diff --git a/.gitignore b/.gitignore index 7118b70..d00ddb0 100644 --- a/.gitignore +++ b/.gitignore @@ -217,6 +217,7 @@ $RECYCLE.BIN/ !dist/ dist/* +packages/*/dist/* !dist/*.zip # End of https://www.toptal.com/developers/gitignore/api/node,macos,windows,linux \ No newline at end of file diff --git a/packages/backend/dist/index.js b/packages/backend/dist/index.js deleted file mode 100644 index 4a8c39f..0000000 --- a/packages/backend/dist/index.js +++ /dev/null @@ -1,81 +0,0 @@ -// packages/backend/src/controller/implictGrant.ts -var ImplicitGrantController = class { - isImplicitGrantReq(req) { - const query = req.getQuery(); - if (query.includes("client_id=") && query.includes("response_type=token")) { - return true; - } - return false; - } - isSendTokenToClient(req) { - const path = req.getPath(); - const query = req.getQuery(); - if (query.includes("access_token=") && query.includes("state=") || path.includes("&access_token=") || /access_token=%/i.test(query)) { - return true; - } - return false; - } - testReq(req) { - if (this.isImplicitGrantReq(req)) { - return "isImplicitGrantReq"; - } - if (this.isSendTokenToClient(req)) { - return "isSendTokenToClient"; - } - return false; - } -}; - -// packages/backend/src/controller/authZCodeGrant.ts -var AuthZCodeGrantController = class { - constructor() { - } - isAuthZReq(req) { - const query = req.getQuery(); - if (query.includes("client_id=") && query.includes("response_type=code")) { - return true; - } - return false; - } - isSendCodeToClient(req) { - const path = req.getPath(); - const query = req.getQuery(); - if (query.includes("code=") && query.includes("state=") || path.includes("&code=") || /code=%/i.test(query)) { - return true; - } - return false; - } - testReq(req) { - if (this.isAuthZReq(req)) { - return "isAuthZReq"; - } - if (this.isSendCodeToClient(req)) { - return "isSendCodeToClient"; - } - return false; - } - // isAccessTokenReq(req: Response) { - // } -}; - -// packages/backend/src/index.ts -var implicitGrantController = new ImplicitGrantController(); -var authZCodeGrantController = new AuthZCodeGrantController(); -function init(sdk) { - sdk.events.onInterceptRequest(async (sdk2, req) => { - const result = authZCodeGrantController.testReq(req) || implicitGrantController.testReq(req); - if (result) { - await sdk2.findings.create({ - title: "Possible SSO Request Detected", - description: `SSO-related parameters detected in request: - -${req.getMethod()} ${req.getUrl()} : ${result}`, - request: req, - reporter: "" - }); - } - }); -} -export { - init -};