { | ||
| const result = input_validation_fail("field1", "user123"); | ||
| expect(result).toBe("input_validation_fail:field1,user123"); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /** | ||
| * When input validation fails on the server-side it must either be because | ||
| * a) sufficient validation was not provided on the client, or | ||
| * b) client-side validation was bypassed. | ||
| * In either case it's an opportunity for attack and should be mitigated quickly. | ||
| * | ||
| * **Level:** `WARN` | ||
| * | ||
| * @example | ||
| * ```ts | ||
| * const field = 'date_of_birth'; | ||
| * const userId = "joebob1"; | ||
| * logger.warn({ event: input_validation_fail(field, userId) }, `User ${userId} submitted data that failed validation.`); | ||
| * ``` | ||
| * @example | ||
| * ```json | ||
| * { | ||
| * "datetime": "2019-01-01 00:00:00,000", | ||
| * "appid": "foobar.netportal_auth", | ||
| * "event": "input_validation_fail:date_of_birth,joebob1", | ||
| * "level": "WARN", | ||
| * "description": "User joebob1 submitted data that failed validation.", | ||
| * "requestId": "e22569d2-5fb6-4453-ae7e-c496a2584d94" | ||
| * } | ||
| * ``` | ||
| * @see [OWASP Logging Vocabulary Cheat Sheet - input_validation_fail](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html#input-validation-input) | ||
| */ | ||
| export function input_validation_fail< | ||
| F extends string, | ||
| U extends string | number | bigint, | ||
| >(field: F, userId: U) { | ||
| return `input_validation_fail:${field},${userId}` as const; | ||
| } |
Oops, something went wrong.