firewall-node/sample-apps/hapi-postgres/app.js at c400d2702f593d6a0e93b1d2faf5047e6c2b8755 · AikidoSec/firewall-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
const Zen = require("@aikidosec/firewall");

const Cats = require("./Cats");
const Hapi = require("@hapi/hapi");
const { Client } = require("pg");

require("@aikidosec/firewall/nopp");

function getHTMLBody(cats) {
  return `
<html lang="en">
  <body>
    <p>All cats : ${cats.join(", ")}</p>
    <form action="/" method="GET">
      <label for="search">Add a new cat</label>
      <input type="text" name="petname">
      <input type="submit" value="Add" />
    </form>
    <a href="http://localhost:4000/?petname=Kitty'); DELETE FROM cats;-- H">Test injection</a> / <a href="http://localhost:4000/clear">Clear table</a>
  </body>
</html>`;
}

async function createConnection() {
  const client = new Client({
    user: "root",
    host: "127.0.0.1",
    database: "main_db",
    password: "password",
    port: 27016,
  });

  await client.connect();
  await client.query(`
    CREATE TABLE IF NOT EXISTS cats (
        petname varchar(255)
    );
  `);

  return client;
}

async function init(port) {
  const db = await createConnection();
  const cats = new Cats(db);

  const server = new Hapi.Server({
    port: port,
    host: "127.0.0.1",
  });

  Zen.addHapiMiddleware(server);

  server.route({
    method: "GET",
    path: "/",
    handler: async (request, h) => {
      try {
        if (request.query.petname) {
          await cats.add(request.query.petname);
        }
      } catch (e) {
        return h.response(e.message).code(500);
      }

      return getHTMLBody(await cats.getAll());
    },
  });

  server.route([
    {
      method: "GET",
      path: "/clear",
      handler: async (request, h) => {
        await db.query("DELETE FROM cats;");
        return h.redirect("/");
      },
    },
  ]);

  await server.start();
  console.log(`Server running on http://127.0.0.1:${port}`);
}

function getPort() {
  const port = parseInt(process.argv[2], 10) || 4000;

  if (isNaN(port)) {
    console.error("Invalid port");
    process.exit(1);
  }

  return port;
}

init(getPort());