使用NodeJsScan扫描nodejs代码检查安全性

使用NodeJsScan扫描nodejs代码检查安全性
1.下载源码：https://github.com/ajinabraham/NodeJsScan
2.下载Windows版docker toolbox: http://get.daocloud.io/#install-toolbox
3.下载PostgreSQL安装详细步骤（windows）
http://blog.chinaunix.net/uid-354915-id-3498734.html
https://www.enterprisedb.com/downloads/postgres-postgresql-downloads
https://www.pgadmin.org/
user:postgres,pw:admin,port:5432
4.重启电脑，打开pgAdmin4程序
http://127.0.0.1:49908/browser/
创建一个数据库nodejsscan
=================
https://ajinabraham.github.io/NodeJsScan/
安装Python3.7 设置环境变量
D:\Python\Python37\Scripts\
D:\Python\Python37\
cmd命令行
d:
cd D:\pyworkspace\NodeJsScan>
先升级pip
python -m pip install --upgrade pip
安装依赖包
pip3 install -r requirements.txt
执行命令
python migrate.py # Run once to create database entries required
python app.py # Testing Environment
gunicorn -b 0.0.0.0:9090 app:app # Production Environment
-----------------
D:\pyworkspace\NodeJsScan>python app.py
* Serving Flask app "app" (lazy loading)
* Environment: production
WARNING: Do not use the development server in a production environment.
Use a production WSGI server instead.
* Debug mode: off
* Running on http://0.0.0.0:9090/ (Press CTRL+C to quit)

===========================
pip install nodejsscan
-----------------
Docker
docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan
-------------------
D:\pyworkspace\NodeJsScan> docker build -t nodejsscan .
要执行多次下载很多东西后才成功
Successfully built 829f23dfd371
Successfully tagged nodejsscan:latest

-----------------
docker run -it -p 9090:9090 nodejsscan

LOG: database system was shut down at 2018-08-03 09:48:02 UTC
LOG: MultiXact member wraparound protections are now enabled
LOG: database system is ready to accept connections
LOG: autovacuum launcher started
[INFO] Table entries created!
[2018-08-03 09:48:09 +0000] [57] [INFO] Starting gunicorn 19.9.0
[2018-08-03 09:48:09 +0000] [57] [INFO] Listening at: http://0.0.0.0:9090 (57)
[2018-08-03 09:48:09 +0000] [57] [INFO] Using worker: sync
[2018-08-03 09:48:09 +0000] [60] [INFO] Booting worker with pid: 60

=========================
在另外一个控制台，cmd进入到对应js文件目录下执行nodejsscan -d 文件夹名称
d:
D:\nodejsspace>nodejsscan -d yourjsdir
输出类似：
[INFO] Running Static Analyzer on - yourjsdir

{
"files": [
{
"\\app.js": "yourjsdir\\app.js"
},
示例如下：

另外，部署后可以在网页版查看的

=========================
可能遇到的错误：
'pip3' 不是内部或外部命令，也不是可运行的程序
解决办法：要添加Python的环境变量
D:\Program Files (x86)\pgAdmin 4\v3\venv\Scripts

pip3 install -r requirements.txt
Fatal error in launcher: Unable to create process using '"'

python -m pip3 install -r requirements.txt
D:\Program Files (x86)\pgAdmin 4\v3\venv\Scripts\python.exe: No module named pip3
要先安装pip3，或者升级，或者改成php命令执行

----------------
pip3 install -r requirements.txt
python3 migrate.py # Run once to create database entries required
python3 app.py # Testing Environment
gunicorn -b 0.0.0.0:9090 app:app # Production Environment
--------------
pip3 install -r requirements.txt
python migrate.py # Run once to create database entries required
python app.py # Testing Environment
gunicorn -b 0.0.0.0:9090 app:app # Production Environment
-----------------
docker run -it -p 9090:9090 nodejsscan
D:\pyworkspace\NodeJsScan>docker run -it -p 9090:9090 nodejsscan
Unable to find image 'nodejsscan:latest' locally
docker: Error response from daemon: pull access denied for nodejsscan, repository does not exist or may require 'docker login'.
See 'docker run --help'.

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

================

node防xss攻击插件

var xss = require('node-xss').clean;
router.post("/orders/insert-orders", function (req, res) {
    //对请求体做xss过滤
    var data = xss(req.body);
    var url = urlMap.englishlistenspeakserver + '/orders/insert-orders';
    var options = {
        url: url,
        method: 'POST',
        json: true,
        qs: data
    };
    request(options, function (error, response, body) {
        res.send(body);
    })
});