[OWASP ZAP] 会員管理 会員登録

.github/workflows/penetration-test.yml

@@ -17,6 +17,7 @@ jobs:
           - 'test/front_guest/contact.test.ts'
           - 'test/admin/content_layout.test.ts'
           - 'test/admin/content_layout_delete.test.ts'
+          - 'test/admin/customer_new.test.ts'
           - 'test/admin/customer.test.ts'
           - 'test/admin/content_cache.test.ts'
           - 'test/admin/customer_edit.test.ts'
@@ -61,6 +62,10 @@ jobs:
         if: matrix.group == 'test/admin/content_layout_delete.test.ts'
         working-directory: zap/selenium/ci/TypeScript
         run: git am patches/0001-DeleteLayout.patch
+      - name: Apply patch to new_customer
+        if: matrix.group == 'test/admin/customer_new.test.ts'
+        working-directory: zap/selenium/ci/TypeScript
+        run: git am patches/0002-NewCustomer.patch
       - name: Penetration testing
         working-directory: zap/selenium/ci/TypeScript
         env:

zap/selenium/ci/TypeScript/patches/0002-NewCustomer.patch

@@ -0,0 +1,39 @@
+From 99bc810aa3eeaefb75615a27984ecd8538bddc0c Mon Sep 17 00:00:00 2001
+From: carkn <carbuncle.panic@gmail.com>
+Date: Fri, 1 Apr 2022 16:44:33 +0900
+Subject: [PATCH] =?UTF-8?q?modified=20=E9=A1=A7=E5=AE=A2=E6=83=85=E5=A0=B1?=
+ =?UTF-8?q?=E8=BF=BD=E5=8A=A0=E3=82=92=E6=8A=91=E6=AD=A2?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ .../Controller/Admin/Customer/CustomerEditController.php     | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/Eccube/Controller/Admin/Customer/CustomerEditController.php b/src/Eccube/Controller/Admin/Customer/CustomerEditController.php
+index f8beac4f6d..4f67185c5f 100644
+--- a/src/Eccube/Controller/Admin/Customer/CustomerEditController.php
++++ b/src/Eccube/Controller/Admin/Customer/CustomerEditController.php
+@@ -114,7 +114,7 @@ class CustomerEditController extends AbstractController
+             }
+
+             $this->entityManager->persist($Customer);
+-            $this->entityManager->flush();
++//            $this->entityManager->flush();
+
+             log_info('会員登録完了', [$Customer->getId()]);
+
+@@ -130,7 +130,8 @@ class CustomerEditController extends AbstractController
+             $this->addSuccess('admin.common.save_complete', 'admin');
+
+             return $this->redirectToRoute('admin_customer_edit', [
+-                'id' => $Customer->getId(),
++//                'id' => $Customer->getId(),
++                  'id' => 0,
+             ]);
+         }
+
+-- 
+2.30.2
+

zap/selenium/ci/TypeScript/test/admin/customer_new.test.ts

@@ -0,0 +1,88 @@
+import { test, expect, chromium, Page } from '@playwright/test';
+import PlaywrightConfig from '../../playwright.config';
+import { intervalRepeater } from '../../utils/Progress';
+import { ZapClient, Mode, ContextType, Risk, HttpMessage } from '../../utils/ZapClient';
+import { ECCUBE_ADMIN_ROUTE } from '../../config/default.config';
+
+const zapClient = new ZapClient();
+
+const url = `${PlaywrightConfig.use.baseURL}/${ECCUBE_ADMIN_ROUTE}/customer/new`;
+
+test.describe.serial('会員管理 会員登録のテストを行います', () => {
+  let page: Page;
+  test.beforeAll(async () => {
+    await zapClient.setMode(Mode.Protect);
+    await zapClient.newSession('/zap/wrk/sessions/admin_customer_new', true);
+    await zapClient.importContext(ContextType.Admin);
+
+    if (!await zapClient.isForcedUserModeEnabled()) {
+      await zapClient.setForcedUserModeEnabled();
+      expect(await zapClient.isForcedUserModeEnabled()).toBeTruthy();
+    }
+    const browser = await chromium.launch();
+    page = await browser.newPage();
+    await page.goto(url);
+  });
+
+  test('会員管理 会員登録のページを表示します', async () => {
+    await expect(page).toHaveTitle(/会員登録/);
+  });
+
+  test('タイトルを確認します', async () => {
+    await page.textContent('.c-pageTitle__subTitle')
+      .then(title => expect(title).toContain('会員管理'));
+  });
+
+  test.describe('テストを実行します[GET] @attack', () => {
+    let scanId: number;
+    test('アクティブスキャンを実行します', async () => {
+      scanId = await zapClient.activeScanAsUser(url, 2, 55, false, null, 'GET');
+      await intervalRepeater(async () => await zapClient.getActiveScanStatus(scanId), 5000, page);
+    });
+
+    test('結果を確認します', async () => {
+      await zapClient.getAlerts(url, 0, 1, Risk.High)
+        .then(alerts => expect(alerts).toEqual([]));
+    });
+  });
+
+  test('ユーザ情報を入力します', async () => {
+    await page.locator('id=admin_customer_name_name01').fill('山田');
+    await page.locator('id=admin_customer_name_name02').fill('太郎');
+    await page.locator('id=admin_customer_kana_kana01').fill('ヤマダ');
+    await page.locator('id=admin_customer_kana_kana02').fill('タロウ');
+    await page.locator('id=admin_customer_company_name').fill('イーシーキューブ');
+    await page.locator('id=admin_customer_postal_code').fill('5300001');
+    await page.locator('id=admin_customer_address_pref').selectOption('1');
+    await page.locator('id=admin_customer_address_addr01').fill('大阪市北区梅田');
+    await page.locator('id=admin_customer_address_addr02').fill('2-4-9');
+    await page.locator('id=admin_customer_email').fill('taro_yamada@test.local');
+    await page.locator('id=admin_customer_phone_number').fill('0001112222');
+    await page.locator('id=admin_customer_password_first').fill('password123');
+    await page.locator('id=admin_customer_password_second').fill('password123');
+    await page.locator('id=admin_customer_sex_1').click();
+    await page.locator('id=admin_customer_job').selectOption('3');
+    await page.locator('id=admin_customer_birth').fill('1980-04-01');
+    await page.locator('id=admin_customer_point').fill('10');
+    await page.locator('id=admin_customer_note').fill('国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語国語');
+    await page.click('button >> text=登録');
+  });
+
+  let message: HttpMessage;
+  test('HttpMessage を取得します', async () => {
+    message = await zapClient.getLastMessage(url);
+  });
+
+  test.describe('テストを実行します[POST][入力→登録] @attack', () => {
+    let scanId: number;
+    test('アクティブスキャンを実行します', async () => {
+      scanId = await zapClient.activeScan(url, false, true, null, 'POST', message.requestBody);
+      await intervalRepeater(async () => await zapClient.getActiveScanStatus(scanId), 5000, page);
+    });
+
+    test('ユーザ登録の結果を確認します', async () => {
+      await zapClient.getAlerts(url, 0, 1, Risk.High)
+        .then(alerts => expect(alerts).toEqual([]));
+    });
+  });
+});