Merge pull request pwndoc#457 from pwndoc/codequality

Improved code quality (based on CodeQL)
AmadeusITGroup · Apr 10, 2023 · ac74fa4 · ac74fa4
2 parents 38e18d8 + 7886658
commit ac74fa4
Show file tree

Hide file tree

Showing 19 changed files with 34 additions and 42 deletions.
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
@@ -2,6 +2,11 @@ name: "PwnDoc CodeQL config"
 
 queries:
   - uses: security-and-quality
+  - uses: security-extended
+
+query-filters:
+  - exclude:
+      id: js/missing-rate-limiting
 
 paths:
   - backend

diff --git a/backend/src/app.js b/backend/src/app.js
@@ -47,14 +47,14 @@ require('./models/settings');
 // Socket IO configuration
 io.on('connection', (socket) => {
   socket.on('join', (data) => {
-    console.log(`user ${data.username} joined room ${data.room}`)
+    console.log(`user ${data.username.replace(/\n|\r/g, "")} joined room ${data.room.replace(/\n|\r/g, "")}`)
     socket.username = data.username;
     do { socket.color = '#'+(0x1000000+(Math.random())*0xffffff).toString(16).substr(1,6); } while (socket.color === "#77c84e")
     socket.join(data.room);
     io.to(data.room).emit('updateUsers');
   });
   socket.on('leave', (data) => {
-    console.log(`user ${data.username} left room ${data.room}`)
+    console.log(`user ${data.username.replace(/\n|\r/g, "")} left room ${data.room.replace(/\n|\r/g, "")}`)
     socket.leave(data.room)
     io.to(data.room).emit('updateUsers');
   })

diff --git a/backend/src/lib/custom-generator.js b/backend/src/lib/custom-generator.js
@@ -15,8 +15,6 @@ var filters = {};
 
 // Convert input CVSS criteria into French: {input | criteriaFR}
 expressions.filters.criteriaFR = function(input) {
-    var pre = '<w:p><w:r><w:t>';
-    var post = '</w:t></w:r></w:p>';
     var result = "Non défini"
 
     if (input === "Network") result = "Réseau"
@@ -30,7 +28,6 @@ expressions.filters.criteriaFR = function(input) {
     else if (input === "Unchanged") result = "Inchangé"
     else if (input === "Changed") result = "Changé"
 
-    // return pre + result + post;
     return result;
 }
 

diff --git a/backend/src/lib/report-generator.js b/backend/src/lib/report-generator.js
@@ -63,7 +63,7 @@ async function generateDoc(audit) {
             }
             return [width,height];
         }
-        return [0,0]
+        return [0,0];
     }
 
     if (settings.report.private.imageBorder && settings.report.private.imageBorderColor)
@@ -425,7 +425,7 @@ async function prepAuditData(data, settings) {
     result.date_start = data.date_start || "undefined"
     result.date_end = data.date_end || "undefined"
     if (data.customFields) {
-        for (field of data.customFields) {
+        for (var field of data.customFields) {
             var fieldType = field.customField.fieldType
             var label = field.customField.label
 
@@ -469,7 +469,7 @@ async function prepAuditData(data, settings) {
     result.scope = data.scope.toObject() || []
 
     result.findings = []
-    for (finding of data.findings) {
+    for (var finding of data.findings) {
         var tmpCVSS = CVSS31.calculateCVSSFromVector(finding.cvssv3);
         var tmpFinding = {
             title: finding.title || "",
@@ -571,7 +571,7 @@ async function prepAuditData(data, settings) {
         result.creator.role = data.creator.role || "undefined"
     }
 
-    for (section of data.sections) {
+    for (var section of data.sections) {
         var formatSection = { 
             name: $t(section.name)
         }
@@ -600,7 +600,7 @@ async function splitHTMLParagraphs(data) {
 
     var splitted = data.split(/(<img.+?src=".*?".+?alt=".*?".*?>)/)
 
-    for (value of splitted){
+    for (var value of splitted){
         if (value.startsWith("<img")) {
             var src = value.match(/<img.+src="(.*?)"/) || ""
             var alt = value.match(/<img.+alt="(.*?)"/) || ""

diff --git a/backend/src/models/settings.js b/backend/src/models/settings.js
@@ -1,6 +1,5 @@
 var mongoose = require('mongoose');//.set('debug', true);
 var Schema = mongoose.Schema;
-var fs = require('fs');
 var _ = require('lodash');
 var Utils = require('../lib/utils.js');
 

diff --git a/backend/src/models/user.js b/backend/src/models/user.js
@@ -138,7 +138,7 @@ UserSchema.statics.updateProfile = function (username, user) {
                 payload.lastname = row.lastname;
                 payload.email = row.email;
                 payload.phone = row.phone;
-                payload.roles = auth.acl.getRoles(payload.role)
+                payload.roles = auth.acl.getRoles(payload.role);
 
                 return row.save();
             }

diff --git a/backend/src/models/vulnerability.js b/backend/src/models/vulnerability.js
@@ -222,7 +222,7 @@ VulnerabilitySchema.statics.Merge = (vulnIdPrime, vulnIdMerge, locale) => {
             if (mergeDetail.description) detail.description = mergeDetail.description;
             if (mergeDetail.observation) detail.observation = mergeDetail.observation;
             if (mergeDetail.remediation) detail.remediation = mergeDetail.remediation;
-            if (mergeDetail.customFields) detail.customFields = mergeDetail.customFields
+            if (mergeDetail.customFields) detail.customFields = mergeDetail.customFields;
             primeVuln.details.push(detail);
             return primeVuln.save();
         })

diff --git a/backend/src/routes/audit.js b/backend/src/routes/audit.js
@@ -72,7 +72,7 @@ module.exports = function(app, io) {
         Audit.delete(acl.isAllowed(req.decodedToken.role, 'audits:delete-all'), req.params.auditId, req.decodedToken.id)
         .then(msg => Response.Ok(res, msg))
         .catch(err => Response.Internal(res, err))
-    })
+    });
 
     /* ### AUDITS EDIT ### */
 
@@ -150,7 +150,7 @@ module.exports = function(app, io) {
 
             // If the new collaborator already gave a review, remove said review, accept collaborator
             if (audit.approvals) {
-                newApprovals = audit.approvals.filter((approval) => !req.body.collaborators.some((collaborator) => approval.toString() === collaborator._id));
+                var newApprovals = audit.approvals.filter((approval) => !req.body.collaborators.some((collaborator) => approval.toString() === collaborator._id));
                 update.approvals = newApprovals;
             }
         }
@@ -354,7 +354,7 @@ module.exports = function(app, io) {
         .then(msg => {
             Response.Ok(res, msg)
         })
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Generate Report for specific audit
@@ -430,7 +430,7 @@ module.exports = function(app, io) {
             io.to(req.params.auditId).emit('updateAudit');
             Response.Ok(res, msg)
         })
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Give or remove a reviewer's approval to an audit
@@ -522,6 +522,6 @@ module.exports = function(app, io) {
             io.to(req.params.auditId).emit('updateAudit');
             Response.Ok(res, msg)
         })
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 }
diff --git a/backend/src/routes/client.js b/backend/src/routes/client.js
@@ -33,7 +33,7 @@ module.exports = function(app) {
 
         Client.create(client, company)
         .then(msg => Response.Created(res, msg))
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Update client
@@ -51,7 +51,7 @@ module.exports = function(app) {
 
         Client.update(req.params.id, client, company)
         .then(msg => Response.Ok(res, 'Client updated successfully'))
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Delete client

diff --git a/backend/src/routes/template.js b/backend/src/routes/template.js
@@ -103,5 +103,5 @@ module.exports = function(app) {
             res.download(file, `${data.name}.${data.ext}`)
         })
         .catch(err => Response.Internal(res, err))
-    })
+    });
 }
diff --git a/backend/src/routes/user.js b/backend/src/routes/user.js
@@ -188,7 +188,7 @@ module.exports = function(app) {
 
         User.create(user)
         .then(msg => Response.Created(res, 'User created successfully'))
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Create First User
@@ -231,7 +231,7 @@ module.exports = function(app) {
             else
                 Response.Forbidden(res, 'Already Initialized');
         })        
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Update my profile
@@ -268,7 +268,7 @@ module.exports = function(app) {
             res.cookie('token', msg.token, {secure: true, httpOnly: true})
             Response.Ok(res, msg)
         })
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 
     // Update any user (admin only)
@@ -292,6 +292,6 @@ module.exports = function(app) {
 
         User.updateUser(req.params.id, user)
         .then(msg => Response.Ok(res, msg))
-        .catch(err => Response.Internal(res, err))
+        .catch(err => Response.Internal(res, err));
     });
 }
diff --git a/backend/src/routes/vulnerability.js b/backend/src/routes/vulnerability.js
@@ -188,5 +188,5 @@ module.exports = function(app) {
         Vulnerability.Merge(req.params.vulnId, req.body.vulnId, req.body.locale)
         .then(() => Response.Ok(res, 'Vulnerability merge successfully'))
         .catch(err => Response.Internal(res, err))
-    })
+    });
 }
diff --git a/frontend/src/i18n/de-DE/index.js b/frontend/src/i18n/de-DE/index.js
@@ -365,7 +365,6 @@ export default {
     export: 'Export',
     hostsAssociateScopes: 'Importierte Hosts mit Geltungsbereichen assoziieren',
     handleCustomData: 'Handle Custom Data',
-    companies: 'Firmen',
     clients: 'Kunden',
     templates: 'Vorlagen',
     addClient: 'Kunde hinzufügen',
@@ -441,7 +440,6 @@ export default {
     auditSection: 'Auditabschnitte',
     vulnerability: 'Vulnerability',
     checkbox: 'Checkbox',
-    date: 'Datum',
     editor: 'Editor',
     input: 'Eingabe',
     radio: 'Radio',

diff --git a/frontend/src/i18n/en-US/index.js b/frontend/src/i18n/en-US/index.js
@@ -371,7 +371,6 @@ export default {
     export: 'Export',
     hostsAssociateScopes: 'Associate imported hosts with Scopes',
     handleCustomData: 'Handle Custom Data',
-    companies: 'Companies',
     clients: 'Clients',
     templates: 'Templates',
     addClient: 'Add Client',
@@ -447,7 +446,6 @@ export default {
     auditSection: 'Audit Section',
     vulnerability: 'Vulnerability',
     checkbox: 'Checkbox',
-    date: 'Date',
     editor: 'Editor',
     input: 'Input',
     radio: 'Radio',

diff --git a/frontend/src/i18n/fr-FR/index.js b/frontend/src/i18n/fr-FR/index.js
@@ -225,7 +225,6 @@ export default {
     export: 'Exporter',
     hostsAssociateScopes: 'Associer des hôtes "importés" au périmètre défini',
     handleCustomData: 'Gérer les Données Personnalisées',
-    companies: 'Entreprises',
     clients: 'Clients',
     templates: 'Modèles',
     addClient: 'Ajouter un Client',
@@ -301,7 +300,6 @@ export default {
     auditSection: 'Section d\'Audit',
     vulnerability: 'Vulnerabilité',
     checkbox: 'Checkbox',
-    date: 'Date',
     editor: 'Editeur',
     input: 'Input',
     radio: 'Radio',

diff --git a/frontend/src/i18n/zh-CN/index.js b/frontend/src/i18n/zh-CN/index.js
@@ -370,7 +370,6 @@ export default {
     export: '导出',
     hostsAssociateScopes: '将导入的主机与范围关联',
     handleCustomData: '处理自定义数据',
-    companies: '公司',
     clients: '客户',
     templates: '模板',
     addClient: '添加客户',
@@ -446,7 +445,6 @@ export default {
     auditSection: '审计编辑 -  段落',
     vulnerability: '漏洞编辑',
     checkbox: '复选框',
-    date: '日期',
     editor: '编辑器',
     input: '输入框',
     radio: '单选框',

diff --git a/frontend/src/pages/audits/edit/index.vue b/frontend/src/pages/audits/edit/index.vue
@@ -253,7 +253,6 @@ export default {
 					vulnCategories: [],
 					customFields: [],
 					auditTypes: [],
-					vulnCategories: [],
 					findingList: [],
 					frontEndAuditState: Utils.AUDIT_VIEW_STATE.EDIT_READONLY,
 					AUDIT_VIEW_STATE: Utils.AUDIT_VIEW_STATE

diff --git a/frontend/src/pages/audits/edit/network/network.js b/frontend/src/pages/audits/edit/network/network.js
@@ -231,16 +231,16 @@ export default {
                     color: 'positive',
                     textColor:'white',
                     position: 'top-right'
-                })
+                });
             }
             catch (err) {
-                console.log(err)
+                console.log(err);
                 Notify.create({
                     message: 'Error parsing Nmap',
                     color: 'negative',
                     textColor:'white',
                     position: 'top-right'
-                })
+                });
             }
         },
 
@@ -321,16 +321,16 @@ export default {
                     color: 'positive',
                     textColor:'white',
                     position: 'top-right'
-                })
+                });
             }
             catch (err) {
-                console.log(err)
+                console.log(err);
                 Notify.create({
                     message: 'Error parsing Nessus',
                     color: 'negative',
                     textColor:'white',
                     position: 'top-right'
-                })
+                });
             }
         }
     }

diff --git a/frontend/src/pages/data/templates/templates.js b/frontend/src/pages/data/templates/templates.js
@@ -73,7 +73,7 @@ export default {
         downloadTemplate: function(row) {
             TemplateService.downloadTemplate(row._id)
             .then((data) => {
-                status = exportFile(`${row.name}.${row.ext || 'docx'}`, data.data, {type: "application/octet-stream"})
+                var status = exportFile(`${row.name}.${row.ext || 'docx'}`, data.data, {type: "application/octet-stream"})
                 if (!status)
                     throw (status)
             })
-Original file line number
+Diff line change
@@ Expand Up / @@ -103,5 +103,5 @@ module.exports = function(app) { @@
                 res.download(file, `${data.name}.${data.ext}`)
             })
             .catch(err => Response.Internal(res, err))
-        })
+        });
     }