Skip to content

Commit dc13fff

Browse files
subashsnsubashsn
committed
Added XXE,Jse
1 parent b8e83be commit dc13fff

File tree

8 files changed

+129
-3
lines changed

8 files changed

+129
-3
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ docs/_book
33
npm-debug.log
44
vars.env
55
package-lock.json
6+
.dev/

‎core/appHandler.js

+34
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ var db = require('../models')
22
var bCrypt = require('bcrypt')
33
const exec = require('child_process').exec;
44
var mathjs = require('mathjs')
5+
var libxmljs = require("libxmljs");
6+
var serialize = require("node-serialize")
57
const Op = db.Sequelize.Op
68

79
module.exports.userSearch = function (req, res) {
@@ -209,3 +211,35 @@ module.exports.listUsersAPI = function (req, res) {
209211
})
210212
})
211213
}
214+
215+
module.exports.bulkProducts = function(req, res) {
216+
// TODO: Deprecate this soon
217+
if (req.query.legacy && req.files.products){
218+
var products = serialize.unserialize(req.files.products.data.toString('utf8'))
219+
console.log(products)
220+
products.forEach( function (product) {
221+
var newProduct = new db.Product()
222+
newProduct.name = product.name
223+
newProduct.code = product.code
224+
newProduct.tags = product.tags
225+
newProduct.description = product.description
226+
227+
newProduct.save()
228+
})
229+
res.redirect('/app/products')
230+
}
231+
else if (req.files.products && req.files.products.mimetype=='text/xml'){
232+
var products = libxmljs.parseXmlString(req.files.products.data.toString('utf8'), {noent:true,noblanks:true})
233+
products.root().childNodes().forEach( product => {
234+
var newProduct = new db.Product()
235+
newProduct.name = product.childNodes()[0].text()
236+
newProduct.code = product.childNodes()[1].text()
237+
newProduct.tags = product.childNodes()[2].text()
238+
newProduct.description = product.childNodes()[3].text()
239+
newProduct.save()
240+
})
241+
res.redirect('/app/products')
242+
}else{
243+
res.render('app/bulkproducts',{messages:{danger:'Invalid file'}})
244+
}
245+
}

‎models/product.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ module.exports = function (sequelize, DataTypes) {
1717
allowNull: false
1818
},
1919
description: {
20-
type: DataTypes.STRING,
20+
type: DataTypes.TEXT,
2121
allowNull: false
2222
},
2323
tags: {

‎package.json

+3
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,16 @@
1515
"bcrypt": "^1.0.3",
1616
"ejs": "^2.5.7",
1717
"express": "^4.16.2",
18+
"express-fileupload": "^0.4.0",
1819
"express-flash": "0.0.2",
1920
"express-session": "^1.15.6",
2021
"flash": "^1.1.0",
22+
"libxmljs": "^0.19.1",
2123
"mathjs": "3.10.1",
2224
"md5": "^2.2.1",
2325
"morgan": "^1.9.0",
2426
"mysql2": "^1.4.2",
27+
"node-serialize": "0.0.4",
2528
"passport": "^0.4.0",
2629
"passport-local": "^1.0.0",
2730
"sequelize": "^4.13.10"

‎routes/app.js

+6
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ module.exports = function () {
1919
})
2020
})
2121

22+
router.get('/bulkproducts', authHandler.isAuthenticated, function (req, res) {
23+
res.render('app/bulkproducts')
24+
})
25+
2226
router.get('/products', authHandler.isAuthenticated, appHandler.listProducts)
2327

2428
router.get('/modifyproduct', authHandler.isAuthenticated, appHandler.modifyProduct)
@@ -55,5 +59,7 @@ module.exports = function () {
5559

5660
router.post('/calc', authHandler.isAuthenticated, appHandler.calc)
5761

62+
router.post('/bulkproducts',authHandler.isAuthenticated, appHandler.bulkProducts);
63+
5864
return router
5965
}

‎server.js

+3-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ var passport = require('passport')
44
var session = require('express-session')
55
var ejs = require('ejs')
66
var morgan = require('morgan')
7+
const fileUpload = require('express-fileupload');
78
var config = require('./config/server')
89

910
//Initialize Express
@@ -13,8 +14,9 @@ app.use(express.static('public'))
1314
app.set('view engine','ejs')
1415
app.use(morgan('tiny'))
1516
app.use(bodyParser.urlencoded({ extended: false }))
17+
app.use(fileUpload());
1618

17-
// For Reverse proxy support
19+
// Enable for Reverse proxy support
1820
// app.set('trust proxy', 1)
1921

2022
// Intialize Session

‎views/app/bulkproducts.ejs

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<% include ../common/head %>
5+
</head>
6+
<body>
7+
<% include ../common/navigation %>
8+
<div class='container' style='min-height: 450px'><div class='row'><div class='col-md-12'>
9+
10+
<h2>
11+
<i class='fa fa-upload'></i> Bulk Import Products
12+
</h2>
13+
14+
<% if (messages.success) { %>
15+
<div class="alert alert-success"><%=messages.success%></div>
16+
<% } else if (messages.danger) { %>
17+
<div class="alert alert-danger"><%= messages.danger %></div>
18+
<% } else if (messages.warning) {%>
19+
<div class="alert alert-warning"><%= messages.warning %></div>
20+
<% } else if (messages.info) {%>
21+
<div class="alert alert-info"><%= messages.info %></div>
22+
<% } %>
23+
24+
<div>
25+
<h3>Upload products</h3>
26+
<form encType="multipart/form-data" method="post" action="/app/bulkproducts">
27+
<div class="input-group mb-3">
28+
<div class="products-file">
29+
<input type="file" name="products" class="file-input" id="inputfile" accept=".xml">
30+
<br>
31+
<input class="button" type="submit" name="submit" value="Upload">
32+
</div>
33+
</div>
34+
</form>
35+
</div>
36+
37+
<div><br>
38+
<h3>Sample XML</h3>
39+
<xmp>
40+
<products>
41+
<product>
42+
<name>Xbox One</name>
43+
<code>23</code>
44+
<tags>gaming console</tags>
45+
<description>Gaming console by Microsoft</description>
46+
</product>
47+
<product>
48+
<name>Playstation 4</name>
49+
<code>26</code>
50+
<tags>gaming console</tags>
51+
<description>Gaming console by Sony</description>
52+
</product>
53+
</products>
54+
</xmp>
55+
<xmp>
56+
<products>
57+
<product>
58+
<name>Xbox One</name>
59+
<code>23</code>
60+
<tags>gaming console</tags>
61+
<description>Gaming console by Microsoft</description>
62+
</product>
63+
<product>
64+
<name>Playstation 4</name>
65+
<code>26</code>
66+
<tags>gaming console</tags>
67+
<description>Gaming console by Sony</description>
68+
</product>
69+
</products>
70+
</xmp>
71+
<!-- For legacy endpoit /app/bulkproducts?legacy=true <xmp>[{"name":"Xbox 360","code":"15","tags":"gaming console","description":"Microsoft's flagship gaming console"},{"name":"Playstation 3","code":"17","tags":"gaming console","description":"Sony's flagshipgaming console"}]</xmp> -->
72+
</div>
73+
74+
75+
76+
</div></div></div>
77+
<% include ../common/footer %>
78+
</body>
79+
</html>

‎views/app/modifyproduct.ejs

+2-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<h2>
1111
Add/Edit Product
1212
<span class='pull-right'>
13+
<a href='/app/bulkproducts' class='btn btn-primary'>Bulk Import</a>
1314
<a href='/app/products' class='btn btn-primary'>List Products</a>
1415
</span>
1516
</h2>
@@ -52,7 +53,7 @@
5253
<input type="text" name="tags" value="<%= output.product.tags %>" id="addEditProduct_product_tags" class="form-control" placeholder="Enter product tags eg. Tag1,Tag2,Tag3" />
5354
</div>
5455
</div>
55-
56+
5657
<div class="form-group ">
5758
<label class=" control-label" for="addEditProduct_product_description">Product Description </label>
5859
<div class=" controls">

0 commit comments

Comments
 (0)