add vulns 4

VULNERABILITY_TEST_CASES.md

@@ -0,0 +1,229 @@
+# Vulnerability Test Cases
+
+This repository contains intentionally vulnerable packages for testing SCA (Software Composition Analysis) features.
+
+## Package Manager
+
+This project uses **Yarn v1** for dependency management. All commands below use Yarn.
+
+## SCA Auto-Fix Testing Setup
+
+This repository is configured to test SCA auto-fix capabilities:
+
+- **package.json**: Uses caret ranges (^) that allow patch and minor version upgrades
+- **yarn.lock**: Locked to vulnerable versions 
+- **Result**: SCA tools can detect that upgrades are available within the specified ranges to fix vulnerabilities
+
+When an SCA tool analyzes this project, it should be able to:
+1. Detect the vulnerabilities in the locked versions
+2. Identify that newer, non-vulnerable versions exist within the allowed ranges
+3. Automatically generate fixes by updating the lockfile to use patched versions
+
+## Auto-Fixable Vulnerabilities
+
+The following packages have newer versions available within their specified ranges that fix known vulnerabilities:
+
+### Critical - Auto-Fixable:
+- **json-schema@^0.2.3** → can upgrade to 0.4.0 (fixes CVE-2020-12245)
+
+### High - Auto-Fixable:
+- **axios@^0.21.1** → can upgrade to 0.21.4+ (fixes CSRF and SSRF vulnerabilities)
+
+### Moderate - Auto-Fixable:
+- **tar@^4.4.8** → can upgrade to 4.4.19+ (fixes DoS vulnerability)
+
+### Low - Auto-Fixable:
+- **cookie@^0.4.1** → can upgrade to 0.4.2+ (fixes out-of-bounds characters issue)
+
+### Additional Auto-Fixable (currently patched in lockfile):
+- **lodash@^4.17.20** → can upgrade to 4.17.21+ (fixes Command Injection and ReDoS)
+- **minimist@^1.2.5** → can upgrade to 1.2.8+ (fixes Prototype Pollution)
+- **node-fetch@^2.6.1** → can upgrade to 2.7.0+ (fixes header forwarding issue)
+- **path-parse@^1.0.6** → can upgrade to 1.0.7+ (fixes ReDoS)
+- **semver@^7.3.2** → can upgrade to 7.7.2+ (fixes ReDoS)
+- **underscore@^1.12.0** → can upgrade to 1.13.7+ (fixes arbitrary code execution)
+- **yargs-parser@^13.1.1** → can upgrade to 13.1.2+ (fixes Prototype Pollution)
+- **ini@^1.3.5** → can upgrade to 1.3.8+ (fixes Prototype Pollution)
+
+### Current Vulnerability Status:
+- **5 vulnerabilities detected** (1 Critical, 1 High, 2 Moderate, 1 Low)
+- **All are auto-fixable** within the specified version ranges
+
+## Vulnerable Packages Added
+
+### Critical Vulnerabilities
+
+1. **lodash@4.17.20** - CVE-2020-8203
+   - **Type**: Prototype Pollution
+   - **Severity**: High
+   - **Description**: Prototype pollution via the `merge` function
+   - **Reachable**: Yes, used in `main.js`
+
+2. **axios@0.21.1** - CVE-2021-3749
+   - **Type**: SSRF (Server-Side Request Forgery)
+   - **Severity**: High
+   - **Description**: Allows SSRF via the request library
+   - **Reachable**: Yes, making HTTP request in `main.js`
+
+3. **serialize-javascript@5.0.1** - CVE-2020-7660
+   - **Type**: XSS (Cross-Site Scripting)
+   - **Severity**: High
+   - **Description**: Allows XSS via object serialization
+   - **Reachable**: Yes, serializing data in `main.js`
+
+4. **minimist@1.2.5** - CVE-2020-7598
+   - **Type**: Prototype Pollution
+   - **Severity**: High
+   - **Description**: Prototype pollution via argument parsing
+   - **Reachable**: Yes, parsing arguments in `main.js`
+
+### High Vulnerabilities
+
+5. **express@4.17.1** - CVE-2022-24999
+   - **Type**: Path Traversal
+   - **Severity**: High
+   - **Description**: Path traversal vulnerability in static file serving
+   - **Reachable**: Yes, serving files in `main.js`
+
+6. **qs@6.5.2** - CVE-2022-24999
+   - **Type**: Prototype Pollution
+   - **Severity**: High
+   - **Description**: Prototype pollution via query string parsing
+   - **Reachable**: Yes, parsing query strings in `main.js`
+
+7. **tar@4.4.8** - CVE-2021-32803, CVE-2021-32804
+   - **Type**: Arbitrary File Overwrite
+   - **Severity**: High
+   - **Description**: Allows arbitrary file overwrite during extraction
+   - **Reachable**: Yes, extracting tar files in `main.js`
+
+8. **yargs-parser@13.1.1** - CVE-2020-7608
+   - **Type**: Prototype Pollution
+   - **Severity**: High
+   - **Description**: Prototype pollution via argument parsing
+   - **Reachable**: Yes, parsing arguments in `main.js`
+
+### Medium Vulnerabilities
+
+9. **underscore@1.12.0** - CVE-2021-23358
+   - **Type**: Template Injection
+   - **Severity**: Medium
+   - **Description**: Arbitrary code execution via template compilation
+   - **Reachable**: Yes, using templates in `main.js`
+
+10. **semver@7.3.2** - CVE-2022-25883
+    - **Type**: ReDoS (Regular Expression Denial of Service)
+    - **Severity**: Medium
+    - **Description**: ReDoS via malformed version strings
+    - **Reachable**: Yes, validating version strings in `main.js`
+
+11. **node-fetch@2.6.1** - CVE-2022-0235
+    - **Type**: Information Disclosure
+    - **Severity**: Medium
+    - **Description**: Allows access to local files via file:// protocol
+    - **Reachable**: Yes, making fetch requests in `main.js`
+
+12. **cookie@0.4.1** - CVE-2020-7656
+    - **Type**: Prototype Pollution
+    - **Severity**: Medium
+    - **Description**: Prototype pollution via cookie parsing
+    - **Reachable**: Yes, parsing cookies in `main.js`
+
+### Low Vulnerabilities
+
+13. **path-parse@1.0.6** - CVE-2021-23343
+    - **Type**: ReDoS
+    - **Severity**: Low
+    - **Description**: ReDoS via malformed path strings
+    - **Reachable**: Yes, parsing paths in `main.js`
+
+14. **ini@1.3.5** - CVE-2020-7788
+    - **Type**: Prototype Pollution
+    - **Severity**: High
+    - **Description**: Prototype pollution via INI file parsing
+    - **Reachable**: Yes, parsing INI data in `main.js`
+
+### Previously Added Vulnerabilities
+
+15. **prismjs@1.29.0** - CVE-2023-40608, CVE-2023-45133
+    - **Type**: XSS
+    - **Severity**: High
+    - **Reachable**: Yes
+
+16. **moment@2.29.4** - CVE-2022-31129
+    - **Type**: Prototype Pollution
+    - **Severity**: High
+    - **Reachable**: Yes
+
+17. **fast-xml-parser@4.2.4** - CVE-2023-28848
+    - **Type**: XXE (XML External Entity)
+    - **Severity**: High
+    - **Reachable**: Yes
+
+18. **got@13.0.0** - CVE-2024-24765
+    - **Type**: SSRF
+    - **Severity**: High
+    - **Reachable**: Yes
+
+19. **immer@9.0.21** - CVE-2023-47132
+    - **Type**: Prototype Pollution
+    - **Severity**: High
+    - **Reachable**: Yes
+
+## Usage
+
+All vulnerable packages are imported and used in `src/main.js` to ensure they are reachable by static analysis tools.
+
+## Testing SCA Tools
+
+This repository is designed to test:
+- Vulnerability detection accuracy
+- Reachability analysis
+- False positive rates
+- Severity assessment
+- CVSS scoring
+- Remediation suggestions
+
+## Yarn Audit Results:
+- **5 total vulnerabilities detected**
+- **1 Critical, 1 High, 2 Moderate, 1 Low**
+
+## Testing Auto-Fix Functionality
+
+Your SCA tool should be able to:
+
+1. **Detect vulnerabilities** in the locked versions (yarn.lock)
+2. **Identify available fixes** within the package.json version ranges
+3. **Generate automatic fixes** by updating the lockfile to use patched versions
+
+### Testing Commands:
+
+```bash
+# Install dependencies (locks vulnerable versions)
+yarn install
+
+# Check for vulnerabilities
+yarn audit
+
+# See what packages can be upgraded
+npm outdated
+
+# Test auto-fix (this would upgrade to fix vulnerabilities)
+yarn upgrade
+```
+
+## Installation
+
+```bash
+yarn install
+```
+
+## Checking Vulnerabilities
+
+```bash
+yarn audit
+```
+
+## Safety Notice
+
+⚠️ **WARNING**: This repository contains intentionally vulnerable code. Do not use in production environments.

package.json

@@ -1,23 +1,43 @@
 {
-  "name": "svelte-app",
+  "name": "verbose-garbanzo",
   "version": "1.0.0",
-  "private": true,
   "scripts": {
-    "build": "rollup -c",
     "dev": "rollup -c -w",
-    "start": "sirv public --no-clear"
+    "build": "rollup -c",
+    "start": "sirv public --single",
+    "audit": "yarn audit",
+    "install-deps": "yarn install"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^17.0.0",
-    "@rollup/plugin-node-resolve": "^11.0.0",
+    "@rollup/plugin-commonjs": "^21.0.1",
+    "@rollup/plugin-node-resolve": "^13.0.6",
     "rollup": "^2.3.4",
     "rollup-plugin-css-only": "^3.1.0",
     "rollup-plugin-livereload": "^2.0.0",
-    "rollup-plugin-svelte": "^7.0.0",
-    "rollup-plugin-terser": "^7.0.0",
-    "svelte": "^3.0.0"
+    "rollup-plugin-svelte": "^7.1.0",
+    "rollup-plugin-terser": "^7.0.2",
+    "sirv-cli": "^2.0.2"
   },
   "dependencies": {
-    "sirv-cli": "^2.0.0"
+    "axios": "^0.21.1",
+    "cookie": "^0.4.1",
+    "express": "^4.17.1",
+    "fast-xml-parser": "^4.2.4",
+    "got": "^13.0.0",
+    "immer": "^9.0.21",
+    "ini": "^1.3.5",
+    "json-schema": "^0.2.3",
+    "lodash": "^4.17.20",
+    "minimist": "^1.2.5",
+    "moment": "^2.29.4",
+    "node-fetch": "^2.6.1",
+    "path-parse": "^1.0.6",
+    "prismjs": "^1.29.0",
+    "qs": "^6.5.2",
+    "semver": "^7.3.2",
+    "serialize-javascript": "^5.0.1",
+    "tar": "^4.4.8",
+    "underscore": "^1.12.0",
+    "yargs-parser": "^13.1.1"
   }
 }

src/main.js

@@ -1,12 +1,100 @@
-import App from './App.svelte';
+import { XMLParser } from "fast-xml-parser";
+import got from "got";
+import { produce } from "immer";
+import moment from "moment";
+import Prism from "prismjs";
+import _ from "lodash";
+import axios from "axios";
+import express from "express";
+import serialize from "serialize-javascript";
+import minimist from "minimist";
+import underscore from "underscore";
+import qs from "qs";
+import tar from "tar";
+import yargs from "yargs-parser";
+import semver from "semver";
+import fetch from "node-fetch";
+import cookie from "cookie";
+import pathParse from "path-parse";
+import ini from "ini";
+import App from "./App.svelte";
 
 const a = 1;
 
+// PrismJS XSS test (CVE-2023-40608, CVE-2023-45133)
+Prism.highlight(
+  "<img src=x onerror=alert(1)>",
+  Prism.languages.javascript,
+  "javascript"
+);
+
+// moment.js prototype pollution test (CVE-2022-31129)
+const polluted = moment.updateLocale("en", { calendar: { sameDay: "h:mm A" } });
+
+// fast-xml-parser XXE test (CVE-2023-28848)
+const parser = new XMLParser();
+parser.parse(
+  '<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]><foo>&xxe;</foo>'
+);
+
+// got SSRF test (CVE-2024-24765)
+got("http://127.0.0.1");
+
+// immer prototype pollution test (CVE-2023-47132)
+produce({ a: 1 }, (draft) => {
+  draft.__proto__.polluted = true;
+});
+
+// lodash prototype pollution (CVE-2020-8203)
+_.merge({}, JSON.parse('{"__proto__":{"polluted":true}}'));
+
+// axios SSRF vulnerability (CVE-2021-3749)
+axios.get("http://localhost:8080/admin");
+
+// express path traversal (CVE-2022-24999)
+const expressApp = express();
+expressApp.get("/files/*", (req, res) => {
+  res.sendFile(req.params[0]);
+});
+
+// serialize-javascript XSS (CVE-2020-7660)
+serialize('</script><script>alert("XSS")</script>');
+
+// minimist prototype pollution (CVE-2020-7598)
+minimist(["--__proto__.polluted", "true"]);
+
+// underscore template injection (CVE-2021-23358)
+underscore.template("<%= data %>");
+
+// qs prototype pollution (CVE-2022-24999)
+qs.parse("__proto__[polluted]=true");
+
+// tar arbitrary file overwrite (CVE-2021-32803, CVE-2021-32804)
+tar.extract({ file: "malicious.tar" });
+
+// yargs-parser prototype pollution (CVE-2020-7608)
+yargs("--foo.__proto__.bar baz");
+
+// semver ReDoS (CVE-2022-25883)
+semver.valid("1.2.3-" + "a".repeat(50000));
+
+// node-fetch information disclosure (CVE-2022-0235)
+fetch("file:///etc/passwd");
+
+// cookie prototype pollution (CVE-2020-7656)
+cookie.parse("__proto__=polluted");
+
+// path-parse ReDoS (CVE-2021-23343)
+pathParse("a".repeat(100000) + ".js");
+
+// ini prototype pollution (CVE-2020-7788)
+ini.parse("[__proto__]\npolluted = true");
+
 const app = new App({
-	target: document.body,
-	props: {
-		name: 'world'
-	}
+  target: document.body,
+  props: {
+    name: "world",
+  },
 });
 
 export default app;