dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add new service to view source

Browse Source
This commit is contained in:
lawson89 2014-08-11 16:22:25 -04:00
parent 76c08cac5c
commit 05dc945d95
4 changed files with 253 additions and 166 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

301
java/org/owasp/webgoat/LessonSource.java
View File

@ -1,4 +1,3 @@
package org.owasp.webgoat; package org.owasp.webgoat;
import java.io.IOException; import java.io.IOException;
@ -10,197 +9,177 @@ import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.session.Course; import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
/**
/*************************************************************************************************** * *************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project
* please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* *
* Copyright (c) 2002 - 2007 Bruce Mayhew * Copyright (c) 2002 - 2007 Bruce Mayhew
* *
* This program is free software; you can redistribute it and/or modify it under the terms of the * This program is free software; you can redistribute it and/or modify it under
* GNU General Public License as published by the Free Software Foundation; either version 2 of the * the terms of the GNU General Public License as published by the Free Software
* License, or (at your option) any later version. * Foundation; either version 2 of the License, or (at your option) any later
* * version.
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without *
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * This program is distributed in the hope that it will be useful, but WITHOUT
* General Public License for more details. * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* You should have received a copy of the GNU General Public License along with this program; if * details.
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA *
* 02111-1307, USA. * You should have received a copy of the GNU General Public License along with
* * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Getting Source ============== * Getting Source ==============
* *
* Source for this application is maintained at code.google.com, a repository for free software * Source for this application is maintained at code.google.com, a repository
* projects. * for free software projects.
* *
* For details, please see http://code.google.com/p/webgoat/ * For details, please see http://code.google.com/p/webgoat/
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
public class LessonSource extends HammerHead public class LessonSource extends HammerHead {
{
/** /**
* *
*/ */
private static final long serialVersionUID = 2588430536196446145L; private static final long serialVersionUID = 2588430536196446145L;
/** /**
* Description of the Field * Description of the Field
*/ */
public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE"; public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE";
public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE"; public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE";
/** /**
* Description of the Method * Description of the Method
* *
* @param request * @param request Description of the Parameter
* Description of the Parameter * @param response Description of the Parameter
* @param response * @exception IOException Description of the Exception
* Description of the Parameter * @exception ServletException Description of the Exception
* @exception IOException */
* Description of the Exception public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
* @exception ServletException String source = null;
* Description of the Exception
*/
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
{
String source = null;
try try {
{
// System.out.println( "Entering doPost: " ); // System.out.println( "Entering doPost: " );
// System.out.println( " - request " + request); // System.out.println( " - request " + request);
// System.out.println( " - principle: " + request.getUserPrincipal() // System.out.println( " - principle: " + request.getUserPrincipal()
// ); // );
// setCacheHeaders(response, 0); // setCacheHeaders(response, 0);
WebSession session = (WebSession) request.getSession(true).getAttribute(WebSession.SESSION); WebSession session = (WebSession) request.getSession(true).getAttribute(WebSession.SESSION);
// FIXME: Too much in this call. // FIXME: Too much in this call.
session.update(request, response, this.getServletName()); session.update(request, response, this.getServletName());
boolean showSolution = session.getParser().getBooleanParameter("solution", false); boolean showSolution = session.getParser().getBooleanParameter("solution", false);
boolean showSource = session.getParser().getBooleanParameter("source", false); boolean showSource = session.getParser().getBooleanParameter("source", false);
if (showSolution) if (showSolution) {
{
// Get the Java solution of the lesson. // Get the Java solution of the lesson.
source = getSolution(session); source = getSolution(session);
int scr = session.getCurrentScreen(); int scr = session.getCurrentScreen();
Course course = session.getCourse(); Course course = session.getCourse();
AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE); AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE);
lesson.getLessonTracker(session).setViewedSolution(true); lesson.getLessonTracker(session).setViewedSolution(true);
} } else if (showSource) {
else if (showSource)
{
// Get the Java source of the lesson. FIXME: Not needed // Get the Java source of the lesson. FIXME: Not needed
source = getSource(session); source = getSource(session);
int scr = session.getCurrentScreen(); int scr = session.getCurrentScreen();
Course course = session.getCourse(); Course course = session.getCourse();
AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE); AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE);
lesson.getLessonTracker(session).setViewedSource(true); lesson.getLessonTracker(session).setViewedSource(true);
} }
} catch (Throwable t) } catch (Throwable t) {
{ t.printStackTrace();
t.printStackTrace(); log("ERROR: " + t);
log("ERROR: " + t); } finally {
} finally try {
{ this.writeSource(source, response);
try } catch (Throwable thr) {
{ thr.printStackTrace();
this.writeSource(source, response); log(request, "Could not write error screen: " + thr.getMessage());
} catch (Throwable thr) }
{ // System.out.println( "Leaving doPost: " );
thr.printStackTrace();
log(request, "Could not write error screen: " + thr.getMessage());
}
// System.out.println( "Leaving doPost: " );
} }
} }
/** /**
* Description of the Method * Description of the Method
* *
* @param s * @param s Description of the Parameter
* Description of the Parameter * @return Description of the Return Value
* @return Description of the Return Value */
*/ protected String getSource(WebSession s) {
protected String getSource(WebSession s)
{
String source = null; String source = null;
int scr = s.getCurrentScreen(); int scr = s.getCurrentScreen();
Course course = s.getCourse(); Course course = s.getCourse();
if (s.isUser() || s.isChallenge()) if (s.isUser() || s.isChallenge()) {
{
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE); AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
if (lesson != null) if (lesson != null) {
{ source = lesson.getSource(s);
source = lesson.getSource(s); }
} }
} if (source == null) {
if (source == null) { return "Source code is not available. Contact " return "Source code is not available. Contact "
+ s.getWebgoatContext().getFeedbackAddressHTML(); } + s.getWebgoatContext().getFeedbackAddressHTML();
return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP, }
"Code Section Deliberately Omitted")); return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
} "Code Section Deliberately Omitted"));
}
protected String getSolution(WebSession s) protected String getSolution(WebSession s) {
{
String source = null; String source = null;
int scr = s.getCurrentScreen(); int scr = s.getCurrentScreen();
Course course = s.getCourse(); Course course = s.getCourse();
if (s.isUser() || s.isChallenge()) if (s.isUser() || s.isChallenge()) {
{
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE); AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
if (lesson != null) if (lesson != null) {
{ source = lesson.getSolution(s);
source = lesson.getSolution(s); }
} }
} if (source == null) {
if (source == null) { return "Solution is not available. Contact " return "Solution is not available. Contact "
+ s.getWebgoatContext().getFeedbackAddressHTML(); } + s.getWebgoatContext().getFeedbackAddressHTML();
return (source); }
} return (source);
}
/** /**
* Description of the Method * Description of the Method
* *
* @param s * @param s Description of the Parameter
* Description of the Parameter * @param response Description of the Parameter
* @param response * @exception IOException Description of the Exception
* Description of the Parameter */
* @exception IOException protected void writeSource(String s, HttpServletResponse response) throws IOException {
* Description of the Exception response.setContentType("text/html");
*/
protected void writeSource(String s, HttpServletResponse response) throws IOException
{
response.setContentType("text/html");
PrintWriter out = response.getWriter(); PrintWriter out = response.getWriter();
if (s == null) if (s == null) {
{ s = new String();
s = new String(); }
}
out.print(s); out.print(s);
out.close(); out.close();
} }
} }

24
java/org/owasp/webgoat/lessons/AbstractLesson.java
View File

@ -1,6 +1,7 @@
package org.owasp.webgoat.lessons; package org.owasp.webgoat.lessons;
import java.io.BufferedReader; import java.io.BufferedReader;
import java.io.FileNotFoundException;
import java.io.FileReader; import java.io.FileReader;
import java.io.InputStreamReader; import java.io.InputStreamReader;
import java.io.StringReader; import java.io.StringReader;
@ -313,10 +314,10 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
} }
protected abstract List<String> getHints(WebSession s); protected abstract List<String> getHints(WebSession s);
// @TODO we need to restrict access at the service layer // @TODO we need to restrict access at the service layer
// rather than passing session object around // rather than passing session object around
public List<String> getHintsPublic(WebSession s){ public List<String> getHintsPublic(WebSession s) {
List<String> hints = getHints(s); List<String> hints = getHints(s);
return hints; return hints;
} }
@ -491,6 +492,25 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
return source; return source;
} }
public String getRawSource(WebSession s) {
String src;
try {
// System.out.println("Loading source file: " +
// getSourceFileName());
src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getSourceFileName()))), true);
} catch (FileNotFoundException e) {
s.setMessage("Could not find source file");
src = ("Could not find the source file or source file does not exist.<br/>"
+ "Send this message to: <a href=\"mailto:" + s.getWebgoatContext().getFeedbackAddress()
+ "?subject=Source " + getSourceFileName() + " not found. Lesson: "
+ s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext().getFeedbackAddress() + "</a>");
}
return src;
}
public String getSolution(WebSession s) { public String getSolution(WebSession s) {
String src = null; String src = null;

3
java/org/owasp/webgoat/service/CookieService.java
View File

@ -30,12 +30,9 @@
*/ */
package org.owasp.webgoat.service; package org.owasp.webgoat.service;
import java.util.ArrayList;
import java.util.List; import java.util.List;
import javax.servlet.http.Cookie; import javax.servlet.http.Cookie;
import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSession;
import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.model.Hint;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller; import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;

91
java/org/owasp/webgoat/service/SourceService.java Normal file
View File

@ -0,0 +1,91 @@
/**
* *************************************************************************************************
*
*
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
*
* Copyright (c) 2002 - 2007 Bruce Mayhew
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Getting Source ==============
*
* Source for this application is maintained at code.google.com, a repository
* for free software projects.
*
* For details, please see http://code.google.com/p/webgoat/
*/
package org.owasp.webgoat.service;
import javax.servlet.http.HttpSession;
import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
/**
*
* @author rlawson
*/
@Controller
public class SourceService extends BaseService {
/**
* Returns source for current attack
*
* @param session
* @return
*/
@RequestMapping(value = "/source.mvc", produces = "application/json")
public @ResponseBody
String showSource(HttpSession session) {
WebSession ws = getWebSesion(session);
String source = getSource(ws);
return source;
}
/**
* Description of the Method
*
* @param s Description of the Parameter
* @return Description of the Return Value
*/
protected String getSource(WebSession s) {
String source = null;
int scr = s.getCurrentScreen();
Course course = s.getCourse();
if (s.isUser() || s.isChallenge()) {
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
if (lesson != null) {
source = lesson.getRawSource(s);
}
}
if (source == null) {
return "Source code is not available. Contact "
+ s.getWebgoatContext().getFeedbackAddressHTML();
}
return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
"Code Section Deliberately Omitted"));
}
}