merge in Mitun project

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at [email protected]. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -0,0 +1,13 @@
+## Contributing
+
+Contributions from community are key to make NodeGoat a high quality comprehensive resource. Lets make NodeGoat awesome together!
+
+### Ways to Contribute
+Depending on your preference, you can contribute in various ways. Here are tasks planned for [upcoming release](https://github.com/OWASP/NodeGoat/milestones).
+You can also open an issue, sending a PR, or get in touch on [Gitter Chat](https://gitter.im/OWASP/NodeGoat) or [Slack](https://owasp.slack.com/messages/project-nodegoat/)
+
+If sending PR, once code is ready to commit, run:
+```
+npm run precommit
+```
+This command uses `js-beautifier` to indent the code and verifies these [coding standards](https://github.com/OWASP/NodeGoat/blob/master/.jshintrc) using `jsHint`. Please resolve all `jsHint` errors before committing the code.

Dockerfile

@@ -0,0 +1,18 @@
+FROM node:12-alpine
+ENV WORKDIR /usr/src/app/
+WORKDIR $WORKDIR
+COPY package*.json $WORKDIR
+RUN npm install --production --no-cache
+
+FROM node:12-alpine
+ENV USER node
+ENV WORKDIR /home/$USER/app
+WORKDIR $WORKDIR
+COPY --from=0 /usr/src/app/node_modules node_modules
+RUN chown $USER:$USER $WORKDIR
+COPY --chown=node . $WORKDIR
+# In production environment uncomment the next line
+#RUN chown -R $USER:$USER /home/$USER && chmod -R g-s,o-rx /home/$USER && chmod -R o-wrx $WORKDIR
+# Then all further actions including running the containers should be done under non-root user.
+USER $USER
+EXPOSE 4000

Gruntfile.js

@@ -0,0 +1,194 @@
+"use strict";
+
+var exec = require("child_process").exec;
+
+var APP_JS_FILES = ["app/assets/js/**/*.js", "config/**/*.js", "app/data/**/*.js",
+    "app/routes/**/*.js", "server.js"
+];
+
+var SUPPORT_JS_FILES = ["Gruntfile.js", "artifacts/**/*.js", "test/**/*.js"];
+
+var JS_FILES = APP_JS_FILES.concat(SUPPORT_JS_FILES);
+
+
+module.exports = function(grunt) {
+    // Project Configuration
+    grunt.initConfig({
+        pkg: grunt.file.readJSON("package.json"),
+        watch: {
+            js: {
+                files: APP_JS_FILES,
+                tasks: ["jshint"],
+                options: {
+                    livereload: true
+                }
+            },
+            support: {
+                files: SUPPORT_JS_FILES,
+                tasks: ["jshint"]
+            },
+            html: {
+                files: ["app/views/**"],
+                options: {
+                    livereload: true
+                }
+            },
+            css: {
+                files: ["app/assets/css/**"],
+                options: {
+                    livereload: true
+                }
+            }
+        },
+        jshint: {
+            all: JS_FILES,
+            options: {
+                jshintrc: true
+            }
+        },
+        jsbeautifier: {
+            files: JS_FILES.concat(["app/views/**", "app/assets/css/**"]),
+            options: {
+                html: {
+                    braceStyle: "collapse",
+                    indentChar: " ",
+                    indentScripts: "keep",
+                    indentSize: 4,
+                    maxPreserveNewlines: 10,
+                    preserveNewlines: true,
+                    unformatted: ["a", "sub", "sup", "b", "i", "u", "pre"],
+                    wrapLineLength: 0
+                },
+                css: {
+                    indentChar: " ",
+                    indentSize: 4
+                },
+                js: {
+                    braceStyle: "collapse",
+                    breakChainedMethods: false,
+                    e4x: false,
+                    evalCode: false,
+                    indentChar: " ",
+                    indentLevel: 0,
+                    indentSize: 4,
+                    indentWithTabs: false,
+                    jslintHappy: false,
+                    keepArrayIndentation: false,
+                    keepFunctionIndentation: false,
+                    maxPreserveNewlines: 10,
+                    preserveNewlines: true,
+                    spaceBeforeConditional: true,
+                    spaceInParen: false,
+                    unescapeStrings: false,
+                    wrapLineLength: 0
+                }
+            }
+        },
+        concurrent: {
+            tasks: ["nodemon", "watch"],
+            options: {
+                logConcurrentOutput: true
+            }
+        },
+        if: {
+            testSecurityDependenciesInstalled: {
+                options: {
+                    test: function() {
+                        console.log("Checking to see if chromedriver is installed.");
+                        try {
+                            return require.resolve("chromedriver");
+                        } catch (e) {
+                            console.log(e);
+                            console.log("We will now try to install it.");
+                            console.log("If this fails, please try installing manually,");
+                            console.log("there may be some help here:");
+                            console.log("https://github.com/vuejs/vue-router/issues/261#issuecomment-218618180");
+                            throw e;
+                        }
+                    }
+                },
+                ifTrue: ["mochaTest:security"],
+                ifFalse: ["npm-install:chromedriver@^2.21.2", "mochaTest:security"]
+            }
+        },
+        mochaTest: {
+            options: {
+                reporter: "spec"
+            },
+            unit: {
+                src: ["test/unit/*.js"],
+            },
+            security: {
+                src: ["test/security/*.js"]
+            }
+        },
+        env: {
+            test: {
+                NODE_ENV: "test"
+            }
+        },
+        retire: {
+            js: [],
+            node: ["./"],
+            options: {
+                verbose: true,
+                packageOnly: true,
+                jsRepository: "https://raw.github.com/bekk/retire.js/master/repository/jsrepository.json",
+                nodeRepository: "https://raw.github.com/bekk/retire.js/master/repository/npmrepository.json",
+            }
+        }
+
+    });
+
+    // Load NPM tasks
+    grunt.loadNpmTasks("grunt-contrib-watch");
+    grunt.loadNpmTasks("grunt-contrib-jshint");
+    grunt.loadNpmTasks("grunt-mocha-test");
+    grunt.loadNpmTasks("grunt-nodemon");
+    grunt.loadNpmTasks("grunt-concurrent");
+    grunt.loadNpmTasks("grunt-env");
+    grunt.loadNpmTasks("grunt-jsbeautifier");
+    grunt.loadNpmTasks("grunt-retire"); // run as: grunt retire
+    grunt.loadNpmTasks("grunt-if");
+    grunt.loadNpmTasks("grunt-npm-install");
+
+    // Making grunt default to force in order not to break the project.
+    grunt.option("force", true);
+
+    grunt.registerTask("db-reset", "(Re)init the database.", function(arg) {
+        var finalEnv = process.env.NODE_ENV || arg || "development";
+        var done;
+
+        done = this.async();
+        var cmd = process.platform === "win32" ? "NODE_ENV=" + finalEnv + " & " : "NODE_ENV=" + finalEnv + " ";
+
+        exec(
+            cmd + "node artifacts/db-reset.js",
+            function(err, stdout, stderr) {
+                if (err) {
+                    grunt.log.error("db-reset:");
+                    grunt.log.error(err);
+                    grunt.log.error(stderr);
+                } else {
+                    grunt.log.ok(stdout);
+                }
+                done();
+            }
+        );
+    });
+
+    // Code Validation, beautification task(s).
+    grunt.registerTask("precommit", ["jsbeautifier", "jshint"]);
+
+    // Test task.
+    grunt.registerTask("test", ["env:test", "mochaTest:unit"]);
+
+    // Security test task.
+    grunt.registerTask("testsecurity", ["env:test", "if:testSecurityDependenciesInstalled"]);
+
+    // start server.
+    grunt.registerTask("run", ["precommit", "concurrent"]);
+
+    // Default task(s).
+    grunt.registerTask("default", ["precommit", "concurrent"]);
+};