npm - create-walle - Versions diffs - 0.9.21 → 0.9.23 - Mend

create-walle 0.9.21 → 0.9.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (500) hide show

package/template/wall-e/eval/fixtures/express-xss/server.js DELETED Viewed

@@ -1,90 +0,0 @@
-const http = require('http');
-const fs = require('fs');
-const path = require('path');
-const url = require('url');
-const profiles = {};
-function renderTemplate(templateName, data) {
-  let template = fs.readFileSync(path.join(__dirname, 'views', templateName), 'utf8');
-  for (const [key, value] of Object.entries(data)) {
-    template = template.replace(new RegExp(`<%=\\s*${key}\\s*%>`, 'g'), value);
-  }
-  return template;
-}
-function parseBody(req) {
-  return new Promise((resolve, reject) => {
-    let body = '';
-    req.on('data', chunk => (body += chunk));
-    req.on('end', () => {
-      try { resolve(body ? JSON.parse(body) : {}); }
-      catch { reject(new Error('Invalid JSON')); }
-    });
-  });
-}
-const server = http.createServer(async (req, res) => {
-  const parsed = url.parse(req.url, true);
-  const pathname = parsed.pathname;
-  if (req.method === 'GET' && pathname === '/') {
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ message: 'XSS Vulnerable App' }));
-    return;
-  }
-  // POST /profile - create a profile (stores user input)
-  if (req.method === 'POST' && pathname === '/profile') {
-    try {
-      const body = await parseBody(req);
-      const id = Object.keys(profiles).length + 1;
-      profiles[id] = { id, name: body.name || '', bio: body.bio || '', website: body.website || '' };
-      res.writeHead(201, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(profiles[id]));
-    } catch {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid request' }));
-    }
-    return;
-  }
-  // GET /profile/:id - render profile (XSS vulnerable - injects user input directly into HTML)
-  if (req.method === 'GET' && pathname.startsWith('/profile/')) {
-    const id = parseInt(pathname.split('/')[2]);
-    const profile = profiles[id];
-    if (!profile) {
-      res.writeHead(404, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Profile not found' }));
-      return;
-    }
-    // VULNERABILITY: renders user input directly into HTML without escaping
-    const html = renderTemplate('profile.ejs', {
-      name: profile.name,
-      bio: profile.bio,
-      website: profile.website,
-    });
-    res.writeHead(200, { 'Content-Type': 'text/html' });
-    res.end(html);
-    return;
-  }
-  // GET /search?q=... - search with reflected XSS
-  if (req.method === 'GET' && pathname === '/search') {
-    const q = parsed.query.q || '';
-    // VULNERABILITY: reflects search query directly into HTML
-    const html = `<html><body><h1>Search Results</h1><p>Results for: ${q}</p><p>No results found.</p></body></html>`;
-    res.writeHead(200, { 'Content-Type': 'text/html' });
-    res.end(html);
-    return;
-  }
-  res.writeHead(404, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify({ error: 'not found' }));
-});
-const PORT = process.env.PORT || 3000;
-if (require.main === module) {
-  server.listen(PORT, () => console.log(`Server running on port ${PORT}`));
-}
-module.exports = server;

package/template/wall-e/eval/fixtures/express-xss/test.js DELETED Viewed

@@ -1,67 +0,0 @@
-const http = require('http');
-const app = require('./server');
-let server;
-let passed = 0;
-let failed = 0;
-function request(method, path, body) {
-  return new Promise((resolve, reject) => {
-    const addr = server.address();
-    const options = { hostname: '127.0.0.1', port: addr.port, path, method };
-    if (body) options.headers = { 'Content-Type': 'application/json' };
-    const req = http.request(options, (res) => {
-      let data = '';
-      res.on('data', chunk => (data += chunk));
-      res.on('end', () => {
-        try { resolve({ status: res.statusCode, body: JSON.parse(data), raw: data }); }
-        catch { resolve({ status: res.statusCode, body: data, raw: data }); }
-      });
-    });
-    req.on('error', reject);
-    if (body) req.write(JSON.stringify(body));
-    req.end();
-  });
-}
-function assert(condition, msg) {
-  if (condition) { passed++; console.log(`  PASS: ${msg}`); }
-  else { failed++; console.log(`  FAIL: ${msg}`); }
-}
-async function run() {
-  server = app.listen(0);
-  try {
-    // Root endpoint
-    const root = await request('GET', '/');
-    assert(root.status === 200, 'root returns 200');
-    // Create profile
-    const create = await request('POST', '/profile', { name: 'Alice', bio: 'Hello world', website: 'https://example.com' });
-    assert(create.status === 201, 'create profile returns 201');
-    // Get profile HTML
-    const profile = await request('GET', '/profile/1');
-    assert(profile.status === 200, 'get profile returns 200');
-    assert(profile.raw.includes('Alice'), 'profile contains name');
-    // XSS test: creating a profile with script tag should NOT render the script
-    const xss = await request('POST', '/profile', { name: '<script>alert("xss")</script>', bio: 'test', website: 'https://example.com' });
-    const xssProfile = await request('GET', `/profile/${xss.body.id}`);
-    assert(!xssProfile.raw.includes('<script>alert("xss")</script>'), 'profile does not contain unescaped script tag');
-    // XSS test: search reflected XSS
-    const search = await request('GET', '/search?q=<img%20onerror=alert(1)%20src=x>');
-    assert(!search.raw.includes('<img onerror=alert(1) src=x>'), 'search does not reflect unescaped HTML');
-    // 404
-    const notfound = await request('GET', '/profile/999');
-    assert(notfound.status === 404, 'missing profile returns 404');
-  } finally {
-    server.close();
-  }
-  console.log(`\nResults: ${passed} passed, ${failed} failed`);
-  process.exit(failed > 0 ? 1 : 0);
-}
-run().catch(err => { console.error(err); process.exit(1); });

package/template/wall-e/eval/fixtures/express-xss/views/profile.ejs DELETED Viewed

@@ -1,9 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head><title>Profile - <%= name %></title></head>
-<body>
-  <h1><%= name %></h1>
-  <div class="bio"><%= bio %></div>
-  <div class="website"><a href="<%= website %>">Website</a></div>
-</body>
-</html>

package/template/wall-e/eval/fixtures/fullstack-app/config/default.js DELETED Viewed

@@ -1,9 +0,0 @@
-const path = require('path');
-module.exports = {
-  port: 3000,
-  host: '127.0.0.1',
-  dbPath: path.join(__dirname, '..', 'db.json'),
-  tokenHeader: 'x-auth-token',
-  logRequests: true,
-};

package/template/wall-e/eval/fixtures/fullstack-app/config/test.js DELETED Viewed

@@ -1,13 +0,0 @@
-const path = require('path');
-const os = require('os');
-const crypto = require('crypto');
-const tmpFile = path.join(os.tmpdir(), `fullstack-test-${crypto.randomUUID()}.json`);
-module.exports = {
-  port: 0, // random available port
-  host: '127.0.0.1',
-  dbPath: tmpFile,
-  tokenHeader: 'x-auth-token',
-  logRequests: false,
-};

package/template/wall-e/eval/fixtures/fullstack-app/package.json DELETED Viewed

@@ -1,11 +0,0 @@
-{
-  "name": "fullstack-app",
-  "version": "1.0.0",
-  "description": "Fullstack app with API + frontend + JSON-file database",
-  "scripts": {
-    "test": "node test.js",
-    "start": "node server.js",
-    "seed": "node scripts/seed.js",
-    "migrate": "node scripts/migrate.js"
-  }
-}

package/template/wall-e/eval/fixtures/fullstack-app/public/css/style.css DELETED Viewed

@@ -1,137 +0,0 @@
-* {
-  margin: 0;
-  padding: 0;
-  box-sizing: border-box;
-}
-body {
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-  line-height: 1.6;
-  color: #333;
-  max-width: 960px;
-  margin: 0 auto;
-  padding: 1rem;
-  background: #f5f5f5;
-}
-header {
-  background: #2c3e50;
-  color: white;
-  padding: 1rem;
-  border-radius: 8px;
-  margin-bottom: 1.5rem;
-}
-header h1 {
-  font-size: 1.5rem;
-  margin-bottom: 0.5rem;
-}
-nav a {
-  color: #ecf0f1;
-  text-decoration: none;
-  margin-right: 1rem;
-  padding: 0.25rem 0.5rem;
-  border-radius: 4px;
-}
-nav a.active {
-  background: rgba(255, 255, 255, 0.2);
-}
-nav a:hover {
-  background: rgba(255, 255, 255, 0.1);
-}
-main {
-  background: white;
-  padding: 1.5rem;
-  border-radius: 8px;
-  box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
-}
-h2 {
-  margin-bottom: 1rem;
-  color: #2c3e50;
-  border-bottom: 2px solid #ecf0f1;
-  padding-bottom: 0.5rem;
-}
-h3 {
-  margin: 1rem 0 0.5rem;
-  color: #34495e;
-}
-form {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  max-width: 400px;
-}
-input {
-  padding: 0.5rem;
-  border: 1px solid #ddd;
-  border-radius: 4px;
-  font-size: 1rem;
-}
-button {
-  padding: 0.5rem 1rem;
-  background: #3498db;
-  color: white;
-  border: none;
-  border-radius: 4px;
-  cursor: pointer;
-  font-size: 1rem;
-}
-button:hover {
-  background: #2980b9;
-}
-button.danger {
-  background: #e74c3c;
-}
-button.danger:hover {
-  background: #c0392b;
-}
-.error {
-  color: #e74c3c;
-  margin-top: 0.5rem;
-}
-.success {
-  color: #27ae60;
-  margin-top: 0.5rem;
-}
-.item-card, .user-card {
-  border: 1px solid #ecf0f1;
-  padding: 1rem;
-  margin-bottom: 0.75rem;
-  border-radius: 4px;
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-}
-.item-card h4, .user-card h4 {
-  margin: 0;
-}
-.item-card .price {
-  color: #27ae60;
-  font-weight: bold;
-}
-.item-card .actions, .user-card .actions {
-  display: flex;
-  gap: 0.5rem;
-}
-section {
-  margin-bottom: 2rem;
-}

package/template/wall-e/eval/fixtures/fullstack-app/public/index.html DELETED Viewed

@@ -1,46 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Fullstack App</title>
-  <link rel="stylesheet" href="/css/style.css">
-</head>
-<body>
-  <header>
-    <h1>Fullstack App</h1>
-    <nav>
-      <a href="/" class="active">Home</a>
-      <a href="/login.html" id="nav-login">Login</a>
-      <a href="#" id="nav-logout" style="display:none;">Logout</a>
-    </nav>
-  </header>
-  <main>
-    <section id="items-section">
-      <h2>Items</h2>
-      <div id="items-list"></div>
-      <div id="item-form" style="display:none;">
-        <h3>Add Item</h3>
-        <form onsubmit="return false;">
-          <input type="text" id="item-name" placeholder="Name" required>
-          <input type="text" id="item-description" placeholder="Description">
-          <input type="number" id="item-price" placeholder="Price" step="0.01">
-          <button id="btn-add-item">Add</button>
-        </form>
-      </div>
-    </section>
-    <section id="users-section" style="display:none;">
-      <h2>Users</h2>
-      <div id="users-list"></div>
-    </section>
-  </main>
-  <script src="/js/auth.js"></script>
-  <script src="/js/items.js"></script>
-  <script src="/js/users.js"></script>
-  <script src="/js/app.js"></script>
-</body>
-</html>

package/template/wall-e/eval/fixtures/fullstack-app/public/js/app.js DELETED Viewed

@@ -1,121 +0,0 @@
-/**
- * Main app logic - initializes UI based on auth state.
- */
-(function () {
-  function updateNav() {
-    const loginLink = document.getElementById('nav-login');
-    const logoutLink = document.getElementById('nav-logout');
-    if (Auth.isLoggedIn()) {
-      if (loginLink) loginLink.style.display = 'none';
-      if (logoutLink) logoutLink.style.display = 'inline';
-    } else {
-      if (loginLink) loginLink.style.display = 'inline';
-      if (logoutLink) logoutLink.style.display = 'none';
-    }
-  }
-  async function initHome() {
-    updateNav();
-    // Load items
-    const itemsList = document.getElementById('items-list');
-    if (itemsList) {
-      const items = await Items.loadAll();
-      Items.render(items, itemsList);
-    }
-    // Show item form if logged in
-    const itemForm = document.getElementById('item-form');
-    if (itemForm && Auth.isLoggedIn()) {
-      itemForm.style.display = 'block';
-    }
-    // Add item handler
-    const btnAdd = document.getElementById('btn-add-item');
-    if (btnAdd) {
-      btnAdd.addEventListener('click', async () => {
-        const name = document.getElementById('item-name').value;
-        const description = document.getElementById('item-description').value;
-        const price = document.getElementById('item-price').value;
-        if (!name) return;
-        const result = await Items.create(name, description, price);
-        if (result.ok) {
-          document.getElementById('item-name').value = '';
-          document.getElementById('item-description').value = '';
-          document.getElementById('item-price').value = '';
-          const items = await Items.loadAll();
-          Items.render(items, itemsList);
-        }
-      });
-    }
-    // Show users section if logged in
-    const usersSection = document.getElementById('users-section');
-    if (usersSection && Auth.isLoggedIn()) {
-      usersSection.style.display = 'block';
-      const users = await Users.loadAll();
-      Users.render(users, document.getElementById('users-list'));
-    }
-    // Logout handler
-    const logoutLink = document.getElementById('nav-logout');
-    if (logoutLink) {
-      logoutLink.addEventListener('click', async (e) => {
-        e.preventDefault();
-        await Auth.logout();
-        window.location.reload();
-      });
-    }
-  }
-  function initLogin() {
-    updateNav();
-    const loginForm = document.getElementById('login-form');
-    if (loginForm) {
-      loginForm.addEventListener('submit', async () => {
-        const username = document.getElementById('login-username').value;
-        const password = document.getElementById('login-password').value;
-        const errorEl = document.getElementById('login-error');
-        const result = await Auth.login(username, password);
-        if (result.ok) {
-          window.location.href = '/';
-        } else {
-          errorEl.textContent = result.data.error || 'Login failed';
-        }
-      });
-    }
-    const registerForm = document.getElementById('register-form');
-    if (registerForm) {
-      registerForm.addEventListener('submit', async () => {
-        const username = document.getElementById('reg-username').value;
-        const password = document.getElementById('reg-password').value;
-        const email = document.getElementById('reg-email').value;
-        const errorEl = document.getElementById('register-error');
-        const successEl = document.getElementById('register-success');
-        const result = await Auth.register(username, password, email);
-        if (result.ok) {
-          successEl.textContent = 'Registered! You can now log in.';
-          errorEl.textContent = '';
-        } else {
-          errorEl.textContent = result.data.error || 'Registration failed';
-          successEl.textContent = '';
-        }
-      });
-    }
-  }
-  // Initialize based on page
-  if (document.getElementById('login-form')) {
-    initLogin();
-  } else {
-    initHome();
-  }
-})();

package/template/wall-e/eval/fixtures/fullstack-app/public/js/auth.js DELETED Viewed

@@ -1,71 +0,0 @@
-/**
- * Auth token management.
- * Stores token in localStorage, provides helpers for API calls.
- */
-const Auth = {
-  TOKEN_KEY: 'auth_token',
-  USER_ID_KEY: 'auth_user_id',
-  getToken() {
-    return localStorage.getItem(this.TOKEN_KEY);
-  },
-  setToken(token, userId) {
-    localStorage.setItem(this.TOKEN_KEY, token);
-    localStorage.setItem(this.USER_ID_KEY, userId);
-  },
-  clearToken() {
-    localStorage.removeItem(this.TOKEN_KEY);
-    localStorage.removeItem(this.USER_ID_KEY);
-  },
-  isLoggedIn() {
-    return !!this.getToken();
-  },
-  getUserId() {
-    return localStorage.getItem(this.USER_ID_KEY);
-  },
-  getHeaders() {
-    const headers = { 'Content-Type': 'application/json' };
-    const token = this.getToken();
-    if (token) {
-      headers['x-auth-token'] = token;
-    }
-    return headers;
-  },
-  async login(username, password) {
-    const res = await fetch('/api/auth/login', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username, password }),
-    });
-    const data = await res.json();
-    if (res.ok) {
-      this.setToken(data.token, data.userId);
-    }
-    return { ok: res.ok, data };
-  },
-  async register(username, password, email) {
-    const res = await fetch('/api/auth/register', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username, password, email }),
-    });
-    const data = await res.json();
-    return { ok: res.ok, data };
-  },
-  async logout() {
-    await fetch('/api/auth/logout', {
-      method: 'POST',
-      headers: this.getHeaders(),
-    });
-    this.clearToken();
-  },
-};

package/template/wall-e/eval/fixtures/fullstack-app/public/js/items.js DELETED Viewed

@@ -1,80 +0,0 @@
-/**
- * Item list/create UI logic.
- * Note: This is a test fixture. In production, use DOMPurify or safe DOM methods.
- */
-const Items = {
-  async loadAll() {
-    const res = await fetch('/api/items');
-    return res.json();
-  },
-  async create(name, description, price) {
-    const res = await fetch('/api/items', {
-      method: 'POST',
-      headers: Auth.getHeaders(),
-      body: JSON.stringify({ name, description, price: parseFloat(price) || 0 }),
-    });
-    return { ok: res.ok, data: await res.json() };
-  },
-  async remove(id) {
-    const res = await fetch(`/api/items/${id}`, {
-      method: 'DELETE',
-      headers: Auth.getHeaders(),
-    });
-    return { ok: res.ok, data: await res.json() };
-  },
-  renderCard(item, container) {
-    const card = document.createElement('div');
-    card.className = 'item-card';
-    card.dataset.id = item.id;
-    const info = document.createElement('div');
-    const h4 = document.createElement('h4');
-    h4.textContent = item.name;
-    const desc = document.createElement('p');
-    desc.textContent = item.description;
-    const price = document.createElement('span');
-    price.className = 'price';
-    price.textContent = '$' + (item.price || 0).toFixed(2);
-    info.appendChild(h4);
-    info.appendChild(desc);
-    info.appendChild(price);
-    card.appendChild(info);
-    if (Auth.isLoggedIn()) {
-      const actions = document.createElement('div');
-      actions.className = 'actions';
-      const btn = document.createElement('button');
-      btn.className = 'danger';
-      btn.textContent = 'Delete';
-      btn.addEventListener('click', () => Items.handleDelete(item.id));
-      actions.appendChild(btn);
-      card.appendChild(actions);
-    }
-    container.appendChild(card);
-  },
-  render(items, container) {
-    if (!container) return;
-    container.textContent = '';
-    if (items.length === 0) {
-      const p = document.createElement('p');
-      p.textContent = 'No items yet.';
-      container.appendChild(p);
-      return;
-    }
-    items.forEach(item => Items.renderCard(item, container));
-  },
-  async handleDelete(id) {
-    const result = await this.remove(id);
-    if (result.ok) {
-      const items = await this.loadAll();
-      this.render(items, document.getElementById('items-list'));
-    }
-  },
-};