DinisCruz-Dev/1.original sample code.html

## 1.original sample code.html
<!DOCTYPE html>

<meta charset="utf-8" >

<title>WebSocket Test></title>

<script language="javascript" type="text/javascript">

  var wsUri = "ws://echo.websocket.org/";
  var output;

  function init()
  {
    output = document.getElementById("output");
    testWebSocket();
  }

  function testWebSocket()
  {
    websocket = new WebSocket(wsUri);
    websocket.onopen = function(evt) { onOpen(evt) };
    websocket.onclose = function(evt) { onClose(evt) };
    websocket.onmessage = function(evt) { onMessage(evt) };
    websocket.onerror = function(evt) { onError(evt) };
  }

  function onOpen(evt)
  {
    writeToScreen("CONNECTED");
    doSend("WebSocket rocks");
  }

  function onClose(evt)
  {
    writeToScreen("DISCONNECTED");
  }

  function onMessage(evt)
  {
    writeToScreen('<span style="color: blue;">RESPONSE: ' + evt.data+'</span>');
    websocket.close();
  }

  function onError(evt)
  {
    writeToScreen('<span style="color: red;">ERROR:</span> ' + evt.data);
  }

  function doSend(message)
  {
    writeToScreen("SENT: " + message);
    websocket.send(message);
  }

  function writeToScreen(message)
  {
    var pre = document.createElement("p");
    pre.style.wordWrap = "break-word";
    pre.innerHTML = message;
    output.appendChild(pre);
  }

  window.addEventListener("load", init, false);

</script>

<h2>WebSocket Test</h2>

<div id="output"></div>;

</html>

## 2. original vulnerable echo.js file.js
  var secureCb;
  var secureCbLabel;
  var wsUri;
  var consoleLog;
  var connectBut;
  var disconnectBut;
  var sendMessage;
  var sendBut;
  var clearLogBut;

  function echoHandlePageLoad()
  {
    if (window.WebSocket)
    {
      document.getElementById("webSocketSupp").style.display = "block";
    }
    else
    {
      document.getElementById("noWebSocketSupp").style.display = "block";
    }

    secureCb = document.getElementById("secureCb");
    secureCb.checked = false;
    secureCb.onclick = toggleTls;

    secureCbLabel = document.getElementById("secureCbLabel")

    wsUri = document.getElementById("wsUri");
    toggleTls();

    connectBut = document.getElementById("connect");
    connectBut.onclick = doConnect;

    disconnectBut = document.getElementById("disconnect");
    disconnectBut.onclick = doDisconnect;

    sendMessage = document.getElementById("sendMessage");

    sendBut = document.getElementById("send");
    sendBut.onclick = doSend;

    consoleLog = document.getElementById("consoleLog");

    clearLogBut = document.getElementById("clearLogBut");
    clearLogBut.onclick = clearLog;

    setGuiConnected(false);

    document.getElementById("disconnect").onclick = doDisconnect;
    document.getElementById("send").onclick = doSend;

  }

  function toggleTls()
  {
    var wsPort = (window.location.port.toString() === "" ? "" : ":"+window.location.port)
    if (wsUri.value === "") {
        wsUri.value = "ws://" + window.location.hostname.replace("www", "echo") + wsPort;
    }

    if (secureCb.checked)
    {
      wsUri.value = wsUri.value.replace("ws:", "wss:");
    }
    else
    {
      wsUri.value = wsUri.value.replace ("wss:", "ws:");
    }
  }

  function doConnect()
  {
    if (window.MozWebSocket)
    {
        logToConsole('<span style="color: red;"><strong>Info:</strong> This browser supports WebSocket using the MozWebSocket constructor</span>');
        window.WebSocket = window.MozWebSocket;
    }
    else if (!window.WebSocket)
    {
        logToConsole('<span style="color: red;"><strong>Error:</strong> This browser does not have support for WebSocket</span>');
        return;
    }

    // prefer text messages
    var uri = wsUri.value;
    if (uri.indexOf("?") == -1) {
        uri += "?encoding=text";
    } else {
        uri += "&encoding=text";
    }
    websocket = new WebSocket(uri);
    websocket.onopen = function(evt) { onOpen(evt) };
    websocket.onclose = function(evt) { onClose(evt) };
    websocket.onmessage = function(evt) { onMessage(evt) };
    websocket.onerror = function(evt) { onError(evt) };
  }

  function doDisconnect()
  {
    websocket.close()
  }

  function doSend()
  {
    logToConsole("SENT: " + sendMessage.value);
    websocket.send(sendMessage.value);
  }

  function logToConsole(message)
  {
    var pre = document.createElement("p");
    pre.style.wordWrap = "break-word";
    pre.innerHTML = getSecureTag()+message;
    consoleLog.appendChild(pre);

    while (consoleLog.childNodes.length > 50)
    {
      consoleLog.removeChild(consoleLog.firstChild);
    }

    consoleLog.scrollTop = consoleLog.scrollHeight;
  }

  function onOpen(evt)
  {
    logToConsole("CONNECTED");
    setGuiConnected(true);
  }

  function onClose(evt)
  {
    logToConsole("DISCONNECTED");
    setGuiConnected(false);
  }

  function onMessage(evt)
  {
    logToConsole('<span style="color: blue;">RESPONSE: ' + evt.data+'</span>');
  }

  function onError(evt)
  {
    logToConsole('<span style="color: red;">ERROR:</span> ' + evt.data);
  }

  function setGuiConnected(isConnected)
  {
    wsUri.disabled = isConnected;
    connectBut.disabled = isConnected;
    disconnectBut.disabled = !isConnected;
    sendMessage.disabled = !isConnected;
    sendBut.disabled = !isConnected;
    secureCb.disabled = isConnected;
    var labelColor = "black";
    if (isConnected)
    {
      labelColor = "#999999";
    }
     secureCbLabel.style.color = labelColor;

  }

	function clearLog()
	{
		while (consoleLog.childNodes.length > 0)
		{
			consoleLog.removeChild(consoleLog.lastChild);
		}
	}

	function getSecureTag()
	{
		if (secureCb.checked)
		{
			return '<img src="img/tls-lock.png" width="6px" height="9px"> ';
		}
		else
		{
			return '';
		}
	}

  window.addEventListener("load", echoHandlePageLoad, false);
	<!DOCTYPE html>

	<meta charset="utf-8" >

	<title>WebSocket Test></title>

	<script language="javascript" type="text/javascript">

	var wsUri = "ws://echo.websocket.org/";
	var output;

	function init()
	{
	output = document.getElementById("output");
	testWebSocket();
	}

	function testWebSocket()
	{
	websocket = new WebSocket(wsUri);
	websocket.onopen = function(evt) { onOpen(evt) };
	websocket.onclose = function(evt) { onClose(evt) };
	websocket.onmessage = function(evt) { onMessage(evt) };
	websocket.onerror = function(evt) { onError(evt) };
	}

	function onOpen(evt)
	{
	writeToScreen("CONNECTED");
	doSend("WebSocket rocks");
	}

	function onClose(evt)
	{
	writeToScreen("DISCONNECTED");
	}

	function onMessage(evt)
	{
	writeToScreen('<span style="color: blue;">RESPONSE: ' + evt.data+'</span>');
	websocket.close();
	}

	function onError(evt)
	{
	writeToScreen('<span style="color: red;">ERROR:</span> ' + evt.data);
	}

	function doSend(message)
	{
	writeToScreen("SENT: " + message);
	websocket.send(message);
	}

	function writeToScreen(message)
	{
	var pre = document.createElement("p");
	pre.style.wordWrap = "break-word";
	pre.innerHTML = message;
	output.appendChild(pre);
	}

	window.addEventListener("load", init, false);

	</script>

	<h2>WebSocket Test</h2>

	<div id="output"></div>;

	</html>
	var secureCb;
	var secureCbLabel;
	var wsUri;
	var consoleLog;
	var connectBut;
	var disconnectBut;
	var sendMessage;
	var sendBut;
	var clearLogBut;

	function echoHandlePageLoad()
	{
	if (window.WebSocket)
	{
	document.getElementById("webSocketSupp").style.display = "block";
	}
	else
	{
	document.getElementById("noWebSocketSupp").style.display = "block";
	}

	secureCb = document.getElementById("secureCb");
	secureCb.checked = false;
	secureCb.onclick = toggleTls;

	secureCbLabel = document.getElementById("secureCbLabel")

	wsUri = document.getElementById("wsUri");
	toggleTls();

	connectBut = document.getElementById("connect");
	connectBut.onclick = doConnect;

	disconnectBut = document.getElementById("disconnect");
	disconnectBut.onclick = doDisconnect;

	sendMessage = document.getElementById("sendMessage");

	sendBut = document.getElementById("send");
	sendBut.onclick = doSend;

	consoleLog = document.getElementById("consoleLog");

	clearLogBut = document.getElementById("clearLogBut");
	clearLogBut.onclick = clearLog;

	setGuiConnected(false);

	document.getElementById("disconnect").onclick = doDisconnect;
	document.getElementById("send").onclick = doSend;

	}

	function toggleTls()
	{
	var wsPort = (window.location.port.toString() === "" ? "" : ":"+window.location.port)
	if (wsUri.value === "") {
	wsUri.value = "ws://" + window.location.hostname.replace("www", "echo") + wsPort;
	}

	if (secureCb.checked)
	{
	wsUri.value = wsUri.value.replace("ws:", "wss:");
	}
	else
	{
	wsUri.value = wsUri.value.replace ("wss:", "ws:");
	}
	}

	function doConnect()
	{
	if (window.MozWebSocket)
	{
	logToConsole('<span style="color: red;"><strong>Info:</strong> This browser supports WebSocket using the MozWebSocket constructor</span>');
	window.WebSocket = window.MozWebSocket;
	}
	else if (!window.WebSocket)
	{
	logToConsole('<span style="color: red;"><strong>Error:</strong> This browser does not have support for WebSocket</span>');
	return;
	}

	// prefer text messages
	var uri = wsUri.value;
	if (uri.indexOf("?") == -1) {
	uri += "?encoding=text";
	} else {
	uri += "&encoding=text";
	}
	websocket = new WebSocket(uri);
	websocket.onopen = function(evt) { onOpen(evt) };
	websocket.onclose = function(evt) { onClose(evt) };
	websocket.onmessage = function(evt) { onMessage(evt) };
	websocket.onerror = function(evt) { onError(evt) };
	}

	function doDisconnect()
	{
	websocket.close()
	}

	function doSend()
	{
	logToConsole("SENT: " + sendMessage.value);
	websocket.send(sendMessage.value);
	}

	function logToConsole(message)
	{
	var pre = document.createElement("p");
	pre.style.wordWrap = "break-word";
	pre.innerHTML = getSecureTag()+message;
	consoleLog.appendChild(pre);

	while (consoleLog.childNodes.length > 50)
	{
	consoleLog.removeChild(consoleLog.firstChild);
	}

	consoleLog.scrollTop = consoleLog.scrollHeight;
	}

	function onOpen(evt)
	{
	logToConsole("CONNECTED");
	setGuiConnected(true);
	}

	function onClose(evt)
	{
	logToConsole("DISCONNECTED");
	setGuiConnected(false);
	}

	function onMessage(evt)
	{
	logToConsole('<span style="color: blue;">RESPONSE: ' + evt.data+'</span>');
	}

	function onError(evt)
	{
	logToConsole('<span style="color: red;">ERROR:</span> ' + evt.data);
	}

	function setGuiConnected(isConnected)
	{
	wsUri.disabled = isConnected;
	connectBut.disabled = isConnected;
	disconnectBut.disabled = !isConnected;
	sendMessage.disabled = !isConnected;
	sendBut.disabled = !isConnected;
	secureCb.disabled = isConnected;
	var labelColor = "black";
	if (isConnected)
	{
	labelColor = "#999999";
	}
	secureCbLabel.style.color = labelColor;

	}

	function clearLog()
	{
	while (consoleLog.childNodes.length > 0)
	{
	consoleLog.removeChild(consoleLog.lastChild);
	}
	}

	function getSecureTag()
	{
	if (secureCb.checked)
	{
	return '<img src="img/tls-lock.png" width="6px" height="9px"> ';
	}
	else
	{
	return '';
	}
	}

	window.addEventListener("load", echoHandlePageLoad, false);