DEF", "ABC

DEF", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "`\"'>

", "`\"'>

", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "\"`'>", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "

", "

", "", "

", "

", "XXX", "

javascript:alert(1)\"` `>", "", "", "<a href=http://foo.bar/#x=`y></a><img alt=\"`><img src=x:x onerror=javascript:alert(1)></a>\">", "", "", "<script src=\"/\\%(jscript)s\"></script>", "<script src=\"\\\\%(jscript)s\"></script>", "<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\">", "<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>", "<IMG SRC=# onmouseover=\"alert('xxs')\">", "<IMG SRC= onmouseover=\"alert('xxs')\">", "<IMG onmouseover=\"alert('xxs')\">", "<IMG SRC=javascript:alert('XSS')>", "<IMG SRC=javascript:alert('XSS')>", "<IMG SRC=javascript:alert('XSS')>", "<IMG SRC=\"jav ascript:alert('XSS');\">", "<IMG SRC=\"jav ascript:alert('XSS');\">", "<IMG SRC=\"jav ascript:alert('XSS');\">", "<IMG SRC=\"jav ascript:alert('XSS');\">", "perl -e 'print \"<IMG SRC=java\\0script:alert(\\\"XSS\\\")>\";' > out", "<IMG SRC=\" javascript:alert('XSS');\">", "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", "<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", "<SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", "<<SCRIPT>alert(\"XSS\");//<</SCRIPT>", "<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >", "<SCRIPT SRC=//ha.ckers.org/.j>", "<IMG SRC=\"javascript:alert('XSS')\"", "<iframe src=http://ha.ckers.org/scriptlet.html <", "\\\";alert('XSS');//", "<plaintext>", "1;DROP TABLE users", "1'; DROP TABLE users-- 1", "' OR 1=1 -- 1", "' OR '1'='1", "-", "--", "--version", "--help", "$USER", "/dev/null; touch /tmp/blns.fail ; echo", "`touch /tmp/blns.fail`", "$(touch /tmp/blns.fail)", "@{[system \"touch /tmp/blns.fail\"]}", "eval(\"puts 'hello world'\")", "System(\"ls -al /\")", "`ls -al /`", "Kernel.exec(\"ls -al /\")", "Kernel.exit(1)", "%x('ls -al /')", "<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]><foo>&xxe;</foo>", "$HOME", "$ENV{'HOME'}", "%d", "%s", "%*.*s", "../../../../../../../../../../../etc/passwd%00", "../../../../../../../../../../../etc/hosts", "() { 0; }; touch /tmp/blns.shellshock1.fail;", "() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; }", "CON", "PRN", "AUX", "CLOCK$", "NUL", "A:", "ZZ:", "COM1", "LPT1", "LPT2", "LPT3", "COM2", "COM3", "COM4", "Scunthorpe General Hospital", "Penistone Community Church", "Lightwater Country Park", "Jimmy Clitheroe", "Horniman Museum", "shitake mushrooms", "RomansInSussex.co.uk", "http://www.cum.qc.ca/", "Craig Cockburn, Software Specialist", "Linda Callahan", "Dr. Herman I. Libshitz", "magna cum laude", "Super Bowl XXX", "medieval erection of parapets", "evaluate", "mocha", "expression", "Arsenal canal", "classic", "Tyson Gay", "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.", "Roses are \u001b[0;31mred\u001b[0m, violets are \u001b[0;34mblue. Hope you enjoy terminal hue", "But now...\u001b[20Cfor my greatest trick...\u001b[8m", "The quic\b\b\b\b\b\bk brown fo\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007x... [Beeeep]", "Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗" ] rev: 6 }] @version = 42 @ranges = [] jobs = for doc in @docs do (doc) => (callback) => DocstoreClient.createDoc @project_id, doc._id, doc.lines, @version, @ranges, (err)=> doc.lines[0] = doc.lines[0]+" added" DocstoreClient.updateDoc @project_id, doc._id, doc.lines, @version, @ranges, callback # Make sure archiving works on deleted docs too jobs.push (cb) => DocstoreClient.deleteDoc @project_id, @docs[2]._id, cb async.series jobs, done afterEach (done) -> db.docs.remove({project_id: @project_id}, done) describe "Archiving all docs", -> beforeEach (done) -> DocstoreClient.archiveAllDoc @project_id, (error, @res) => done() it "should archive all the docs", (done) -> @res.statusCode.should.equal 204 done() it "should set inS3 and unset lines in each doc", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => db.docs.findOne _id: archiveDoc._id, (error, doc) => should.not.exist doc.lines doc.inS3.should.equal true callback() async.series jobs, done it "should be able get the same docs back", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => DocstoreClient.getS3Doc @project_id, archiveDoc._id, (error, res, doc) => doc.toString().should.equal archiveDoc.lines.toString() callback() async.series jobs, done describe "Arching all docs twice", -> beforeEach (done) -> DocstoreClient.archiveAllDoc @project_id, (error, @res) => @res.statusCode.should.equal 204 DocstoreClient.archiveAllDoc @project_id, (error, @res) => @res.statusCode.should.equal 204 done() it "should archive all the docs", (done) -> @res.statusCode.should.equal 204 done() it "should set inS3 and unset lines in each doc", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => db.docs.findOne _id: archiveDoc._id, (error, doc) => should.not.exist doc.lines doc.inS3.should.equal true callback() async.series jobs, done it "should be able get the same docs back", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => DocstoreClient.getS3Doc @project_id, archiveDoc._id, (error, res, doc) => doc.toString().should.equal archiveDoc.lines.toString() callback() async.series jobs, done describe "Archiving a large document", (done)-> beforeEach (done)-> @timeout 1000 * 30 quarterMegInBytes = 250000 lines = require("crypto").randomBytes(quarterMegInBytes).toString("hex") @docs[1].lines = [lines,lines,lines,lines] @version = 42 @ranges = [] DocstoreClient.updateDoc @project_id, @docs[1]._id, @docs[1].lines, @version, @ranges, () => DocstoreClient.archiveAllDoc @project_id, (error, @res) => done() it "should archive all the docs", (done) -> @res.statusCode.should.equal 204 done() it "should set inS3 and unset lines in each doc", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => db.docs.findOne _id: archiveDoc._id, (error, doc) => should.not.exist doc.lines doc.inS3.should.equal true callback() async.series jobs, done it "should be able get the same docs back", (done) -> jobs = for archiveDoc in @docs do (archiveDoc) => (callback) => DocstoreClient.getS3Doc @project_id, archiveDoc._id, (error, res, doc) => doc.toString().should.equal archiveDoc.lines.toString() callback() async.series jobs, done describe "Unarchiving", -> it "should unarchive all the docs", (done) -> non_deleted_docs = @docs.slice(0,2) DocstoreClient.archiveAllDoc @project_id, (error, res) => DocstoreClient.getAllDocs @project_id, (error, res, docs) => throw error if error? docs.length.should.equal non_deleted_docs.length for doc, i in non_deleted_docs doc.lines.should.deep.equal @docs[i].lines done()