Gsoc challenge 2/integer overflow

config/default.yml

@@ -412,6 +412,10 @@ memories:
     caption: 'My old workplace...'
     geoStalkingVisualSecurityQuestion: 10
     geoStalkingVisualSecurityAnswer: 'ITsec'
+  -
+    image: 'bee.png'
+    caption: 'Juice Shop is now cooler😎'
+    user: bjoernGoogle
 ctf:
   showFlagsInNotifications: false
   showCountryDetailsInNotifications: none # Options: none  name  flag  both

data/static/challenges.yml

@@ -93,6 +93,17 @@
   hintUrl: ''
   mitigationUrl: ~
   key: nftUnlockChallenge
+-
+  name: 'Mint the Honey Pot'
+  category: 'Sensitive Data Exposure'
+  tags:
+    - Security Misconfiguration
+  description: 'Mint the Honey Pot NFT by gathering BEEs from the bee owner.'
+  difficulty: 3
+  hint: 'Extract more BEEs than the owner has.'
+  hintUrl: ''
+  mitigationUrl: ~
+  key: nftMintChallenge
 -
   name: 'Blocked RCE DoS'
   category: 'Insecure Deserialization'

frontend/angular.json

@@ -30,7 +30,11 @@
               "node_modules/flag-icons/sass/flag-icons.scss",
               "node_modules/font-mfizz/dist/font-mfizz.css",
               "node_modules/highlight.js/styles/github.css",
-              "node_modules/ngx-spinner/animations/timer.css"
+              "node_modules/ngx-spinner/animations/timer.css",
+              "node_modules/codemirror/lib/codemirror.css",
+              "node_modules/codemirror/theme/dracula.css",
+              "node_modules/codemirror/theme/material.css"
+
             ],
             "allowedCommonJsDependencies": [
               "jwt-decode",

frontend/package.json

@@ -12,6 +12,7 @@
   },
   "private": true,
   "dependencies": {
+    "@agnostico/browser-solidity-compiler": "^0.1.1",
     "@angular-devkit/build-angular": "^15.0.4",
     "@angular-material-extensions/password-strength": "^6.0.0",
     "@angular/animations": "^15.0.4",
@@ -28,16 +29,22 @@
     "@angular/platform-browser": "^15.0.4",
     "@angular/platform-browser-dynamic": "^15.0.4",
     "@angular/router": "^15.0.4",
+    "@ctrl/ngx-codemirror": "^6.1.0",
     "@fortawesome/fontawesome-svg-core": "~1.2.30",
     "@fortawesome/free-brands-svg-icons": "^5.14.0",
     "@fortawesome/free-regular-svg-icons": "^5.14.0",
     "@fortawesome/free-solid-svg-icons": "^5.14.0",
     "@nguniversal/express-engine": "10.0.1",
     "@ngx-translate/core": "^13.0.0",
     "@ngx-translate/http-loader": "^6.0.0",
+    "@remix-project/remix-solidity": "^0.5.15",
+    "@wagmi/core": "^0.5.8",
     "anuglar2-qrcode": "~2.0.3",
     "canvas-confetti": "^1.4.0",
+    "codemirror": "^5.65.13",
+    "codemirror-solidity": "^0.2.5",
     "core-js": "^3.22.5",
+    "ethers": "^5.7.2",
     "file-saver": "^2.0.2",
     "flag-icons": "^6.6.4",
     "font-mfizz": "^2.4.1",
@@ -56,7 +63,9 @@
     "sass": "^1.32.2",
     "snarkdown": "^1.2.2",
     "socket.io-client": "^3.1.0",
+    "solc": "^0.8.20",
     "typescript": "~4.8.4",
+    "url": "^0.11.1",
     "zone.js": "~0.11.4"
   },
   "devDependencies": {
@@ -72,7 +81,9 @@
     "@typescript-eslint/eslint-plugin": "^4.11.0",
     "@typescript-eslint/eslint-plugin-tslint": "^4.11.0",
     "@typescript-eslint/parser": "^4.11.0",
+    "assert": "^2.0.0",
     "codelyzer": "^6.0.0",
+    "crypto-browserify": "^3.12.0",
     "eslint": "^7.16.0",
     "eslint-config-prettier": "7.1.0",
     "eslint-config-standard-with-typescript": "^21.0.1",
@@ -81,6 +92,7 @@
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^4.2.1",
     "eslint-plugin-standard": "^4.1.0",
+    "https-browserify": "^1.0.0",
     "jasmine": "^3.9.0",
     "jasmine-core": "~3.9.0",
     "jasmine-spec-reporter": "~7.0.0",
@@ -89,6 +101,10 @@
     "karma-coverage": "^2.0.3",
     "karma-jasmine": "~4.0.1",
     "karma-jasmine-html-reporter": "^1.7.0",
+    "os-browserify": "^0.3.0",
+    "path-browserify": "^1.0.1",
+    "stream-browserify": "^3.0.0",
+    "stream-http": "^3.2.0",
     "stylelint": "^13.8.0",
     "stylelint-config-sass-guidelines": "^7.1.0",
     "stylelint-scss": "^3.18.0",

frontend/src/app/Services/keys.service.ts

@@ -20,6 +20,22 @@ export class KeysService {
       })
     )
   }
+  nftMinted () {
+    return this.http.get(this.host + '/nftMinted').pipe(
+      map((response: any) => response),
+      catchError((err) => {
+        throw err
+      })
+    )
+  }
+  checkNftMinted () {
+    return this.http.get(this.host + '/checkNftMinted').pipe(
+      map((response: any) => response),
+      catchError((err) => {
+        throw err
+      })
+    )
+  }
 
   submitKey (privateKey: string) {
     const endpoint = this.host + '/submitKey'

frontend/src/app/app.module.ts

@@ -139,6 +139,12 @@ import { CodeSnippetComponent } from './code-snippet/code-snippet.component'
 import { CodeAreaComponent } from './code-area/code-area.component'
 import { NgxTextDiffModule } from 'ngx-text-diff'
 import { CodeFixesComponent } from './code-fixes/code-fixes.component'
+import { WalletconnectComponent } from './walletconnect/walletconnect.component'
+import { CodemirrorModule } from "@ctrl/ngx-codemirror"
+import "codemirror/mode/javascript/javascript";
+import "codemirror/mode/markdown/markdown";
+import "codemirror-solidity/solidity";
+
 
 export function HttpLoaderFactory (http: HttpClient) {
   return new TranslateHttpLoader(http, './assets/i18n/', '.json')
@@ -202,9 +208,11 @@ export function HttpLoaderFactory (http: HttpClient) {
     FeedbackDetailsComponent,
     CodeSnippetComponent,
     CodeAreaComponent,
-    CodeFixesComponent
+    CodeFixesComponent,
+    WalletconnectComponent
   ],
   imports: [
+    CodemirrorModule,
     BrowserModule,
     Routing,
     TranslateModule.forRoot(

frontend/src/app/app.routing.ts

@@ -42,6 +42,7 @@ import { PhotoWallComponent } from './photo-wall/photo-wall.component'
 import { DeluxeUserComponent } from './deluxe-user/deluxe-user.component'
 import { AccountingGuard, AdminGuard, LoginGuard } from './app.guard'
 import { NFTUnlockComponent } from './nft-unlock/nft-unlock.component'
+import { WalletconnectComponent } from "./walletconnect/walletconnect.component";
 
 // vuln-code-snippet start adminSectionChallenge scoreBoardChallenge
 const routes: Routes = [
@@ -55,6 +56,10 @@ const routes: Routes = [
     component: AccountingComponent,
     canActivate: [AccountingGuard]
   },
+  {
+    path: 'wallet-poc',
+    component: WalletconnectComponent
+  },
   {
     path: 'about',
     component: AboutComponent

frontend/src/app/nft-unlock/nft-unlock.component.scss

@@ -59,6 +59,9 @@ mat-card:nth-child(1) {
 .box-text {
   margin-top: 8px;
 }
+.form-group{
+  margin-top: 16px;
+}
 
 .form-group {
   display: flex;

frontend/src/app/photo-wall/photo-wall.component.html

@@ -3,67 +3,101 @@
   ~ SPDX-License-Identifier: MIT
   -->
 
-<mat-card class="heading mat-elevation-z6 mat-own-card" style="margin-bottom:10px;">
-  <h1>{{"LABEL_PHOTO_WALL" | translate}}</h1>
+<mat-card
+  class="heading mat-elevation-z6 mat-own-card"
+  style="margin-bottom: 10px"
+>
+  <h1>{{ "LABEL_PHOTO_WALL" | translate }}</h1>
   <div>
     <div class="grid" *ngIf="!emptyState; else emptyResult">
-                <span *ngFor="let image of slideshowDataSource" class="container mat-elevation-z6">
-                    <img src="{{ image.url }}" alt="{{ image.caption }}" class="image">
-                    <div class="overlay">
-                        <div>{{ image.caption }}</div>
-                        <a *ngIf="twitterHandle"
-                           href="https://twitter.com/intent/tweet?text={{ image.caption }} {{ twitterHandle }}&hashtags=appsec"
-                           target="_blank">
-                            <button mat-icon-button aria-label="Tweet">
-                                <i class="fab fa-twitter fa-lg"></i>
-                            </button>
-                         </a>
-                    </div>
-                </span>
+      <span
+        *ngFor="let image of slideshowDataSource"
+        class="container mat-elevation-z6"
+      >
+        <img src="{{ image.url }}" alt="{{ image.caption }}" class="image" />
+        <div class="overlay">
+          <div>{{ image.caption }}</div>
+          <ng-container
+            *ngIf="image.caption.includes('Juice Shop is now cooler')"
+          >
+            <a href="/#/wallet-poc">
+              <button mat-icon-button aria-label="Visit">
+                <i class="material-icons"> open_in_new </i>
+              </button>
+            </a>
+          </ng-container>
+          <ng-container
+            *ngIf="!image.caption.includes('Juice Shop is now cooler')"
+          >
+            <a
+              href="https://twitter.com/intent/tweet?text={{ image.caption }} {{
+                twitterHandle
+              }}&hashtags=appsec"
+              target="_blank"
+            >
+              <button mat-icon-button aria-label="Tweet">
+                <i class="fab fa-twitter fa-lg"></i>
+              </button>
+            </a>
+          </ng-container>
+        </div>
+      </span>
     </div>
   </div>
 
   <ng-template #emptyResult>
     <mat-card class="mat-elevation-z0 emptyState">
-      <img alt=" No results found"
-           class="img-responsive noResult"
-           src="assets/public/images/products/no-results.png">
+      <img
+        alt=" No results found"
+        class="img-responsive noResult"
+        src="assets/public/images/products/no-results.png"
+      />
       <mat-card-title>
-            <span class="noResultText" translate>
-                NO_SEARCH_RESULT
-            </span>
+        <span class="noResultText" translate> NO_SEARCH_RESULT </span>
       </mat-card-title>
       <mat-card-content>
-            <span class="noResultText" translate>
-                EMPTY_MEMORY_LIST
-            </span>
+        <span class="noResultText" translate> EMPTY_MEMORY_LIST </span>
       </mat-card-content>
     </mat-card>
   </ng-template>
 
   <div *ngIf="isLoggedIn()">
-    <div style="margin-top: 10px;">
+    <div style="margin-top: 10px">
       <h2 translate>LABEL_SHARE_A_MEMORY</h2>
       <form [formGroup]="form" enctype="multipart/form-data">
         <div>
-          <button mat-stroked-button type="button" (click)="filePicker.click()">{{'LABEL_PICK_IMAGE' | translate}}
+          <button mat-stroked-button type="button" (click)="filePicker.click()">
+            {{ "LABEL_PICK_IMAGE" | translate }}
           </button>
-          <input type="file" name='file' #filePicker (change)="onImagePicked($event)">
+          <input
+            type="file"
+            name="file"
+            #filePicker
+            (change)="onImagePicked($event)"
+          />
         </div>
-        <div class="image-preview" *ngIf="imagePreview !== '' && imagePreview && form.get('image').valid">
-          <img [src]="imagePreview" [alt]="form.value.caption">
+        <div
+          class="image-preview"
+          *ngIf="imagePreview !== '' && imagePreview && form.get('image').valid"
+        >
+          <img [src]="imagePreview" [alt]="form.value.caption" />
         </div>
         <mat-form-field appearance="outline" color="accent">
           <mat-label translate>LABEL_CAPTION</mat-label>
-          <input formControlName="caption" type="text" matInput>
-          <mat-error *ngIf="form.get('caption').invalid" translate>{{'MANDATORY_CAPTION' | translate}}</mat-error>
+          <input formControlName="caption" type="text" matInput />
+          <mat-error *ngIf="form.get('caption').invalid" translate>{{
+            "MANDATORY_CAPTION" | translate
+          }}</mat-error>
         </mat-form-field>
-        <button id="submitButton" mat-raised-button color="primary" (click)="save()"
-                [disabled]="form.get('image').invalid || form.get('caption').invalid">
-          <i class="material-icons">
-          send
-          </i>
-          {{'BTN_SUBMIT' | translate}}
+        <button
+          id="submitButton"
+          mat-raised-button
+          color="primary"
+          (click)="save()"
+          [disabled]="form.get('image').invalid || form.get('caption').invalid"
+        >
+          <i class="material-icons"> send </i>
+          {{ "BTN_SUBMIT" | translate }}
         </button>
       </form>
     </div>