A R R R Associates
44 lines
2.2 KiB
JavaScript
44 lines
2.2 KiB
JavaScript
const { test, expect, request } = require('@playwright/test');
|
|
require('dotenv').config();
|
|
const { login, fillFirst, clickFirst } = require('../fixtures/auth');
|
|
const { expectBlockedOrSafe, expectNoServerError, expectSecurityHeaders } = require('../fixtures/assertions');
|
|
|
|
test('VAPT-TARGET-001 security headers on login', async ({ page }) => {
|
|
const resp = await page.goto('/login');
|
|
await expectSecurityHeaders(resp);
|
|
});
|
|
|
|
test('VAPT-TARGET-002 unauthorized protected URL redirects or blocks', async ({ page }) => {
|
|
const resp = await page.goto('/notice-cases');
|
|
await expectBlockedOrSafe(page, resp);
|
|
});
|
|
|
|
test('VAPT-TARGET-003 CSRF negative request should not create case', async () => {
|
|
const api = await request.newContext({ baseURL: process.env.BASE_URL });
|
|
const resp = await api.post('/notice-cases/new', { form: { title: 'csrf-negative', reference_no: 'CSRF-NEG' } });
|
|
expect([400,401,403,404,405,422,303].includes(resp.status())).toBeTruthy();
|
|
});
|
|
|
|
test('VAPT-TARGET-004 basic XSS payload should not execute in notice case list', async ({ page }) => {
|
|
await login(page, 'System Admin');
|
|
await page.goto('/notice-cases');
|
|
await expectNoServerError(page);
|
|
const body = await page.locator('body').innerText().catch(()=>'');
|
|
expect(body).not.toContain('<script>alert(1)</script>');
|
|
});
|
|
|
|
test('VAPT-TARGET-005 OTP brute force does not crash and should throttle/block', async ({ page }) => {
|
|
await page.goto('/login');
|
|
await fillFirst(page, ['input[name="email"]','input[name="login_id"]','input[type="email"]'], process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local');
|
|
await fillFirst(page, ['input[name="password"]','input[type="password"]'], process.env.SYSTEM_ADMIN_PASSWORD || 'admin123');
|
|
await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
|
|
await page.waitForLoadState('domcontentloaded').catch(()=>{});
|
|
if (!page.url().includes('/otp')) test.skip(true, 'OTP page not enabled in this environment');
|
|
for (let i=0;i<8;i++) {
|
|
await fillFirst(page, ['input[name="otp"]','input[name="code"]','input[type="text"]'], '000000');
|
|
await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
|
|
await page.waitForLoadState('domcontentloaded').catch(()=>{});
|
|
}
|
|
await expectNoServerError(page);
|
|
});
|