team-alpha/railsgoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removes user_id column from User model to use idiomatic Rails automatic IDs

Browse Source
This commit is contained in:
Joseph Mastey
2017-10-07 09:34:26 -06:00
parent c4f0b91534
commit b6c2259b88
29 changed files with 421 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/vulnerabilities/insecure_dor_spec.rb
+5 -5
View File
@@ -10,9 +10,9 @@ feature "insecure direct object reference" do
scenario "attack one" do
login(@normal_user)
visit "/users/#{@normal_user.user_id}/benefit_forms"
download_url = first(".widget-body a")[:href]
visit download_url.sub(/name=(.*?)&/, "name=config/database.yml&")
visit "/users/#{@normal_user.id}/benefit_forms"
download_url = first('.widget-body a')[:href]
visit download_url.sub(/name=(.*?)&/, 'name=config/database.yml&')
pending if verifying_fixed?
@@ -24,8 +24,8 @@ feature "insecure direct object reference" do
scenario "attack two\nTutorial: https://github.com/OWASP/railsgoat/wiki/A4-Insecure-Direct-Object-Reference" do
login(@normal_user)
expect(@normal_user.user_id).not_to eq(2)
visit "/users/2/work_info"
expect(@normal_user.id).not_to eq(2)
visit '/users/2/work_info'
pending if verifying_fixed?
expect(first("td").text).to eq("Joseph Mastey")