@arcadialdev/arcality 2.4.25 → 2.4.26

package/tests/_helpers/qa-security-tools.ts

@@ -1,265 +1,265 @@
-/* eslint-disable no-console */
-import { Page, expect } from '@playwright/test';
-
-export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
-
-export type SecurityFindingType = 'confirmed_vulnerability' | 'security_misconfiguration' | 'potential_issue' | 'informational';
-export type Confidence = 'High' | 'Medium' | 'Low';
-export type Exploitability = 'confirmed' | 'likely' | 'unknown' | 'not_confirmed';
-
-export interface SecurityFinding {
-  type: SecurityFindingType;
-  category: string;
-  subcategory?: string;
-  severity: Severity;
-  confidence: Confidence;
-  exploitability: Exploitability;
-  status: 'detected';
-  description: string;
-  impact?: string;
-  evidence: {
-    [key: string]: any;
-  };
-  reproductionSteps?: string[];
-  remediation: string;
-  classification?: {
-    owaspTop10?: string;
-    cwe?: string;
-  };
-}
-
-/**
- * Attempts to inject a simple XSS payload into a specified element and checks for an alert.
- * @param page - The Playwright Page object.
- * @param selector - The selector for the input field to test.
- * @returns A vulnerability object if successful, null otherwise.
- */
-export async function test_xss_injection(
-  page: Page,
-  selector: string,
-): Promise<SecurityFinding | null> {
-  const payload = `<script>alert('XSS-ARCALITY-TEST')</script>`;
-  console.log(`[QA-SEC] Testing XSS on selector: ${selector}`);
-
-  let alertTriggered = false;
-  page.once('dialog', async (dialog) => {
-    if (dialog.message().includes('XSS-ARCALITY-TEST')) {
-      alertTriggered = true;
-    }
-    await dialog.dismiss();
-  });
-
-  await page.fill(selector, payload);
-  // Submit the form or trigger the action that would process the input
-  // This part is crucial and might need to be adapted based on the application's behavior
-  await page.press(selector, 'Enter'); 
-
-  // Wait a moment for any potential script execution
-  await page.waitForTimeout(1000);
-
-  if (alertTriggered) {
-    console.log(`[QA-SEC] XSS Vulnerability DETECTED at ${selector}`);
-    return {
-      type: 'confirmed_vulnerability',
-      category: 'Injection',
-      subcategory: 'Reflected XSS',
-      severity: 'High',
-      confidence: 'High',
-      exploitability: 'confirmed',
-      status: 'detected',
-      description: `A reflected Cross-Site Scripting (XSS) vulnerability was detected in the element '${selector}'. The application executed a script injected into this input field.`,
-      impact: 'Allows execution of arbitrary JavaScript in the context of the user session, potentially leading to session hijacking, credential theft, or unauthorized actions.',
-      evidence: {
-        payload,
-        url: page.url(),
-        selector,
-      },
-      reproductionSteps: [
-        `Navigate to the page containing '${selector}'.`,
-        `Inject the payload: ${payload}`,
-        'Trigger the form submission or blur event.',
-        'Observe the script execution (alert dialog).'
-      ],
-      remediation: 'Sanitize all user-supplied input on the server-side before rendering it back to the page. Use libraries like DOMPurify on the client-side as an additional layer of defense.',
-      classification: {
-        owaspTop10: 'A03:2021 Injection',
-        cwe: 'CWE-79'
-      }
-    };
-  }
-
-  console.log(`[QA-SEC] No XSS detected for selector: ${selector}`);
-  return null;
-}
-
-/**
- * Checks if a given URL, assumed to be protected, can be accessed without authentication.
- * @param page - The Playwright Page object.
- * @param url - The protected URL to test.
- * @param redirectUrl - The URL the app should redirect to if unauthorized.
- * @returns A vulnerability object if bypass is successful, null otherwise.
- */
-export async function test_auth_bypass(
-  page: Page,
-  url: string,
-  redirectUrl: string | RegExp,
-): Promise<SecurityFinding | null> {
-  console.log(`[QA-SEC] Testing Auth Bypass on URL: ${url}`);
-  const response = await page.goto(url, { waitUntil: 'domcontentloaded' });
-
-  // If the page loads the protected content (doesn't redirect or redirects to a different page)
-  if (response?.ok() && !page.url().match(redirectUrl)) {
-    console.log(`[QA-SEC] Auth Bypass DETECTED for URL: ${url}`);
-    return {
-      type: 'confirmed_vulnerability',
-      category: 'Broken Access Control',
-      subcategory: 'Authentication Bypass',
-      severity: 'Critical',
-      confidence: 'High',
-      exploitability: 'confirmed',
-      status: 'detected',
-      description: `Unauthorized access to the protected route '${url}' was successful. The application failed to enforce authentication, allowing a direct bypass to sensitive content.`,
-      impact: 'An unauthenticated attacker can access protected resources, potentially reading or modifying sensitive user data.',
-      evidence: {
-        accessedUrl: url,
-        finalUrl: page.url(),
-      },
-      reproductionSteps: [
-        'Ensure no active session (cleared cookies/storage).',
-        `Navigate directly to: ${url}`,
-        'Observe that the protected page loads without redirection.'
-      ],
-      remediation: 'Implement server-side middleware to verify user authentication and authorization status before serving any protected routes.',
-      classification: {
-        owaspTop10: 'A01:2021 Broken Access Control',
-        cwe: 'CWE-285'
-      }
-    };
-  }
-
-  console.log(`[QA-SEC] No Auth Bypass detected for URL: ${url}`);
-  return null;
-}
-
-/**
- * Audits the HTTP security headers of the current page.
- * @param page - The Playwright Page object.
- * @returns An array of vulnerability objects for missing headers.
- */
-export async function audit_http_headers(page: Page): Promise<SecurityFinding[]> {
-  console.log(`[QA-SEC] Auditing HTTP Headers for: ${page.url()}`);
-  const response = await page.reload({ waitUntil: 'domcontentloaded' });
-  const headers = response?.headers();
-  const vulnerabilities: SecurityFinding[] = [];
-
-  const securityHeaders = {
-    'Content-Security-Policy': {
-      severity: 'Medium',
-      remediation: 'Implement a strict Content-Security-Policy (CSP) to mitigate XSS and other injection attacks. Start with a restrictive policy and gradually allow trusted sources.',
-      impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
-      cwe: 'CWE-16'
-    },
-    'Strict-Transport-Security': {
-      severity: 'Medium',
-      remediation: 'Implement HTTP Strict Transport Security (HSTS) to force browsers to communicate over HTTPS, preventing downgrade attacks.',
-      impact: 'Man-in-the-middle attacks could downgrade the connection to HTTP, allowing traffic interception.',
-      cwe: 'CWE-319'
-    },
-    'X-Content-Type-Options': {
-      severity: 'Low',
-      remediation: 'Set `X-Content-Type-Options: nosniff` to prevent browsers from MIME-sniffing a response away from the declared content-type.',
-      impact: 'Browsers may interpret non-executable MIME types as executable, leading to potential XSS.',
-      cwe: 'CWE-430'
-    },
-    'X-Frame-Options': {
-      severity: 'Medium',
-      remediation: 'Set `X-Frame-Options: SAMEORIGIN` or `DENY` to protect against clickjacking attacks by preventing the page from being loaded in an iframe on other domains.',
-      impact: 'Attackers could trick users into clicking visually hidden elements, causing unintended actions (Clickjacking).',
-      cwe: 'CWE-1021'
-    }
-  };
-
-  for (const [header, info] of Object.entries(securityHeaders)) {
-    if (!headers || !Object.keys(headers).find(h => h.toLowerCase() === header.toLowerCase())) {
-        vulnerabilities.push({
-            type: 'security_misconfiguration',
-            category: 'Missing Security Header',
-            subcategory: header,
-            severity: info.severity as Severity,
-            confidence: 'High',
-            exploitability: 'not_confirmed',
-            status: 'detected',
-            description: `The '${header}' HTTP header is missing. This header is crucial for defending against various web attacks.`,
-            impact: info.impact,
-            evidence: {
-                url: page.url(),
-                missingHeader: header
-            },
-            reproductionSteps: [
-                `Navigate to ${page.url()}`,
-                `Inspect the response headers.`,
-                `Verify that ${header} is absent.`
-            ],
-            remediation: info.remediation,
-            classification: {
-                owaspTop10: 'A05:2021 Security Misconfiguration',
-                cwe: info.cwe
-            }
-        });
-    }
-  }
-  
-  console.log(`[QA-SEC] Found ${vulnerabilities.length} missing security headers.`);
-  return vulnerabilities;
-}
-
-/**
- * Scans localStorage and sessionStorage for potentially sensitive data.
- * @param page - The Playwright Page object.
- * @returns An array of vulnerability objects for any sensitive data found.
- */
-export async function scan_sensitive_data_exposure(page: Page): Promise<SecurityFinding[]> {
-  console.log(`[QA-SEC] Scanning localStorage and sessionStorage for sensitive data.`);
-  const vulnerabilities: SecurityFinding[] = [];
-  const sensitiveKeywords = ['token', 'password', 'secret', 'key', 'jwt', 'auth'];
-
-  const storages = {
-    localStorage: await page.evaluate(() => Object.entries(window.localStorage)),
-    sessionStorage: await page.evaluate(() => Object.entries(window.sessionStorage)),
-  };
-
-  for (const [storageType, items] of Object.entries(storages)) {
-    for (const [key, value] of items) {
-      if (sensitiveKeywords.some(keyword => key.toLowerCase().includes(keyword))) {
-        vulnerabilities.push({
-          type: 'potential_issue',
-          category: 'Sensitive Data Exposure',
-          subcategory: 'Browser Storage',
-          severity: 'Medium',
-          confidence: 'Medium',
-          exploitability: 'unknown',
-          status: 'detected',
-          description: `Potentially sensitive data was found in ${storageType}. Storing sensitive information like tokens or keys in browser storage is insecure.`,
-          impact: 'If an attacker discovers an XSS vulnerability, they can read localStorage/sessionStorage and exfiltrate secrets.',
-          evidence: {
-            storage: storageType,
-            key: key,
-            valuePreview: value ? `${value.substring(0, 10)}...` : '(empty)',
-          },
-          reproductionSteps: [
-            `Open Developer Tools on ${page.url()}`,
-            `Check ${storageType} for the key '${key}'.`
-          ],
-          remediation: 'Avoid storing sensitive data in browser storage. Use secure, HttpOnly cookies for session tokens. If you must store data, encrypt it first.',
-          classification: {
-            owaspTop10: 'A04:2021 Insecure Design',
-            cwe: 'CWE-312'
-          }
-        });
-      }
-    }
-  }
-
-  console.log(`[QA-SEC] Found ${vulnerabilities.length} instances of sensitive data in browser storage.`);
-  return vulnerabilities;
-}
+/* eslint-disable no-console */
+import { Page, expect } from '@playwright/test';
+
+export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
+
+export type SecurityFindingType = 'confirmed_vulnerability' | 'security_misconfiguration' | 'potential_issue' | 'informational';
+export type Confidence = 'High' | 'Medium' | 'Low';
+export type Exploitability = 'confirmed' | 'likely' | 'unknown' | 'not_confirmed';
+
+export interface SecurityFinding {
+  type: SecurityFindingType;
+  category: string;
+  subcategory?: string;
+  severity: Severity;
+  confidence: Confidence;
+  exploitability: Exploitability;
+  status: 'detected';
+  description: string;
+  impact?: string;
+  evidence: {
+    [key: string]: any;
+  };
+  reproductionSteps?: string[];
+  remediation: string;
+  classification?: {
+    owaspTop10?: string;
+    cwe?: string;
+  };
+}
+
+/**
+ * Attempts to inject a simple XSS payload into a specified element and checks for an alert.
+ * @param page - The Playwright Page object.
+ * @param selector - The selector for the input field to test.
+ * @returns A vulnerability object if successful, null otherwise.
+ */
+export async function test_xss_injection(
+  page: Page,
+  selector: string,
+): Promise<SecurityFinding | null> {
+  const payload = `<script>alert('XSS-ARCALITY-TEST')</script>`;
+  console.log(`[QA-SEC] Testing XSS on selector: ${selector}`);
+
+  let alertTriggered = false;
+  page.once('dialog', async (dialog) => {
+    if (dialog.message().includes('XSS-ARCALITY-TEST')) {
+      alertTriggered = true;
+    }
+    await dialog.dismiss();
+  });
+
+  await page.fill(selector, payload);
+  // Submit the form or trigger the action that would process the input
+  // This part is crucial and might need to be adapted based on the application's behavior
+  await page.press(selector, 'Enter'); 
+
+  // Wait a moment for any potential script execution
+  await page.waitForTimeout(1000);
+
+  if (alertTriggered) {
+    console.log(`[QA-SEC] XSS Vulnerability DETECTED at ${selector}`);
+    return {
+      type: 'confirmed_vulnerability',
+      category: 'Injection',
+      subcategory: 'Reflected XSS',
+      severity: 'High',
+      confidence: 'High',
+      exploitability: 'confirmed',
+      status: 'detected',
+      description: `A reflected Cross-Site Scripting (XSS) vulnerability was detected in the element '${selector}'. The application executed a script injected into this input field.`,
+      impact: 'Allows execution of arbitrary JavaScript in the context of the user session, potentially leading to session hijacking, credential theft, or unauthorized actions.',
+      evidence: {
+        payload,
+        url: page.url(),
+        selector,
+      },
+      reproductionSteps: [
+        `Navigate to the page containing '${selector}'.`,
+        `Inject the payload: ${payload}`,
+        'Trigger the form submission or blur event.',
+        'Observe the script execution (alert dialog).'
+      ],
+      remediation: 'Sanitize all user-supplied input on the server-side before rendering it back to the page. Use libraries like DOMPurify on the client-side as an additional layer of defense.',
+      classification: {
+        owaspTop10: 'A03:2021 Injection',
+        cwe: 'CWE-79'
+      }
+    };
+  }
+
+  console.log(`[QA-SEC] No XSS detected for selector: ${selector}`);
+  return null;
+}
+
+/**
+ * Checks if a given URL, assumed to be protected, can be accessed without authentication.
+ * @param page - The Playwright Page object.
+ * @param url - The protected URL to test.
+ * @param redirectUrl - The URL the app should redirect to if unauthorized.
+ * @returns A vulnerability object if bypass is successful, null otherwise.
+ */
+export async function test_auth_bypass(
+  page: Page,
+  url: string,
+  redirectUrl: string | RegExp,
+): Promise<SecurityFinding | null> {
+  console.log(`[QA-SEC] Testing Auth Bypass on URL: ${url}`);
+  const response = await page.goto(url, { waitUntil: 'domcontentloaded' });
+
+  // If the page loads the protected content (doesn't redirect or redirects to a different page)
+  if (response?.ok() && !page.url().match(redirectUrl)) {
+    console.log(`[QA-SEC] Auth Bypass DETECTED for URL: ${url}`);
+    return {
+      type: 'confirmed_vulnerability',
+      category: 'Broken Access Control',
+      subcategory: 'Authentication Bypass',
+      severity: 'Critical',
+      confidence: 'High',
+      exploitability: 'confirmed',
+      status: 'detected',
+      description: `Unauthorized access to the protected route '${url}' was successful. The application failed to enforce authentication, allowing a direct bypass to sensitive content.`,
+      impact: 'An unauthenticated attacker can access protected resources, potentially reading or modifying sensitive user data.',
+      evidence: {
+        accessedUrl: url,
+        finalUrl: page.url(),
+      },
+      reproductionSteps: [
+        'Ensure no active session (cleared cookies/storage).',
+        `Navigate directly to: ${url}`,
+        'Observe that the protected page loads without redirection.'
+      ],
+      remediation: 'Implement server-side middleware to verify user authentication and authorization status before serving any protected routes.',
+      classification: {
+        owaspTop10: 'A01:2021 Broken Access Control',
+        cwe: 'CWE-285'
+      }
+    };
+  }
+
+  console.log(`[QA-SEC] No Auth Bypass detected for URL: ${url}`);
+  return null;
+}
+
+/**
+ * Audits the HTTP security headers of the current page.
+ * @param page - The Playwright Page object.
+ * @returns An array of vulnerability objects for missing headers.
+ */
+export async function audit_http_headers(page: Page): Promise<SecurityFinding[]> {
+  console.log(`[QA-SEC] Auditing HTTP Headers for: ${page.url()}`);
+  const response = await page.reload({ waitUntil: 'domcontentloaded' });
+  const headers = response?.headers();
+  const vulnerabilities: SecurityFinding[] = [];
+
+  const securityHeaders = {
+    'Content-Security-Policy': {
+      severity: 'Medium',
+      remediation: 'Implement a strict Content-Security-Policy (CSP) to mitigate XSS and other injection attacks. Start with a restrictive policy and gradually allow trusted sources.',
+      impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
+      cwe: 'CWE-16'
+    },
+    'Strict-Transport-Security': {
+      severity: 'Medium',
+      remediation: 'Implement HTTP Strict Transport Security (HSTS) to force browsers to communicate over HTTPS, preventing downgrade attacks.',
+      impact: 'Man-in-the-middle attacks could downgrade the connection to HTTP, allowing traffic interception.',
+      cwe: 'CWE-319'
+    },
+    'X-Content-Type-Options': {
+      severity: 'Low',
+      remediation: 'Set `X-Content-Type-Options: nosniff` to prevent browsers from MIME-sniffing a response away from the declared content-type.',
+      impact: 'Browsers may interpret non-executable MIME types as executable, leading to potential XSS.',
+      cwe: 'CWE-430'
+    },
+    'X-Frame-Options': {
+      severity: 'Medium',
+      remediation: 'Set `X-Frame-Options: SAMEORIGIN` or `DENY` to protect against clickjacking attacks by preventing the page from being loaded in an iframe on other domains.',
+      impact: 'Attackers could trick users into clicking visually hidden elements, causing unintended actions (Clickjacking).',
+      cwe: 'CWE-1021'
+    }
+  };
+
+  for (const [header, info] of Object.entries(securityHeaders)) {
+    if (!headers || !Object.keys(headers).find(h => h.toLowerCase() === header.toLowerCase())) {
+        vulnerabilities.push({
+            type: 'security_misconfiguration',
+            category: 'Missing Security Header',
+            subcategory: header,
+            severity: info.severity as Severity,
+            confidence: 'High',
+            exploitability: 'not_confirmed',
+            status: 'detected',
+            description: `The '${header}' HTTP header is missing. This header is crucial for defending against various web attacks.`,
+            impact: info.impact,
+            evidence: {
+                url: page.url(),
+                missingHeader: header
+            },
+            reproductionSteps: [
+                `Navigate to ${page.url()}`,
+                `Inspect the response headers.`,
+                `Verify that ${header} is absent.`
+            ],
+            remediation: info.remediation,
+            classification: {
+                owaspTop10: 'A05:2021 Security Misconfiguration',
+                cwe: info.cwe
+            }
+        });
+    }
+  }
+  
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} missing security headers.`);
+  return vulnerabilities;
+}
+
+/**
+ * Scans localStorage and sessionStorage for potentially sensitive data.
+ * @param page - The Playwright Page object.
+ * @returns An array of vulnerability objects for any sensitive data found.
+ */
+export async function scan_sensitive_data_exposure(page: Page): Promise<SecurityFinding[]> {
+  console.log(`[QA-SEC] Scanning localStorage and sessionStorage for sensitive data.`);
+  const vulnerabilities: SecurityFinding[] = [];
+  const sensitiveKeywords = ['token', 'password', 'secret', 'key', 'jwt', 'auth'];
+
+  const storages = {
+    localStorage: await page.evaluate(() => Object.entries(window.localStorage)),
+    sessionStorage: await page.evaluate(() => Object.entries(window.sessionStorage)),
+  };
+
+  for (const [storageType, items] of Object.entries(storages)) {
+    for (const [key, value] of items) {
+      if (sensitiveKeywords.some(keyword => key.toLowerCase().includes(keyword))) {
+        vulnerabilities.push({
+          type: 'potential_issue',
+          category: 'Sensitive Data Exposure',
+          subcategory: 'Browser Storage',
+          severity: 'Medium',
+          confidence: 'Medium',
+          exploitability: 'unknown',
+          status: 'detected',
+          description: `Potentially sensitive data was found in ${storageType}. Storing sensitive information like tokens or keys in browser storage is insecure.`,
+          impact: 'If an attacker discovers an XSS vulnerability, they can read localStorage/sessionStorage and exfiltrate secrets.',
+          evidence: {
+            storage: storageType,
+            key: key,
+            valuePreview: value ? `${value.substring(0, 10)}...` : '(empty)',
+          },
+          reproductionSteps: [
+            `Open Developer Tools on ${page.url()}`,
+            `Check ${storageType} for the key '${key}'.`
+          ],
+          remediation: 'Avoid storing sensitive data in browser storage. Use secure, HttpOnly cookies for session tokens. If you must store data, encrypt it first.',
+          classification: {
+            owaspTop10: 'A04:2021 Insecure Design',
+            cwe: 'CWE-312'
+          }
+        });
+      }
+    }
+  }
+
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} instances of sensitive data in browser storage.`);
+  return vulnerabilities;
+}