Merge remote-tracking branch 'upstream/develop' into develop

README.MD

@@ -90,6 +90,10 @@ mvn -pl webgoat-server spring-boot:run
 ```
 ... you should be running webgoat on localhost:8080/WebGoat momentarily
 
+To change IP addresss add the following variable to WebGoat/webgoat-container/src/main/resources/application.properties file
+
+```server.address=x.x.x.x
+```
 
 # Vagrant
 

webgoat-container/pom.xml

@@ -37,6 +37,16 @@
 
     </profiles>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>de.flapdoodle.embed</groupId>
+                <artifactId>de.flapdoodle.embed.mongo</artifactId>
+                <version>2.0.0</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <build>
         <resources>
             <resource>

webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc

@@ -1,6 +1,6 @@
 == Order by clause
 
-Question: Does a preparared statement always prevent against an SQL injection?
+Question: Does a prepared statement always prevent against an SQL injection?
 Answer: No it does not
 
 Let's take a look at the following statement:
@@ -30,12 +30,11 @@ selectExpression:
 Based on HSQLDB
 ----
 
-This means an `orderExpression` van be a `selectExpression` which can be a function as well, so for example with
+This means an `orderExpression` can be a `selectExpression` which can be a function as well, so for example with
 a `case` statement we might be able to ask the database some questions, like:
 
 ----
-select * from users order by
+select * from users order by (case when (true) then lastname else firstname)
-    (select case when (true) then lastname else firstname)
 ----
 
 So we can substitute any kind of boolean operation in the `when(....)` part. The statement will just work because

webgoat-server/src/main/docker/Dockerfile

@@ -1,6 +1,8 @@
 FROM openjdk:8-jre
-VOLUME /tmp
+
-RUN cd /root; mkdir -p .webgoat
+RUN useradd --home-dir /home/webgoat --create-home -U webgoat
-ADD webgoat-server-8.0-SNAPSHOT.jar webgoat.jar
+
-RUN sh -c 'touch /webgoat.jar'
+USER webgoat
-ENTRYPOINT ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/webgoat.jar"]
+RUN cd /home/webgoat/; mkdir -p .webgoat
+COPY webgoat-server-8.0-SNAPSHOT.jar /home/webgoat/webgoat.jar
+ENTRYPOINT ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/home/webgoat/webgoat.jar"]