@auth0/auth0-checkmate 1.4.0

package/tests/email_templates/checkEmailTemplates.test.js

@@ -0,0 +1,120 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkEmailTemplates = require("../../analyzer/lib/email_templates/checkEmailTemplates");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkEmailTemplates", function () {
+  it("should return fail when no email templates are provided", function () {
+    const options = {};
+
+    checkEmailTemplates(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "email_templates_not_configured",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail for email templates without configuration", function () {
+    const options = {
+      emailTemplates: [
+        {
+          name: "Verification Email (Link)",
+          template: { template: "verify_email", enabled: true },
+        },
+        { name: "Verification Email (Code)", template: null },
+        { name: "Welcome Email", template: null },
+      ],
+    };
+
+    checkEmailTemplates(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "email_template_enabled",
+          status: CONSTANTS.SUCCESS,
+          attr: "verify_email",
+          value: "verify_email",
+        },
+        {
+          field: "email_template_not_configured",
+          status: CONSTANTS.FAIL,
+          attr: "Verification Email (Code)",
+          value: "Verification Email (Code)",
+        },
+        {
+          field: "email_template_not_configured",
+          status: CONSTANTS.FAIL,
+          attr: "Welcome Email",
+          value: "Welcome Email",
+        },
+      ]);
+    });
+  });
+
+  it("should return success for enabled email templates", function () {
+    const options = {
+      emailTemplates: [
+        {
+          name: "Verification Email (Link)",
+          template: { template: "verify_email", enabled: true },
+        },
+        {
+          name: "Verification Email (Code)",
+          template: { template: "verify_code", enabled: true },
+        },
+      ],
+    };
+
+    checkEmailTemplates(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "email_template_enabled",
+          status: CONSTANTS.SUCCESS,
+          attr: "verify_email",
+          value: "verify_email",
+        },
+        {
+          field: "email_template_enabled",
+          status: CONSTANTS.SUCCESS,
+          attr: "verify_code",
+          value: "verify_code",
+        },
+      ]);
+    });
+  });
+
+  it("should return fail for disabled email templates", function () {
+    const options = {
+      emailTemplates: [
+        {
+          name: "Verification Email (Link)",
+          template: { template: "verify_email", enabled: false },
+        },
+        {
+          name: "Verification Email (Code)",
+          template: { template: "verify_code", enabled: false },
+        },
+      ],
+    };
+
+    checkEmailTemplates(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "email_template_not_enabled",
+          status: CONSTANTS.FAIL,
+          attr: "Verification Email (Link)",
+          value: "Verification Email (Link)",
+        },
+        {
+          field: "email_template_not_enabled",
+          status: CONSTANTS.FAIL,
+          attr: "Verification Email (Code)",
+          value: "Verification Email (Code)",
+        },
+      ]);
+    });
+  });
+});

package/tests/error_page_template/checkErrorPageTemplate.test.js

@@ -0,0 +1,315 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkErrorPageTemplate = require("../../analyzer/lib/error_page_template/checkErrorPageTemplate");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkErrorPageTemplate", function () {
+  it("should return success when no error page template is provided", function (done) {
+    const options = {};
+
+    checkErrorPageTemplate(options).then((result) => {
+      expect(result.details).to.deep.include({
+        field: "liquidjs_no_templates_to_analyze",
+        status: CONSTANTS.SUCCESS,
+        value: "No custom error page templates found to analyze for XSS"
+      });
+      done();
+    }).catch(done);
+  });
+
+  it("should return success when error page template is empty", function (done) {
+    const options = {
+      errorPageTemplate: ""
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      expect(result.details).to.deep.include({
+        field: "liquidjs_no_templates_to_analyze",
+        status: CONSTANTS.SUCCESS,
+        value: "No custom error page templates found to analyze for XSS"
+      });
+      done();
+    }).catch(done);
+  });
+
+  it("should detect unescaped variable output", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <h1>Error</h1>
+            <p>Hello {{ user.name }}</p>
+            <p>Error details: {{ error.description }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      const unescapedIssue = result.details.find(d => d.field === "liquidjs_unescaped_output");
+      expect(unescapedIssue).to.exist;
+      expect(unescapedIssue.status).to.equal(CONSTANTS.FAIL);
+      expect(unescapedIssue.value).to.be.a("string");
+      done();
+    }).catch(done);
+  });
+
+  it("should not flag properly escaped variables as issues", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <h1>Error</h1>
+            <p>Hello {{ user.name | escape }}</p>
+            <p>Error: {{ error.description | h }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should not detect unescaped output since variables are properly escaped
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.not.exist;
+      
+      // Should have a success entry for unescaped output
+      const successIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.SUCCESS
+      );
+      expect(successIssue).to.exist;
+      done();
+    }).catch(done);
+  });
+
+  it("should detect raw filter usage", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <h1>Error</h1>
+            <div>{{ error.html_content | raw }}</div>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      const rawFilterIssue = result.details.find(d => d.field === "liquidjs_raw_filter_usage");
+      expect(rawFilterIssue).to.exist;
+      expect(rawFilterIssue.status).to.equal(CONSTANTS.FAIL);
+      expect(rawFilterIssue.value).to.be.a("string");
+      done();
+    }).catch(done);
+  });
+
+  it("should detect unsafe filter usage", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <p>{{ user.bio | safe }}</p>
+            <p>{{ content | unescaped }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      const rawFilterIssue = result.details.find(d => d.field === "liquidjs_raw_filter_usage");
+      expect(rawFilterIssue).to.exist;
+      expect(rawFilterIssue.status).to.equal(CONSTANTS.FAIL);
+      done();
+    }).catch(done);
+  });
+
+  it("should handle templates with no liquid variables", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <h1>Error Page</h1>
+            <p>Something went wrong. Please try again later.</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should not find any unescaped output issues
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.not.exist;
+
+      // Should not find any raw filter issues
+      const rawIssue = result.details.find(d => 
+        d.field === "liquidjs_raw_filter_usage" && d.status === CONSTANTS.FAIL
+      );
+      expect(rawIssue).to.not.exist;
+
+      // Should have success entries
+      const successUnescaped = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.SUCCESS
+      );
+      expect(successUnescaped).to.exist;
+
+      const successRaw = result.details.find(d => 
+        d.field === "liquidjs_raw_filter_usage" && d.status === CONSTANTS.SUCCESS
+      );
+      expect(successRaw).to.exist;
+      done();
+    }).catch(done);
+  });
+
+  it("should handle complex templates with mixed safe and unsafe patterns", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <head>
+            <title>Error - {{ error.code | escape }}</title>
+          </head>
+          <body>
+            <h1>{{ error.title }}</h1>
+            <p>Hello {{ user.name | escape }}, an error occurred.</p>
+            <div>{{ error.html_details | raw }}</div>
+            <p>Error ID: {{ error.id }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should detect unescaped variables (error.title and error.id)
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.exist;
+
+      // Should detect raw filter usage
+      const rawIssue = result.details.find(d => 
+        d.field === "liquidjs_raw_filter_usage" && d.status === CONSTANTS.FAIL
+      );
+      expect(rawIssue).to.exist;
+      done();
+    }).catch(done);
+  });
+
+  it("should handle templates with various safe filters", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <p>{{ user.name | escape }}</p>
+            <p>{{ user.email | h }}</p>
+            <p>{{ user.bio | html_escape }}</p>
+            <p>{{ user.url | url_encode }}</p>
+            <p>{{ user.data | escape_once }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should not detect unescaped output issues since all variables use safe filters
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.not.exist;
+
+      // Should have a success entry for unescaped output
+      const successIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.SUCCESS
+      );
+      expect(successIssue).to.exist;
+      done();
+    }).catch(done);
+  });
+
+  it("should detect variables with unsafe filter combinations", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <p>{{ user.name | downcase }}</p>
+            <p>{{ user.bio | truncate: 100 }}</p>
+            <p>{{ user.title | upcase | strip }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should detect unescaped output since these filters don't provide XSS protection
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.exist;
+      expect(unescapedIssue.status).to.equal(CONSTANTS.FAIL);
+      done();
+    }).catch(done);
+  });
+
+  it("should handle edge cases with whitespace and formatting", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <p>{{user.name}}</p>
+            <p>{{ user.email }}</p>
+            <p>{{  user.bio  }}</p>
+            <p>{{ user.data|escape }}</p>
+            <p>{{ user.info | escape }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should detect unescaped variables regardless of whitespace
+      const unescapedIssue = result.details.find(d => 
+        d.field === "liquidjs_unescaped_output" && d.status === CONSTANTS.FAIL
+      );
+      expect(unescapedIssue).to.exist;
+      done();
+    }).catch(done);
+  });
+
+  it("should handle malformed liquid syntax gracefully", function (done) {
+    const options = {
+      errorPageTemplate: `
+        <html>
+          <body>
+            <p>{{ user.name</p>
+            <p>user.email }}</p>
+            <p>{{ user.bio | }}</p>
+            <p>{{ | escape }}</p>
+          </body>
+        </html>
+      `
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      // Should not crash and should handle malformed syntax gracefully
+      expect(result).to.exist;
+      expect(result.details).to.be.an("array");
+      done();
+    }).catch(done);
+  });
+
+  it("should return proper structure with checkName and timestamp", function (done) {
+    const options = {
+      errorPageTemplate: "<p>{{ user.name }}</p>"
+    };
+
+    checkErrorPageTemplate(options).then((result) => {
+      expect(result).to.have.property("checkName", "checkErrorPageTemplate");
+      expect(result).to.have.property("timestamp");
+      expect(result).to.have.property("details");
+      expect(result.details).to.be.an("array");
+      done();
+    }).catch(done);
+  });
+});

package/tests/event_streams/checkEventStreams.test.js

@@ -0,0 +1,118 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkEventStreams = require("../../analyzer/lib/event_streams/checkEventStreams");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+
+describe("checkEventStreams", function () {
+    it("should return fail when eventStreams is empty", function () {
+        const options = { eventStreams: [] };
+
+        checkEventStreams(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "event_stream_not_configured",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+
+    it("should return empty when a event stream is enabled", function () {
+        const options = {
+            eventStreams: [
+                {
+                    id: "lst_0001",
+                    name: "Auth0 Eventstream",
+                    destination: {
+                        type: "webhook",
+                    },
+                    status: "enabled"
+                },
+            ],
+        };
+
+        checkEventStreams(options, (report) => {
+            expect(report).to.deep.equal([]);
+        });
+    });
+
+    it("should return fail when a event stream is disabled", function () {
+        const options = {
+            eventStreams: [
+                {
+                    id: "lst_0001",
+                    name: "Auth0 Eventstream",
+                    destination: {
+                        type: "webhook",
+                    },
+                    status: "disabled"
+                },
+            ],
+        };
+
+        checkEventStreams(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "event_stream_disabled",
+                    name: "Auth0 Eventstream",
+                    type: "http",
+                    stream_status: "disabled",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+
+    it('should return an empty report if errorCode "insufficient_scope" is present', function () {
+        const options = {
+            eventStreams: [
+                {
+                    id: "lst_0001",
+                    name: "Auth0 Eventstream",
+                    errorCode: "insufficient_scope"
+                },
+            ],
+        };
+
+        checkEventStreams(options, (report) => {
+            expect(report).to.deep.equal([]); // The report should be empty for insufficient scope
+        });
+    });
+
+    it("should handle multiple log streams with mixed statuses", function () {
+        const options = {
+            eventStreams: [
+                {
+                    id: "lst_0001",
+                    name: "Auth0 Eventstream",
+                    destination: {
+                        type: "webhook",
+                    },
+                    status: "enabled"
+                },
+                {
+                    id: "lst_0000000000014672",
+                    name: "Another Eventstream",
+                    destination: {
+                        type: "aws",
+                    },
+                    status: "disabled"
+                },
+            ],
+        };
+
+        checkEventStreams(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "event_stream_disabled",
+                    name: "Another Eventstream",
+                    type: "aws",
+                    stream_status: "disabled",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+});

package/tests/hooks/checkHooks.test.js

@@ -0,0 +1,112 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkHooks = require("../../analyzer/lib/hooks/checkHooks");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkHooks", function () {
+  it("should return success when no hooks are provided", function () {
+    const options = {};
+
+    checkHooks(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_enabled_hooks",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail for an enabled hook", function () {
+    const options = {
+      hooks: [
+        {
+          id: "test",
+          name: "test",
+          script: "",
+          dependencies: {},
+          enabled: true,
+          triggerId: "post-user-registration",
+        },
+      ],
+    };
+
+    checkHooks(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          name: "test",
+          value: "post-user-registration",
+          field: "enabled_hooks",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return success for a disabled hook", function () {
+    const options = {
+      hooks: [
+        {
+          id: "test",
+          name: "test",
+          script: "",
+          dependencies: {},
+          enabled: false,
+          triggerId: "post-user-registration",
+        },
+      ],
+    };
+
+    checkHooks(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          name: "test",
+          value: "post-user-registration",
+          field: "enabled_hooks",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should handle multiple hooks with mixed enabled/disabled states", function () {
+    const options = {
+      hooks: [
+        {
+          id: "test1",
+          name: "test1",
+          script: "",
+          dependencies: {},
+          enabled: true,
+          triggerId: "post-user-registration",
+        },
+        {
+          id: "test2",
+          name: "test2",
+          script: "",
+          dependencies: {},
+          enabled: false,
+          triggerId: "pre-user-registration",
+        },
+      ],
+    };
+
+    checkHooks(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          name: "test1",
+          value: "post-user-registration",
+          field: "enabled_hooks",
+          status: CONSTANTS.FAIL,
+        },
+        {
+          name: "test2",
+          value: "pre-user-registration",
+          field: "enabled_hooks",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+});