wip

.github/workflows/semgrep.yml

@@ -1,26 +1,27 @@
+# Name of this GitHub Actions workflow.
+name: Semgrep CE scan
+
 on:
-  workflow_dispatch: {}
+  # Scan in PRs:
   pull_request: {}
+  # Scan on-demand through GitHub Actions interface:
+  workflow_dispatch: {}
+  # Scan mainline branches and report all findings:
   push:
-    branches:
-    - main
-    - master
-    paths:
-    - .github/workflows/semgrep.yml
-  schedule:
-  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
-  - cron: 42 3 * * *
-name: Semgrep
+    branches: ["master", "!main"]
+
+permissions:
+  contents: read
+
 jobs:
   semgrep:
-    name: semgrep/ci
+    name: semgrep-oss/scan
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    env:
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
+      # A Docker image with Semgrep installed. Do not change this.
       image: semgrep/semgrep
+    if: (github.actor != 'dependabot[bot]')
     steps:
-    - uses: actions/checkout@v4
-    - run: semgrep ci
+      - uses: actions/checkout@v4
+      - name: Run Semgrep
+        run: semgrep scan --config auto --error

src/app/d1.js

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2014-2022 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import challengeUtils = require('../lib/challengeUtils')
+import { Request, Response, NextFunction } from 'express'
+import { Review } from '../data/types'
+
+const challenges = require('../data/datacache').challenges
+const db = require('../data/mongodb')
+const security = require('../lib/insecurity')
+
+module.exports = function productReviews () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const id = req.body.id
+    const user = security.authenticatedUsers.from(req)
+    db.reviews.findOne({ _id: id }).then((review: Review) => {
+      if (!review) {
+        res.status(404).json({ error: 'Not found' })
+      } else {
+        const likedBy = review.likedBy
+        if (!likedBy.includes(user.data.email)) {
+          db.reviews.update(
+            { _id: id },
+            { $inc: { likesCount: 1 } }
+          ).then(
+            () => {
+              // Artificial wait for timing attack challenge
+              setTimeout(function () {
+                db.reviews.findOne({ _id: id }).then((review: Review) => {
+                  const likedBy = review.likedBy
+                  likedBy.push(user.data.email)
+                  let count = 0
+                  for (let i = 0; i < likedBy.length; i++) {
+                    if (likedBy[i] === user.data.email) {
+                      count++
+                    }
+                  }
+                  challengeUtils.solveIf(challenges.timingAttackChallenge, () => { return count > 2 })
+                  db.reviews.update(
+                    { _id: id },
+                    { $set: { likedBy: likedBy } }
+                  ).then(
+                    (result: any) => {
+                      res.json(result)
+                    }, (err: unknown) => {
+                      res.status(500).json(err)
+                    })
+                }, () => {
+                  res.status(400).json({ error: 'Wrong Params' })
+                })
+              }, 150)
+            }, (err: unknown) => {
+              res.status(500).json(err)
+            })
+        } else {
+          res.status(403).json({ error: 'Not allowed' })
+        }
+      }
+    }, () => {
+      res.status(400).json({ error: 'Wrong Params' })
+    })
+  }
+}