Merge pull request #288 from KarenZita01/feature/security-testing-suite

Implement comprehensive security testing suite

Author: Nathydre

.github/workflows/comprehensive-tests.yml

@@ -112,13 +112,11 @@ jobs:
       uses: actions/setup-node@v4
       with:
         node-version: '20'
-        cache: 'npm'
-        cache-dependency-path: frontend/package-lock.json
 
     - name: Install frontend dependencies
       run: |
         cd frontend
-        npm ci
+        npm install
         
     - name: TypeScript compilation check
       run: |
@@ -185,8 +183,11 @@ jobs:
           ${{ runner.os }}-cargo-
           
     - name: Install stellar-cli
-      run: cargo install stellar-cli --locked
-      
+      uses: stellar/stellar-cli@v27.0.0
+
+    - name: Install wasm32v1-none target
+      run: rustup target add wasm32v1-none
+
     - name: Build contract
       run: stellar contract build
       working-directory: ./contract
@@ -249,7 +250,6 @@ jobs:
         
     - name: Build contract
       run: |
-        cargo install stellar-cli --locked
         stellar contract build
       working-directory: ./contract
 

.github/workflows/security-tests.yml

@@ -0,0 +1,60 @@
+name: Security Tests
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  security-tests:
+    name: Run Security Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: security-tests/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: ./security-tests
+
+      - name: TypeScript compilation check
+        run: npx tsc --noEmit
+        working-directory: ./security-tests
+
+      - name: Run OWASP security tests
+        run: npm run test:owasp
+        working-directory: ./security-tests
+
+      - name: Run penetration tests
+        run: npm run test:penetration
+        working-directory: ./security-tests
+
+      - name: Run dependency scanner
+        run: npm run scan:dependencies
+        working-directory: ./security-tests
+
+      - name: Run code security scanner
+        run: npm run scan:code
+        working-directory: ./security-tests
+
+      - name: Generate security report
+        run: npm run report:security
+        working-directory: ./security-tests
+        if: always()
+
+      - name: Upload security report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-report
+          path: security-tests/reports/
+          retention-days: 30

.github/workflows/test.yml

@@ -33,7 +33,7 @@ jobs:
           ${{ runner.os }}-cargo-
           
     - name: Install stellar-cli
-      run: cargo install stellar-cli --locked
+      uses: stellar/stellar-cli@v27.0.0
 
     - name: Build contract
       run: stellar contract build

contract/src/lib.rs

@@ -1,5 +1,5 @@
 #![no_std]
-use soroban_sdk::{contract, contractimpl, contracttype, Address, Env, String, token, Symbol, Vec, Map, i64};
+use soroban_sdk::{contract, contractimpl, contracttype, Address, Env, String, token, Symbol, Vec, Map};
 
 // Refund Status Enum
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -164,7 +164,7 @@ impl NepaBillingContract {
             panic!("Only admin can set refund approvers");
         }
 
-        if threshold == 0 || threshold as usize > approvers.len() {
+        if threshold == 0 || threshold > approvers.len() {
             panic!("Invalid approval threshold");
         }
 
@@ -187,14 +187,14 @@ impl NepaBillingContract {
         if meter_id_len < METER_ID_MIN_LENGTH || meter_id_len > METER_ID_MAX_LENGTH {
             panic!("Meter ID must be between 3 and 50 characters");
         }
-        let meter_id_bytes = meter_id.as_bytes();
-        for i in 0..meter_id_len as usize {
-            let b = meter_id_bytes[i];
-            let is_valid = (b >= b'A' && b <= b'Z')
-                || (b >= b'a' && b <= b'z')
-                || (b >= b'0' && b <= b'9')
-                || b == b'-'
-                || b == b'_';
+        let meter_id_bytes: Vec<u8> = meter_id.clone().into();
+        for i in 0..meter_id_len {
+            let b = meter_id_bytes.get(i as u32).unwrap_or(0);
+            let is_valid = (b >= 65 && b <= 90)
+                || (b >= 97 && b <= 122)
+                || (b >= 48 && b <= 57)
+                || b == 45
+                || b == 95;
             if !is_valid {
                 panic!("Meter ID contains invalid characters (alphanumeric, hyphens, and underscores only)");
             }
@@ -288,7 +288,7 @@ impl NepaBillingContract {
             reviewer: reviewer.clone(),
             rating,
             comment,
-            timestamp: env.ledger().timestamp(),
+            timestamp: env.ledger().timestamp() as i64,
             transaction_hash,
         };
 
@@ -324,7 +324,7 @@ impl NepaBillingContract {
         env.storage().persistent().get(&stats_key).unwrap_or(RatingStats {
             total_reviews: 0,
             average_rating: 0,
-            rating_counts: Vec::from_array(&env, &[0, 0, 0, 0, 0]),
+            rating_counts: Vec::from_array(&env, [0i64, 0, 0, 0, 0]),
         })
     }
 
@@ -341,7 +341,7 @@ impl NepaBillingContract {
         let mut stats: RatingStats = env.storage().persistent().get(&stats_key).unwrap_or(RatingStats {
             total_reviews: 0,
             average_rating: 0,
-            rating_counts: Vec::from_array(&env, &[0, 0, 0, 0, 0]),
+            rating_counts: Vec::from_array(&env, [0i64, 0, 0, 0, 0]),
         });
 
         // Update total reviews
@@ -381,12 +381,12 @@ impl NepaBillingContract {
             .unwrap_or_else(|| panic!("Refund config not found"));
 
         if !config.enabled || config.paused {
-            panic!(REFUNDS_PAUSED);
+            panic!("{}", REFUNDS_PAUSED);
         }
 
         // Get payment record
         let payment_record: PaymentRecord = env.storage().persistent().get(&payment_id)
-            .unwrap_or_else(|| panic!(PAYMENT_NOT_FOUND));
+            .unwrap_or_else(|| panic!("{}", PAYMENT_NOT_FOUND));
 
         // Validation: Only original payer can request refund
         if payment_record.payer != requester {
@@ -401,17 +401,17 @@ impl NepaBillingContract {
         // Validation: Check refund window (24 hours)
         let current_time = env.ledger().timestamp();
         if current_time > payment_record.timestamp + config.refund_window_seconds {
-            panic!(REFUND_WINDOW_EXPIRED);
+            panic!("{}", REFUND_WINDOW_EXPIRED);
         }
 
         // Validation: Check amount limits
         if payment_record.amount > config.max_refund_amount {
-            panic!(INVALID_REFUND_AMOUNT);
+            panic!("{}", INVALID_REFUND_AMOUNT);
         }
 
         // Validation: Check reason length
         if reason.len() == 0 || reason.len() > 500 {
-            panic!(INVALID_REFUND_REASON);
+            panic!("{}", INVALID_REFUND_REASON);
         }
 
         // Generate refund ID
@@ -464,25 +464,25 @@ impl NepaBillingContract {
             .unwrap_or_else(|| panic!("Refund config not found"));
 
         if !config.approvers.contains(&approver) {
-            panic!(INVALID_APPROVER);
+            panic!("{}", INVALID_APPROVER);
         }
 
         // Get refund request
         let refund_key = (REFUND_REQUESTS, refund_id);
         let mut refund_request: RefundRequest = env.storage().persistent().get(&refund_key)
-            .unwrap_or_else(|| panic!(REFUND_NOT_FOUND));
+            .unwrap_or_else(|| panic!("{}", REFUND_NOT_FOUND));
 
         // Check if refund is still pending
         if refund_request.status != RefundStatus::Pending {
-            panic!(REFUND_ALREADY_PROCESSED);
+            panic!("{}", REFUND_ALREADY_PROCESSED);
         }
 
         // Check expiration
         let current_time = env.ledger().timestamp();
         if current_time > refund_request.expiration {
             refund_request.status = RefundStatus::Expired;
             env.storage().persistent().set(&refund_key, &refund_request);
-            panic!(REFUND_EXPIRED);
+            panic!("{}", REFUND_EXPIRED);
         }
 
         // Check if approver already approved
@@ -523,17 +523,17 @@ impl NepaBillingContract {
             .unwrap_or_else(|| panic!("Refund config not found"));
 
         if !config.approvers.contains(&approver) {
-            panic!(INVALID_APPROVER);
+            panic!("{}", INVALID_APPROVER);
         }
 
         // Get refund request
         let refund_key = (REFUND_REQUESTS, refund_id);
         let mut refund_request: RefundRequest = env.storage().persistent().get(&refund_key)
-            .unwrap_or_else(|| panic!(REFUND_NOT_FOUND));
+            .unwrap_or_else(|| panic!("{}", REFUND_NOT_FOUND));
 
         // Check if refund is still pending
         if refund_request.status != RefundStatus::Pending {
-            panic!(REFUND_ALREADY_PROCESSED);
+            panic!("{}", REFUND_ALREADY_PROCESSED);
         }
 
         // Mark as rejected
@@ -560,7 +560,7 @@ impl NepaBillingContract {
         // Get refund request
         let refund_key = (REFUND_REQUESTS, refund_id);
         let refund_request: RefundRequest = env.storage().persistent().get(&refund_key)
-            .unwrap_or_else(|| panic!(REFUND_NOT_FOUND));
+            .unwrap_or_else(|| panic!("{}", REFUND_NOT_FOUND));
 
         // Check if refund is approved
         if refund_request.status != RefundStatus::Approved {
@@ -569,7 +569,7 @@ impl NepaBillingContract {
 
         // Get payment record
         let mut payment_record: PaymentRecord = env.storage().persistent().get(&refund_request.original_payment_id)
-            .unwrap_or_else(|| panic!(PAYMENT_NOT_FOUND));
+            .unwrap_or_else(|| panic!("{}", PAYMENT_NOT_FOUND));
 
         // Check if payment is already refunded
         if payment_record.is_refunded {
@@ -682,8 +682,8 @@ impl NepaBillingContract {
         if is_add {
             // Add approver if not already present
             if !config.approvers.contains(&approver) {
-                config.approvers.push_back(approver);
-                env.storage().persistent().set((APPROVER_STATUS, approver), &true);
+                config.approvers.push_back(approver.clone());
+                env.storage().persistent().set(&(APPROVER_STATUS, approver), &true);
             }
         } else {
             // Remove approver