From 38a995b921b9dd403a872e77f735d7671c234384 Mon Sep 17 00:00:00 2001 From: Josh Buker Date: Sun, 24 Apr 2022 23:09:48 -0700 Subject: [PATCH] Implement issue creation via edit button I suspect CSURF isn't actually doing its job and preventing CSRF attacks. Will definitely want to address that before deploying this code. --- gsd-web-demo/package.json | 1 + gsd-web-demo/quasar.conf.js | 4 +- .../src-ssr/middlewares/body-parser.js | 7 + .../src-ssr/middlewares/github-proxy.js | 57 +++ gsd-web-demo/src/components/EditDialog.vue | 53 ++- gsd-web-demo/src/layouts/MainLayout.vue | 4 +- gsd-web-demo/src/misc/ErrorNotification.js | 16 + gsd-web-demo/src/pages/Identifier.vue | 19 +- gsd-web-demo/yarn.lock | 429 +++++++++++++++++- 9 files changed, 562 insertions(+), 28 deletions(-) create mode 100644 gsd-web-demo/src-ssr/middlewares/body-parser.js create mode 100644 gsd-web-demo/src/misc/ErrorNotification.js diff --git a/gsd-web-demo/package.json b/gsd-web-demo/package.json index 4084c9a..c6a9970 100644 --- a/gsd-web-demo/package.json +++ b/gsd-web-demo/package.json @@ -21,6 +21,7 @@ "cookie-session": "^2.0.0", "core-js": "^3.6.5", "csurf": "^1.11.0", + "octokit": "^1.7.1", "prismjs": "^1.25.0", "quasar": "^2.0.0", "vue": "^3.0.0", diff --git a/gsd-web-demo/quasar.conf.js b/gsd-web-demo/quasar.conf.js index d32e8e4..f32994f 100644 --- a/gsd-web-demo/quasar.conf.js +++ b/gsd-web-demo/quasar.conf.js @@ -104,7 +104,8 @@ module.exports = configure(function (ctx) { // Quasar plugins plugins: [ 'Cookies', - 'Dialog' + 'Dialog', + 'Notify' ] }, @@ -132,6 +133,7 @@ module.exports = configure(function (ctx) { middlewares: [ ctx.prod ? 'compression' : '', + 'body-parser', 'cookie-sessions', 'csrf-protection', 'github-proxy', diff --git a/gsd-web-demo/src-ssr/middlewares/body-parser.js b/gsd-web-demo/src-ssr/middlewares/body-parser.js new file mode 100644 index 0000000..c6d684e --- /dev/null +++ b/gsd-web-demo/src-ssr/middlewares/body-parser.js @@ -0,0 +1,7 @@ +import bodyParser from 'body-parser' +import { ssrMiddleware } from 'quasar/wrappers' + +export default ssrMiddleware(({ app }) => { + app.use(bodyParser.json()) + app.use(bodyParser.urlencoded({ extended: false })) +}) diff --git a/gsd-web-demo/src-ssr/middlewares/github-proxy.js b/gsd-web-demo/src-ssr/middlewares/github-proxy.js index aed549d..c87d29e 100644 --- a/gsd-web-demo/src-ssr/middlewares/github-proxy.js +++ b/gsd-web-demo/src-ssr/middlewares/github-proxy.js @@ -1,9 +1,25 @@ import axios from 'axios' import { ssrMiddleware } from 'quasar/wrappers' +import { Octokit } from 'octokit' const githubClientID = process.env.GSD_GITHUB_KEY const githubClientSecret = process.env.GSD_GITHUB_SECRET +async function createFork(octokit) { + return await octokit.rest.forks.create({ + owner: 'cloudsecurityalliance', + repo: 'gsd-database' + }) +} + +async function createBranch(octokit) { + // TODO: Allow multiple edits without overwriting existing edits + const branchPrefix = `automated/${identifier}` + const editNumber = 1 + const branchName = `${branchPrefix}/${editNumber}` + // octokit.rest.branches. +} + export default ssrMiddleware(async ({ app, resolve }) => { app.get(resolve.urlPath('/oauth/callback/github'), async (req, res) => { try { @@ -50,4 +66,45 @@ export default ssrMiddleware(async ({ app, resolve }) => { req.session = null res.json({ message: 'Session destroyed' }) }) + + // FIXME: Seems like CSURF is doing literally nothing + app.patch(resolve.urlPath('/update-gsd'), async (req, res) => { + if(!req.session.access_token) { + res.status(403).send('Login first!') + return + } + + try { + const octokit = new Octokit({ auth: req.session.access_token }); + + console.log(req.body) + + const identifier = req.body.identifier + const fileContent = req.body.file_content + + const issueTitle = `Update Request - ${identifier}` + const issueBody = + '**Automated Edit Request**\n\n' + + `For: "${identifier}"\n\n` + + `\`\`\`json\n${fileContent}\n\`\`\`` + + // await createFork(octokit) + // await createBranch(octokit) + // await updateFile(octokit) + // await submitPullRequest(octokit) + + // FIXME: Labels don't appear to work via this method, perhaps have the bot auto add them? + const response = await octokit.rest.issues.create({ + owner: 'cloudsecurityalliance', + repo: 'gsd-database', + title: issueTitle, + body: issueBody + }) + + res.json({ redirect_url: response.data['html_url'] }) + } catch(error) { + console.log(error) + res.send('broke') + } + }) }) diff --git a/gsd-web-demo/src/components/EditDialog.vue b/gsd-web-demo/src/components/EditDialog.vue index 97d1cf0..18b4ff3 100644 --- a/gsd-web-demo/src/components/EditDialog.vue +++ b/gsd-web-demo/src/components/EditDialog.vue @@ -26,8 +26,11 @@