test(e2e): restore e2e sectester tests functionality

NeuraLegion · Aug 27, 2024 · b04f259 · b04f259
1 parent e24f294
commit b04f259
Show file tree

Hide file tree

Showing 11 changed files with 3,957 additions and 3,193 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -38,12 +38,11 @@
     "@nestjs/mercurius": "^11.0.3",
     "@nestjs/platform-fastify": "^9.3.9",
     "@nestjs/swagger": "^6.2.1",
-    "@sectester/bus": "^0.16.5",
-    "@sectester/core": "^0.16.5",
-    "@sectester/repeater": "^0.16.5",
-    "@sectester/reporter": "^0.16.5",
-    "@sectester/runner": "^0.16.5",
-    "@sectester/scan": "^0.16.5",
+    "@sectester/core": "^0.29.1",
+    "@sectester/repeater": "^0.29.1",
+    "@sectester/reporter": "^0.29.1",
+    "@sectester/runner": "^0.29.1",
+    "@sectester/scan": "^0.29.1",
     "axios": "^0.21.4",
     "bcrypt": "^5.1.0",
     "class-transformer": "^0.5.1",
@@ -72,9 +71,9 @@
   },
   "devDependencies": {
     "@mikro-orm/cli": "^4.5.10",
-    "@nestjs/cli": "^7.5.3",
+    "@nestjs/cli": "^9.5.0",
     "@nestjs/schematics": "^7.1.3",
-    "@nestjs/testing": "^7.6.18",
+    "@nestjs/testing": "^9.4.3",
     "@types/axios": "^0.14.0",
     "@types/dot": "^1.1.5",
     "@types/estree": "^1.0.0",
@@ -92,11 +91,11 @@
     "eslint": "^7.32.0",
     "eslint-config-prettier": "^6.15.0",
     "eslint-plugin-prettier": "^3.4.1",
-    "jest": "^26.6.3",
+    "jest": "^29.7.0",
     "nodemon": "^2.0.21",
     "prettier": "^2.8.4",
     "supertest": "^6.3.3",
-    "ts-jest": "^26.5.6",
+    "ts-jest": "^29.2.5",
     "ts-loader": "^8.4.0",
     "ts-node": "^9.1.0",
     "tsconfig-paths": "^3.14.2",

diff --git a/test/auth.e2e-spec.ts b/test/auth.e2e-spec.ts
@@ -1,4 +1,4 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 import axios from 'axios';
 
@@ -15,8 +15,10 @@ const generateToken = async (jwtType) => {
 };
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -31,7 +33,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },
@@ -44,7 +46,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },
@@ -57,7 +59,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },
@@ -70,7 +72,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },
@@ -83,7 +85,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },
@@ -96,7 +98,7 @@ describe('/api', () => {
       const token = await generateToken(jwtType);
       await runner
         .createScan({ tests: [TestType.JWT], name: `JWT ${jwtType}` })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: { authorization: token },

diff --git a/test/config.e2e-spec.ts b/test/config.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -19,7 +21,7 @@ describe('/api', () => {
           tests: [TestType.COOKIE_SECURITY],
           name: 'COOKIE_SECURITY',
         })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           url: `${process.env.SEC_TESTER_TARGET}/api/config`,
@@ -32,7 +34,7 @@ describe('/api', () => {
           tests: [TestType.HEADER_SECURITY],
           name: 'HEADER_SECURITY',
         })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           url: `${process.env.SEC_TESTER_TARGET}/api/config?query=no-sec-headers`,
@@ -45,7 +47,7 @@ describe('/api', () => {
           tests: [TestType.FULL_PATH_DISCLOSURE],
           name: 'FULL_PATH_DISCLOSURE',
         })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           headers: {

diff --git a/test/global-setup.ts b/test/global-setup.ts
@@ -0,0 +1,5 @@
+import { config } from 'dotenv';
+
+export default function globalSetup() {
+  config();
+}
diff --git a/test/jest-e2e.json b/test/jest-e2e.json
@@ -5,5 +5,6 @@
   "testRegex": ".e2e-spec.ts$",
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"
-  }
+  },
+  "globalSetup": "<rootDir>/global-setup.ts"
 }
diff --git a/test/metadata.e2e-spec.ts b/test/metadata.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -16,7 +18,7 @@ describe('/api', () => {
     it('should not contains forms liable vulnerable cross-site filling and submitting', async () => {
       await runner
         .createScan({ tests: [TestType.CSRF], name: 'CSRF' })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'POST',
           url: `${process.env.SEC_TESTER_TARGET}/api/metadata`,

diff --git a/test/render.e2e-spec.ts b/test/render.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -16,7 +18,7 @@ describe('/api', () => {
     it('should not contain possibility to server-side code execution', async () => {
       await runner
         .createScan({ tests: [TestType.SSTI], name: 'SSTI' })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'POST',
           headers: {

diff --git a/test/root.e2e-spec.ts b/test/root.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -29,7 +31,7 @@ describe('/', () => {
           tests: [TestType.INSECURE_TLS_CONFIGURATION],
           name: 'INSECURE_TLS_CONFIGURATION',
         })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           url: `${process.env.SEC_TESTER_TARGET}`,

diff --git a/test/spawn.e2e-spec.ts b/test/spawn.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -16,7 +18,7 @@ describe('/api', () => {
     it('should not be able to execute shell commands on the host operating system', async () => {
       await runner
         .createScan({ tests: [TestType.OSI], name: 'OS Command Injection' })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           url: `${process.env.SEC_TESTER_TARGET}/api/spawn?command=pwd`,

diff --git a/test/testimonials.e2e-spec.ts b/test/testimonials.e2e-spec.ts
@@ -1,9 +1,11 @@
-import { SecRunner, SecScan } from '@sectester/runner';
+import { SecRunner } from '@sectester/runner';
 import { TestType } from '@sectester/scan';
 
 describe('/api', () => {
+  const timeout = 600000;
+  jest.setTimeout(timeout);
+
   let runner: SecRunner;
-  let scan: SecScan;
 
   beforeEach(async () => {
     runner = new SecRunner({ hostname: process.env.BRIGHT_CLUSTER });
@@ -16,7 +18,7 @@ describe('/api', () => {
     it('should not execute commands for SQL database', async () => {
       await runner
         .createScan({ tests: [TestType.SQLI], name: 'SQLI' })
-        .timeout(3000000)
+        .timeout(timeout)
         .run({
           method: 'GET',
           url: `${process.env.SEC_TESTER_TARGET}/api/testimonials/count?query=lorem`,