<commit_before>var frisby = require('frisby')

var URL = 'http://localhost:3000'

frisby.create('GET redirected to https://github.com/bkimminich/juice-shop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://github.com/bkimminich/juice-shop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://gratipay.com/juice-shop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://gratipay.com/juice-shop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://flattr.com/thing/3856930/bkimminichjuice-shop-on-GitHub when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://flattr.com/thing/3856930/bkimminichjuice-shop-on-GitHub', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://shop.spreadshirt.com/juiceshop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://shop.spreadshirt.com/juiceshop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://shop.spreadshirt.de/juiceshop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://shop.spreadshirt.de/juiceshop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://www.stickermule.com/user/1070702817/stickers when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://www.stickermule.com/user/1070702817/stickers', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://explorer.dash.org/address/Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://explorer.dash.org/address/Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET error message with information leakage when calling /redirect without query parameter')
  .get(URL + '/redirect')
  .expectStatus(500)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('TypeError')
  .expectBodyContains('&#39;indexOf&#39; of undefined')
  .toss()

frisby.create('GET error message with information leakage when calling /redirect with unrecognized query parameter')
  .get(URL + '/redirect?x=y')
  .expectStatus(500)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('TypeError')
  .expectBodyContains('&#39;indexOf&#39; of undefined')
  .toss()

frisby.create('GET error message hinting at whitelist validation when calling /redirect with an unrecognized "to" target')
  .get(URL + '/redirect?to=whatever')
  .expectStatus(406)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('Unrecognized target URL for redirect: whatever')
  .toss()

frisby.create('GET redirected to target URL in "to" parameter when a white-listed URL is part of the query string')
  .get(URL + '/redirect?to=/score-board?satisfyIndexOf=https://github.com/bkimminich/juice-shop')
  .expectStatus(200)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('OWASP Juice Shop</title>')
  .toss()<commit_msg>Use more stable verification for being on the Score Board page<commit_after>var frisby = require('frisby')

var URL = 'http://localhost:3000'

frisby.create('GET redirected to https://github.com/bkimminich/juice-shop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://github.com/bkimminich/juice-shop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://gratipay.com/juice-shop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://gratipay.com/juice-shop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://flattr.com/thing/3856930/bkimminichjuice-shop-on-GitHub when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://flattr.com/thing/3856930/bkimminichjuice-shop-on-GitHub', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://shop.spreadshirt.com/juiceshop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://shop.spreadshirt.com/juiceshop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to http://shop.spreadshirt.de/juiceshop when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=http://shop.spreadshirt.de/juiceshop', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://www.stickermule.com/user/1070702817/stickers when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://www.stickermule.com/user/1070702817/stickers', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET redirected to https://explorer.dash.org/address/Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW when this URL is passed as "to" parameter')
  .get(URL + '/redirect?to=https://explorer.dash.org/address/Xr556RzuwX6hg5EGpkybbv5RanJoZN17kW', { followRedirect: false })
  .expectStatus(302)
  .toss()

frisby.create('GET error message with information leakage when calling /redirect without query parameter')
  .get(URL + '/redirect')
  .expectStatus(500)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('TypeError')
  .expectBodyContains('&#39;indexOf&#39; of undefined')
  .toss()

frisby.create('GET error message with information leakage when calling /redirect with unrecognized query parameter')
  .get(URL + '/redirect?x=y')
  .expectStatus(500)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('TypeError')
  .expectBodyContains('&#39;indexOf&#39; of undefined')
  .toss()

frisby.create('GET error message hinting at whitelist validation when calling /redirect with an unrecognized "to" target')
  .get(URL + '/redirect?to=whatever')
  .expectStatus(406)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('<h1>Juice Shop (Express ~')
  .expectBodyContains('Unrecognized target URL for redirect: whatever')
  .toss()

frisby.create('GET redirected to target URL in "to" parameter when a white-listed URL is part of the query string')
  .get(URL + '/redirect?to=/score-board?satisfyIndexOf=https://github.com/bkimminich/juice-shop')
  .expectStatus(200)
  .expectHeaderContains('content-type', 'text/html')
  .expectBodyContains('/public/images/tracking/scoreboard.png')
  .toss()
{'fraction_non_alphanumeric': 0.14774726018130158, 'fraction_numerical': 0.030577729671221757, 'mean_word_length': 5.165137614678899, 'pattern_counts': {'":': 0, '<': 10, '<?xml version=': 0, '>': 10, 'https://': 22, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '490115', 'n_tokens_mistral': 2684, 'n_tokens_neox': 2512, 'n_words': 523}