EMA-145 - Security findings

dev/testv2/cypress.config.js

@@ -0,0 +1,22 @@
+const { defineConfig } = require('cypress');
+
+module.exports = defineConfig({
+    video: false,
+    trashAssetsBeforeRuns: false,
+    requestTimeout: 30000,
+    defaultCommandTimeout: 30000,
+    pageLoadTimeout: 30000,
+    blockHosts: ['*snippet.url.com', '*scarabresearch.com'],
+    env: {
+        snippetUrl: 'http://snippet.url.com/main.js'
+    },
+    e2e: {
+        // We've imported your old cypress plugins here.
+        // You may want to clean this up later by importing these.
+        setupNodeEvents(on, config) {
+            return require('./cypress/plugins/index.js')(on, config);
+        },
+        baseUrl: 'http://magento-test.local/index.php/default/',
+        specPattern: 'cypress/integration/**/*.spec.js'
+    }
+});

dev/testv2/cypress/integration/default-behaviour.spec.js

@@ -65,7 +65,7 @@ describe('Default behaviour with everything turned off', function() {
       cy.task('setDefaultCustomerProperty', { email: newEmail, password: newPassword });
 
       cy.task('getSentAddresses').then(emailAddresses => {
-        expect(emailAddresses).to.be.eql([this.defaultCustomer.email]);
+          expect(emailAddresses).to.include.members([this.defaultCustomer.email]);
       });
     });
   });

dev/testv2/cypress/plugins/index.js

@@ -14,13 +14,13 @@ db('information_schema.tables')
         const { table_name: tableName } = rows[0];
         let prefix = tableName.split('core_config_data')[0];
         let replaceQuery = db(prefix + 'core_config_data')
-            .insert({scope: 'default', scope_id: 0, path: 'oauth/consumer/enable_integration_as_bearer', value: '1'})
+            .insert({ scope: 'default', scope_id: 0, path: 'oauth/consumer/enable_integration_as_bearer', value: '1' })
             .toString().replace(/^INSERT/i, 'REPLACE');
 
-        db.raw(replaceQuery).then((result) => {
+        db.raw(replaceQuery).then(() => {
             let _baseUrl = process.env.CYPRESS_baseUrl || 'http://magento-test.local';
-            axios.get(`${_baseUrl}/cache-flush.php`)
-        })
+            axios.get(`${_baseUrl}/cache-flush.php`);
+        });
     });
 // END API bearer token compatibility
 

dev/testv2/cypress/support/commands.js

@@ -12,7 +12,7 @@ Cypress.Commands.add('shouldCreateEvent', (type, expectedDataSubset) => {
 
 Cypress.Commands.add('shouldNotExistsEvents', () => {
   cy.task('getAllEvents').then(events => {
-    expect(events.length).to.be.empty;
+      expect(events.length).to.equal(0);
   });
 });
 
@@ -59,7 +59,7 @@ Cypress.Commands.add('shouldNotShowErrorMessage', excludeErrorMessage => {
       expect(errorMessage).to.include(excludeErrorMessage);
     });
   } else {
-    return cy.get('[data-ui-id="message-error"]').should('not.be.visible');
+      return cy.get('[data-ui-id="message-error"]').should('not.exist');
   }
 });
 

dev/testv2/cypress/support/index.js → dev/testv2/cypress/support/e2e.js

@@ -1,6 +1,5 @@
 'use strict';
 
-require('cypress-plugin-retries');
 require('./commands');
 
 before(() => {
@@ -16,6 +15,7 @@ Cypress.on('uncaught:exception', (err, runnable) => { // eslint-disable-line no-
 let logs = '';
 
 Cypress.on('window:before:load', window => {
+/*
   const docIframe = window.parent.document.getElementById("Your App: 'test'");
   const appWindow = docIframe.contentWindow;
 
@@ -24,6 +24,7 @@ Cypress.on('window:before:load', window => {
       logs += args.join(' ') + '\n';
     };
   });
+ */
 });
 
 Cypress.mocha.getRunner().on('test', () => {