test: add API security tests using Bright

.github/workflows/bright.yml

@@ -0,0 +1,32 @@
+name: Run SecTester Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    env:
+      BRIGHT_HOSTNAME: app.brightsec.com
+      BRIGHT_TOKEN: ${{ secrets.BRIGHT_TOKEN }}
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v2
+      with:
+        node-version: '16'
+
+    - name: Install dependencies
+      run: npm ci
+
+    - name: Run SecTester tests
+      run: npm test -- test/routes

test/routes/articles-feed.test.js

@@ -0,0 +1,47 @@
+'use strict'
+const t = require('tap')
+const { Configuration, SecRunner } = require('@sectester/runner');
+const { TestType, Severity } = require('@sectester/scan');
+const startServer = require('../setup-server')
+
+const configuration = new Configuration({ hostname: 'app.brightsec.com' });
+
+async function runSecurityTests() {
+  const runner = new SecRunner(configuration);
+  await runner.init();
+
+  const scan = runner.createScan({
+    tests: [TestType.SQLI, TestType.XSS],
+    threshold: Severity.MEDIUM,
+    timeout: 300000, // 5 minutes
+  });
+
+  const target = {
+    method: 'GET',
+    url: 'https://localhost:3000/articles/feed',
+    headers: { 'Authorization': 'Token jwt.token.here' },
+    query: { limit: 10, offset: 0 }
+  };
+
+  await scan.run(target);
+  await runner.clear();
+}
+
+runSecurityTests().catch(console.error);
+
+// Regular functional test
+
+ t.test('requests the "/articles/feed" route', async t => {
+  const server = await startServer()
+  t.teardown(() => server.close())
+
+  const response = await server.inject({
+    method: 'GET',
+    url: '/articles/feed',
+    headers: { 'Authorization': 'Token jwt.token.here' },
+    query: { limit: 10, offset: 0 }
+  })
+
+  t.equal(response.statusCode, 200, 'returns a status code of 200')
+  t.end()
+})

test/routes/articles.test.js

@@ -0,0 +1,127 @@
+'use strict'
+const t = require('tap')
+const startServer = require('../setup-server')
+const { Configuration, SecRunner } = require('@sectester/runner');
+const { TestType, Severity } = require('@sectester/scan');
+
+const configuration = new Configuration({ hostname: 'app.brightsec.com' });
+
+const scanSettings = {
+  tests: [TestType.SQLI, TestType.XSS, TestType.BROKEN_ACCESS_CONTROL],
+  threshold: Severity.MEDIUM,
+  timeout: 300000, // 5 minutes
+};
+
+async function runSecurityTests(target) {
+  const runner = new SecRunner(configuration);
+  await runner.init();
+  const scan = runner.createScan(scanSettings);
+  await scan.run(target);
+  await runner.clear();
+}
+
+// Test for creating an article
+async function testCreateArticle(t) {
+  const server = await startServer();
+  t.teardown(() => server.close());
+
+  const target = {
+    method: 'POST',
+    url: 'https://localhost:8000/articles',
+    headers: { 'Authorization': 'Token jwt.token.here' },
+    body: { article: { title: 'string', description: 'string', body: 'string', tagList: ['string'] } }
+  };
+
+  await runSecurityTests(target);
+
+  const response = await server.inject({
+    method: 'POST',
+    url: '/api/articles',
+    headers: { 'Authorization': 'Token jwt.token.here' },
+    payload: {
+      article: {
+        title: 'string',
+        description: 'string',
+        body: 'string',
+        tagList: ['string']
+      }
+    }
+  });
+  t.equal(response.statusCode, 201, 'returns a status code of 201 Created');
+  t.end();
+}
+
+// Test for updating an article
+async function testUpdateArticle(t) {
+  const server = await startServer();
+  t.teardown(() => server.close());
+
+  const target = {
+    method: 'PUT',
+    url: 'http://localhost:3000/api/articles/test-article',
+    headers: { 'Authorization': 'Token jwt.token.here' },
+    body: {
+      article: {
+        title: 'string',
+        description: 'string',
+        body: 'string'
+      }
+    }
+  };
+
+  await runSecurityTests(target);
+
+  const response = await server.inject(target);
+  t.equal(response.statusCode, 200, 'returns a status code of 200 OK');
+  t.end();
+}
+
+// Test for deleting an article with invalid token
+async function testDeleteArticleInvalidToken(t) {
+  const server = await startServer();
+  t.teardown(() => server.close());
+
+  const target = {
+    method: 'DELETE',
+    url: 'https://localhost:3000/articles/{slug}',
+    headers: { Authorization: 'Token jwt.token.here' }
+  };
+
+  await runSecurityTests(target);
+
+  const response = await server.inject({
+    method: 'DELETE',
+    url: '/api/articles/test-article',
+    headers: { Authorization: 'Token invalid.token.here' }
+  });
+  t.equal(response.statusCode, 401, 'returns a status code of 401 Unauthorized');
+  t.end();
+}
+
+// Test for deleting article favorite without authorization
+async function testDeleteArticleFavorite(t) {
+  const server = await startServer();
+  t.teardown(() => server.close());
+
+  const target = {
+    method: 'DELETE',
+    url: 'http://localhost:3000/articles/{slug}/favorite',
+    headers: { Authorization: 'Token jwt.token.here' }
+  };
+
+  await runSecurityTests(target);
+
+  const response = await server.inject({
+    method: 'DELETE',
+    url: '/articles/{slug}/favorite',
+    headers: { Authorization: 'Token jwt.token.here' }
+  });
+  t.equal(response.statusCode, 401, 'returns a status code of 401 Unauthorized');
+  t.end();
+}
+
+// Run all tests
+t.test('create article with SQLi and XSS tests', testCreateArticle);
+t.test('update article with potential vulnerabilities', testUpdateArticle);
+t.test('delete article with invalid token', testDeleteArticleInvalidToken);
+t.test('delete article favorite without authorization', testDeleteArticleFavorite);

test/routes/comments-delete.test.js

@@ -0,0 +1,31 @@
+'use strict'
+const t = require('tap')
+const startServer = require('../setup-server')
+const { SecRunner, TestType, Severity } = require('@sectester/runner')
+
+const configuration = { hostname: 'app.brightsec.com' }
+
+// Test for DELETE /articles/example-article/comments/1
+
+t.test('DELETE /articles/example-article/comments/1 should not have broken access control', async t => {
+  const server = await startServer()
+  t.teardown(() => server.close())
+
+  const runner = new SecRunner(configuration)
+  await runner.init()
+
+  const scan = runner.createScan({
+    tests: [TestType.BROKEN_ACCESS_CONTROL],
+    threshold: Severity.MEDIUM,
+    timeout: 300000 // 5 minutes
+  })
+
+  await scan.run({
+    method: 'DELETE',
+    url: 'https://localhost:8000/articles/example-article/comments/1',
+    headers: { Authorization: 'Bearer <token>' }
+  })
+
+  await runner.clear()
+  t.end()
+})

test/routes/comments.test.js

@@ -0,0 +1,58 @@
+'use strict'
+const t = require('tap');
+const { Configuration, SecRunner } = require('@sectester/runner');
+const { TestType, Severity } = require('@sectester/scan');
+const startServer = require('../setup-server');
+
+const configuration = new Configuration({ hostname: 'app.brightsec.com' });
+
+async function runSecurityTests() {
+  const runner = new SecRunner(configuration);
+  await runner.init();
+
+  const scan = runner.createScan({
+    tests: [TestType.XSS, TestType.SQLI],
+    threshold: Severity.MEDIUM,
+    timeout: 300000, // 5 minutes
+  });
+
+  const server = await startServer();
+
+  // Test case 1: GET request
+  await scan.run({
+    method: 'GET',
+    url: 'http://localhost:3000/articles/example-article/comments'
+  });
+
+  // Test case 2: POST request
+  await scan.run({
+    method: 'POST',
+    url: 'https://localhost:8000/articles/example-article/comments',
+    headers: { 'Authorization': 'Bearer <token>' },
+    body: { comment: { body: 'This is a comment.' } }
+  });
+
+  await runner.clear();
+  server.close();
+}
+
+runSecurityTests().catch(err => {
+  console.error(err);
+  process.exit(1);
+});
+
+// TAP test for POST request
+t.test('post comment with security tests', async t => {
+  const server = await startServer();
+  t.teardown(() => server.close());
+
+  const response = await server.inject({
+    method: 'POST',
+    url: '/articles/example-article/comments',
+    headers: { 'Authorization': 'Bearer <token>' },
+    payload: { comment: { body: 'This is a comment.' } }
+  });
+
+  t.equal(response.statusCode, 200, 'returns a status code of 200 OK');
+  t.end();
+});