getSource.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getSource(WebSession s) {
- String source = null;
- String src = null;
-
- try {
- // System.out.println("Loading source file: " +
- // getSourceFileName());
- src = convertMetacharsJavaCode(readFromFile(new BufferedReader(new FileReader(getSourceFileName())), true));
-
- // TODO: For styled line numbers and better memory efficiency,
- // use a custom FilterReader
- // that performs the convertMetacharsJavaCode() transform plus
- // optionally adds a styled
- // line number. Wouldn't color syntax be great too?
- } catch (Exception e) {
- s.setMessage("Could not find source file");
- src = ("Could not find the source file or source file does not exist.getRawSource.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getRawSource(WebSession s) {
- String src = "";
-
- try {
- logger.debug("Loading source file: " + getSourceFileName());
- if (getSourceFileName() != null) {
- src = readFromFile(new BufferedReader(new FileReader(getSourceFileName())), false);
- }
-
- } catch (FileNotFoundException e) {
- s.setMessage("Could not find source file");
- src = ("Could not find the source file or source file does not exist.getSolution.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getSolution(WebSession s) {
- String src = null;
-
- try {
- // System.out.println("Solution: " + getLessonSolutionFileName());
- src = readFromFile(new BufferedReader(new FileReader(getLessonSolutionFileName())), false);
- } catch (Exception e) {
- logger.error("Could not find solution for {}", getLessonSolutionFileName());
- s.setMessage("Could not find the solution file");
- src = ("Could not find the solution file or solution file does not exist.Returns the default "path" portion of a lesson's URL.
*
@@ -643,244 +199,9 @@ public abstract class AbstractLesson extends Screen implements Comparable
- * Unlike getLink() this method does not require rendering the output of
- * the request to the link in order to execute the servlet's method with
- * conventional HTTP query parameters.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getServletLink() {
- StringBuffer link = new StringBuffer("attack");
-
- return link
- .append("?Screen=").append(getScreenId())
- .append("&menu=").append(getCategory().getRanking()).toString();
- }
-
- /**
- * Get the link to the jsp page used to render this screen.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getPage(WebSession s) {
- return null;
- }
-
- /**
- * Get the link to the jsp template page used to render this screen.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getTemplatePage(WebSession s) {
- return null;
- }
-
- /**
- * getCurrentAction.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public abstract String getCurrentAction(WebSession s);
-
- /**
- * Initiates lesson restart functionality
- */
- public abstract void restartLesson();
-
-
- /**
- * setCurrentAction.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param lessonScreen a {@link java.lang.String} object.
- */
- public abstract void setCurrentAction(WebSession s, String lessonScreen);
-
- /**
- * Override this method to implement accesss control in a lesson.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param functionId a {@link java.lang.String} object.
- * @param employeeId a int.
- * @return a boolean.
- */
- public boolean isAuthorized(WebSession s, int employeeId, String functionId) {
- return false;
- }
-
- /**
- * Override this method to implement accesss control in a lesson.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param functionId a {@link java.lang.String} object.
- * @param role a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean isAuthorized(WebSession s, String role, String functionId) {
- logger.info("Checking if " + role + " authorized for: " + functionId);
- boolean authorized = false;
- try {
- String query = "SELECT * FROM auth WHERE role = '" + role + "' and functionid = '" + functionId + "'";
- try {
- Statement answer_statement = WebSession.getConnection(s)
- .createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
- ResultSet answer_results = answer_statement.executeQuery(query);
- authorized = answer_results.first();
- logger.info("authorized: " + authorized);
- } catch (SQLException sqle) {
- s.setMessage("Error authorizing");
- logger.error("Error authorizing", sqle);
- }
- } catch (Exception e) {
- s.setMessage("Error authorizing");
- logger.error("Error authorizing", e);
- }
- return authorized;
- }
-
- /**
- * getUserId.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a int.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public int getUserId(WebSession s) throws ParameterNotFoundException {
- return -1;
- }
-
- /**
- * getUserName.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getUserName(WebSession s) throws ParameterNotFoundException {
- return null;
- }
-
- /**
- * Description of the Method
- *
- * @param windowName Description of the Parameter
- * @return Description of the Return Value
- */
- public static String makeWindowScript(String windowName) {
- // FIXME: make this string static
- StringBuffer script = new StringBuffer();
- script.append("\n");
-
- return script.toString();
- }
-
- /**
- * Simply reads a url into an Element for display. CAUTION: you might want
- * to tinker with any non-https links (href)
- *
- * @param url Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element readFromURL(String url) {
- ElementContainer ec = new ElementContainer();
-
- try {
- URL u = new URL(url);
- HttpURLConnection huc = (HttpURLConnection) u.openConnection();
- BufferedReader reader = new BufferedReader(new InputStreamReader(huc.getInputStream()));
- String line;
-
- while ((line = reader.readLine()) != null) {
- ec.addElement(new StringElement(line));
- }
-
- reader.close();
- } catch (Exception e) {
- System.out.println(e);
- e.printStackTrace();
- }
-
- return (ec);
- }
-
- /**
- * Description of the Method
- *
- * @param reader Description of the Parameter
- * @param numbers Description of the Parameter
- * @param methodName Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element readMethodFromFile(BufferedReader reader, String methodName, boolean numbers) {
- PRE pre = new PRE().addElement(getFileMethod(reader, methodName, numbers));
-
- return (pre);
- }
-
- /**
- * Description of the Method
- *
- * @param s Description of the Parameter
- */
- public void handleRequest(WebSession s) {
- // call createContent first so messages will go somewhere
- Form form = new Form(getFormAction(), Form.POST).setName("form").setEncType("");
- form.addElement(createContent(s));
- setContent(form);
- s.getRequest().getRequestURL();
- }
-
- /**
- * getFormAction.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getFormAction() {
- return getLink();
- }
-
/**
* Description of the Method
*
@@ -890,116 +211,6 @@ public abstract class AbstractLesson extends Screen implements ComparableGetter for the field defaultLanguage.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getDefaultLanguage() {
- return this.defaultLanguage;
- }
-
- /**
- * getAvailableLanguages() {
- return this.availableLanguages;
- }
-
- /**
- * Getter for the field lessonSolutionFileName.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getLessonSolutionFileName() {
- return lessonSolutionFileName;
- }
-
- /**
- * Setter for the field lessonSolutionFileName.
- *
- * @param lessonSolutionFileName a {@link java.lang.String} object.
- */
- public void setLessonSolutionFileName(String lessonSolutionFileName) {
- this.lessonSolutionFileName = lessonSolutionFileName;
- }
-
- /**
- * Getter for the field sourceFileName.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSourceFileName() {
- return sourceFileName;
- }
-
- /**
- * Setter for the field sourceFileName.
- *
- * @param sourceFileName a {@link java.lang.String} object.
- */
- public void setSourceFileName(String sourceFileName) {
- logger.debug("Setting source file of lesson " + this + " to: " + sourceFileName);
- this.sourceFileName = sourceFileName;
- }
-
- /**
- * Getter for the field webgoatContext.
- *
- * @return a {@link org.owasp.webgoat.session.WebgoatContext} object.
- */
- public WebgoatContext getWebgoatContext() {
- return webgoatContext;
- }
-
- /**
- * Setter for the field webgoatContext.
- *
- * @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
- */
- public void setWebgoatContext(WebgoatContext webgoatContext) {
- this.webgoatContext = webgoatContext;
- }
-
- /**
- * Getter for the field labelManager.
- *
- * @return a {@link org.owasp.webgoat.util.LabelManager} object.
- */
- protected LabelManager getLabelManager() {
- if (labelManager == null) {
- labelManager = BeanProvider.getBean("labelManager", LabelManager.class);
- }
- return labelManager;
- }
-
public String getId() {
return "";
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpoint.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java
similarity index 86%
rename from webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpoint.java
rename to webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java
index f7a8a8a0d..1a7e3aee2 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpoint.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java
@@ -28,7 +28,6 @@ package org.owasp.webgoat.lessons;
import org.owasp.webgoat.lessons.model.AttackResult;
import org.owasp.webgoat.session.LessonTracker;
import org.owasp.webgoat.session.UserTracker;
-import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.boot.actuate.endpoint.Endpoint;
@@ -46,14 +45,13 @@ import java.io.File;
* Note: each subclass should declare this annotation otherwise the WebGoat framework cannot find your endpoint.
*/
@LessonEndpointMapping
-public abstract class LessonEndpoint implements MvcEndpoint {
+public abstract class AssignmentEndpoint implements MvcEndpoint {
@Autowired
@Qualifier("pluginTargetDirectory")
private File pluginDirectory;
@Autowired
- private WebSession webSession;
- private boolean solved = false;
+ private UserTracker userTracker;
/**
* The directory of the plugin directory in which the lessons resides, so if you want to access the lesson 'ClientSideFiltering' you will
@@ -71,15 +69,21 @@ public abstract class LessonEndpoint implements MvcEndpoint {
return new File(this.pluginDirectory, "plugin");
}
+ /**
+ * Get the lesson tracker which is based on the current user and do the
+ * @return
+ */
protected LessonTracker getLessonTracker() {
- UserTracker userTracker = UserTracker.instance();
- LessonTracker lessonTracker = userTracker.getLessonTracker(webSession, webSession.getCurrentLesson());
+ LessonTracker lessonTracker = userTracker.getCurrentLessonTracker();
return lessonTracker;
}
protected AttackResult trackProgress(AttackResult attackResult) {
- this.solved = attackResult.isLessonCompleted();
- getLessonTracker().setCompleted(solved);
+ //// TODO: 11/5/2016 improve
+ if (attackResult.isLessonCompleted()) {
+ getLessonTracker().incrementNumVisits();
+ }
+ getLessonTracker().setCompleted(attackResult.isLessonCompleted());
return attackResult;
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Attack.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Attack.java
deleted file mode 100644
index c8976dce6..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Attack.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package org.owasp.webgoat.lessons;
-
-
-import org.owasp.webgoat.lessons.model.AttackResult;
-
-/**
- * ************************************************************************************************
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- *
- * @author WebGoat
- * @version $Id: $Id
- * @since August 08, 2016
- */
- public interface Attack {
-
- AttackResult attack();
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java
index 66b3ee276..ea6a3cbb4 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java
@@ -1,220 +1,76 @@
package org.owasp.webgoat.lessons;
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
+import lombok.Getter;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
*
* @author Bruce Mayhew WebGoat
- * @since October 28, 2003
* @version $Id: $Id
+ * @since October 28, 2003
*/
-public class Category implements Comparable {
+public enum Category {
- /** Constant INTRODUCTION */
- public final static Category INTRODUCTION = new Category("Introduction", new Integer(5));
-
- /** Constant GENERAL */
- public final static Category GENERAL = new Category("General", new Integer(100));
-
- /** Constant ACCESS_CONTROL */
- public final static Category ACCESS_CONTROL = new Category("Access Control Flaws", new Integer(200));
-
- /** Constant AJAX_SECURITY */
- public final static Category AJAX_SECURITY = new Category("AJAX Security", new Integer(400));
-
- /** Constant AUTHENTICATION */
- public final static Category AUTHENTICATION = new Category("Authentication Flaws", new Integer(500));
-
- /** Constant BUFFER_OVERFLOW */
- public final static Category BUFFER_OVERFLOW = new Category("Buffer Overflows", new Integer(600));
-
- /** Constant CODE_QUALITY */
- public final static Category CODE_QUALITY = new Category("Code Quality", new Integer(700));
-
- /** Constant CONCURRENCY */
- public final static Category CONCURRENCY = new Category("Concurrency", new Integer(800));
-
- /** Constant XSS */
- public final static Category XSS = new Category("Cross-Site Scripting (XSS)", new Integer(900));
-
- /** Constant ERROR_HANDLING */
- public final static Category ERROR_HANDLING = new Category("Improper Error Handling", new Integer(1000));
-
- /** Constant INJECTION */
- public final static Category INJECTION = new Category("Injection Flaws", new Integer(1100));
-
- /** Constant DOS */
- public final static Category DOS = new Category("Denial of Service", new Integer(1200));
-
- /** Constant INSECURE_COMMUNICATION */
- public final static Category INSECURE_COMMUNICATION = new Category("Insecure Communication", new Integer(1300));
-
- /** Constant INSECURE_CONFIGURATION */
- public final static Category INSECURE_CONFIGURATION = new Category("Insecure Configuration", new Integer(1400));
-
- /** Constant INSECURE_STORAGE */
- public final static Category INSECURE_STORAGE = new Category("Insecure Storage", new Integer(1500));
-
- /** Constant MALICIOUS_EXECUTION */
- public final static Category MALICIOUS_EXECUTION = new Category("Malicious Execution", new Integer(1600));
-
- /** Constant PARAMETER_TAMPERING */
- public final static Category PARAMETER_TAMPERING = new Category("Parameter Tampering", new Integer(1700));
-
- /** Constant SESSION_MANAGEMENT */
- public final static Category SESSION_MANAGEMENT = new Category("Session Management Flaws", new Integer(1800));
-
- /** Constant WEB_SERVICES */
- public final static Category WEB_SERVICES = new Category("Web Services", new Integer(1900));
-
- /** Constant ADMIN_FUNCTIONS */
- public final static Category ADMIN_FUNCTIONS = new Category("Admin Functions", new Integer(2000));
-
- /** Constant CHALLENGE */
- public final static Category CHALLENGE = new Category("Challenge", new Integer(3000));
-
- private static final List categories = new ArrayList();
-
- private String category;
+ INTRODUCTION("Introduction", new Integer(5)),
+ GENERAL("General", new Integer(100)),
+ ACCESS_CONTROL("Access Control Flaws", new Integer(200)),
+ AJAX_SECURITY("AJAX Security", new Integer(400)),
+ AUTHENTICATION("Authentication Flaws", new Integer(500)),
+ BUFFER_OVERFLOW("Buffer Overflows", new Integer(600)),
+ CODE_QUALITY("Code Quality", new Integer(700)),
+ CONCURRENCY("Concurrency", new Integer(800)),
+ XSS("Cross-Site Scripting (XSS)", new Integer(900)),
+ ERROR_HANDLING("Improper Error Handling", new Integer(1000)),
+ INJECTION("Injection Flaws", new Integer(1100)),
+ DOS("Denial of Service", new Integer(1200)),
+ INSECURE_COMMUNICATION("Insecure Communication", new Integer(1300)),
+ INSECURE_CONFIGURATION("Insecure Configuration", new Integer(1400)),
+ INSECURE_STORAGE("Insecure Storage", new Integer(1500)),
+ MALICIOUS_EXECUTION("Malicious Execution", new Integer(1600)),
+ PARAMETER_TAMPERING("Parameter Tampering", new Integer(1700)),
+ SESSION_MANAGEMENT("Session Management Flaws", new Integer(1800)),
+ WEB_SERVICES("Web Services", new Integer(1900)),
+ ADMIN_FUNCTIONS("Admin Functions", new Integer(2000)),
+ CHALLENGE("Challenge", new Integer(3000));
+ @Getter
+ private String name;
+ @Getter
private Integer ranking;
- static {
- categories.add(INTRODUCTION);
- categories.add(PARAMETER_TAMPERING);
- categories.add(ACCESS_CONTROL);
- categories.add(AUTHENTICATION);
- categories.add(SESSION_MANAGEMENT);
- categories.add(XSS);
- categories.add(BUFFER_OVERFLOW);
- categories.add(INJECTION);
- categories.add(MALICIOUS_EXECUTION);
- categories.add(ERROR_HANDLING);
- categories.add(INSECURE_STORAGE);
- categories.add(DOS);
- categories.add(INSECURE_CONFIGURATION);
- categories.add(WEB_SERVICES);
- categories.add(AJAX_SECURITY);
- categories.add(ADMIN_FUNCTIONS);
- categories.add(GENERAL);
- categories.add(CODE_QUALITY);
- categories.add(CONCURRENCY);
- categories.add(INSECURE_COMMUNICATION);
- categories.add(CHALLENGE);
- }
-
- /**
- * addCategory.
- *
- * @param c a {@link org.owasp.webgoat.lessons.Category} object.
- */
- public static synchronized void addCategory(Category c) {
- categories.add(c);
- }
-
- /**
- * Getter for the field category.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link org.owasp.webgoat.lessons.Category} object.
- */
- public static synchronized Category getCategory(String name) {
- Iterator it = categories.iterator();
- while (it.hasNext()) {
- Category c = it.next();
- if (c.getName().equals(name)) {
- return c;
- }
- }
- return null;
- }
-
- /**
- * Constructor for Category.
- *
- * @param category a {@link java.lang.String} object.
- * @param ranking a {@link java.lang.Integer} object.
- */
- public Category(String category, Integer ranking) {
- this.category = category;
+ Category(String name, Integer ranking) {
+ this.name = name;
this.ranking = ranking;
}
- /** {@inheritDoc} */
- @Override
- public int compareTo(Object obj) {
- int value = 1;
-
- if (obj instanceof Category) {
- value = this.getRanking().compareTo(((Category) obj).getRanking());
- }
-
- return value;
- }
-
/**
- * Getter for the field ranking.
- *
- * @return a {@link java.lang.Integer} object.
+ * {@inheritDoc}
*/
- public Integer getRanking() {
- return ranking;
- }
-
- /**
- * Setter for the field ranking.
- *
- * @param ranking a {@link java.lang.Integer} object.
- * @return a {@link java.lang.Integer} object.
- */
- public Integer setRanking(Integer ranking) {
- return this.ranking = ranking;
- }
-
- /**
- * getName.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getName() {
- return category;
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(Object obj) {
- return (obj instanceof Category) && getName().equals(((Category) obj).getName());
- }
-
- /** {@inheritDoc} */
@Override
public String toString() {
return getName();
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
index 993c18694..2825ef6e7 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
@@ -30,76 +30,8 @@
*/
package org.owasp.webgoat.lessons;
-import com.google.common.base.Joiner;
-import org.apache.commons.io.IOUtils;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.Center;
-import org.apache.ecs.html.H3;
-import org.apache.ecs.html.P;
-import org.apache.ecs.html.PRE;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.session.WebSession;
-
-import java.io.BufferedReader;
-import java.io.FileReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-
-
public abstract class LessonAdapter extends AbstractLesson {
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s) {
- // Mark this lesson as completed.
- makeSuccess(s);
-
- ElementContainer ec = new ElementContainer();
-
- ec.addElement(new Center().addElement(new H3().addElement(new StringElement(
- "Detailed Lesson Creation Instructions."))));
- ec.addElement(new P());
- ec
- .addElement(new StringElement(
- "Lesson are simple to create and very little coding is required. "
- + "In fact, most lessons can be created by following the easy to use instructions in the "
- + "WebGoat User Guide. "
- + "If you would prefer, send your lesson ideas to "
- + getWebgoatContext().getFeedbackAddressHTML()));
-
- try (InputStream is = Thread.currentThread().getContextClassLoader()
- .getResourceAsStream("New Lesson Instructions.txt")) {
- if (is != null) {
- PRE pre = new PRE();
- pre.addElement(Joiner.on("\n").join(IOUtils.readLines(is)));
- ec.addElement(pre);
- }
- } catch (IOException e) {
- e.printStackTrace();
- }
- return (ec);
- }
-
- /**
- * Gets the category attribute of the LessonAdapter object. The default
- * category is "General" Only override this method if you wish to create a
- * new category or if you wish this lesson to reside within a category other
- * the "General"
- *
- * @return The category value
- */
- protected Category getDefaultCategory() {
- return Category.GENERAL;
- }
/**
* getDefaultHidden.
@@ -129,29 +61,6 @@ public abstract class LessonAdapter extends AbstractLesson {
return DEFAULT_RANKING;
}
- /**
- * {@inheritDoc}
- *
- * Gets the hintCount attribute of the LessonAdapter object
- */
- public int getHintCount(WebSession s) {
- return getHints(s).size();
- }
-
- /**
- * {@inheritDoc}
- *
- * Fill in a minor hint that will help people who basically get it, but are
- * stuck on somthing silly. Hints will be returned to the user in the order
- * they appear below. The user must click on the "next hint" button before
- * the hint will be displayed.
- */
- protected List getHints(WebSession s) {
- List hints = new ArrayList();
- hints.add("There are no hints defined.");
- return hints;
- }
-
/**
* provide a default submitMethod of lesson does not implement
*
@@ -161,44 +70,6 @@ public abstract class LessonAdapter extends AbstractLesson {
return "GET";
}
- /**
- * {@inheritDoc}
- *
- * Gets the instructions attribute of the LessonAdapter object. Instructions
- * will rendered as html and will appear below the control area and above
- * the actual lesson area. Instructions should provide the user with the
- * general setup and goal of the lesson.
- */
- public String getInstructions(WebSession s) {
- StringBuffer buff = new StringBuffer();
- String lang = s.getCurrrentLanguage();
- try {
- String fileName = getLessonPlanFileName(lang);
- if (fileName != null) {
- BufferedReader in = new BufferedReader(new FileReader(fileName));
- String line = null;
- boolean startAppending = false;
- while ((line = in.readLine()) != null) {
- if (line.indexOf("") != -1) {
- startAppending = true;
- continue;
- }
- if (line.indexOf("") != -1) {
- startAppending = false;
- continue;
- }
- if (startAppending) {
- buff.append(line + "\n");
- }
- }
- }
- } catch (Exception e) {
- }
-
- return buff.toString();
-
- }
-
/**
* Fill in a descriptive title for this lesson. The title of the lesson.
* This will appear above the control area at the top of the page. This
@@ -210,71 +81,5 @@ public abstract class LessonAdapter extends AbstractLesson {
return "Untitled Lesson " + getScreenId();
}
- /** {@inheritDoc} */
- public String getCurrentAction(WebSession s) {
- return s.getLessonSession(this).getCurrentLessonScreen();
- }
-
- /** {@inheritDoc} */
- public void setCurrentAction(WebSession s, String lessonScreen) {
- s.getLessonSession(this).setCurrentLessonScreen(lessonScreen);
- }
-
- @Override
- protected Element makeMessages(WebSession s) {
- return super.makeMessages(s);
- }
-
- /**
- * getSessionAttribute.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param key a {@link java.lang.String} object.
- * @return a {@link java.lang.Object} object.
- */
- public Object getSessionAttribute(WebSession s, String key) {
- return s.getRequest().getSession().getAttribute(key);
- }
-
- /**
- * setSessionAttribute.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param key a {@link java.lang.String} object.
- * @param value a {@link java.lang.Object} object.
- */
- public void setSessionAttribute(WebSession s, String key, Object value) {
- s.getRequest().getSession().setAttribute(key, value);
- }
-
- /**
- * Description of the Method
- *
- * @param s Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element makeSuccess(WebSession s) {
- getLessonTracker(s).setCompleted(true);
-
- //s.setMessage(getLabelManager().get("LessonCompleted"));
-
- return (null);
- }
-
- /**
- * Gets the credits attribute of the AbstractLesson object
- *
- * @return The credits value
- * @param text a {@link java.lang.String} object.
- * @param e a {@link org.apache.ecs.Element} object.
- */
- protected Element getCustomCredits(String text, Element e) {
- Table t = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("RIGHT");
- TR tr = new TR();
- tr.addElement(new TD(text).setVAlign("MIDDLE").setAlign("RIGHT").setWidth("100%"));
- tr.addElement(new TD(e).setVAlign("MIDDLE").setAlign("RIGHT"));
- t.addElement(tr);
- return t;
- }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java
index a328f992d..94bc84c2c 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java
@@ -39,7 +39,7 @@ import java.lang.annotation.Target;
/**
* Annotation as a marker annotation. During the startup we scan the plugins for classes which use this annotation.
- * @see LessonEndpoint for more information.
+ * @see AssignmentEndpoint for more information.
*/
@Component
@Target(ElementType.TYPE)
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
index b19db4194..074391ba6 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
@@ -1,5 +1,7 @@
package org.owasp.webgoat.lessons;
+import lombok.Getter;
+import lombok.Setter;
import org.owasp.webgoat.session.WebSession;
import java.util.List;
@@ -35,18 +37,28 @@ import java.util.List;
*/
public abstract class NewLesson extends LessonAdapter {
+ @Setter
+ @Getter
+ private int totalNumberOfAssignments = 0;
+
@Override
public abstract Category getDefaultCategory();
- @Override
- public abstract List getHints(WebSession s); //TODO we should probably remove WebSession due to old lessons still here
+ public abstract List getHints();
@Override
- public abstract Integer getDefaultRanking();
+ public abstract Integer getDefaultRanking();
@Override
- public abstract String getTitle();
+ public abstract String getTitle();
@Override
public abstract String getId();
+
+ public final List getHints(WebSession w) {
+ throw new IllegalStateException("Do not use");
+ }
+
+
+
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/RandomLessonAdapter.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/RandomLessonAdapter.java
deleted file mode 100644
index e4a815f1c..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/RandomLessonAdapter.java
+++ /dev/null
@@ -1,143 +0,0 @@
-
-package org.owasp.webgoat.lessons;
-
-import org.owasp.webgoat.session.CreateDB;
-import org.owasp.webgoat.session.DatabaseUtilities;
-import org.owasp.webgoat.session.LessonTracker;
-import org.owasp.webgoat.session.RandomLessonTracker;
-import org.owasp.webgoat.session.WebSession;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-
-
-/**
- * Abstract RandomLessonAdapter class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public abstract class RandomLessonAdapter extends LessonAdapter
-{
-
- /**
- * getStages.
- *
- * @return an array of {@link java.lang.String} objects.
- */
- public abstract String[] getStages();
-
- /**
- * setStage.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param stage a {@link java.lang.String} object.
- * @param stage a {@link java.lang.String} object.
- */
- public void setStage(WebSession s, String stage)
- {
- getLessonTracker(s).setStage(stage);
- try
- {
- Connection connection = DatabaseUtilities.getConnection(s);
-
- CreateDB db = new CreateDB();
- db.makeDB(connection);
- System.out.println("Successfully refreshed the database.");
-
- } catch (SQLException sqle)
- {
- System.out.println("Error refreshing the database!");
- sqle.printStackTrace();
- }
- }
-
- /**
- * getStage.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public String getStage(WebSession s)
- {
- return getLessonTracker(s).getStage();
- }
-
- /**
- * setStageComplete.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param stage a {@link java.lang.String} object.
- * @param stage a {@link java.lang.String} object.
- */
- public void setStageComplete(WebSession s, String stage)
- {
- RandomLessonTracker lt = getLessonTracker(s);
- lt.setStageComplete(stage, true);
- if (lt.getCompleted())
- {
- //s.setMessage("Congratulations, you have completed this lab");
- }
- else
- {
- s.setMessage("You have completed Stage " + (lt.getStageNumber(stage) + 1) + ": " + stage + ".");
- if (!stage.equals(lt.getStage()))
- s.setMessage(" Welcome to Stage " + (lt.getStageNumber(lt.getStage()) + 1) + ": " + lt.getStage());
- }
- try
- {
- Connection connection = DatabaseUtilities.getConnection(s);
-
- CreateDB db = new CreateDB();
- db.makeDB(connection);
- System.out.println("Successfully refreshed the database.");
-
- } catch (SQLException sqle)
- {
- System.out.println("Error refreshing the database!");
- sqle.printStackTrace();
- }
- }
-
- /**
- * isStageComplete.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param stage a {@link java.lang.String} object.
- * @param stage a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean isStageComplete(WebSession s, String stage)
- {
- return getLessonTracker(s).hasCompleted(stage);
- }
-
- /** {@inheritDoc} */
- @Override
- public RandomLessonTracker getLessonTracker(WebSession s)
- {
- return (RandomLessonTracker) super.getLessonTracker(s);
- }
-
- /** {@inheritDoc} */
- @Override
- public RandomLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
- {
- return (RandomLessonTracker) super.getLessonTracker(s, lesson);
- }
-
- /** {@inheritDoc} */
- @Override
- public RandomLessonTracker getLessonTracker(WebSession s, String userNameOverride)
- {
- return (RandomLessonTracker) super.getLessonTracker(s, userNameOverride);
- }
-
- /** {@inheritDoc} */
- @Override
- public LessonTracker createLessonTracker()
- {
- return new RandomLessonTracker(getStages());
- }
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/SequentialLessonAdapter.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/SequentialLessonAdapter.java
deleted file mode 100644
index 1053d212e..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/SequentialLessonAdapter.java
+++ /dev/null
@@ -1,214 +0,0 @@
-
-package org.owasp.webgoat.lessons;
-
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.owasp.webgoat.session.LessonTracker;
-import org.owasp.webgoat.session.SequentialLessonTracker;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- * Abstract SequentialLessonAdapter class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public abstract class SequentialLessonAdapter extends LessonAdapter
-{
-
- /**
- * setStage.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param stage a int.
- * @param stage a int.
- */
- public void setStage(WebSession s, int stage)
- {
- // System.out.println("Changed to stage " + stage);
- getLessonTracker(s).setStage(stage);
- }
-
- /*
- * By default returns 1 stage. (non-Javadoc)
- */
- /**
- * getStageCount.
- *
- * @return a int.
- */
- public int getStageCount()
- {
- return 1;
- }
-
- /**
- * getStage.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a int.
- */
- public int getStage(WebSession s)
- {
- int stage = getLessonTracker(s).getStage();
-
- // System.out.println("In stage " + stage);
- return stage;
- }
-
- /** {@inheritDoc} */
- @Override
- public SequentialLessonTracker getLessonTracker(WebSession s)
- {
- return (SequentialLessonTracker) super.getLessonTracker(s);
- }
-
- /** {@inheritDoc} */
- @Override
- public SequentialLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
- {
- return (SequentialLessonTracker) super.getLessonTracker(s, lesson);
- }
-
- /** {@inheritDoc} */
- @Override
- public SequentialLessonTracker getLessonTracker(WebSession s, String userNameOverride)
- {
- return (SequentialLessonTracker) super.getLessonTracker(s, userNameOverride);
- }
-
- /** {@inheritDoc} */
- @Override
- public LessonTracker createLessonTracker()
- {
- return new SequentialLessonTracker();
- }
-
- /**
- * createStagedContent.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- */
- protected Element createStagedContent(WebSession s)
- {
- try
- {
- int stage = getLessonTracker(s).getStage();
- // int stage = Integer.parseInt(
- // getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE,"1"));
-
- switch (stage)
- {
- case 1:
- return (doStage1(s));
- case 2:
- return (doStage2(s));
- case 3:
- return (doStage3(s));
- case 4:
- return (doStage4(s));
- case 5:
- return (doStage5(s));
- case 6:
- return (doStage6(s));
- default:
- throw new Exception("Invalid stage");
- }
- } catch (Exception e)
- {
- s.setMessage("Error generating " + this.getClass().getName());
- // System.out.println(e);
- e.printStackTrace();
- }
-
- return (new StringElement(""));
- }
-
- /**
- * doStage1.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage1(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 1 Stub");
- return ec;
- }
-
- /**
- * doStage2.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage2(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 2 Stub");
- return ec;
- }
-
- /**
- * doStage3.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage3(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 3 Stub");
- return ec;
- }
-
- /**
- * doStage4.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage4(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 4 Stub");
- return ec;
- }
-
- /**
- * doStage5.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage5(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 5 Stub");
- return ec;
- }
-
- /**
- * doStage6.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- * @throws java.lang.Exception if any.
- */
- protected Element doStage6(WebSession s) throws Exception
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement("Stage 6 Stub");
- return ec;
- }
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/WelcomeScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/WelcomeScreen.java
deleted file mode 100644
index d9ac9328e..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/WelcomeScreen.java
+++ /dev/null
@@ -1,159 +0,0 @@
-
-package org.owasp.webgoat.lessons;
-
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.HtmlColor;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.Center;
-import org.apache.ecs.html.Form;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.session.*;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class WelcomeScreen extends Screen
-{
-
- /**
- * Constructor for the WelcomeScreen object
- *
- * @param s
- * Description of the Parameter
- */
- public WelcomeScreen(WebSession s)
- {
- setup(s);
- }
-
- /**
- * Constructor for the WelcomeScreen object
- */
- public WelcomeScreen()
- {
- }
-
- /**
- * setup.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public void setup(WebSession s)
- {
- // call createContent first so messages will go somewhere
-
- Form form = new Form("attack", Form.POST).setName("form").setEncType("");
-
- form.addElement(wrapForm(s));
-
- TD lowerright = new TD().setHeight("100%").setVAlign("top").setAlign("left").addElement(form);
- TR row = new TR().addElement(lowerright);
- Table layout = new Table().setBgColor(HtmlColor.WHITE).setCellSpacing(0).setCellPadding(0).setBorder(0);
-
- layout.addElement(row);
-
- setContent(layout);
- }
-
- /**
- * wrapForm.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- */
- protected Element wrapForm(WebSession s)
- {
- if (s == null) { return new StringElement("Invalid Session"); }
-
- Table container = new Table().setWidth("100%").setCellSpacing(10).setCellPadding(0).setBorder(0);
-
- // CreateContent can generate error messages so you MUST call it before makeMessages()
- Element content = createContent(s);
- container.addElement(new TR().addElement(new TD().setColSpan(2).setVAlign("TOP").addElement(makeMessages(s))));
- container.addElement(new TR().addElement(new TD().setColSpan(2).addElement(content)));
- container.addElement(new TR());
-
- return (container);
- }
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
- Element b = ECSFactory.makeButton("Start the Course!");
- ec.addElement(new Center(b));
-
- return (ec);
- }
-
- /**
- * Gets the instructions attribute of the WelcomeScreen object
- *
- * @return The instructions value
- */
- protected String getInstructions()
- {
- String instructions = "Enter your name and learn how HTTP really works!";
-
- return (instructions);
- }
-
- /**
- * Gets the title attribute of the WelcomeScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Welcome to the Penetration Testing Course");
- }
-
- /*
- * (non-Javadoc)
- * @see session.Screen#getRole()
- */
- /**
- * getRole.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getRole()
- {
- return AbstractLesson.USER_ROLE;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/AdminScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/AdminScreen.java
deleted file mode 100644
index ea1cbb175..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/AdminScreen.java
+++ /dev/null
@@ -1,109 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.Screen;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public abstract class AdminScreen extends Screen
-{
-
- /**
- * Description of the Field
- */
- protected String query = null;
-
- /**
- * Constructor for the AdminScreen object
- *
- * @param s
- * Description of the Parameter
- * @param q
- * Description of the Parameter
- */
- public AdminScreen(WebSession s, String q)
- {
- setQuery(q);
-
- // setupAdmin(s); FIXME: what was this supposed to do?
- }
-
- /**
- * Constructor for the AdminScreen object
- *
- * @param s
- * Description of the Parameter
- */
- public AdminScreen(WebSession s)
- {
- }
-
- /**
- * Constructor for the AdminScreen object
- */
- public AdminScreen()
- {
- }
-
- /**
- * Gets the title attribute of the AdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Admin Information");
- }
-
- /**
- * getRole.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getRole()
- {
- return AbstractLesson.ADMIN_ROLE;
- }
-
- /**
- * Sets the query attribute of the AdminScreen object
- *
- * @param q
- * The new query value
- */
- public void setQuery(String q)
- {
- query = q;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/MenuToLessonMapperScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/MenuToLessonMapperScreen.java
deleted file mode 100644
index 5a5085ef5..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/MenuToLessonMapperScreen.java
+++ /dev/null
@@ -1,162 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.BR;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TH;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.LessonAdapter;
-import org.owasp.webgoat.session.WebSession;
-
-import java.net.URL;
-
-import static org.springframework.util.StringUtils.getFilename;
-import static org.springframework.util.StringUtils.stripFilenameExtension;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Bruce Mayhew WebGoat
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class MenuToLessonMapperScreen extends LessonAdapter
-{
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement(new StringElement("This page describes an overview of all the lessons and maps the lesson to the WebGoat-Lessons project"));
- ec.addElement(new BR());
- ec.addElement(new BR());
- ec.addElement(makeMenuToLessonMapping(s));
-
- return ec;
- }
-
- /**
- * Gets the category attribute of the UserAdminScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * Gets the role attribute of the UserAdminScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the UserAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Lesson information");
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public Element makeMenuToLessonMapping(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
- Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1);
- t.addElement(makeHeaderRow());
-
- for (AbstractLesson lesson : s.getCourse().getLessons(s, AbstractLesson.USER_ROLE)) {
- TR tr = new TR();
- tr.addElement(new TD().addElement(lesson.getName()));
-
- URL jarLocation = lesson.getClass().getProtectionDomain().getCodeSource().getLocation();
- String projectName = removeVersion(stripFilenameExtension(getFilename(jarLocation.getFile())));
- tr.addElement(new TD().addElement(projectName));
-
- tr.addElement(new TD().addElement(lesson.getClass().getName() + ".java"));
- t.addElement(tr);
- }
- ec.addElement(t);
- return (ec);
- }
-
- //Remove version number and last '-'
- private static String removeVersion(String s) {
- return s.replaceAll("[^a-z\\-]", "").replaceAll("-$", "");
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- private TR makeHeaderRow()
- {
- TR tr = new TR();
-
- tr.addElement(new TH("Lesson menu item"));
- tr.addElement(new TH("Lesson project"));
- tr.addElement(new TH("Lesson source class"));
-
- return tr;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ProductsAdminScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ProductsAdminScreen.java
deleted file mode 100644
index 43b74795d..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ProductsAdminScreen.java
+++ /dev/null
@@ -1,124 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.sql.Connection;
-import java.sql.ResultSet;
-import java.sql.ResultSetMetaData;
-import java.sql.Statement;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.LessonAdapter;
-import org.owasp.webgoat.session.DatabaseUtilities;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class ProductsAdminScreen extends LessonAdapter
-{
-
- private final static String QUERY = "SELECT * FROM product_system_data";
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- try
- {
- Connection connection = DatabaseUtilities.getConnection(s);
-
- Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
- ResultSet.CONCUR_READ_ONLY);
- ResultSet results = statement.executeQuery(QUERY);
-
- if (results != null)
- {
- makeSuccess(s);
- ResultSetMetaData resultsMetaData = results.getMetaData();
- ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
- }
- } catch (Exception e)
- {
- s.setMessage("Error generating " + this.getClass().getName());
- e.printStackTrace();
- }
-
- return (ec);
- }
-
- /**
- * Gets the category attribute of the ProductsAdminScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- /**
- * Gets the role attribute of the ProductsAdminScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return HACKED_ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the ProductsAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Product Information");
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/RefreshDBScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/RefreshDBScreen.java
deleted file mode 100644
index 556701f0b..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/RefreshDBScreen.java
+++ /dev/null
@@ -1,160 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.sql.Connection;
-import org.owasp.webgoat.lessons.*;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.A;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.session.*;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class RefreshDBScreen extends LessonAdapter
-{
-
- private final static String REFRESH = "Refresh";
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- try
- {
- boolean refresh = s.getParser().getBooleanParameter(REFRESH, false);
-
- if (refresh)
- {
- refreshDB(s);
- ec.addElement(new StringElement("Successfully refreshed the database."));
- }
- else
- {
- Element label = new StringElement("Refresh the database? ");
- A link1 = ECSFactory.makeLink("Yes", REFRESH, true);
- A link2 = ECSFactory.makeLink("No", REFRESH, false);
- TD td1 = new TD().addElement(label);
- TD td2 = new TD().addElement(link1);
- TD td3 = new TD().addElement(link2);
- TR row = new TR().addElement(td1).addElement(td2).addElement(td3);
- Table t = new Table().setCellSpacing(40).setWidth("50%");
-
- if (s.isColor())
- {
- t.setBorder(1);
- }
-
- t.addElement(row);
- ec.addElement(t);
- }
- } catch (Exception e)
- {
- s.setMessage("Error generating " + this.getClass().getName());
- e.printStackTrace();
- }
-
- return (ec);
- }
-
- /**
- * Gets the category attribute of the RefreshDBScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * Gets the role attribute of the RefreshDBScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the RefreshDBScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Refresh Database");
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- */
- public void refreshDB(WebSession s)
- {
- try
- {
- Connection connection = DatabaseUtilities.getConnection(s);
-
- CreateDB db = new CreateDB();
- db.makeDB(connection);
- System.out.println("Successfully refreshed the database.");
- } catch (Exception e)
- {
- s.setMessage("Error refreshing database " + this.getClass().getName());
- e.printStackTrace();
- }
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java
deleted file mode 100644
index 13f31a753..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java
+++ /dev/null
@@ -1,295 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.util.Iterator;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.HtmlColor;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.Center;
-import org.apache.ecs.html.H2;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TH;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.LessonAdapter;
-import org.owasp.webgoat.session.LessonTracker;
-import org.owasp.webgoat.session.Screen;
-import org.owasp.webgoat.session.UserTracker;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Bruce Mayhew WebGoat
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class ReportCardScreen extends LessonAdapter
-{
-
- /**
- * Description of the Field
- */
- protected final static String USERNAME = "Username";
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- String user = null;
-
- try
- {
- if (s.getRequest().isUserInRole(WebSession.WEBGOAT_ADMIN))
- {
- user = s.getParser().getRawParameter(USERNAME);
- }
- else
- {
- user = s.getUserName();
- }
- } catch (Exception e)
- {
- }
-
- if (user == null)
- {
- user = s.getUserName();
- }
-
- ec.addElement(makeFeedback(s));
- ec.addElement(makeReportCard(s, user));
-
- return ec;
- }
-
- private Element makeFeedback(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
- ec.addElement(new StringElement("Comments and suggestions are welcome. "
- + getWebgoatContext().getFeedbackAddressHTML() + "getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * Gets the role attribute of the UserAdminScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return USER_ROLE;
- }
-
- /**
- * Gets the title attribute of the UserAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Report Card");
- }
-
- /**
- * Description of the Method
- *
- * @param screen
- * Description of the Parameter
- * @param s
- * Description of the Parameter
- * @param user
- * Description of the Parameter
- * @return Description of the Return Value
- */
- private TR makeLessonRow(WebSession s, String user, Screen screen)
- {
- LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
- TR tr = new TR();
- if (lessonTracker.getCompleted())
- {
- tr.setBgColor(HtmlColor.LIGHTGREEN);
- }
- else if (lessonTracker.getNumVisits() == 0)
- {
- tr.setBgColor(HtmlColor.LIGHTBLUE);
- }
- else if (!lessonTracker.getCompleted() && lessonTracker.getNumVisits() > 10)
- {
- tr.setBgColor(HtmlColor.RED);
- }
- else
- {
- tr.setBgColor(HtmlColor.YELLOW);
- }
- tr.addElement(new TD().addElement(screen.getTitle()));
- tr.addElement(new TD().setAlign("CENTER").addElement(lessonTracker.getCompleted() ? "Y" : "N"));
- tr.addElement(new TD().setAlign("CENTER").addElement(Integer.toString(lessonTracker.getNumVisits())));
- tr.addElement(new TD().setAlign("CENTER").addElement(Integer.toString(lessonTracker.getMaxHintLevel())));
- return tr;
- }
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element makeMessages(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- return (ec);
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- * @param user
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public Element makeReportCard(WebSession s, String user)
- {
- ElementContainer ec = new ElementContainer();
-
- ec.addElement(makeUser(s, user));
- Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1);
-
- if (s.isColor())
- {
- t.setBorder(1);
- }
- TR tr = new TR();
- t.addElement(makeUserHeaderRow());
-
- // These are all the user lesson
- tr = new TR();
- tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Normal user lessons"));
- t.addElement(tr);
- for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.USER_ROLE).iterator(); lessonIter
- .hasNext();)
- {
- Screen screen = (Screen) lessonIter.next();
- t.addElement(makeLessonRow(s, user, screen));
- }
-
- // The user figured out there was a hackable admin acocunt
- tr = new TR();
- tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Hackable Admin Screens"));
- t.addElement(tr);
- for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.HACKED_ADMIN_ROLE).iterator(); lessonIter
- .hasNext();)
- {
- Screen screen = (Screen) lessonIter.next();
- t.addElement(makeLessonRow(s, user, screen));
- }
-
- // The user figured out how to actually hack the admin acocunt
- tr = new TR();
- tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Actual Admin Screens"));
- t.addElement(tr);
- for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.ADMIN_ROLE).iterator(); lessonIter
- .hasNext();)
- {
- Screen screen = (Screen) lessonIter.next();
- t.addElement(makeLessonRow(s, user, screen));
- }
-
- ec.addElement(t);
- return (ec);
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- * @param user
- * Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element makeUser(WebSession s, String user)
- {
- H2 h2 = new H2();
- // FIXME: The session is the current session, not the session of the user we are reporting.
- // String type = s.isAdmin() ? " [Administrative User]" : s.isHackedAdmin() ?
- // " [Normal User - Hacked Admin Access]" : " [Normal User]";
- String type = "";
- h2.addElement(new StringElement("Results for: " + user + type));
- return h2;
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- private TR makeUserHeaderRow()
- {
- TR tr = new TR();
-
- tr.addElement(new TH("Lesson"));
- tr.addElement(new TH("Complete"));
- tr.addElement(new TH("Visits"));
- tr.addElement(new TH("Hints"));
-
- return tr;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/SummaryReportCardScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/SummaryReportCardScreen.java
deleted file mode 100644
index 00225fcc8..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/SummaryReportCardScreen.java
+++ /dev/null
@@ -1,326 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.util.Enumeration;
-import java.util.Iterator;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.HtmlColor;
-import org.apache.ecs.html.Center;
-import org.apache.ecs.html.Input;
-import org.apache.ecs.html.P;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TH;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.LessonAdapter;
-import org.owasp.webgoat.session.LessonTracker;
-import org.owasp.webgoat.session.Screen;
-import org.owasp.webgoat.session.UserTracker;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Bruce mayhew WebGoat
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class SummaryReportCardScreen extends LessonAdapter
-{
-
- private int totalUsersNormalComplete = 0;
-
- private int totalUsersAdminComplete = 0;
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- String selectedUser = null;
-
- try
- {
- if (s.getRequest().isUserInRole(WebSession.WEBGOAT_ADMIN))
- {
- Enumeration e = s.getParser().getParameterNames();
-
- while (e.hasMoreElements())
- {
- String key = (String) e.nextElement();
- if (key.startsWith("View_"))
- {
- selectedUser = key.substring("View_".length());
- ReportCardScreen reportCard = new ReportCardScreen();
- return reportCard.makeReportCard(s, selectedUser);
- }
- if (key.startsWith("Delete_"))
- {
- selectedUser = key.substring("Delete_".length());
- deleteUser(selectedUser);
- }
- }
- }
- } catch (Exception e)
- {
- e.printStackTrace();
- }
-
- ec.addElement(new Center().addElement(makeSummary(s)));
-
- ec.addElement(new P());
-
- Table t = new Table().setCellSpacing(0).setCellPadding(4).setBorder(1).setWidth("100%");
- if (s.isColor())
- {
- t.setBorder(1);
- }
- t.addElement(makeUserSummaryHeader());
-
- for (Iterator userIter = UserTracker.instance().getAllUsers(WebSession.WEBGOAT_USER).iterator(); userIter
- .hasNext();)
- {
-
- String user = userIter.next();
- t.addElement(makeUserSummaryRow(s, user));
- }
-
- ec.addElement(new Center().addElement(t));
-
- return ec;
- }
-
- /**
- * makeSummary.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- */
- protected Element makeSummary(WebSession s)
- {
- Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("100%");
- if (s.isColor())
- {
- t.setBorder(1);
- }
- TR tr = new TR();
- // tr.addElement( new TH().addElement( "Summary").setColSpan(1));
- // t.addElement( tr );
-
- tr = new TR();
- tr.addElement(new TD().setWidth("60%").addElement("Total number of users"));
- tr.addElement(new TD().setAlign("LEFT").addElement(
- Integer.toString(UserTracker.instance()
- .getAllUsers(WebSession.WEBGOAT_USER).size())));
- t.addElement(tr);
-
- tr = new TR();
- tr.addElement(new TD().setWidth("60%").addElement("Total number of users that completed all normal lessons"));
- tr.addElement(new TD().setAlign("LEFT").addElement(Integer.toString(totalUsersNormalComplete)));
- t.addElement(tr);
-
- tr = new TR();
- tr.addElement(new TD().setWidth("60%").addElement("Total number of users that completed all admin lessons"));
- tr.addElement(new TD().setAlign("LEFT").addElement(Integer.toString(totalUsersAdminComplete)));
- t.addElement(tr);
- return t;
- }
-
- private void deleteUser(String user)
- {
- UserTracker.instance().deleteUser(user);
- }
-
- /**
- * Gets the category attribute of the UserAdminScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * Gets the role attribute of the UserAdminScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the UserAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Summary Report Card");
- }
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element makeMessages(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- return (ec);
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- protected Element makeUserSummaryHeader()
- {
- TR tr = new TR();
-
- tr.addElement(new TH("User Name"));
- tr.addElement(new TH("Normal Complete"));
- tr.addElement(new TH("Admin Complete"));
- tr.addElement(new TH("View"));
- tr.addElement(new TH("Delete"));
-
- return tr;
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- * @param user
- * Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element makeUserSummaryRow(WebSession s, String user)
- {
- TR tr = new TR();
-
- tr.addElement(new TD().setAlign("LEFT").addElement(user));
- int lessonCount = 0;
- int passedCount = 0;
- boolean normalComplete = false;
- boolean adminComplete = false;
-
- for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.USER_ROLE).iterator(); lessonIter
- .hasNext();)
- {
- lessonCount++;
- Screen screen = (Screen) lessonIter.next();
-
- LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
- if (lessonTracker.getCompleted())
- {
- passedCount++;
- }
- }
- if (lessonCount == passedCount)
- {
- normalComplete = true;
- totalUsersNormalComplete++;
- }
- String text = Integer.toString(passedCount) + " of " + Integer.toString(lessonCount);
- tr.addElement(new TD().setAlign("CENTER").addElement(text));
-
- lessonCount = 0;
- passedCount = 0;
- for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.HACKED_ADMIN_ROLE).iterator(); lessonIter
- .hasNext();)
- {
- lessonCount++;
- Screen screen = (Screen) lessonIter.next();
-
- LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
- if (lessonTracker.getCompleted())
- {
- passedCount++;
- }
- }
- if (lessonCount == passedCount)
- {
- adminComplete = true;
- totalUsersAdminComplete++;
- }
- text = Integer.toString(passedCount) + " of " + Integer.toString(lessonCount);
- tr.addElement(new TD().setAlign("CENTER").addElement(text));
-
- tr.addElement(new TD().setAlign("CENTER").addElement(new Input(Input.SUBMIT, "View_" + user, "View")));
- tr.addElement(new TD().setAlign("CENTER").addElement(new Input(Input.SUBMIT, "Delete_" + user, "Delete")));
-
- if (normalComplete && adminComplete)
- {
- tr.setBgColor(HtmlColor.GREEN);
- }
- else if (normalComplete)
- {
- tr.setBgColor(HtmlColor.LIGHTGREEN);
- }
- else
- {
- tr.setBgColor(HtmlColor.LIGHTBLUE);
- }
-
- return (tr);
- }
-
- /**
- * isEnterprise.
- *
- * @return a boolean.
- */
- public boolean isEnterprise()
- {
- return true;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/UserAdminScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/UserAdminScreen.java
deleted file mode 100644
index 7cae656e5..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/UserAdminScreen.java
+++ /dev/null
@@ -1,124 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.sql.Connection;
-import java.sql.ResultSet;
-import java.sql.ResultSetMetaData;
-import java.sql.Statement;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.LessonAdapter;
-import org.owasp.webgoat.session.DatabaseUtilities;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Bruce Mayhew WebGoat
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class UserAdminScreen extends LessonAdapter
-{
-
- private final static String QUERY = "SELECT * FROM user_system_data";
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- try
- {
- Connection connection = DatabaseUtilities.getConnection(s);
-
- Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
- ResultSet.CONCUR_READ_ONLY);
- ResultSet results = statement.executeQuery(QUERY);
-
- if (results != null)
- {
- makeSuccess(s);
- ResultSetMetaData resultsMetaData = results.getMetaData();
- ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
- }
- } catch (Exception e)
- {
- s.setMessage("Error generating " + this.getClass().getName());
- e.printStackTrace();
- }
-
- return (ec);
- }
-
- /**
- * Gets the category attribute of the UserAdminScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * Gets the role attribute of the UserAdminScreen object
- *
- * @return The role value
- */
- public String getRole()
- {
- return HACKED_ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the UserAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("User Information");
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ViewDatabase.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ViewDatabase.java
deleted file mode 100644
index c967255ff..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/ViewDatabase.java
+++ /dev/null
@@ -1,165 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import java.sql.Connection;
-import java.sql.ResultSet;
-import java.sql.ResultSetMetaData;
-import java.sql.Statement;
-import java.util.ArrayList;
-import java.util.List;
-import org.owasp.webgoat.lessons.*;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.Input;
-import org.owasp.webgoat.session.*;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class ViewDatabase extends LessonAdapter
-{
-
- private final static String SQL = "sql";
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- try
- {
- ec.addElement(new StringElement("Enter a SQL statement: "));
-
- StringBuffer sqlStatement = new StringBuffer(s.getParser().getRawParameter(SQL, ""));
- Input input = new Input(Input.TEXT, SQL, sqlStatement.toString());
- ec.addElement(input);
-
- Element b = ECSFactory.makeButton("Go!");
- ec.addElement(b);
-
- Connection connection = DatabaseUtilities.getConnection(s);
-
- if (sqlStatement.length() > 0)
- {
-
- Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
- ResultSet.CONCUR_READ_ONLY);
- ResultSet results = statement.executeQuery(sqlStatement.toString());
-
- if ((results != null) && (results.first() == true))
- {
- makeSuccess(s);
- ResultSetMetaData resultsMetaData = results.getMetaData();
- ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
- }
-
- }
- } catch (Exception e)
- {
- s.setMessage("Error generating " + this.getClass().getName());
- e.printStackTrace();
- }
-
- return (ec);
- }
-
- /**
- * Gets the category attribute of the DatabaseScreen object
- *
- * @return The category value
- */
- protected Category getDefaultCategory()
- {
- return Category.ADMIN_FUNCTIONS;
- }
-
- private final static Integer DEFAULT_RANKING = new Integer(1000);
-
- /**
- * getDefaultRanking.
- *
- * @return a {@link java.lang.Integer} object.
- */
- protected Integer getDefaultRanking()
- {
- return DEFAULT_RANKING;
- }
-
- /**
- * {@inheritDoc}
- *
- * Gets the hints attribute of the DatabaseScreen object
- */
- protected List getHints(WebSession s)
- {
- List hints = new ArrayList();
- hints.add("There are no hints defined");
-
- return hints;
- }
-
- /**
- * {@inheritDoc}
- *
- * Gets the instructions attribute of the ViewDatabase object
- */
- public String getInstructions(WebSession s)
- {
- String instructions = "Please post a message to to the WebGoat forum. Your messages will be available for everyone to read.";
-
- return (instructions);
- }
-
- /**
- * Gets the role attribute of the ViewDatabase object
- *
- * @return The role value
- */
- public String getRole()
- {
- return HACKED_ADMIN_ROLE;
- }
-
- /**
- * Gets the title attribute of the DatabaseScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Adhoc Query");
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/WelcomeAdminScreen.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/WelcomeAdminScreen.java
deleted file mode 100644
index b6b456a10..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/admin/WelcomeAdminScreen.java
+++ /dev/null
@@ -1,87 +0,0 @@
-
-package org.owasp.webgoat.lessons.admin;
-
-import org.owasp.webgoat.lessons.WelcomeScreen;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.html.Center;
-import org.apache.ecs.html.H1;
-import org.owasp.webgoat.session.WebSession;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @since October 28, 2003
- * @version $Id: $Id
- */
-public class WelcomeAdminScreen extends WelcomeScreen
-{
-
- /**
- * Constructor for the WelcomeAdminScreen object
- *
- * @param s
- * Description of the Parameter
- */
- public WelcomeAdminScreen(WebSession s)
- {
- super(s);
- }
-
- /**
- * Constructor for the WelcomeAdminScreen object
- */
- public WelcomeAdminScreen()
- {
- }
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- ElementContainer ec = new ElementContainer();
-
- ec.addElement(new Center(new H1("You are logged on as an administrator")));
- ec.addElement(super.createContent(s));
-
- return (ec);
- }
-
- /**
- * Gets the title attribute of the WelcomeAdminScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Admin Welcome");
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
index a08decbc6..ad661ab59 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
@@ -1,7 +1,6 @@
package org.owasp.webgoat.lessons.model;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
import org.owasp.webgoat.session.WebSession;
/**
@@ -10,6 +9,7 @@ import org.owasp.webgoat.session.WebSession;
* @author dm
* @version $Id: $Id
*/
+//// TODO: 11/5/2016 this can be removed???
public class LessonInfoModel {
private String lessonTitle;
@@ -27,78 +27,11 @@ public class LessonInfoModel {
public LessonInfoModel(WebSession webSession) {
AbstractLesson lesson = webSession.getCurrentLesson();
//TODO make these first class citizens of the lesson itself; and stop passing the session all over ... and generally tighten the checks up
- this.hasSource = !lesson.getSource(webSession).contains("Could not find the source file or source file does not exist");
- this.hasPlan = !lesson.getSource(webSession).contains("Could not find lesson plan");
- this.hasSolution = !lesson.getSolution(webSession).contains("Could not find the solution file or solution file does not exist");
+ this.hasSource = false;
+ this.hasPlan = false;
+ this.hasSolution = false;
this.lessonTitle = lesson.getTitle();
- this.numberHints = lesson.getHintCount(webSession);
+ this.numberHints = lesson.getHintCount();
this.submitMethod = lesson.getSubmitMethod();
-
- if ( this.numberHints < 1 || lesson.getHint(webSession,0).equals("Hint: There are no hints defined.")) {
- this.numberHints = 0;
- }
- //special challenge case
- if (lesson.getCategory().equals(Category.CHALLENGE)) {
- this.numberHints = (lesson.isAuthorized(webSession, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS)) ? lesson.getHintCount(webSession) : 0;
- this.hasSource = (lesson.isAuthorized(webSession, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
- this.hasSolution = (lesson.isAuthorized(webSession, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS)); //assuming we want this to fall in line with source and solution
- this.hasPlan = (lesson.isAuthorized(webSession, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS)); //assuming we want this to fall in line with source and solutionn
- }
}
-
- // GETTERS
- /**
- * Getter for the field lessonTitle.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getLessonTitle() {
- return lessonTitle;
- }
-
- /**
- * Getter for the field numberHints.
- *
- * @return a int.
- */
- public int getNumberHints() {
- return numberHints;
- }
-
- /**
- * isHasSource.
- *
- * @return a boolean.
- */
- public boolean isHasSource() {
- return hasSource;
- }
-
- /**
- * isHasSolution.
- *
- * @return a boolean.
- */
- public boolean isHasSolution() {
- return hasSolution;
- }
-
- /**
- * isHasPlan.
- *
- * @return a boolean.
- */
- public boolean isHasPlan() {
- return hasPlan;
- }
-
- /**
- * Getter for the field submitMethod.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSubmitMethod() {
- return submitMethod;
- }
-
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/LegacyLoader.java b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/LegacyLoader.java
deleted file mode 100644
index c7fc3c166..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/LegacyLoader.java
+++ /dev/null
@@ -1,270 +0,0 @@
-package org.owasp.webgoat.plugins;
-
-import lombok.extern.slf4j.Slf4j;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.WebgoatContext;
-import org.owasp.webgoat.session.WebgoatProperties;
-import org.springframework.beans.factory.support.BeanDefinitionRegistry;
-import org.springframework.beans.factory.support.SimpleBeanDefinitionRegistry;
-import org.springframework.context.annotation.ClassPathBeanDefinitionScanner;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.core.type.filter.AssignableTypeFilter;
-import org.springframework.core.type.filter.TypeFilter;
-
-import javax.servlet.ServletContext;
-import java.io.File;
-import java.util.Iterator;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Set;
-
-/**
- * ************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Bruce Mayhew WebGoat
- * @version $Id: $Id
- * @since October 28, 2003
- */
-@Slf4j
-public class LegacyLoader {
-
- private final List files = new LinkedList();
-
- /**
- * Constructor for LegacyLoader.
- */
- public LegacyLoader() {
- }
-
- /**
- * Take an absolute file and return the filename.
- *
- * Ex. /etc/password becomes password
- *
- * @param s
- * @return the file name
- */
- private static String getFileName(String s) {
- String fileName = new File(s).getName();
-
- if (fileName.contains("/")) {
- fileName = fileName.substring(fileName.lastIndexOf("/"), fileName.length());
- }
-
- if (fileName.contains(".")) {
- fileName = fileName.substring(0, fileName.indexOf("."));
- }
-
- return fileName;
- }
-
- /**
- * Take a class name and return the equivalent file name
- *
- * Ex. org.owasp.webgoat becomes org/owasp/webgoat.java
- *
- * @param className
- * @return
- */
- private static String getSourceFile(String className) {
- StringBuilder sb = new StringBuilder();
-
- sb.append(className.replace(".", "/"));
- sb.append(".java");
-
- return sb.toString();
- }
-
- /**
- * Takes a file name and builds the class file name
- *
- * @param fileName Description of the Parameter
- * @param path Description of the Parameter
- * @return Description of the Return Value
- */
- private static String getClassFile(String fileName, String path) {
- String ext = ".class";
- fileName = fileName.trim();
-
- /**
- * We do not handle directories. We do not handle files with different
- * extensions
- */
- if (fileName.endsWith("/") || !fileName.endsWith(ext)) {
- return null;
- }
-
- // skip over plugins and/or extracted plugins
- if (fileName.indexOf("lessons/plugin") >= 0 || fileName.indexOf("plugin_extracted") >= 0) {
- return null;
- }
-
- // if the file is in /WEB-INF/classes strip the dir info off
- int index = fileName.indexOf("/WEB-INF/classes/");
- if (index != -1) {
- fileName = fileName.substring(index + "/WEB-INF/classes/".length(), fileName.length() - ext.length());
- fileName = fileName.replace('/', '.');
- fileName = fileName.replace('\\', '.');
- } else {
- // Strip off the leading path info
- fileName = fileName.substring(path.length(), fileName.length() - ext.length());
- }
-
- return fileName;
- }
-
-
- /**
- * Load all of the filenames into a temporary cache
- *
- * @param context a {@link javax.servlet.ServletContext} object.
- * @param path a {@link java.lang.String} object.
- */
- public void loadFiles(ServletContext context, String path) {
- log.debug("Loading files into cache, path: " + path);
- Resource resource = new ClassPathResource("/");
- //resource.get
- Set resourcePaths = null;
- if (resourcePaths == null) {
- log.error("Unable to load file cache for courses, this is probably a bug or configuration issue");
- return;
- }
- Iterator itr = resourcePaths.iterator();
-
- while (itr.hasNext()) {
- String file = (String) itr.next();
-
- if (file.length() != 1 && file.endsWith("/")) {
- loadFiles(context, file);
- } else {
- files.add(file);
- }
- }
- }
-
- /**
- * Instantiate all the lesson objects into a cache
- *
- * @param path a {@link java.lang.String} object.
- * @param context a {@link javax.servlet.ServletContext} object.
- * @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
- * @param properties a {@link org.owasp.webgoat.session.WebgoatProperties} object.
- * @return a {@link java.util.List} object.
- */
- public List loadLessons(WebgoatContext webgoatContext, ServletContext context, String path, WebgoatProperties properties) {
- BeanDefinitionRegistry bdr = new SimpleBeanDefinitionRegistry();
- ClassPathBeanDefinitionScanner s = new ClassPathBeanDefinitionScanner(bdr);
-
- TypeFilter tf = new AssignableTypeFilter(AbstractLesson.class);
- s.addIncludeFilter(tf);
- s.setIncludeAnnotationConfig(false);
- s.scan("org.owasp.webgoat.lessons.admin");
- String[] beanDefinitionNames = bdr.getBeanDefinitionNames();
-
- List lessons = new LinkedList();
-
- for (String file : beanDefinitionNames) {
- String className = bdr.getBeanDefinition(file).getBeanClassName();
-
- try {
- Class c = Class.forName(className);
- Object o = c.newInstance();
-
- if (o instanceof AbstractLesson) {
- AbstractLesson lesson = (AbstractLesson) o;
- lesson.setWebgoatContext(webgoatContext);
-
- lesson.update(properties);
-
- if (lesson.getHidden() == false) {
- lessons.add(lesson);
- }
- }
- } catch (Exception e) {
- // Bruce says:
- // I don't think we want to log the exception here. We could
- // be potentially showing a lot of exceptions that don't matter.
- // We would only care if the lesson extended AbstractLesson and we
- // can't tell that because it threw the exception. Catch 22
- // logger.error("Error in loadLessons: ", e);
- }
- }
- loadResources(lessons);
- return lessons;
- }
-
- private String getLanguageFromFileName(String first, String absoluteFile) {
- int p1 = absoluteFile.indexOf("/", absoluteFile.indexOf(first) + 1);
- int p2 = absoluteFile.indexOf("/", p1 + 1);
- String langStr = absoluteFile.substring(p1 + 1, p2);
-
- return langStr;
- }
-
- /**
- * For each lesson, set the source file and lesson file
- *
- * @param lessons a {@link java.util.List} object.
- */
- public void loadResources(List lessons) {
- for (AbstractLesson lesson : lessons) {
- log.info("Loading resources for lesson -> " + lesson.getName());
- String className = lesson.getClass().getName();
- String classFile = getSourceFile(className);
- log.info("Lesson classname: " + className);
- log.info("Lesson java file: " + classFile);
-
- for (String absoluteFile : files) {
- String fileName = getFileName(absoluteFile);
- //logger.debug("Course: looking at file: " + absoluteFile);
-
- if (absoluteFile.endsWith(classFile)) {
- log.info("Set source file for " + classFile);
- lesson.setSourceFileName(absoluteFile);
- }
-
- if (absoluteFile.startsWith("/lesson_plans") && absoluteFile.endsWith(".html")
- && className.endsWith(fileName)) {
- log.info("setting lesson plan file " + absoluteFile + " for lesson "
- + lesson.getClass().getName());
- log.info("fileName: " + fileName + " == className: " + className);
- String language = getLanguageFromFileName("/lesson_plans", absoluteFile);
- lesson.setLessonPlanFileName(language, absoluteFile);
- }
- if (absoluteFile.startsWith("/lesson_solutions") && absoluteFile.endsWith(".html")
- && className.endsWith(fileName)) {
- log.info("setting lesson solution file " + absoluteFile + " for lesson "
- + lesson.getClass().getName());
- log.info("fileName: " + fileName + " == className: " + className);
- lesson.setLessonSolutionFileName(absoluteFile);
- }
- }
- }
- }
-
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
index f1bdf8cb0..b34a1b351 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
@@ -3,7 +3,7 @@ package org.owasp.webgoat.plugins;
import com.google.common.base.Optional;
import com.google.common.collect.Lists;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.LessonEndpoint;
+import org.owasp.webgoat.lessons.AssignmentEndpoint;
import org.owasp.webgoat.lessons.NewLesson;
import org.springframework.util.StringUtils;
@@ -28,9 +28,8 @@ public class Plugin {
private static final String NAME_LESSON_PLANS_DIRECTORY = "lessonPlans";
private PluginClassLoader classLoader;
- private Class lesson;
private Class newLesson;
- private List> lessonEndpoints = Lists.newArrayList();
+ private List> lessonEndpoints = Lists.newArrayList();
private Map solutionLanguageFiles = new HashMap<>();
private Map lessonPlansLanguageFiles = new HashMap<>();
private List pluginFiles = Lists.newArrayList();
@@ -40,7 +39,7 @@ public class Plugin {
this.classLoader = classLoader;
}
- public List> getLessonEndpoints() {
+ public List> getLessonEndpoints() {
return this.lessonEndpoints;
}
@@ -56,15 +55,10 @@ public class Plugin {
}
private void findLesson(String name) {
- //Old code remove after we migrated the lessons
String realClassName = StringUtils.trimLeadingCharacter(name, '/').replaceAll("/", ".").replaceAll(".class", "");
try {
Class clazz = classLoader.loadClass(realClassName);
-
- if (AbstractLesson.class.isAssignableFrom(clazz)) {
- this.lesson = clazz;
- }
if (NewLesson.class.isAssignableFrom(clazz)) {
this.newLesson = clazz;
}
@@ -80,7 +74,7 @@ public class Plugin {
try {
Class clazz = classLoader.loadClass(realClassName);
- if (LessonEndpoint.class.isAssignableFrom(clazz)) {
+ if (AssignmentEndpoint.class.isAssignableFrom(clazz)) {
this.lessonEndpoints.add(clazz);
}
} catch (ClassNotFoundException ce) {
@@ -118,14 +112,11 @@ public class Plugin {
*/
public Optional getLesson() {
try {
- if (lesson != null) {
- return Optional.of(lesson.newInstance());
- }
if (newLesson != null) {
return Optional.of(newLesson.newInstance());
}
} catch (IllegalAccessException | InstantiationException e) {
- throw new PluginLoadingFailure("Unable to instantiate the lesson " + lesson.getName(), e);
+ throw new PluginLoadingFailure("Unable to instantiate the lesson " + newLesson.getName(), e);
}
return Optional.absent();
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java
index e07206f25..5139a19f7 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java
@@ -3,8 +3,7 @@ package org.owasp.webgoat.plugins;
import com.google.common.collect.Lists;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.io.FileUtils;
-import org.owasp.webgoat.util.LabelProvider;
-import org.springframework.beans.factory.annotation.Autowired;
+import org.owasp.webgoat.i18n.LabelProvider;
import org.springframework.util.ResourceUtils;
import java.io.File;
@@ -43,7 +42,6 @@ public class PluginsLoader {
private final File pluginTargetDirectory;
private final PluginClassLoader classLoader;
- @Autowired
public PluginsLoader(File pluginTargetDirectory, PluginClassLoader pluginClassLoader) {
this.classLoader = pluginClassLoader;
this.pluginTargetDirectory = pluginTargetDirectory;
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/BaseService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/BaseService.java
deleted file mode 100644
index aec0d2076..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/BaseService.java
+++ /dev/null
@@ -1,108 +0,0 @@
-/**
- * *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project
- * utility. For details, please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; either version 2 of the License, or (at your option) any later
- * version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
- * for free software projects.
- *
- */
-package org.owasp.webgoat.service;
-
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpSession;
-import org.owasp.webgoat.session.WebSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.http.HttpStatus;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.ResponseStatus;
-
-/**
- * Abstract BaseService class.
- *
- * @author rlawson
- * @version $Id: $Id
- */
-@RequestMapping("/service")
-public abstract class BaseService {
-
- private static final Logger logger = LoggerFactory.getLogger(BaseService.class);
-
- /**
- * handleException.
- *
- * @param request a {@link javax.servlet.http.HttpServletRequest} object.
- * @param ex a {@link java.lang.Exception} object.
- * @return a {@link org.owasp.webgoat.service.ExceptionInfo} object.
- */
- @ExceptionHandler(Exception.class)
- @ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)
- public @ResponseBody
- ExceptionInfo handleException(HttpServletRequest request, Exception ex) {
- String url = request.getRequestURL().toString();
- logger.error("Exception handler for service caught exception when processing: " + url, ex);
- ExceptionInfo response = new ExceptionInfo();
- response.setUrl(url);
-
- response.setMessage(getStringStackTrace(ex));
-
- return response;
- }
-
- /**
- * getWebSession.
- *
- * @param session a {@link javax.servlet.http.HttpSession} object.
- * @return a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public WebSession getWebSession(HttpSession session) {
- WebSession ws;
- Object o = session.getAttribute(WebSession.SESSION);
- if (o == null) {
- throw new IllegalArgumentException("No valid WebSession object found, has session timed out? [" + session.getId() + "]");
- }
- if (!(o instanceof WebSession)) {
- throw new IllegalArgumentException("Invalid WebSession object found, this is probably a bug! [" + o.getClass() + " | " + session.getId() + "]");
- }
- ws = (WebSession) o;
- return ws;
- }
-
- /**
- * getStringStackTrace.
- *
- * @param t a {@link java.lang.Throwable} object.
- * @return a {@link java.lang.String} object.
- */
- public String getStringStackTrace(Throwable t){
- StringWriter sw = new StringWriter();
- PrintWriter pw = new PrintWriter(sw);
- t.printStackTrace(pw);
- return sw.toString();
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java
index 69dd9e8fa..fd9f55ae0 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/CookieService.java
@@ -29,16 +29,13 @@
*/
package org.owasp.webgoat.service;
-import org.owasp.webgoat.lessons.model.RequestParameter;
-import org.owasp.webgoat.session.WebSession;
+import com.google.common.collect.Lists;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.servlet.ModelAndView;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpSession;
-import java.util.Collections;
import java.util.List;
/**
@@ -48,7 +45,7 @@ import java.util.List;
* @version $Id: $Id
*/
@Controller
-public class CookieService extends BaseService {
+public class CookieService {
/**
* Returns cookies for last attack
@@ -56,30 +53,11 @@ public class CookieService extends BaseService {
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.util.List} object.
*/
- @RequestMapping(path = "/cookie.mvc", produces = "application/json")
+ @RequestMapping(path = "/service/cookie.mvc", produces = "application/json")
public @ResponseBody
- List showCookies(HttpSession session) {
- WebSession ws = getWebSession(session);
- List cookies = ws.getCookiesOnLastRequest();
+ List showCookies() {
+ //// TODO: 11/6/2016 to be decided
+ List cookies = Lists.newArrayList();
return cookies;
}
-
- /**
- * Returns cookies and params for current lesson
- *
- * @param session a {@link javax.servlet.http.HttpSession} object.
- * @return a {@link org.springframework.web.servlet.ModelAndView} object.
- */
- @RequestMapping(value = "/cookies_widget.mvc", produces = "text/html")
- public ModelAndView showCookiesAndParamsAsHtml(HttpSession session) {
- ModelAndView model = new ModelAndView();
- WebSession ws = getWebSession(session);
- List cookies = ws.getCookiesOnLastRequest();
- List listParms = ws.getParmsOnLastRequest();
- Collections.sort(listParms);
- model.addObject("wgcookies", cookies);
- model.addObject("wgparams", listParms);
- model.setViewName("widgets/cookies_and_params");
- return model;
- }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/ExceptionInfo.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/ExceptionInfo.java
deleted file mode 100644
index 80b40bef1..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/ExceptionInfo.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/***************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- */
-package org.owasp.webgoat.service;
-
-/**
- * ExceptionInfo class.
- *
- * @author rlawson
- * @version $Id: $Id
- */
-public class ExceptionInfo {
-
- private String url;
- private String message;
-
- /**
- * Getter for the field url.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getUrl() {
- return url;
- }
-
- /**
- * Setter for the field url.
- *
- * @param url a {@link java.lang.String} object.
- */
- public void setUrl(String url) {
- this.url = url;
- }
-
- /**
- * Getter for the field message.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getMessage() {
- return message;
- }
-
- /**
- * Setter for the field message.
- *
- * @param message a {@link java.lang.String} object.
- */
- public void setMessage(String message) {
- this.message = message;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java
index 5efcdaf87..8ec3fa8df 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/HintService.java
@@ -5,17 +5,17 @@
*/
package org.owasp.webgoat.service;
-import java.util.ArrayList;
-import java.util.List;
-import javax.servlet.http.HttpSession;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
import org.owasp.webgoat.lessons.model.Hint;
import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.servlet.ModelAndView;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import static java.util.stream.Collectors.toList;
/**
* HintService class.
@@ -24,73 +24,43 @@ import org.springframework.web.servlet.ModelAndView;
* @version $Id: $Id
*/
@Controller
-public class HintService extends BaseService {
+public class HintService {
+
+ private final WebSession webSession;
+
+ public HintService(WebSession webSession) {
+ this.webSession = webSession;
+ }
/**
* Returns hints for current lesson
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.util.List} object.
*/
- @RequestMapping(path = "/hint.mvc", produces = "application/json")
- public @ResponseBody
- List showHint(HttpSession session) {
+ @RequestMapping(path = "/service/hint.mvc", produces = "application/json")
+ public
+ @ResponseBody
+ List showHint() {
List listHints = new ArrayList();
- WebSession ws = getWebSession(session);
- AbstractLesson l = ws.getCurrentLesson();
+ AbstractLesson l = webSession.getCurrentLesson();
if (l == null) {
return listHints;
}
- List hints = (l.getCategory().equals(Category.CHALLENGE)) ? null : l.getHintsPublic(ws);
+ List hints = l.getHints();
if (hints == null) {
return listHints;
}
int idx = 0;
- for (String h : hints) {
- Hint hint = new Hint();
- hint.setHint(h);
- hint.setLesson(l.getName());
- hint.setNumber(idx);
- listHints.add(hint);
- idx++;
- }
- return listHints;
+ return hints.stream().map(h -> createHint(h, l.getName(), idx)).collect(toList());
}
- /**
- * showHintsAsHtml.
- *
- * @param session a {@link javax.servlet.http.HttpSession} object.
- * @return a {@link org.springframework.web.servlet.ModelAndView} object.
- */
- @RequestMapping(value = "/hint_widget.mvc", produces = "text/html")
- public
- ModelAndView showHintsAsHtml(HttpSession session) {
- ModelAndView model = new ModelAndView();
- List listHints = new ArrayList();
- model.addObject("hints", listHints);
- WebSession ws = getWebSession(session);
- AbstractLesson l = ws.getCurrentLesson();
- if (l == null) {
- return model;
- }
- List hints;
- hints = l.getHintsPublic(ws);
- if (hints == null) {
- return model;
- }
- int idx = 0;
- for (String h : hints) {
- Hint hint = new Hint();
- hint.setHint(h);
- hint.setLesson(l.getName());
- hint.setNumber(idx);
- listHints.add(hint);
- idx++;
- }
- model.setViewName("widgets/hints");
- return model;
+ private Hint createHint(String hintText, String lesson, int idx) {
+ Hint hint = new Hint();
+ hint.setHint(hintText);
+ hint.setLesson(lesson);
+ hint.setNumber(idx);
+ return hint;
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java
index 56ddd69e0..154744dd7 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java
@@ -51,9 +51,9 @@ import java.util.Map;
* @version $Id: $Id
*/
@Controller
-public class LabelDebugService extends BaseService {
+public class LabelDebugService {
- private static final String URL_DEBUG_LABELS_MVC = "/debug/labels.mvc";
+ private static final String URL_DEBUG_LABELS_MVC = "/service/debug/labels.mvc";
private static final String KEY_ENABLED = "enabled";
private static final String KEY_SUCCESS = "success";
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonInfoService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonInfoService.java
index 40dee8e3f..f249336b4 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonInfoService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonInfoService.java
@@ -1,19 +1,10 @@
package org.owasp.webgoat.service;
-import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.model.LessonInfoModel;
-import org.owasp.webgoat.lessons.model.LessonMenuItem;
import org.owasp.webgoat.session.WebSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.ResponseStatus;
-
-import javax.servlet.http.HttpSession;
@Controller
/**
@@ -22,45 +13,23 @@ import javax.servlet.http.HttpSession;
* @author dm
* @version $Id: $Id
*/
-public class LessonInfoService extends BaseService {
+public class LessonInfoService {
- private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
+ private final WebSession webSession;
+
+ public LessonInfoService(WebSession webSession) {
+ this.webSession = webSession;
+ }
/**
* getLessonInfo.
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link org.owasp.webgoat.lessons.model.LessonInfoModel} object.
*/
- @RequestMapping(path = "/lessoninfo.mvc", produces = "application/json")
+ @RequestMapping(path = "/service/lessoninfo.mvc", produces = "application/json")
public @ResponseBody
- LessonInfoModel getLessonInfo(HttpSession session) {
- WebSession webSession = getWebSession(session);
+ LessonInfoModel getLessonInfo() {
return new LessonInfoModel(webSession);
}
- /**
- * handleException.
- *
- * @param ex a {@link java.lang.Exception} object.
- * @return a {@link java.lang.String} object.
- */
- @ExceptionHandler(Exception.class)
- @ResponseBody
- @ResponseStatus(value = HttpStatus.INTERNAL_SERVER_ERROR)
- public String handleException(Exception ex) {
- return "An error occurred retrieving the LessonInfoModel:" + ex.getMessage();
- }
-
- /**
- * getLessonInfoModel.
- *
- * @param webSession a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.owasp.webgoat.lessons.model.LessonInfoModel} object.
- */
- protected LessonInfoModel getLessonInfoModel(WebSession webSession) {
- return new LessonInfoModel(webSession);
- }
-
-
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java
index 2cf0f3522..3b0cef530 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java
@@ -1,50 +1,49 @@
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at
* https://github.com/WebGoat/WebGoat, a repository for free software projects.
- *
*/
package org.owasp.webgoat.service;
+import lombok.AllArgsConstructor;
import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.RandomLessonAdapter;
import org.owasp.webgoat.lessons.model.LessonMenuItem;
import org.owasp.webgoat.lessons.model.LessonMenuItemType;
import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.LessonTracker;
+import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import javax.servlet.http.HttpSession;
import java.util.ArrayList;
import java.util.List;
+import java.util.Optional;
/**
*
LessonMenuService class.
@@ -53,23 +52,23 @@ import java.util.List;
* @version $Id: $Id
*/
@Controller
-public class LessonMenuService extends BaseService {
+@AllArgsConstructor
+public class LessonMenuService {
- private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
+ private final Course course;
+ private final UserTracker userTracker;
+ private final WebSession webSession;
/**
* Returns the lesson menu which is used to build the left nav
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.util.List} object.
*/
- @RequestMapping(path = "/lessonmenu.mvc", produces = "application/json")
- public @ResponseBody
- List showLeftNav(HttpSession session) {
+ @RequestMapping(path = "/service/lessonmenu.mvc", produces = "application/json")
+ public
+ @ResponseBody
+ List showLeftNav() {
List menu = new ArrayList();
- WebSession ws = getWebSession(session);
- // Get the categories, these are the main menu items
- Course course = ws.getCourse();
List categories = course.getCategories();
for (Category category : categories) {
@@ -77,41 +76,15 @@ public class LessonMenuService extends BaseService {
categoryItem.setName(category.getName());
categoryItem.setType(LessonMenuItemType.CATEGORY);
// check for any lessons for this category
- List lessons = ws.getLessons(category);
- String role = ws.getRole();
- logger.info("Role: " + role);
+ List lessons = course.getLessons(category);
for (AbstractLesson lesson : lessons) {
LessonMenuItem lessonItem = new LessonMenuItem();
lessonItem.setName(lesson.getTitle());
lessonItem.setLink(lesson.getLink());
lessonItem.setType(LessonMenuItemType.LESSON);
- if (lesson.isCompleted(ws)) {
- lessonItem.setComplete(true);
- }
-
+ Optional lessonTracker = userTracker.getLessonTracker(lesson);
+ lessonItem.setComplete(lessonTracker.isPresent() ? lessonTracker.get().getCompleted() : false);
categoryItem.addChild(lessonItem);
- // Does the lesson have stages
- if (lesson instanceof RandomLessonAdapter) {
- RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
- String[] stages = rla.getStages();
- if (stages != null) {
- String lessonLink = lesson.getLink();
- int stageIdx = 1;
- for (String stage : stages) {
- LessonMenuItem stageItem = new LessonMenuItem();
- stageItem.setName("Stage " + stageIdx + ": " + stage);
- // build the link for the stage
- String stageLink = lessonLink + "/" + stageIdx;
- stageItem.setLink(stageLink);
- stageItem.setType(LessonMenuItemType.STAGE);
- if (rla.isStageComplete(ws, stage)) {
- stageItem.setComplete(true);
- }
- lessonItem.addChild(stageItem);
- stageIdx++;
- }
- }
- }
}
menu.add(categoryItem);
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java
index 6d1be3ade..c28a7bd83 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonPlanService.java
@@ -29,15 +29,11 @@
*/
package org.owasp.webgoat.service;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import javax.servlet.http.HttpSession;
-
/**
* LessonPlanService class.
*
@@ -45,42 +41,33 @@ import javax.servlet.http.HttpSession;
* @version $Id: $Id
*/
@Controller
-public class LessonPlanService extends BaseService {
+//TODO remove
+public class LessonPlanService {
+
+ private final WebSession webSession;
+
+ public LessonPlanService(WebSession webSession) {
+ this.webSession = webSession;
+ }
/**
* Returns source for current attack
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/lessonplan.mvc", produces = "application/html")
+ @RequestMapping(path = "/service/lessonplan.mvc", produces = "application/html")
public @ResponseBody
- String showPlan(HttpSession session) {
- WebSession ws = getWebSession(session);
- String plan = getPlan(ws);
+ String showPlan() {
+ String plan = getPlan();
return plan;
}
/**
* Description of the Method
*
- * @param s Description of the Parameter
* @return Description of the Return Value
*/
- protected String getPlan(WebSession s) {
- String plan = null;
- int scr = s.getCurrentScreen();
- Course course = s.getCourse();
-
- if (s.isUser() || s.isAdmin()) {
- AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
- if (lesson != null) {
- plan = lesson.getLessonPlan(s);
- }
- }
- if (plan == null) {
- plan = "Plan is not available for this lesson.";
- }
- return plan;
+ protected String getPlan() {
+ return "Plan is not available for this lesson.";
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java
index 23701894d..a9bdeb343 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java
@@ -1,51 +1,41 @@
package org.owasp.webgoat.service;
import com.google.common.collect.Maps;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.RandomLessonAdapter;
+import lombok.AllArgsConstructor;
+import org.owasp.webgoat.i18n.LabelManager;
import org.owasp.webgoat.lessons.model.LessonInfoModel;
-import org.owasp.webgoat.session.WebSession;
-import org.owasp.webgoat.util.LabelManager;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
+import org.owasp.webgoat.session.LessonTracker;
+import org.owasp.webgoat.session.UserTracker;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import javax.servlet.http.HttpSession;
import java.util.Map;
-@Controller
+
/**
* LessonProgressService class.
*
* @author webgoat
*/
-public class LessonProgressService extends BaseService {
+@Controller
+@AllArgsConstructor
+public class LessonProgressService {
- private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
private LabelManager labelManager;
-
- @Autowired
- public LessonProgressService(final LabelManager labelManager) {
- this.labelManager = labelManager;
- }
+ private UserTracker userTracker;
/**
* LessonProgressService.
*
- * @param session a {@link HttpSession} object.
* @return a {@link LessonInfoModel} object.
*/
- @RequestMapping(value = "/lessonprogress.mvc", produces = "application/json")
+ @RequestMapping(value = "/service/lessonprogress.mvc", produces = "application/json")
@ResponseBody
- public Map getLessonInfo(HttpSession session) {
- WebSession webSession = getWebSession(session);
- AbstractLesson lesson = webSession.getCurrentLesson();
- boolean lessonCompleted = lesson.isCompleted(webSession);
- String successMessage = lesson instanceof RandomLessonAdapter ? "Congratulations, you have completed this lab" : labelManager
- .get("LessonCompleted");
+ public Map getLessonInfo() {
+ LessonTracker lessonTracker = userTracker.getCurrentLessonTracker();
+ boolean lessonCompleted = lessonTracker.getCompleted();
+ String successMessage = labelManager.get("LessonCompleted");
Map json = Maps.newHashMap();
json.put("lessonCompleted", lessonCompleted);
json.put("successMessage", successMessage);
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java
index 1b9c9022f..c3d7a82b5 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java
@@ -1,46 +1,38 @@
package org.owasp.webgoat.service;
-import javax.servlet.http.HttpSession;
-
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-@Controller
+
/**
* LessonTitleService class.
*
- * @version $Id: $Id
* @author dm
+ * @version $Id: $Id
*/
-public class LessonTitleService extends BaseService {
-
+@Controller
+public class LessonTitleService {
+
+ private final WebSession webSession;
+
+ public LessonTitleService(final WebSession webSession) {
+ this.webSession = webSession;
+ }
+
/**
* Returns the title for the current attack
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/lessontitle.mvc", produces = "application/html")
- public @ResponseBody
- String showPlan(HttpSession session) {
- WebSession ws = getWebSession(session);
- return getLessonTitle(ws);
- }
-
- private String getLessonTitle(WebSession s) {
- String title = "";
- int scr = s.getCurrentScreen();
- Course course = s.getCourse();
-
- if (s.isUser() || s.isChallenge()) {
- AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
- title = lesson != null ? lesson.getTitle() : "";
- }
- return title;
+ @RequestMapping(path = "/service/lessontitle.mvc", produces = "application/html")
+ public
+ @ResponseBody
+ String showPlan() {
+ AbstractLesson lesson = webSession.getCurrentLesson();
+ return lesson != null ? lesson.getTitle() : "";
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java
index 47006d76f..f4bce560a 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/ParameterService.java
@@ -29,18 +29,16 @@
*/
package org.owasp.webgoat.service;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import javax.servlet.http.HttpSession;
+import com.google.common.collect.Lists;
import org.owasp.webgoat.lessons.model.RequestParameter;
-import org.owasp.webgoat.session.WebSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
+import javax.servlet.http.HttpSession;
+import java.util.Collections;
+import java.util.List;
+
/**
* ParameterService class.
*
@@ -48,9 +46,7 @@ import org.springframework.web.bind.annotation.ResponseBody;
* @version $Id: $Id
*/
@Controller
-public class ParameterService extends BaseService {
-
- final Logger logger = LoggerFactory.getLogger(ParameterService.class);
+public class ParameterService {
/**
* Returns request parameters for last attack
@@ -58,11 +54,11 @@ public class ParameterService extends BaseService {
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.util.List} object.
*/
- @RequestMapping(path = "/parameter.mvc", produces = "application/json")
+ @RequestMapping(path = "/service/parameter.mvc", produces = "application/json")
public @ResponseBody
List showParameters(HttpSession session) {
- WebSession ws = getWebSession(session);
- List listParms = ws.getParmsOnLastRequest();
+ //// TODO: 11/6/2016 to decide not sure about the role in WebGoat 8
+ List listParms = Lists.newArrayList();
Collections.sort(listParms);
return listParms;
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/PluginReloadService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/PluginReloadService.java
index ec9217955..e9e494523 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/PluginReloadService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/PluginReloadService.java
@@ -29,9 +29,6 @@
*/
package org.owasp.webgoat.service;
-import org.owasp.webgoat.session.WebSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
@@ -50,9 +47,7 @@ import java.util.Map;
* @version $Id: $Id
*/
@Controller
-public class PluginReloadService extends BaseService {
-
- private static final Logger logger = LoggerFactory.getLogger(PluginReloadService.class);
+public class PluginReloadService {
/**
* Reload all the plugins
@@ -60,17 +55,17 @@ public class PluginReloadService extends BaseService {
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link org.springframework.http.ResponseEntity} object.
*/
- @RequestMapping(path = "/reloadplugins.mvc", produces = MediaType.APPLICATION_JSON_VALUE)
+ @RequestMapping(path = "/service/reloadplugins.mvc", produces = MediaType.APPLICATION_JSON_VALUE)
public @ResponseBody
ResponseEntity> reloadPlugins(HttpSession session) {
- WebSession webSession = (WebSession) session.getAttribute(WebSession.SESSION);
-
- logger.debug("Loading plugins into cache");
- String pluginPath = session.getServletContext().getRealPath("plugin_lessons");
- String targetPath = session.getServletContext().getRealPath("plugin_extracted");
- //TODO fix me
- //new PluginsLoader(Paths.get(pluginPath), Paths.get(targetPath)).copyJars();
- //webSession.getCourse().loadLessonFromPlugin();
+// WebSession webSession = (WebSession) session.getAttribute(WebSession.SESSION);
+//
+// logger.debug("Loading plugins into cache");
+// String pluginPath = session.getServletContext().getRealPath("plugin_lessons");
+// String targetPath = session.getServletContext().getRealPath("plugin_extracted");
+// //TODO fix me
+// //new PluginsLoader(Paths.get(pluginPath), Paths.get(targetPath)).copyJars();
+// //webSession.getCourse().createLessonsFromPlugins();
Map result = new HashMap();
result.put("success", true);
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java
index 7d6679cb6..80d05cbe3 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java
@@ -1,32 +1,31 @@
/***************************************************************************************************
- *
- *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
- *
*/
package org.owasp.webgoat.service;
-import javax.servlet.http.HttpSession;
+import lombok.AllArgsConstructor;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
@@ -39,22 +38,25 @@ import org.springframework.web.bind.annotation.ResponseBody;
* @version $Id: $Id
*/
@Controller
-public class RestartLessonService extends BaseService {
+@AllArgsConstructor
+public class RestartLessonService {
+
+ private final WebSession webSession;
+ private final UserTracker userTracker;
/**
* Returns current lesson
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/restartlesson.mvc", produces = "text/text")
- public @ResponseBody
- String restartLesson(HttpSession session) {
- WebSession ws = getWebSession(session);
- int currentScreen = ws.getCurrentScreen();
- if(currentScreen > 0){
- ws.restartLesson(currentScreen);
- }
- return ws.getCurrentLesson().getLink();
+ @RequestMapping(path = "/service/restartlesson.mvc", produces = "text/text")
+ public
+ @ResponseBody
+ String restartLesson() {
+ AbstractLesson al = webSession.getCurrentLesson();
+ System.out.println("Restarting lesson: " + al);
+ userTracker.getCurrentLessonTracker().setCompleted(false);
+
+ return webSession.getCurrentLesson().getLink();
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java
index f86d06ed9..715f4e88f 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java
@@ -5,16 +5,17 @@
*/
package org.owasp.webgoat.service;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
import java.util.Enumeration;
import java.util.List;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpSession;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
/**
*
SessionService class.
@@ -23,7 +24,7 @@ import org.springframework.web.bind.annotation.ResponseBody;
* @version $Id: $Id
*/
@Controller
-public class SessionService extends BaseService {
+public class SessionService {
/**
* Returns hints for current lesson
@@ -32,7 +33,7 @@ public class SessionService extends BaseService {
* @param request a {@link javax.servlet.http.HttpServletRequest} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/session.mvc", produces = "application/json")
+ @RequestMapping(path = "/service/session.mvc", produces = "application/json")
public @ResponseBody
String showSession(HttpServletRequest request, HttpSession session) {
StringBuilder sb = new StringBuilder();
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java
index 3cf245f42..2314ac6d5 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/SolutionService.java
@@ -1,43 +1,37 @@
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
*/
package org.owasp.webgoat.service;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.Course;
-import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
-import javax.servlet.http.HttpSession;
-
/**
*
SolutionService class.
*
@@ -45,42 +39,28 @@ import javax.servlet.http.HttpSession;
* @version $Id: $Id
*/
@Controller
-public class SolutionService extends BaseService {
+public class SolutionService {
/**
* Returns solution for current attack
*
- * @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/solution.mvc", produces = "text/html")
- public @ResponseBody
- String showSolution(HttpSession session) {
- WebSession ws = getWebSession(session);
- String source = getSolution(ws);
+ @RequestMapping(path = "/service/solution.mvc", produces = "text/html")
+ public
+ @ResponseBody
+ String showSolution() {
+ //// TODO: 11/6/2016 to decide not sure about the role in WebGoat 8
+ String source = getSolution();
return source;
}
/**
* getSolution.
*
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @return a {@link java.lang.String} object.
*/
- protected String getSolution(WebSession s) {
- String source = null;
- int scr = s.getCurrentScreen();
- Course course = s.getCourse();
-
- if (s.isUser() || s.isAdmin()) {
- AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
- if (lesson != null) {
- source = lesson.getSolution(s);
- }
- }
- if (source == null) {
- return "Solution is not available. Contact " + s.getWebgoatContext().getFeedbackAddressHTML();
- }
- return source;
+ protected String getSolution() {
+ return "Solution is not available";
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
index 4f01a4858..15267f29d 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
@@ -1,38 +1,34 @@
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
- *
+ *
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
- *
*/
package org.owasp.webgoat.service;
import org.apache.commons.lang3.StringEscapeUtils;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.session.Course;
-import org.owasp.webgoat.session.WebSession;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@@ -46,7 +42,8 @@ import javax.servlet.http.HttpSession;
* @version $Id: $Id
*/
@Controller
-public class SourceService extends BaseService {
+//TODO REMOVE!
+public class SourceService {
/**
* Description of the Field
@@ -62,11 +59,12 @@ public class SourceService extends BaseService {
* @param session a {@link javax.servlet.http.HttpSession} object.
* @return a {@link java.lang.String} object.
*/
- @RequestMapping(path = "/source.mvc", produces = "application/text")
- public @ResponseBody
+ @RequestMapping(path = "/service/source.mvc", produces = "application/text")
+ public
+ @ResponseBody
String showSource(HttpSession session) {
- WebSession ws = getWebSession(session);
- String source = getSource(ws);
+ //// TODO: 11/6/2016 to decide not sure about the role in WebGoat 8
+ String source = getSource();
if (source == null) {
source = "No source listing found";
}
@@ -76,24 +74,9 @@ public class SourceService extends BaseService {
/**
* Description of the Method
*
- * @param s Description of the Parameter
* @return Description of the Return Value
*/
- protected String getSource(WebSession s) {
- String source = null;
- int scr = s.getCurrentScreen();
- Course course = s.getCourse();
-
- if (s.isUser() || s.isAdmin()) {
- AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
- if (lesson != null) {
- source = lesson.getRawSource(s);
- }
- }
- if (source == null) {
- return "Source code is not available for this lesson.";
- }
- return source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
- "Code Section Deliberately Omitted");
+ protected String getSource() {
+ return "Source code is not available for this lesson.";
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/Authorization.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/Authorization.java
deleted file mode 100644
index 36c8c3a67..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/Authorization.java
+++ /dev/null
@@ -1,73 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-import java.util.Hashtable;
-import java.util.Map;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * * @version $Id: $Id
- *
- * @author dm
- * @version $Id: $Id
- */
-public class Authorization
-{
-
- Map permissions = new Hashtable();
-
- /**
- * Constructor for Authorization.
- */
- public Authorization()
- {
- }
-
- /**
- * setPermission.
- *
- * @param userId a int.
- * @param functionId a int.
- */
- public void setPermission(int userId, int functionId)
- {
- permissions.put(new Integer(userId), new Integer(functionId));
- }
-
- /**
- * isAllowed.
- *
- * @param userId a int.
- * @param functionId a int.
- * @return a boolean.
- */
- public boolean isAllowed(int userId, int functionId)
- {
- return (permissions.get(new Integer(userId)) != null);
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java
index c6228f7aa..34be4f847 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java
@@ -1,156 +1,58 @@
package org.owasp.webgoat.session;
+import lombok.extern.slf4j.Slf4j;
import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.plugins.LegacyLoader;
+import org.owasp.webgoat.lessons.NewLesson;
import org.owasp.webgoat.plugins.Plugin;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.servlet.ServletContext;
-import java.io.File;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Iterator;
import java.util.LinkedList;
import java.util.List;
-import java.util.Map;
+
+import static java.util.stream.Collectors.toList;
/**
- *************************************************************************************************
- *
- *
+ * ************************************************************************************************
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
*
* @author Bruce Mayhew WebGoat
- * @since October 28, 2003
* @version $Id: $Id
+ * @since October 28, 2003
*/
+@Slf4j
public class Course {
- final Logger logger = LoggerFactory.getLogger(Course.class);
-
private List lessons = new LinkedList<>();
- private WebgoatProperties properties = null;
-
- private WebgoatContext webgoatContext;
-
- /**
- * Constructor for Course.
- */
- public Course(WebgoatProperties properties) {
- this.properties = properties;
- }
-
- /**
- * Take an absolute file and return the filename.
- *
- * Ex. /etc/password becomes password
- *
- * @param s
- * @return the file name
- */
- private static String getFileName(String s) {
- String fileName = new File(s).getName();
-
- if (fileName.contains("/")) {
- fileName = fileName.substring(fileName.lastIndexOf("/"), fileName.length());
- }
-
- if (fileName.contains(".")) {
- fileName = fileName.substring(0, fileName.indexOf("."));
- }
-
- return fileName;
- }
-
- /**
- * Take a class name and return the equivalent file name
- *
- * Ex. org.owasp.webgoat becomes org/owasp/webgoat.java
- *
- * @param className
- * @return
- */
- private static String getSourceFile(String className) {
- StringBuilder sb = new StringBuilder();
-
- sb.append(className.replace(".", "/"));
- sb.append(".java");
-
- return sb.toString();
- }
-
- /**
- * Takes a file name and builds the class file name
- *
- * @param fileName Description of the Parameter
- * @param path Description of the Parameter
- * @return Description of the Return Value
- */
- private static String getClassFile(String fileName, String path) {
- String ext = ".class";
- fileName = fileName.trim();
-
- /**
- * We do not handle directories. We do not handle files with different
- * extensions
- */
- if (fileName.endsWith("/") || !fileName.endsWith(ext)) {
- return null;
- }
-
- // if the file is in /WEB-INF/classes strip the dir info off
- int index = fileName.indexOf("/WEB-INF/classes/");
- if (index != -1) {
- fileName = fileName.substring(index + "/WEB-INF/classes/".length(), fileName.length() - ext.length());
- fileName = fileName.replace('/', '.');
- fileName = fileName.replace('\\', '.');
- } else {
- // Strip off the leading path info
- fileName = fileName.substring(path.length(), fileName.length() - ext.length());
- }
-
- return fileName;
- }
-
/**
* Gets the categories attribute of the Course object
*
* @return The categories value
*/
- public List getCategories() {
- List categories = new ArrayList();
- for (AbstractLesson lesson : lessons) {
- if (!categories.contains(lesson.getCategory())) {
- categories.add(lesson.getCategory());
- }
- }
-
- Collections.sort(categories);
-
- return categories;
+ public List getCategories() {
+ return lessons.parallelStream().map(l -> l.getCategory()).distinct().sorted().collect(toList());
}
/**
@@ -159,148 +61,28 @@ public class Course {
* @return The firstLesson value
*/
public AbstractLesson getFirstLesson() {
- List roles = new ArrayList();
- roles.add(AbstractLesson.USER_ROLE);
// Category 0 is the admin function. We want the first real category
// to be returned. This is normally the General category and the Http Basics lesson
- return ((AbstractLesson) getLessons((Category) getCategories().get(0), roles).get(0));
- }
-
- /**
- * Gets the lesson attribute of the Course object
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param lessonId Description of the Parameter
- * @param roles a {@link java.util.List} object.
- * @return The lesson value
- */
- public AbstractLesson getLesson(WebSession s, int lessonId, List roles) {
- if (s.isHackedAdmin()) {
- roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
- }
- // System.out.println("getLesson() with roles: " + roles);
- Iterator iter = lessons.iterator();
-
- while (iter.hasNext()) {
- AbstractLesson lesson = iter.next();
-
- if (lesson.getScreenId() == lessonId && roles.contains(lesson.getRole())) {
- return lesson;
- }
- }
-
- return null;
- }
-
- /**
- * getLesson.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param lessonId a int.
- * @param role a {@link java.lang.String} object.
- * @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- */
- public AbstractLesson getLesson(WebSession s, int lessonId, String role) {
- List roles = new ArrayList();
- roles.add(role);
- return getLesson(s, lessonId, roles);
+ return getLessons(getCategories().get(0)).get(0);
}
/**
* Getter for the field lessons.
*
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param role a {@link java.lang.String} object.
* @return a {@link java.util.List} object.
*/
- public List getLessons(WebSession s, String role) {
- List roles = new ArrayList();
- roles.add(role);
- return getLessons(s, roles);
- }
-
- /**
- * Gets the lessons attribute of the Course object
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param roles a {@link java.util.List} object.
- * @return The lessons value
- */
- public List getLessons(WebSession s, List roles) {
- if (s.isHackedAdmin()) {
- roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
- }
- List lessonList = new ArrayList();
- Iterator categoryIter = getCategories().iterator();
-
- while (categoryIter.hasNext()) {
- lessonList.addAll(getLessons(s, (Category) categoryIter.next(), roles));
- }
- return lessonList;
- }
-
- /**
- * Gets the lessons attribute of the Course object
- *
- * @param category Description of the Parameter
- * @param roles Description of the Parameter
- * @return The lessons value
- */
- private List getLessons(Category category, List roles) {
- List lessonList = new ArrayList();
-
- for (AbstractLesson lesson : lessons) {
- if (lesson.getCategory().equals(category) && roles.contains(lesson.getRole())) {
- lessonList.add(lesson);
- }
- }
-
- Collections.sort(lessonList);
- return lessonList;
+ public List getLessons() {
+ return this.lessons;
}
/**
* Getter for the field lessons.
*
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
* @param category a {@link org.owasp.webgoat.lessons.Category} object.
- * @param role a {@link java.lang.String} object.
* @return a {@link java.util.List} object.
*/
- public List getLessons(WebSession s, Category category, String role) {
- List roles = new ArrayList();
- roles.add(role);
- return getLessons(s, category, roles);
- }
-
- /**
- * Getter for the field lessons.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param category a {@link org.owasp.webgoat.lessons.Category} object.
- * @param roles a {@link java.util.List} object.
- * @return a {@link java.util.List} object.
- */
- public List getLessons(WebSession s, Category category, List roles) {
- if (s.isHackedAdmin()) {
- roles.add(AbstractLesson.HACKED_ADMIN_ROLE);
- }
- return getLessons(category, roles);
- }
-
- /**
- * getLesson.
- *
- * @param lessonId a int.
- * @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- */
- public AbstractLesson getLesson(int lessonId) {
- for (AbstractLesson l : lessons) {
- if (l.getScreenId() == lessonId) {
- return l;
- }
- }
- return null;
+ public List getLessons(Category category) {
+ return this.lessons.stream().filter(l -> l.getCategory() == category).collect(toList());
}
public void setLessons(List lessons) {
@@ -308,44 +90,17 @@ public class Course {
}
/**
- * loadLessonFromPlugin.
+ * createLessonsFromPlugins.
*/
- public void loadLessonFromPlugin(List plugins) {
+ public void createLessonsFromPlugins(List plugins) {
for (Plugin plugin : plugins) {
try {
- AbstractLesson lesson = plugin.getLesson().get();
- lesson.setWebgoatContext(webgoatContext);
- lesson.update(properties);
-
- if (!lesson.getHidden()) {
- lessons.add(lesson);
- }
- for(Map.Entry lessonPlan : plugin.getLessonPlans().entrySet()) {
- lesson.setLessonPlanFileName(lessonPlan.getKey(), lessonPlan.getValue().toString());
- }
- if (plugin.getLessonSolution("en").isPresent()) {
- lesson.setLessonSolutionFileName(plugin.getLessonSolution("en").get().toString());
- }
- if (plugin.getLessonSource().isPresent()) {
- lesson.setSourceFileName(plugin.getLessonSource().get().toString());
- }
+ NewLesson lesson = (NewLesson) plugin.getLesson().get();
+ lesson.setTotalNumberOfAssignments(plugin.getLessonEndpoints().size());
+ lessons.add(lesson);
} catch (Exception e) {
- logger.error("Error in loadLessons: ", e);
+ log.error("Error in loadLessons: ", e);
}
}
}
-
- /**
- * Description of the Method
- *
- * @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
- * @param path Description of the Parameter
- * @param context Description of the Parameter
- */
- public void loadCourses(WebgoatContext webgoatContext, ServletContext context, String path) {
- logger.info("Loading courses: " + path);
- this.webgoatContext = webgoatContext;
- LegacyLoader loader = new LegacyLoader();
- lessons.addAll(loader.loadLessons(webgoatContext, context, path, properties));
- }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java
index 2afc1296f..4031e0c82 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java
@@ -4,7 +4,6 @@ package org.owasp.webgoat.session;
import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
-import org.owasp.webgoat.lessons.AbstractLesson;
/**
@@ -759,16 +758,16 @@ public class CreateDB
String insertData25_1 = "INSERT INTO auth VALUES('admin', 'SearchStaff')";
String insertData25_2 = "INSERT INTO auth VALUES('admin', 'FindProfile')";
- // Add a permission for the webgoat role to see the source.
- // The challenge(s) will change the default role to "challenge"
- String insertData26 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOURCE
- + "')";
- String insertData27 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWHINTS
- + "')";
+// // Add a permission for the webgoat role to see the source.
+// // The challenge(s) will change the default role to "challenge"
+// String insertData26 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOURCE
+// + "')";
+// String insertData27 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWHINTS
+// + "')";
// Add a permission for the webgoat role to see the solution.
// The challenge(s) will change the default role to "challenge"
- String insertData28 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOLUTION
- + "')";
+// String insertData28 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOLUTION
+// + "')";
statement.executeUpdate(insertData1);
statement.executeUpdate(insertData2);
@@ -803,9 +802,9 @@ public class CreateDB
statement.executeUpdate(insertData25);
statement.executeUpdate(insertData25_1);
statement.executeUpdate(insertData25_2);
- statement.executeUpdate(insertData26);
- statement.executeUpdate(insertData27);
- statement.executeUpdate(insertData28);
+ //statement.executeUpdate(insertData26);
+ //statement.executeUpdate(insertData27);
+ //statement.executeUpdate(insertData28);
}
private void createOwnershipTable(Connection connection) throws SQLException
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
index 576ec04a8..5a754d9cd 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/DatabaseUtilities.java
@@ -1,17 +1,8 @@
package org.owasp.webgoat.session;
-import org.apache.ecs.MultiPartElement;
-import org.apache.ecs.html.B;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.Table;
-
-import java.io.IOException;
import java.sql.Connection;
import java.sql.DriverManager;
-import java.sql.ResultSet;
-import java.sql.ResultSetMetaData;
import java.sql.SQLException;
import java.util.HashMap;
import java.util.Map;
@@ -132,73 +123,5 @@ public class DatabaseUtilities
String url = context.getDatabaseConnectionString().replaceAll("\\$\\{USER\\}", user);
return DriverManager.getConnection(url, "sa", "");
}
-
- /**
- * Description of the Method
- *
- * @param results
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @param resultsMetaData
- * Description of the Parameter
- * @return Description of the Return Value
- * @exception IOException
- * Description of the Exception
- * @exception SQLException
- * Description of the Exception
- * @throws java.io.IOException if any.
- * @throws java.sql.SQLException if any.
- */
- public static MultiPartElement writeTable(ResultSet results, ResultSetMetaData resultsMetaData) throws IOException,
- SQLException
- {
- int numColumns = resultsMetaData.getColumnCount();
- results.beforeFirst();
-
- if (results.next())
- {
- Table t = new Table(1); // 1 = with border
- t.setCellPadding(1);
-
- TR tr = new TR();
-
- for (int i = 1; i < (numColumns + 1); i++)
- {
- tr.addElement(new TD(new B(resultsMetaData.getColumnName(i))));
- }
-
- t.addElement(tr);
- results.beforeFirst();
-
- while (results.next())
- {
- TR row = new TR();
-
- for (int i = 1; i < (numColumns + 1); i++)
- {
- String str = results.getString(i);
- if (str == null) str = "";
- row.addElement(new TD(str.replaceAll(" ", " ")));
- }
-
- t.addElement(row);
- }
-
- return (t);
- }
- else
- {
- return (new B("Query Successful; however no data was returned from this query."));
- }
- }
-
+
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/ECSFactory.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/ECSFactory.java
deleted file mode 100644
index e3f85f263..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/ECSFactory.java
+++ /dev/null
@@ -1,754 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-import java.util.Iterator;
-import java.util.List;
-import java.util.StringTokenizer;
-import java.util.Vector;
-import org.apache.ecs.Element;
-import org.apache.ecs.ElementContainer;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.A;
-import org.apache.ecs.html.BR;
-import org.apache.ecs.html.H3;
-import org.apache.ecs.html.Input;
-import org.apache.ecs.html.Label;
-import org.apache.ecs.html.Option;
-import org.apache.ecs.html.P;
-import org.apache.ecs.html.Select;
-import org.apache.ecs.html.TD;
-import org.apache.ecs.html.TH;
-import org.apache.ecs.html.TR;
-import org.apache.ecs.html.U;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams (jeff.williams@aspectsecurity.com)
- * @since October 29, 2003
- * @version $Id: $Id
- */
-public class ECSFactory
-{
-
- /**
- * Description of the Field
- */
-
- public final static String ON = "On";
-
- /**
- * Description of the Field
- */
-
- public final static String PASSWORD = "Password";
-
- /**
- * Don't let anyone instantiate this class
- */
-
- private ECSFactory()
- {
- }
-
- /**
- * Description of the Method
- *
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeBox(String name, String value)
- {
-
- Input i = new Input(Input.CHECKBOX, name, ON);
-
- i.setChecked(value.equals(ON));
-
- return (i);
- }
-
- /**
- * Description of the Method
- *
- * @param text
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeButton(String text)
- {
-
- Input b = new Input();
-
- b.setType(Input.SUBMIT);
- b.setValue(text);
- b.setName(Input.SUBMIT);
-
- return (b);
- }
-
- /**
- * makeButton.
- *
- * @param text a {@link java.lang.String} object.
- * @param onClickFunction a {@link java.lang.String} object.
- * @return a {@link org.apache.ecs.Element} object.
- */
- public static Element makeButton(String text, String onClickFunction)
- {
-
- Input b = (Input) makeButton(text);
- b.setOnClick(onClickFunction);
-
- return (b);
- }
-
- /**
- * Description of the Method
- *
- * @param labeltext
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @param e
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static TR makeField(String labeltext, String value, Element e)
- {
-
- TD left = new TD().setAlign("right");
-
- Label label = new Label().addElement(labeltext);
-
- left.addElement(label);
-
- TD right = new TD().setAlign("left");
-
- right.addElement(e);
-
- TR row = new TR();
-
- row.addElement(left);
-
- row.addElement(right);
-
- return (row);
- }
-
- /**
- * Description of the Method
- *
- * @param labeltext
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @param size
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static TR makeField(String labeltext, String name, String value, int size)
- {
-
- Input field = new Input().setName(name).setValue(value).setSize(size).setMaxlength(size);
-
- // double check in case someone means to make a * starred out password field
-
- if (name.equals(PASSWORD))
- {
-
- field.setType(Input.PASSWORD);
-
- }
-
- return (makeField(labeltext, value, field));
- }
-
- /**
- * Description of the Method
- *
- * @param label
- * Description of the Parameter
- * @param type
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @param alignment
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeInput(String label, String type, String name, boolean value, boolean selected,
- String alignment)
- {
-
- return makeInput(label, type, name, new Boolean(value).toString(), selected, alignment);
- }
-
- /**
- * Description of the Method
- *
- * @param label
- * Description of the Parameter
- * @param type
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeInput(String label, String type, String name, String value)
- {
-
- return makeInput(label, type, name, value, new Boolean(value).booleanValue(), "RIGHT");
- }
-
- /**
- * Description of the Method
- *
- * @param label
- * Description of the Parameter
- * @param type
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @param alignment
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeInput(String label, String type, String name, String value, boolean selected,
- String alignment)
- {
-
- ElementContainer ec = new ElementContainer();
-
- if (!alignment.equalsIgnoreCase("LEFT"))
- {
-
- ec.addElement(new StringElement(label));
-
- }
-
- Input input = new Input(type, name, value);
-
- ec.addElement(input);
-
- if (alignment.equalsIgnoreCase("LEFT"))
- {
-
- ec.addElement(new StringElement(label));
-
- }
-
- if (type.equalsIgnoreCase("CHECKBOX"))
- {
-
- input.setChecked(selected);
-
- }
-
- return (ec);
- }
-
- /**
- * Description of the Method
- *
- * @param text
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static A makeLink(String text, String name, String value)
- {
-
- String href = "attack?" + name;
-
- if (value.length() > 0)
- {
-
- href = href + "=" + value;
-
- }
-
- A a = new A(href);
-
- a.addElement(new U().addElement(text));
-
- a.addAttribute("style", "cursor:hand");
-
- return (a);
- }
-
- /**
- * Description of the Method
- *
- * @param text
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static A makeLink(String text, String name, int value)
- {
-
- return (makeLink(text, name, Integer.toString(value)));
- }
-
- /**
- * Description of the Method
- *
- * @param text
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static A makeLink(String text, String name, boolean value)
- {
-
- return (makeLink(text, name, new Boolean(value).toString()));
- }
-
- /**
- * Description of the Method
- *
- * @param text
- * Description of the Parameter
- * @param clickAction
- * Description of the Parameter
- * @param type
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Input makeOnClickInput(String text, String clickAction, String type)
- {
-
- Input b = new Input();
-
- b.setType(type);
-
- b.setValue(text);
-
- b.setOnClick(clickAction);
-
- return (b);
- }
-
- /**
- * Description of the Method
- *
- * @param labeltext
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @param e
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static TR makeOption(String labeltext, String value, Element e)
- {
-
- TD left = new TD().setAlign("left").setWidth("10%");
-
- left.addElement(e);
-
- TD right = new TD().setAlign("right");
-
- Label label = new Label().addElement(labeltext);
-
- right.addElement(label);
-
- TR row = new TR();
-
- row.addElement(right);
-
- row.addElement(left);
-
- return (row);
- }
-
- /**
- * Description of the Method
- *
- * @param label
- * Description of the Parameter
- * @param value
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Option makeOption(String label, boolean value)
- {
-
- Option option = new Option(label, new Boolean(value).toString());
-
- option.setSelected(value);
-
- return option;
- }
-
- /**
- * Description of the Method
- *
- * @param line
- * Description of the Parameter
- * @return Description of the Return Value
- */
-
- private static org.apache.ecs.html.Option makeOption(String line)
- {
-
- StringTokenizer st = new StringTokenizer(line, "|");
-
- org.apache.ecs.html.Option o = new org.apache.ecs.html.Option();
-
- String token = "";
-
- if (st.hasMoreTokens())
- {
-
- token = st.nextToken();
-
- }
-
- o.addElement(token);
-
- return (o);
- }
-
- /**
- * Description of the Method
- *
- * @param name
- * Description of the Parameter
- * @param options
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makePulldown(String name, List options)
- {
-
- Select s = new Select(name);
-
- s.addElement(options.toArray(new String[options.size()]));
-
- return (s);
- }
-
- /**
- * Description of the Method
- *
- * @param results
- * Description of the Parameter
- * @return Description of the Return Value
- * @param name a {@link java.lang.String} object.
- */
- public static Element makePulldown(String name, String results)
- {
-
- Select select = new Select(name);
-
- StringTokenizer st = new StringTokenizer(results, "\n");
-
- if (!st.hasMoreTokens()) {
-
- return (new StringElement("")); }
-
- while (st.hasMoreTokens())
- {
-
- String line = st.nextToken();
-
- select.addElement(makeOption(line));
-
- }
-
- select.addElement("-------------------------");
-
- return (select);
- }
-
- /**
- * Description of the Method
- *
- * @param name
- * Description of the Parameter
- * @param list
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param rowsShowing
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Select makePulldown(String name, Object[] list, String selected, int rowsShowing)
- {
-
- Select select = new Select(name);
-
- for (int loop = 0; loop < list.length; loop++)
- {
-
- String value = list[loop].toString();
-
- org.apache.ecs.html.Option o = new org.apache.ecs.html.Option(value, value, value);
-
- if (value.equals(selected))
- {
-
- o.setSelected(true);
-
- }
-
- select.addElement(o);
-
- }
-
- select.setSize(rowsShowing);
-
- return select;
- }
-
- /**
- * Default size of 1 for rows showing in select box.
- *
- * @param diffNames
- * Description of the Parameter
- * @param select
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param options
- * Description of the Parameter
- * @param list
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeSelect(boolean diffNames, Select select, String name, Vector options,
- String[] list, String selected)
- {
-
- return makeSelect(diffNames, select, name, options, list, selected, 1);
- }
-
- /**
- * Description of the Method
- *
- * @param diffNames
- * Description of the Parameter
- * @param select
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param name
- * Description of the Parameter
- * @param options
- * Description of the Parameter
- * @param list
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param selected
- * Description of the Parameter
- * @param rowsShowing
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Select makeSelect(boolean diffNames, Select select, String name, Vector options,
- String[] list, String selected, int rowsShowing)
- {
-
- if (select == null)
- {
-
- select = new Select(name);
-
- if (diffNames)
- {
-
- for (int loop = 0; loop < list.length; loop += 2)
- {
-
- String value = list[loop];
-
- String label = list[loop + 1];
-
- Option o = new Option(value);
-
- if (loop == 0)
- {
-
- o.setSelected(true);
-
- }
-
- options.addElement(o);// add to Vector containing all options
-
- select.addElement(o);
-
- select.addElement(label);
-
- }
-
- }
-
- else
- {
-
- for (int loop = 0; loop < list.length; loop++)
- {
-
- String value = list[loop];
-
- org.apache.ecs.html.Option o = new org.apache.ecs.html.Option(value);
-
- if (loop == 0)
- {
-
- o.setSelected(true);
-
- }
-
- options.addElement(o);// add to Vector containing all options
-
- select.addElement(o);
-
- select.addElement(value);
-
- }
-
- }
-
- }
-
- // find selected option and set selected
-
- Iterator i = options.iterator();
-
- while (i.hasNext())
- {
-
- org.apache.ecs.html.Option o = (org.apache.ecs.html.Option) i.next();
-
- if (selected.equalsIgnoreCase(o.getAttribute("value")))
- {
-
- o.setSelected(true);
-
- }
-
- }
-
- select.setSize(rowsShowing);
-
- return (select);
- }
-
- /**
- * Description of the Method
- *
- * @param title
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element makeTallHeader(String title)
- {
- StringBuffer buff = new StringBuffer();
- for (int i = 0; i < title.length(); i++)
- {
- buff.append(title.charAt(i));
- buff.append("Aspect Security
- * @since November 4, 2003
- * @version $Id: $Id
- */
-public class ErrorScreen extends Screen
-{
- /**
- * Description of the Field
- */
- protected Throwable error;
-
- /**
- * Description of the Field
- */
- protected String message;
-
- /**
- * Constructor for the ErrorScreen object
- *
- * @param s
- * Description of the Parameter
- * @param t
- * Description of the Parameter
- */
- public ErrorScreen(WebSession s, Throwable t)
- {
- this.error = t;
- fixCurrentScreen(s);
- setup(s);
- }
-
- /**
- * Constructor for the ErrorScreen object
- *
- * @param s
- * Description of the Parameter
- * @param msg
- * Description of the Parameter
- */
- public ErrorScreen(WebSession s, String msg)
- {
- this.message = msg;
- fixCurrentScreen(s);
- setup(s);
- }
-
- /**
- * fixCurrentScreen.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public void fixCurrentScreen(WebSession s)
- {
- // So the user can't get stuck on the error screen, reset the
- // current screen to something known
- if (s != null)
- {
- try
- {
- s.setCurrentScreen(s.getCourse().getFirstLesson().getScreenId());
- } catch (Throwable t)
- {
- s.setCurrentScreen(WebSession.WELCOME);
- }
- }
- }
-
- /**
- * setup.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public void setup(WebSession s)
- {
- // call createContent first so messages will go somewhere
-
- Form form = new Form("attack", Form.POST).setName("form").setEncType("");
-
- form.addElement(wrapForm(s));
-
- TD lowerright = new TD().setHeight("100%").setVAlign("top").setAlign("left").addElement(form);
- TR row = new TR().addElement(lowerright);
- Table layout = new Table().setBgColor(HtmlColor.WHITE).setCellSpacing(0).setCellPadding(0).setBorder(0);
-
- layout.addElement(row);
-
- setContent(layout);
- }
-
- /**
- * wrapForm.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link org.apache.ecs.Element} object.
- */
- protected Element wrapForm(WebSession s)
- {
- if (s == null) { return new StringElement("Invalid Session"); }
-
- Table container = new Table().setWidth("100%").setCellSpacing(10).setCellPadding(0).setBorder(0);
-
- // CreateContent can generate error messages so you MUST call it before makeMessages()
- Element content = createContent(s);
- container.addElement(new TR().addElement(new TD().setColSpan(2).setVAlign("TOP").addElement(makeMessages(s))));
- container.addElement(new TR().addElement(new TD().setColSpan(2).addElement(content)));
- container.addElement(new TR());
-
- return (container);
- }
-
- /**
- * {@inheritDoc}
- *
- * Description of the Method
- */
- protected Element createContent(WebSession s)
- {
- System.out.println("errorscreen createContent Error:" + this.error + " message:" + this.message);
-
- Element content;
-
- if (this.error != null)
- {
- content = createContent(this.error);
- }
- else if (this.message != null)
- {
- content = createContent(this.message);
- }
- else
- {
- content = new StringElement("An unknown error occurred.");
- }
-
- return content;
- }
-
- /**
- * Description of the Method
- *
- * @param s
- * Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element createContent(String s)
- {
- StringElement list = new StringElement(s);
-
- return (list);
- }
-
- /**
- * Description of the Method
- *
- * @param t
- * Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element createContent(Throwable t)
- {
- StringElement list = new StringElement();
- list.addElement(new H2().addElement(new StringElement("Error Message: " + t.getMessage())));
- list.addElement(formatStackTrace(t));
-
- if (t instanceof ServletException)
- {
- Throwable root = ((ServletException) t).getRootCause();
-
- if (root != null)
- {
- list.addElement(new H2().addElement(new StringElement("Root Message: " + root.getMessage())));
- list.addElement(formatStackTrace(root));
- }
- }
-
- return (new Small().addElement(list));
- }
-
- /**
- * Description of the Method
- *
- * @param t
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static Element formatStackTrace(Throwable t)
- {
- String trace = getStackTrace(t);
- StringElement list = new StringElement();
- StringTokenizer st = new StringTokenizer(trace, "\r\n\t");
-
- while (st.hasMoreTokens())
- {
- String line = st.nextToken();
- list.addElement(new Div(line));
- }
-
- return (list);
- }
-
- /**
- * Gets the stackTrace attribute of the ErrorScreen class
- *
- * @param t
- * Description of the Parameter
- * @return The stackTrace value
- */
- public static String getStackTrace(Throwable t)
- {
- ByteArrayOutputStream bytes = new ByteArrayOutputStream();
- PrintWriter writer = new PrintWriter(bytes, true);
- t.printStackTrace(writer);
-
- return (bytes.toString());
- }
-
- /**
- * Gets the title attribute of the ErrorScreen object
- *
- * @return The title value
- */
- public String getTitle()
- {
- return ("Error");
- }
-
- /**
- * getRole.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getRole()
- {
- return AbstractLesson.USER_ROLE;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonSession.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonSession.java
deleted file mode 100644
index 674ba0618..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonSession.java
+++ /dev/null
@@ -1,83 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * Represents a virtual session for a lesson. Lesson-specific session data may be stored here.
- *
- * @author David Anderson Aspect Security
- * @since January 19, 2006
- * @version $Id: $Id
- */
-public class LessonSession
-{
-
- private boolean isAuthenticated = false;
-
- private String currentLessonScreen;
-
- /**
- * setAuthenticated.
- *
- * @param isAuthenticated a boolean.
- */
- public void setAuthenticated(boolean isAuthenticated)
- {
- this.isAuthenticated = isAuthenticated;
- }
-
- /**
- * isAuthenticated.
- *
- * @return a boolean.
- */
- public boolean isAuthenticated()
- {
- return this.isAuthenticated;
- }
-
- /**
- * Setter for the field currentLessonScreen.
- *
- * @param currentLessonScreen a {@link java.lang.String} object.
- */
- public void setCurrentLessonScreen(String currentLessonScreen)
- {
- this.currentLessonScreen = currentLessonScreen;
- }
-
- /**
- * Getter for the field currentLessonScreen.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getCurrentLessonScreen()
- {
- return this.currentLessonScreen;
- }
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonTracker.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonTracker.java
index 1d4196781..9b7b0371e 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonTracker.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/LessonTracker.java
@@ -1,435 +1,329 @@
package org.owasp.webgoat.session;
+import lombok.extern.slf4j.Slf4j;
+
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
+import java.io.IOException;
import java.util.Properties;
/**
- *************************************************************************************************
- *
- *
+ * ************************************************************************************************
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
*
* @author Bruce Mayhew WebGoat
- * @since October 29, 2003
* @version $Id: $Id
+ * @since October 29, 2003
*/
-public class LessonTracker
-{
+@Slf4j
+public class LessonTracker {
- private boolean completed = false;
+ private boolean completed = false;
- private int maxHintLevel = 0;
+ private int maxHintLevel = 0;
- private int numVisits = 0;
+ private int numVisits = 0;
- private boolean viewedCookies = false;
+ private boolean viewedCookies = false;
- private boolean viewedHtml = false;
+ private boolean viewedHtml = false;
- private boolean viewedLessonPlan = false;
+ private boolean viewedLessonPlan = false;
- private boolean viewedParameters = false;
+ private boolean viewedParameters = false;
- private boolean viewedSource = false;
+ private boolean viewedSource = false;
- private boolean viewedSolution = false;
+ private boolean viewedSolution = false;
- Properties lessonProperties = new Properties();
+ Properties lessonProperties = new Properties();
- /**
- * Gets the completed attribute of the LessonTracker object
- *
- * @return The completed value
- */
- public boolean getCompleted()
- {
- return completed;
- }
+ private int totalNumberOfAssignments = 0;
- /**
- * Gets the maxHintLevel attribute of the LessonTracker object
- *
- * @return The maxHintLevel value
- */
- public int getMaxHintLevel()
- {
- return maxHintLevel;
- }
+ public void setTotalNumberOfAssignments(int totalNumberOfAssignments) {
+ this.totalNumberOfAssignments = totalNumberOfAssignments;
+ }
- /**
- * Gets the numVisits attribute of the LessonTracker object
- *
- * @return The numVisits value
- */
- public int getNumVisits()
- {
- return numVisits;
- }
+ /**
+ * Gets the completed attribute of the LessonTracker object
+ *
+ * @return The completed value
+ */
+ public boolean getCompleted() {
+ return completed;
+ }
- /**
- * Gets the viewedCookies attribute of the LessonTracker object
- *
- * @return The viewedCookies value
- */
- public boolean getViewedCookies()
- {
- return viewedCookies;
- }
+ /**
+ * Gets the maxHintLevel attribute of the LessonTracker object
+ *
+ * @return The maxHintLevel value
+ */
+ public int getMaxHintLevel() {
+ return maxHintLevel;
+ }
- /**
- * Gets the viewedHtml attribute of the LessonTracker object
- *
- * @return The viewedHtml value
- */
- public boolean getViewedHtml()
- {
- return viewedHtml;
- }
+ /**
+ * Gets the numVisits attribute of the LessonTracker object
+ *
+ * @return The numVisits value
+ */
+ public int getNumVisits() {
+ return numVisits;
+ }
- /**
- * Gets the viewedLessonPlan attribute of the LessonTracker object
- *
- * @return The viewedLessonPlan value
- */
- public boolean getViewedLessonPlan()
- {
- return viewedLessonPlan;
- }
+ /**
+ * Gets the viewedCookies attribute of the LessonTracker object
+ *
+ * @return The viewedCookies value
+ */
+ public boolean getViewedCookies() {
+ return viewedCookies;
+ }
- /**
- * Gets the viewedParameters attribute of the LessonTracker object
- *
- * @return The viewedParameters value
- */
- public boolean getViewedParameters()
- {
- return viewedParameters;
- }
+ /**
+ * Gets the viewedHtml attribute of the LessonTracker object
+ *
+ * @return The viewedHtml value
+ */
+ public boolean getViewedHtml() {
+ return viewedHtml;
+ }
- /**
- * Gets the viewedSource attribute of the LessonTracker object
- *
- * @return The viewedSource value
- */
- public boolean getViewedSource()
- {
- return viewedSource;
- }
+ /**
+ * Gets the viewedLessonPlan attribute of the LessonTracker object
+ *
+ * @return The viewedLessonPlan value
+ */
+ public boolean getViewedLessonPlan() {
+ return viewedLessonPlan;
+ }
- /**
- *
Getter for the field viewedSolution.
- *
- * @return a boolean.
- */
- public boolean getViewedSolution()
- {
- return viewedSource;
- }
+ /**
+ * Gets the viewedParameters attribute of the LessonTracker object
+ *
+ * @return The viewedParameters value
+ */
+ public boolean getViewedParameters() {
+ return viewedParameters;
+ }
- /**
- * Description of the Method
- */
- public void incrementNumVisits()
- {
- numVisits++;
- }
+ /**
+ * Gets the viewedSource attribute of the LessonTracker object
+ *
+ * @return The viewedSource value
+ */
+ public boolean getViewedSource() {
+ return viewedSource;
+ }
- /**
- * Sets the properties attribute of the LessonTracker object
- *
- * @param props
- * The new properties value
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- */
- protected void setProperties(Properties props, Screen screen)
- {
- completed = Boolean.valueOf(props.getProperty(screen.getTitle() + ".completed")).booleanValue();
- maxHintLevel = Integer.parseInt(props.getProperty(screen.getTitle() + ".maxHintLevel", "0"));
- numVisits = Integer.parseInt(props.getProperty(screen.getTitle() + ".numVisits", "0"));
- viewedCookies = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedCookies", "false")).booleanValue();
- viewedHtml = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedHtml", "false")).booleanValue();
- viewedLessonPlan = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedLessonPlan", "false")).booleanValue();
- viewedParameters = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedParameters", "false")).booleanValue();
- viewedSource = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedSource", "false")).booleanValue();
- }
+ /**
+ * Getter for the field viewedSolution.
+ *
+ * @return a boolean.
+ */
+ public boolean getViewedSolution() {
+ return viewedSource;
+ }
- /**
- * getUserDir.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @return a {@link java.lang.String} object.
- */
- public static String getUserDir(WebSession s)
- {
- return s.getContext().getRealPath("users") + "/";
- }
+ /**
+ * Description of the Method
+ */
+ public void incrementNumVisits() {
+ numVisits++;
+ }
- private static String getTrackerFile(WebSession s, String user, Screen screen)
- {
- return getUserDir(s) + user + "." + screen.getClass().getName() + ".props";
- }
- /**
- * Description of the Method
- *
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param s
- * Description of the Parameter
- * @return Description of the Return Value
- * @param user a {@link java.lang.String} object.
- */
- public static LessonTracker load(WebSession s, String user, Screen screen)
- {
- FileInputStream in = null;
- try
- {
- String fileName = getTrackerFile(s, user, screen);
- if (fileName != null)
- {
- Properties tempProps = new Properties();
- // System.out.println("Loading lesson state from: " + fileName);
- in = new FileInputStream(fileName);
- tempProps.load(in);
- // allow the screen to use any custom properties it may have set
- LessonTracker tempLessonTracker = screen.createLessonTracker(tempProps);
- tempLessonTracker.setProperties(tempProps, screen);
- return tempLessonTracker;
- }
- } catch (FileNotFoundException e)
- {
- // Normal if the lesson has not been accessed yet.
- } catch (Exception e)
- {
- System.out.println("Failed to load lesson state for " + screen);
- e.printStackTrace();
- } finally
- {
- try
- {
- in.close();
- } catch (Exception e)
- {
- }
- }
+ /**
+ * Sets the properties attribute of the LessonTracker object
+ *
+ * @param props The new properties value
+ * @param screen a {@link org.owasp.webgoat.session.Screen} object.
+ */
+ protected void setProperties(Properties props, Screen screen) {
+ completed = Boolean.valueOf(props.getProperty(screen.getTitle() + ".completed")).booleanValue();
+ maxHintLevel = Integer.parseInt(props.getProperty(screen.getTitle() + ".maxHintLevel", "0"));
+ numVisits = Integer.parseInt(props.getProperty(screen.getTitle() + ".numVisits", "0"));
+ viewedCookies = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedCookies", "false")).booleanValue();
+ viewedHtml = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedHtml", "false")).booleanValue();
+ viewedLessonPlan = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedLessonPlan", "false")).booleanValue();
+ viewedParameters = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedParameters", "false")).booleanValue();
+ viewedSource = Boolean.valueOf(props.getProperty(screen.getTitle() + ".viewedSource", "false")).booleanValue();
+ totalNumberOfAssignments = Integer.parseInt(props.getProperty(screen.getTitle() + ".totalNumberOfAssignments", "0"));
+ }
- return screen.createLessonTracker();
- }
+ /**
+ * getUserDir.
+ *
+ * @param s a {@link org.owasp.webgoat.session.WebSession} object.
+ * @return a {@link java.lang.String} object.
+ */
+ public static String getUserDir(WebSession s) {
+ return "";
+ }
- /**
- * Sets the completed attribute of the LessonTracker object
- *
- * @param completed
- * The new completed value
- */
- public void setCompleted(boolean completed)
- {
- this.completed = completed;
- }
+ private static String getTrackerFile(WebSession s, String user, Screen screen) {
+ return getUserDir(s) + user + "." + screen.getClass().getName() + ".props";
+ }
- /**
- * Sets the maxHintLevel attribute of the LessonTracker object
- *
- * @param maxHintLevel
- * The new maxHintLevel value
- */
- public void setMaxHintLevel(int maxHintLevel)
- {
- this.maxHintLevel = Math.max(this.maxHintLevel, maxHintLevel);
- }
+ /**
+ * Description of the Method
+ *
+ * @param screen Description of the Parameter
+ * @param screen Description of the Parameter
+ * @param screen Description of the Parameter
+ * @param screen Description of the Parameter
+ * @param screen Description of the Parameter
+ * @param screen Description of the Parameter
+ * @param s Description of the Parameter
+ * @param user a {@link java.lang.String} object.
+ * @return Description of the Return Value
+ */
+ public static LessonTracker load(WebSession s, String user, Screen screen) {
+ FileInputStream in = null;
+ try {
+ String fileName = getTrackerFile(s, user, screen);
+ if (fileName != null) {
+ Properties tempProps = new Properties();
+ // System.out.println("Loading lesson state from: " + fileName);
+ in = new FileInputStream(fileName);
+ tempProps.load(in);
+ // allow the screen to use any custom properties it may have set
+ LessonTracker tempLessonTracker = new LessonTracker();
+ tempLessonTracker.setProperties(tempProps, screen);
+ return tempLessonTracker;
+ }
+ } catch (FileNotFoundException e) {
+ // Normal if the lesson has not been accessed yet.
+ } catch (Exception e) {
+ System.out.println("Failed to load lesson state for " + screen);
+ e.printStackTrace();
+ } finally {
+ try {
+ in.close();
+ } catch (Exception e) {
+ }
+ }
- /**
- * Sets the viewedCookies attribute of the LessonTracker object
- *
- * @param viewedCookies
- * The new viewedCookies value
- */
- public void setViewedCookies(boolean viewedCookies)
- {
- this.viewedCookies = viewedCookies;
- }
+ return new LessonTracker();
+ }
- /**
- * Sets the viewedHtml attribute of the LessonTracker object
- *
- * @param viewedHtml
- * The new viewedHtml value
- */
- public void setViewedHtml(boolean viewedHtml)
- {
- this.viewedHtml = viewedHtml;
- }
+ /**
+ * Sets the completed attribute of the LessonTracker object
+ *
+ * @param completed The new completed value
+ */
+ public void setCompleted(boolean completed) {
+ this.completed = completed;
+ }
- /**
- * Sets the viewedLessonPlan attribute of the LessonTracker object
- *
- * @param viewedLessonPlan
- * The new viewedLessonPlan value
- */
- public void setViewedLessonPlan(boolean viewedLessonPlan)
- {
- this.viewedLessonPlan = viewedLessonPlan;
- }
+ /**
+ * Sets the maxHintLevel attribute of the LessonTracker object
+ *
+ * @param maxHintLevel The new maxHintLevel value
+ */
+ public void setMaxHintLevel(int maxHintLevel) {
+ this.maxHintLevel = Math.max(this.maxHintLevel, maxHintLevel);
+ }
- /**
- * Sets the viewedParameters attribute of the LessonTracker object
- *
- * @param viewedParameters
- * The new viewedParameters value
- */
- public void setViewedParameters(boolean viewedParameters)
- {
- this.viewedParameters = viewedParameters;
- }
+ /**
+ * Allows the storing of properties for the logged in and a screen.
+ *
+ * @param s Description of the Parameter
+ * @param screen a {@link org.owasp.webgoat.session.Screen} object.
+ * @param screen a {@link org.owasp.webgoat.session.Screen} object.
+ */
+ public void store(WebSession s, Screen screen) {
+ store(s, screen, s.getUserName());
+ }
- /**
- * Sets the viewedSource attribute of the LessonTracker object
- *
- * @param viewedSource
- * The new viewedSource value
- */
- public void setViewedSource(boolean viewedSource)
- {
- this.viewedSource = viewedSource;
- }
+ /**
+ * Allows the storing of properties for a user and a screen.
+ *
+ * @param s Description of the Parameter
+ * @param screen a {@link org.owasp.webgoat.session.Screen} object.
+ * @param screen a {@link org.owasp.webgoat.session.Screen} object.
+ * @param user a {@link java.lang.String} object.
+ */
+ public void store(WebSession s, Screen screen, String user) {
- /**
- * Sets the viewedSource attribute of the LessonTracker object
- *
- * @param viewedSolution a boolean.
- */
- public void setViewedSolution(boolean viewedSolution)
- {
- this.viewedSolution = viewedSolution;
- }
+ String fileName = getTrackerFile(s, user, screen);
+ // System.out.println( "Storing data to" + fileName );
+ lessonProperties.setProperty(screen.getTitle() + ".completed", Boolean.toString(completed));
+ lessonProperties.setProperty(screen.getTitle() + ".maxHintLevel", Integer.toString(maxHintLevel));
+ lessonProperties.setProperty(screen.getTitle() + ".numVisits", Integer.toString(numVisits));
+ lessonProperties.setProperty(screen.getTitle() + ".viewedCookies", Boolean.toString(viewedCookies));
+ lessonProperties.setProperty(screen.getTitle() + ".viewedHtml", Boolean.toString(viewedHtml));
+ lessonProperties.setProperty(screen.getTitle() + ".viewedLessonPlan", Boolean.toString(viewedLessonPlan));
+ lessonProperties.setProperty(screen.getTitle() + ".viewedParameters", Boolean.toString(viewedParameters));
+ lessonProperties.setProperty(screen.getTitle() + ".viewedSource", Boolean.toString(viewedSource));
+ lessonProperties.setProperty(screen.getTitle() + ".totalNumberOfAssignments", Integer.toString(totalNumberOfAssignments));
+ try (FileOutputStream out = new FileOutputStream(fileName)) {
+ lessonProperties.store(out, s.getUserName());
+ } catch (IOException e) {
+ log.warn("Warning User data for {} will not persist", s.getUserName());
+ }
+ }
- /**
- * Allows the storing of properties for the logged in and a screen.
- *
- * @param s
- * Description of the Parameter
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- */
- public void store(WebSession s, Screen screen)
- {
- store(s, screen, s.getUserName());
- }
+ /**
+ * Description of the Method
+ *
+ * @return Description of the Return Value
+ */
+ public String toString() {
+ StringBuffer buff = new StringBuffer();
+ buff.append("LessonTracker:" + "\n");
+ buff.append(" - completed:................. " + completed + "\n");
+ buff.append(" - maxHintLevel:.............. " + maxHintLevel + "\n");
+ buff.append(" - numVisits:................. " + numVisits + "\n");
+ buff.append(" - viewedCookies:............. " + viewedCookies + "\n");
+ buff.append(" - viewedHtml:................ " + viewedHtml + "\n");
+ buff.append(" - viewedLessonPlan:.......... " + viewedLessonPlan + "\n");
+ buff.append(" - viewedParameters:.......... " + viewedParameters + "\n");
+ buff.append(" - viewedSource:.............. " + viewedSource + "\n" + "\n");
+ buff.append(" - totalNumberOfAssignments:.. " + viewedSource + "\n" + "\n");
+ return buff.toString();
+ }
- /**
- * Allows the storing of properties for a user and a screen.
- *
- * @param s
- * Description of the Parameter
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- * @param user a {@link java.lang.String} object.
- */
- public void store(WebSession s, Screen screen, String user)
- {
- FileOutputStream out = null;
- String fileName = getTrackerFile(s, user, screen);
- // System.out.println( "Storing data to" + fileName );
- lessonProperties.setProperty(screen.getTitle() + ".completed", Boolean.toString(completed));
- lessonProperties.setProperty(screen.getTitle() + ".maxHintLevel", Integer.toString(maxHintLevel));
- lessonProperties.setProperty(screen.getTitle() + ".numVisits", Integer.toString(numVisits));
- lessonProperties.setProperty(screen.getTitle() + ".viewedCookies", Boolean.toString(viewedCookies));
- lessonProperties.setProperty(screen.getTitle() + ".viewedHtml", Boolean.toString(viewedHtml));
- lessonProperties.setProperty(screen.getTitle() + ".viewedLessonPlan", Boolean.toString(viewedLessonPlan));
- lessonProperties.setProperty(screen.getTitle() + ".viewedParameters", Boolean.toString(viewedParameters));
- lessonProperties.setProperty(screen.getTitle() + ".viewedSource", Boolean.toString(viewedSource));
- try
- {
- out = new FileOutputStream(fileName);
- lessonProperties.store(out, s.getUserName());
- } catch (Exception e)
- {
- // what do we want to do, I think nothing.
- System.out.println("Warning User data for " + s.getUserName() + " will not persist");
- } finally
- {
- try
- {
- out.close();
- } catch (Exception e)
- {
- }
- }
+ /**
+ * Getter for the field lessonProperties.
+ *
+ * @return Returns the lessonProperties.
+ */
+ public Properties getLessonProperties() {
+ return lessonProperties;
+ }
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- public String toString()
- {
- StringBuffer buff = new StringBuffer();
- buff.append("LessonTracker:" + "\n");
- buff.append(" - completed:.......... " + completed + "\n");
- buff.append(" - maxHintLevel:....... " + maxHintLevel + "\n");
- buff.append(" - numVisits:.......... " + numVisits + "\n");
- buff.append(" - viewedCookies:...... " + viewedCookies + "\n");
- buff.append(" - viewedHtml:......... " + viewedHtml + "\n");
- buff.append(" - viewedLessonPlan:... " + viewedLessonPlan + "\n");
- buff.append(" - viewedParameters:... " + viewedParameters + "\n");
- buff.append(" - viewedSource:....... " + viewedSource + "\n" + "\n");
- return buff.toString();
- }
-
- /**
- * Getter for the field lessonProperties.
- *
- * @return Returns the lessonProperties.
- */
- public Properties getLessonProperties()
- {
- return lessonProperties;
- }
-
- /**
- * Setter for the field lessonProperties.
- *
- * @param lessonProperties
- * The lessonProperties to set.
- */
- public void setLessonProperties(Properties lessonProperties)
- {
- this.lessonProperties = lessonProperties;
- }
+ /**
+ * Setter for the field lessonProperties.
+ *
+ * @param lessonProperties The lessonProperties to set.
+ */
+ public void setLessonProperties(Properties lessonProperties) {
+ this.lessonProperties = lessonProperties;
+ }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/Parameter.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/Parameter.java
deleted file mode 100644
index 51191bdf2..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/Parameter.java
+++ /dev/null
@@ -1,111 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class Parameter implements Comparable
-{
-
- String name;
-
- String value;
-
- /**
- * Constructor for Parameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param value a {@link java.lang.String} object.
- */
- public Parameter(String name, String value)
- {
- this.name = name;
- this.value = value;
- }
-
- /**
- * Getter for the field name.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getName()
- {
- return name;
- }
-
- /**
- * Getter for the field value.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getValue()
- {
- return value;
- }
-
- // @Override
- /** {@inheritDoc} */
- public boolean equals(Object obj)
- {
- if (obj instanceof Parameter)
- {
- Parameter other = (Parameter) obj;
- return (name.equals(other.getName()) && value.equals(other.getValue()));
- }
- return false;
- }
-
- // @Override
- /**
- * hashCode.
- *
- * @return a int.
- */
- public int hashCode()
- {
- return toString().hashCode();
- }
-
- // @Override
- /**
- * toString.
- *
- * @return a {@link java.lang.String} object.
- */
- public String toString()
- {
- return (name + "=" + value);
- }
-
- /** {@inheritDoc} */
- public int compareTo(Object o)
- {
- return toString().compareTo(o.toString());
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterNotFoundException.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterNotFoundException.java
deleted file mode 100644
index d4eefdfd2..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterNotFoundException.java
+++ /dev/null
@@ -1,59 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @author Jeff Williams Aspect Security
- * @version $Id: $Id
- */
-public class ParameterNotFoundException extends Exception
-{
-
- /**
- *
- */
- private static final long serialVersionUID = 3286112913299408382L;
-
- /**
- * Constructs a new ParameterNotFoundException with no detail message.
- */
- public ParameterNotFoundException()
- {
- super();
- }
-
- /**
- * Constructs a new ParameterNotFoundException with the specified detail message.
- *
- * @param s
- * the detail message
- */
- public ParameterNotFoundException(String s)
- {
- super(s);
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterParser.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterParser.java
deleted file mode 100644
index f0ac0b3f6..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/ParameterParser.java
+++ /dev/null
@@ -1,1010 +0,0 @@
-package org.owasp.webgoat.session;
-
-import java.util.Enumeration;
-import java.util.StringTokenizer;
-import java.util.Vector;
-import java.util.regex.Pattern;
-import javax.servlet.ServletRequest;
-import org.owasp.webgoat.util.HtmlEncoder;
-
-/**
- * *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project
- * utility. For details, please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; either version 2 of the License, or (at your option) any later
- * version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
- * for free software projects.
- *
- * @author Jeff Williams Aspect Security
- * @version $Id: $Id
- */
-public class ParameterParser {
-
- private final static String ALLOWED_CHARACTERS = "_$()-?.@!,:;=//+"; // Don't
- // allow
- // #&
- // specifically
-
- private ServletRequest request;
-
- /**
- * Constructs a new ParameterParser to handle the parameters of the given
- * request.
- *
- * @param request the servlet request
- */
- public ParameterParser(ServletRequest request) {
- this.request = request;
- }
-
- /**
- * Description of the Method
- *
- * @param s Description of the Parameter
- * @return Description of the Return Value
- */
- private String clean(String s) {
- StringBuffer clean = new StringBuffer();
-
- for (int loop = 0; loop < s.length(); loop++) {
- char c = s.charAt(loop);
-
- if (Character.isLetterOrDigit(c) || Character.isWhitespace(c) || (ALLOWED_CHARACTERS.indexOf(c) != -1)) {
- clean.append(c);
- } else {
- clean.append('.');
- }
- }
-
- return (clean.toString());
- }
-
- /**
- * Gets the named parameter value as a boolean
- *
- * @param name the parameter name
- * @return the parameter value as a boolean
- * @exception ParameterNotFoundException if the parameter was not found
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public boolean getBooleanParameter(String name) throws ParameterNotFoundException {
- return new Boolean(getStringParameter(name)).booleanValue();
- }
-
- /**
- * Gets the named parameter value as a boolean, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a boolean, or the default
- */
- public boolean getBooleanParameter(String name, boolean def) {
- try {
- return getBooleanParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the booleanSubParameter attribute of the ParameterParser object
- *
- * @param first Description of the Parameter
- * @param next Description of the Parameter
- * @param def Description of the Parameter
- * @return The booleanSubParameter value
- */
- public boolean getBooleanSubParameter(String first, String next, boolean def) {
- try {
- return new Boolean(getSubParameter(first, next)).booleanValue();
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a byte
- *
- * @param name the parameter name
- * @return the parameter value as a byte
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter value could not be
- * converted to a byte
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public byte getByteParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return Byte.parseByte(getStringParameter(name));
- }
-
- /**
- * Gets the named parameter value as a byte, with a default. Returns the
- * default value if the parameter is not found or cannot be converted to a
- * byte.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a byte, or the default
- */
- public byte getByteParameter(String name, byte def) {
- try {
- return getByteParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a char
- *
- * @param name the parameter name
- * @return the parameter value as a char
- * @exception ParameterNotFoundException if the parameter was not found or
- * was the empty string
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public char getCharParameter(String name) throws ParameterNotFoundException {
- String param = getStringParameter(name);
-
- if (param.length() == 0) {
- throw new ParameterNotFoundException(name + " is empty string");
- } else {
- return (param.charAt(0));
- }
- }
-
- /**
- * Gets the named parameter value as a char, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a char, or the default
- */
- public char getCharParameter(String name, char def) {
- try {
- return getCharParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the classNameParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @return The classNameParameter value
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getClassNameParameter(String name) throws ParameterNotFoundException {
- String p = getStringParameter(name);
- StringTokenizer st = new StringTokenizer(p);
-
- return (st.nextToken().trim());
- }
-
- // FIXME: check for [a-zA-Z].([a-zA-Z])*
- /**
- * Gets the classNameParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @param def Description of the Parameter
- * @return The classNameParameter value
- */
- public String getClassNameParameter(String name, String def) {
- try {
- return getClassNameParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a double
- *
- * @param name the parameter name
- * @return the parameter value as a double
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter could not be converted
- * to a double
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public double getDoubleParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return new Double(getStringParameter(name)).doubleValue();
- }
-
- /**
- * Gets the named parameter value as a double, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a double, or the default
- */
- public double getDoubleParameter(String name, double def) {
- try {
- return getDoubleParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a float
- *
- * @param name the parameter name
- * @return the parameter value as a float
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter could not be converted
- * to a float
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public float getFloatParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return new Float(getStringParameter(name)).floatValue();
- }
-
- /**
- * Gets the named parameter value as a float, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a float, or the default
- */
- public float getFloatParameter(String name, float def) {
- try {
- return getFloatParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as an IP String, with a default. Returns
- * the default value if the parameter is not found or is the empty string.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a String, or the default
- */
- public String getIPParameter(String name, String def) {
- try {
- return getIPParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as an IP String
- *
- * @param name the parameter name
- * @return the parameter value as a valid IP String or an Empty string if
- * invalid
- * @exception ParameterNotFoundException if the parameter was not found or
- * was the empty string
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getIPParameter(String name) throws ParameterNotFoundException {
- boolean valid = true;
- String[] values = request.getParameterValues(name);
- String value;
-
- if (values == null) {
- throw new ParameterNotFoundException(name + " not found");
- } else if (values[0].length() == 0) {
- throw new ParameterNotFoundException(name + " was empty");
- } else {
- // trim illegal characters
- value = clean(values[0].trim());
-
- if (value.indexOf("&") > 0) {
- // truncate additional parameters that follow &
- value = value.substring(0, value.indexOf("&"));
- }
-
- // validate the IP ex: 124.143.12.254
- int startIndex = 0;
- int endIndex = 0;
- int octetCount = 0;
- int octetValue;
- String octet;
-
- // if no .'s then it's not an IP
- if (value.indexOf(".") >= 0) {
- while ((valid == true) && (octetCount < 4)) {
- endIndex = value.indexOf(".", startIndex);
-
- if (endIndex == -1) {
- endIndex = value.length();
- }
-
- octet = value.substring(startIndex, endIndex);
- startIndex = endIndex + 1;
-
- try {
- octetValue = Integer.parseInt(octet);
-
- if ((octetValue <= 0) || (octetValue >= 256)) {
- valid = false;
- }
- } catch (Exception e) {
- valid = false;
- }
-
- octetCount++;
- }
- } else {
- // Not a valid IP
- valid = false;
- }
-
- // Check for any extra garbage. If the last octet was a large value
- // it would be trapped by the above range check.
- if (value.length() != endIndex) {
- valid = false;
- }
-
- return valid ? value : null;
- }
- }
-
- /**
- * Gets the named parameter value as a int
- *
- * @param name the parameter name
- * @return the parameter value as a int
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter could not be converted
- * to a int
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public int getIntParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return Integer.parseInt(getStringParameter(name));
- }
-
- /**
- * Gets the named parameter value as a int, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a int, or the default
- */
- public int getIntParameter(String name, int def) {
- try {
- return getIntParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a long
- *
- * @param name the parameter name
- * @return the parameter value as a long
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter could not be converted
- * to a long
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public long getLongParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return Long.parseLong(getStringParameter(name));
- }
-
- /**
- * Gets the named parameter value as a long, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a long, or the default
- */
- public long getLongParameter(String name, long def) {
- try {
- return getLongParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Determines which of the required parameters were missing from the
- * request. Returns null if all the parameters are present.
- *
- * @param requestuired Description of the Parameter
- * @return an array of missing parameters, or null if none are missing
- */
- public String[] getMissingParameters(String[] requestuired) {
- Vector missing = new Vector();
-
- for (int i = 0; i < requestuired.length; i++) {
- String val = getStringParameter(requestuired[i], null);
-
- if (val == null) {
- missing.addElement(requestuired[i]);
- }
- }
-
- if (missing.size() == 0) {
- return null;
- } else {
- String[] ret = new String[missing.size()];
- missing.copyInto(ret);
-
- return ret;
- }
- }
-
- /**
- * Gets the parameterNames attribute of the ParameterParser object
- *
- * @return The parameterNames value
- */
- public Enumeration getParameterNames() {
- if (request == null) {
- return (null);
- }
-
- return request.getParameterNames();
- }
-
- /**
- * Gets the parameterValues attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @return The parameterValues value
- */
- public String[] getParameterValues(String name) {
- if (request == null) {
- return (null);
- }
-
- return request.getParameterValues(name);
- }
-
- /**
- * Gets the rawParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @param def Description of the Parameter
- * @return The rawParameter value
- */
- public String getRawParameter(String name, String def) {
- try {
- return getRawParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the rawParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @return The rawParameter value
- * @exception ParameterNotFoundException Description of the Exception
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getRawParameter(String name) throws ParameterNotFoundException {
- String[] values = request.getParameterValues(name);
-
- if (values == null) {
- throw new ParameterNotFoundException(name + " not found");
- } else if (values[0].length() == 0) {
- throw new ParameterNotFoundException(name + " was empty");
- }
-
- return (values[0]);
- }
-
- /**
- * Gets the named parameter value as a short
- *
- * @param name the parameter name
- * @return the parameter value as a short
- * @exception ParameterNotFoundException if the parameter was not found
- * @exception NumberFormatException if the parameter could not be converted
- * to a short
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws java.lang.NumberFormatException if any.
- */
- public short getShortParameter(String name) throws ParameterNotFoundException, NumberFormatException {
- return Short.parseShort(getStringParameter(name));
- }
-
- /**
- * Gets the named parameter value as a short, with a default. Returns the
- * default value if the parameter is not found.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a short, or the default
- */
- public short getShortParameter(String name, short def) {
- try {
- return getShortParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the named parameter value as a String
- *
- * @param name the parameter name
- * @return the parameter value as a String
- * @exception ParameterNotFoundException if the parameter was not found or
- * was the empty string
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getStringParameter(String name) throws ParameterNotFoundException {
- String[] values = request.getParameterValues(name);
- String value;
-
- if (values == null) {
- throw new ParameterNotFoundException(name + " not found");
- } else if (values[0].length() == 0) {
- throw new ParameterNotFoundException(name + " was empty");
- } else {
- // trim illegal characters
- value = clean(values[0].trim());
-
- if (value.indexOf("&") > 0) {
- // truncate additional parameters that follow &
- value = value.substring(0, value.indexOf("&"));
- }
-
- return value;
- }
- }
-
- /**
- * Gets the named parameter value as a String, with a default. Returns the
- * default value if the parameter is not found or is the empty string.
- *
- * @param name the parameter name
- * @param def the default parameter value
- * @return the parameter value as a String, or the default
- */
- public String getStringParameter(String name, String def) {
- try {
- return getStringParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the subParameter attribute of the ParameterParser object
- *
- * @param first Description of the Parameter
- * @param next Description of the Parameter
- * @param def Description of the Parameter
- * @return The subParameter value
- */
- public String getSubParameter(String first, String next, String def) {
- try {
- return getSubParameter(first, next);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the parameter named 'next' following the parameter 'first'. Presumes
- * the structure: first=firstvalue&next=nextValue
- *
- * @param first Description of the Parameter
- * @param next Description of the Parameter
- * @return The subParameter value
- * @exception ParameterNotFoundException Description of the Exception
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getSubParameter(String first, String next) throws ParameterNotFoundException {
- String[] values = request.getParameterValues(first);
- String value;
-
- if (values == null) {
- throw new ParameterNotFoundException(first + " not found");
- } else if (values[0].length() == 0) {
- throw new ParameterNotFoundException(first + " was empty");
- } else {
- value = clean(values[0].trim());
-
- int idx = value.indexOf("&") + 1;
-
- // index of first char of first sub-param name
- if (idx == 0) {
- throw new ParameterNotFoundException("No subparameter key");
- }
-
- value = value.substring(idx);
-
- // System.out.println("= = = = = =Parameter parser looking for " +
- // next + " in " + value );
- int nextValueIndex = value.indexOf(next + "=");
-
- // System.out.println("= = = = = =Parameter parser nextValueIndex =
- // " + nextValueIndex );
- if (nextValueIndex < 0) {
- throw new ParameterNotFoundException("No subparameter value");
- }
-
- nextValueIndex += (next.length() + 1);
-
- if (nextValueIndex >= 0) {
- value = value.substring(nextValueIndex);
- } else {
- throw new ParameterNotFoundException(next + " not found");
- }
- }
-
- if (value.indexOf("&") > 0) {
- // truncate additional parameters that follow &
- value = value.substring(0, value.indexOf("&"));
- }
-
- // System.out.println("=-=-=-=-=ParameterParser returning value " +
- // value );
- return value;
- }
-
- /**
- * Gets the wordParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @return The wordParameter value
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getWordParameter(String name) throws ParameterNotFoundException {
- String p = getStringParameter(name);
- StringTokenizer st = new StringTokenizer(p);
-
- return (st.nextToken().trim());
- }
-
- // FIXME: check for [a-zA-Z]
- /**
- * Gets the wordParameter attribute of the ParameterParser object
- *
- * @param name Description of the Parameter
- * @param def Description of the Parameter
- * @return The wordParameter value
- */
- public String getWordParameter(String name, String def) {
- try {
- return getWordParameter(name);
- } catch (Exception e) {
- return def;
- }
- }
-
- /**
- * Gets the specified parameter from the request and validates it against
- * the provided regular expression. If the regular expression check fails,
- * the default value is returned instead.
- *
- * @param name The name of the parameter to retrieve from the request.
- * @param def The default value of the parameter.
- * @param regexpattern The precompiled regular expression to be used to
- * validate the parameter.
- * @return The validated parameter value, or the default value if validation
- * failed.
- */
- private String getRegexParameter(String name, String def, Pattern regexpattern) throws ValidationException {
- try {
- return getRegexParameter(name, regexpattern);
- } catch (Exception e) {
- // System.out.println("Exception occured in defined pattern match");
- // e.printStackTrace();
- return def;
- }
- }
-
- /**
- * Gets the specified parameter from the request and validates it against
- * the provided regular expression. If the regular expression check fails,
- * the default value is returned instead.
- *
- * @param name The name of the parameter to retrieve from the request.
- * @param def The default value of the parameter.
- * @param regexpattern The precompiled regular expression to be used to
- * validate the parameter.
- * @return The validated parameter value, or the default value if validation
- * failed.
- */
- private String getRegexParameter(String name, Pattern regexpattern) throws ParameterNotFoundException,
- ValidationException {
- String param = getStringParameter(name);
-
- if (regexpattern.matcher(param).matches()) {
- return param;
- } else {
- // System.out.println(param + " didn't match defined pattern.");
- throw new ValidationException(name + " contained an invalid value");
- }
- }
-
- /**
- * getStrictAlphaParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param maxLength a int.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getStrictAlphaParameter(String name, int maxLength) throws ParameterNotFoundException,
- ValidationException {
- String alphaRegEx = "^[a-zA-Z\\s]{0," + maxLength + "}$";
- Pattern alphaPattern = Pattern.compile(alphaRegEx);
-
- return getRegexParameter(name, alphaPattern);
- }
-
- /**
- * getStrictNumericParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param maxLength a int.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getStrictNumericParameter(String name, int maxLength) throws ParameterNotFoundException,
- ValidationException {
- String numericRegEx = "^\\d{0," + maxLength + "}$";
- Pattern numericPattern = Pattern.compile(numericRegEx);
-
- return getRegexParameter(name, numericPattern);
- }
-
- private static final String SSNREGEX = "^\\d{3}-\\d{2}-\\d{4}$";
-
- private static final Pattern Ssnpattern = Pattern.compile(SSNREGEX);
-
- /**
- * getSsnParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getSsnParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getRegexParameter(name, Ssnpattern);
- }
-
- // Validates format for major brands of credit card.
- // private static final String CCNREGEX =
- // "^(?:(?4\\d{3})|(?5[1-5]\\d{2})|(?6011)|(?(?:3[68]\\d{2})|(?:30[0-5]\\d))|(?3[47]\\d{2}))([
- //-]?)(?(DinersClub)(?:\\d{6}\\1\\d{4})|(?(AmericanExpress)(?:\\d{6}\\1\\d{5})|(?:\\d{4}\\1\\d{4
- // }\\1\\d{4})))$";
- private static final String CCNREGEX = "^\\d{16}$";
-
- private static final Pattern Ccnpattern = Pattern.compile(CCNREGEX);
-
- /**
- * getCcnParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getCcnParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getRegexParameter(name, Ccnpattern);
- }
-
- private static final String ZIPREGEX = "^\\d{5}(-\\d{4})?$";
-
- private static final Pattern Zippattern = Pattern.compile(ZIPREGEX);
-
- /**
- * getZipParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getZipParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getZipParameter(name, null);
- }
-
- /**
- * getZipParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param def a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getZipParameter(String name, String def) throws ValidationException {
- return getRegexParameter(name, def, Zippattern);
- }
-
- private static final String PHONEREGEX = "^\\(?[\\d]{3}\\)?[\\s-]?[\\d]{3}[\\s-]?[\\d]{4}$";
-
- // Or this more forgiving pattern:
- // private static final String PHONEREGEX = "^([\\-()+ 0-9x])+$";
- private static final Pattern phonepattern = Pattern.compile(PHONEREGEX);
-
- /**
- * getPhoneParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getPhoneParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getPhoneParameter(name, null);
- }
-
- /**
- * getPhoneParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param def a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getPhoneParameter(String name, String def) throws ValidationException {
- return getRegexParameter(name, def, phonepattern);
- }
-
- private static final String EMAILREGEX = "^[\\w-]+(?:\\.[\\w-]+)*@(?:[\\w-]+\\.)+[a-zA-Z]{2,7}$";
-
- private static final Pattern emailpattern = Pattern.compile(EMAILREGEX);
-
- /**
- * getEMailParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getEMailParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getEMailParameter(name, null);
- }
-
- /**
- * getEMailParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param def a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getEMailParameter(String name, String def) throws ValidationException {
- return getRegexParameter(name, def, emailpattern);
- }
-
- private static final String DATEREGEX = "([\\/ .,:0-9a-zA-Z])+$";
-
- private static final Pattern datepattern = Pattern.compile(DATEREGEX);
-
- /**
- * getDateParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getDateParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getDateParameter(name, null);
- }
-
- /**
- * getDateParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param def a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getDateParameter(String name, String def) throws ValidationException {
- return getRegexParameter(name, def, datepattern);
- }
-
- private static final String URLREGEX = "^(((https?)://)([-()_.!~*';/?:@&=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$";
-
- private static final Pattern URLpattern = Pattern.compile(URLREGEX);
-
- /**
- * getURLParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getURLParameter(String name) throws ParameterNotFoundException, ValidationException {
- return getURLParameter(name, null);
- }
-
- /**
- * getURLParameter.
- *
- * @param name a {@link java.lang.String} object.
- * @param def a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ValidationException if any.
- */
- public String getURLParameter(String name, String def) throws ValidationException {
- return getRegexParameter(name, def, URLpattern);
- }
-
- /**
- * htmlEncode.
- *
- * @param s a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- */
- protected static String htmlEncode(String s) {
- return HtmlEncoder.encode(s);
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- public String toString() {
- StringBuffer s = new StringBuffer("[");
- Enumeration e = getParameterNames();
-
- while (e.hasMoreElements()) {
- String key = (String) e.nextElement();
- s.append(key + "=" + getParameterValues(key)[0]);
-
- // FIXME: Other values?
- if (e.hasMoreElements()) {
- s.append(",");
- }
- }
-
- s.append("]");
-
- return (s.toString());
- }
-
- /**
- * Description of the Method
- *
- * @param request Description of the Parameter
- */
- public void update(ServletRequest request) {
- this.request = request;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java
deleted file mode 100644
index 20df5902e..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/RandomLessonTracker.java
+++ /dev/null
@@ -1,165 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Properties;
-
-
-/**
- * RandomLessonTracker class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class RandomLessonTracker extends LessonTracker
-{
-
- private String[] stages;
-
- private String stage;
-
- private Map completed = new HashMap();
-
- /**
- * Constructor for RandomLessonTracker.
- *
- * @param stages an array of {@link java.lang.String} objects.
- */
- public RandomLessonTracker(String[] stages)
- {
- if (stages == null) stages = new String[0];
- this.stages = stages;
- }
-
- /**
- * Setter for the field stage.
- *
- * @param stage a {@link java.lang.String} object.
- */
- public void setStage(String stage)
- {
- this.stage = stage;
- }
-
- /**
- * Getter for the field stage.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getStage()
- {
- if (this.stage == null && stages.length > 0) return stages[0];
- return this.stage;
- }
-
- /**
- * setStageComplete.
- *
- * @param stage a {@link java.lang.String} object.
- * @param complete a boolean.
- */
- public void setStageComplete(String stage, boolean complete)
- {
- completed.put(stage, Boolean.valueOf(complete));
- if (!complete) return;
- int i = getStageNumber(stage);
- if (i < stages.length - 1) setStage(stages[i + 1]);
- }
-
- /**
- * getStageNumber.
- *
- * @param stage a {@link java.lang.String} object.
- * @return a int.
- */
- public int getStageNumber(String stage)
- {
- for (int i = 0; i < stages.length; i++)
- if (stages[i].equals(stage)) return i;
- return -1;
- }
-
- /**
- * hasCompleted.
- *
- * @param stage a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean hasCompleted(String stage)
- {
- Boolean complete = completed.get(stage);
- return complete == null ? false : complete.booleanValue();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean getCompleted()
- {
- for (int i = 0; i < stages.length; i++)
- if (!hasCompleted(stages[i])) return false;
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- public void setCompleted(boolean complete)
- {
- if (complete == true) throw new UnsupportedOperationException("Use individual stage completion instead");
- for (int i = 0; i < stages.length; i++)
- setStageComplete(stages[i], false);
- setStage(stages[0]);
- }
-
- /** {@inheritDoc} */
- protected void setProperties(Properties props, Screen screen)
- {
- super.setProperties(props, screen);
- for (int i = 0; i < stages.length; i++)
- {
- String p = props.getProperty(screen.getTitle() + "." + stages[i] + ".completed");
- if (p != null)
- {
- setStageComplete(stages[i], Boolean.valueOf(p));
- }
- }
- setStage(props.getProperty(screen.getTitle() + ".stage"));
- }
-
- /** {@inheritDoc} */
- public void store(WebSession s, Screen screen, String user)
- {
- for (int i = 0; i < stages.length; i++)
- {
- if (hasCompleted(stages[i]))
- {
- lessonProperties.setProperty(screen.getTitle() + "." + stages[i] + ".completed", Boolean.TRUE
- .toString());
- }
- else
- {
- lessonProperties.remove(screen.getTitle() + "." + stages[i] + ".completed");
- }
- }
- lessonProperties.setProperty(screen.getTitle() + ".stage", getStage());
- super.store(s, screen, user);
- }
-
- /**
- * toString.
- *
- * @return a {@link java.lang.String} object.
- */
- public String toString()
- {
- StringBuffer buff = new StringBuffer();
- buff.append(super.toString());
- for (int i = 0; i < stages.length; i++)
- {
- buff.append(" - completed " + stages[i] + " :....... " + hasCompleted(stages[i]) + "\n");
- }
- buff.append(" - currentStage:....... " + getStage() + "\n");
- return buff.toString();
- }
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/Role.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/Role.java
deleted file mode 100644
index 14ca60ab5..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/Role.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package org.owasp.webgoat.session;
-
-/**
- * Role class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class Role {
- private String rolename;
-
- /**
- * Constructor for Role.
- *
- * @param rolename a {@link java.lang.String} object.
- */
- public Role(String rolename) {
- this.rolename = rolename;
- }
-
- /**
- * Getter for the field rolename.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getRolename() {
- return this.rolename;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/Screen.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/Screen.java
index 852c3815c..fae5c7fe7 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/Screen.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/Screen.java
@@ -1,15 +1,5 @@
package org.owasp.webgoat.session;
-import java.io.PrintWriter;
-import java.util.Properties;
-import org.apache.ecs.Element;
-import org.apache.ecs.HtmlColor;
-import org.apache.ecs.StringElement;
-import org.apache.ecs.html.A;
-import org.apache.ecs.html.Font;
-import org.apache.ecs.html.IMG;
-import org.owasp.webgoat.lessons.AbstractLesson;
-
/**
* *************************************************************************************************
*
@@ -45,102 +35,12 @@ import org.owasp.webgoat.lessons.AbstractLesson;
*/
public abstract class Screen {
- /**
- * Description of the Field
- */
- public static int MAIN_SIZE = 375;
-
- // private Head head;
- private Element content;
-
- final static IMG logo = new IMG("images/aspectlogo-horizontal-small.jpg").setAlt("Aspect Security").setBorder(0)
- .setHspace(0).setVspace(0);
-
/**
* Constructor for the Screen object
*/
public Screen() {
}
- // FIXME: Each lesson should have a role assigned to it. Each user/student
- // should also have a role(s) assigned. The user would only be allowed
- // to see lessons that correspond to their role. Eventually these roles
- // will be stored in the internal database. The user will be able to hack
- // into the database and change their role. This will allow the user to
- // see the admin screens, once they figure out how to turn the admin switch on.
- /**
- * getRole.
- *
- * @return a {@link java.lang.String} object.
- */
- public abstract String getRole();
-
- /**
- * Description of the Method
- *
- * @param s Description of the Parameter
- * @return Description of the Return Value
- */
- protected abstract Element createContent(WebSession s);
-
-
- /**
- * Creates a new lessonTracker object.
- *
- * @param props The properties file that was used to persist the user data.
- * @return Description of the Return Value
- */
- public LessonTracker createLessonTracker(Properties props) {
-
- // If the lesson had any specialized properties in the user persisted properties,
- // now would be the time to pull them out.
- return createLessonTracker();
- }
-
- /**
- * This allows the screens to provide a custom LessonTracker object if
- * needed.
- *
- * @return Description of the Return Value
- */
- public LessonTracker createLessonTracker() {
- return new LessonTracker();
- }
-
- /**
- * Gets the lessonTracker attribute of the AbstractLesson object
- *
- * @return The lessonTracker value
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public LessonTracker getLessonTracker(WebSession s) {
- UserTracker userTracker = UserTracker.instance();
- return userTracker.getLessonTracker(s, this);
- }
-
- /**
- * getLessonTracker.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param userNameOverride a {@link java.lang.String} object.
- * @return a {@link org.owasp.webgoat.session.LessonTracker} object.
- */
- public LessonTracker getLessonTracker(WebSession s, String userNameOverride) {
- UserTracker userTracker = UserTracker.instance();
- return userTracker.getLessonTracker(s, userNameOverride, this);
- }
-
- /**
- * getLessonTracker.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- * @return a {@link org.owasp.webgoat.session.LessonTracker} object.
- */
- public LessonTracker getLessonTracker(WebSession s, AbstractLesson lesson) {
- UserTracker userTracker = UserTracker.instance();
- return userTracker.getLessonTracker(s, lesson);
- }
/**
* Fill in a descriptive title for this lesson
@@ -149,168 +49,5 @@ public abstract class Screen {
*/
public abstract String getTitle();
- /**
- * Setter for the field content.
- *
- * @param content a {@link org.apache.ecs.Element} object.
- */
- protected void setContent(Element content) {
- this.content = content;
- }
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- protected Element makeLogo() {
-
- return new A("http://www.aspectsecurity.com/webgoat.html", logo);
- }
-
- /**
- * getSponsor.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSponsor() {
- return "Aspect Security";
- }
-
- /**
- * getSponsorLogoResource.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSponsorLogoResource() {
- return "images/aspectlogo-horizontal-small.jpg";
- }
-
- /**
- * Description of the Method
- *
- * @param s Description of the Parameter
- * @return Description of the Return Value
- */
- protected Element makeMessages(WebSession s) {
-
- if (s == null) {
-
- return (new StringElement(""));
- }
-
- Font f = new Font().setColor(HtmlColor.RED);
-
- String message = s.getMessage();
-
- f.addElement(message);
-
- return (f);
- }
-
- /**
- * Returns the content length of the the html.
- *
- * @return a int.
- */
- public int getContentLength() {
- return getContent().length();
- }
-
- /**
- * Description of the Method
- *
- * @param out Description of the Parameter
- */
- public void output(PrintWriter out) {
-
- // format output -- then send to printwriter
- // otherwise we're doing way too much SSL encryption work
- out.print(getContent());
-
- }
-
- // hook all the links
- /**
- * Getter for the field content.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getContent() {
- //String makeAllAjax = "";
- // need to do this here as some of the lessons render forms after submission of an ajax form
- return (content == null) ? "" : content.toString();// + makeAllAjax;
- }
-
- /**
- * Description of the Method
- *
- * @param x Description of the Parameter
- * @return Description of the Return Value
- */
- protected static String pad(int x) {
-
- StringBuilder sb = new StringBuilder();
-
- if (x < 10) {
-
- sb.append(" ");
-
- }
-
- if (x < 100) {
-
- sb.append(" ");
-
- }
-
- sb.append(x);
-
- return (sb.toString());
- }
-
- /**
- * Description of the Method
- *
- * @param token Description of the Parameter
- * @return Description of the Return Value
- */
- protected static String convertMetachars(String token) {
-
- int mci = 0;
-
- /*
- * meta char array FIXME: Removed the conversion of whitespace " " to " " in order for
- * the html to be automatically wrapped in client browser. It is better to add line length
- * checking and only do " " conversion in lines that won't exceed screen size, say less
- * than 80 characters.
- */
- String[] metaChar = {"&", "<", ">", "\"", "\t", System.getProperty("line.separator")};
-
- String[] htmlCode = {"&", "<", ">", """, " ", "SequentialLessonTracker class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class SequentialLessonTracker extends LessonTracker
-{
-
- private int currentStage = 1;
-
- /**
- * getStage.
- *
- * @return a int.
- */
- public int getStage()
- {
- return currentStage;
- }
-
- /**
- * setStage.
- *
- * @param stage a int.
- */
- public void setStage(int stage)
- {
- currentStage = stage;
- }
-
- /** {@inheritDoc} */
- protected void setProperties(Properties props, Screen screen)
- {
- super.setProperties(props, screen);
- currentStage = Integer.parseInt(props.getProperty(screen.getTitle() + ".currentStage"));
- }
-
- /** {@inheritDoc} */
- public void store(WebSession s, Screen screen, String user)
- {
- lessonProperties.setProperty(screen.getTitle() + ".currentStage", Integer.toString(currentStage));
- super.store(s, screen, user);
- }
-
- /**
- * toString.
- *
- * @return a {@link java.lang.String} object.
- */
- public String toString()
- {
- return super.toString() + " - currentStage:....... " + currentStage + "\n";
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthenticatedException.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthenticatedException.java
deleted file mode 100644
index cab222bb0..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthenticatedException.java
+++ /dev/null
@@ -1,41 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class UnauthenticatedException extends Exception
-{
-
- /**
- *
- */
- private static final long serialVersionUID = 97865025446819061L;
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthorizedException.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthorizedException.java
deleted file mode 100644
index 5ccde9f57..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/UnauthorizedException.java
+++ /dev/null
@@ -1,41 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class UnauthorizedException extends Exception
-{
-
- /**
- *
- */
- private static final long serialVersionUID = 5245519486798464814L;
-
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/User.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/User.java
deleted file mode 100644
index a1ccea6d8..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/User.java
+++ /dev/null
@@ -1,52 +0,0 @@
-package org.owasp.webgoat.session;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-
-/**
- * User class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class User {
- private String username;
- private ArrayList roles;
-
- /**
- * Constructor for User.
- *
- * @param username a {@link java.lang.String} object.
- */
- public User(String username) {
- this.username = username;
- this.roles = new ArrayList();
- }
-
- /**
- * Getter for the field username.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getUsername() {
- return username;
- }
-
- /**
- * Getter for the field roles.
- *
- * @return a {@link java.util.Iterator} object.
- */
- public Iterator getRoles() {
- return roles.iterator();
- }
-
- /**
- * addRole.
- *
- * @param rolename a {@link java.lang.String} object.
- */
- public void addRole(String rolename) {
- roles.add(new Role(rolename));
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java
index 25867223c..09e542487 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java
@@ -1,9 +1,12 @@
package org.owasp.webgoat.session;
-import java.sql.*;
-import java.util.ArrayList;
-import java.util.Iterator;
import java.io.File;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
class UserDatabase {
private Connection userDB;
@@ -20,9 +23,6 @@ class UserDatabase {
private final String QUERY_ALL_ROLES_FOR_USERNAME = "SELECT rolename FROM roles, user_roles, users WHERE roles.id = user_roles.role_id AND user_roles.user_id = users.id AND users.username = ?;";
private final String QUERY_TABLE_COUNT = "SELECT count(id) AS count FROM table;";
- private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ?);";
- private final String DELETE_USER = "DELETE FROM users WHERE username = ?;";
-
/**
* Constructor for UserDatabase.
*/
@@ -101,42 +101,6 @@ class UserDatabase {
return count;
}
- /**
- * getUsers.
- *
- * @return a {@link java.util.Iterator} object.
- */
- public Iterator getUsers() {
- ArrayList users = new ArrayList();
- User currentUser;
- ResultSet userResults, roleResults;
-
- try {
- open();
- Statement statement = userDB.createStatement();
- PreparedStatement rolesForUsers = userDB.prepareStatement(QUERY_ALL_ROLES_FOR_USERNAME);
-
- userResults = statement.executeQuery(QUERY_ALL_USERS);
- while (userResults.next()) {
- currentUser = new User(userResults.getString("username"));
- rolesForUsers.setString(1, currentUser.getUsername());
- roleResults = rolesForUsers.executeQuery();
- while (roleResults.next()) {
- currentUser.addRole(roleResults.getString("rolename"));
- }
- roleResults.close();
- }
- rolesForUsers.close();
- userResults.close();
- close();
- } catch (SQLException e) {
- e.printStackTrace();
- users = new ArrayList();
- }
-
- return users.iterator();
- }
-
/**
* addRoleToUser.
*
@@ -160,46 +124,6 @@ class UserDatabase {
return true;
}
- /**
- * removeUser.
- *
- * @param user a {@link org.owasp.webgoat.session.User} object.
- * @return a boolean.
- */
- public boolean removeUser(User user) {
- return removeUser(user.getUsername());
- }
-
- /**
- * removeUser.
- *
- * @param username a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean removeUser(String username) {
- try {
- open();
-
- PreparedStatement deleteUserRoles = userDB.prepareStatement(DELETE_ALL_ROLES_FOR_USER);
- PreparedStatement deleteUser = userDB.prepareStatement(DELETE_USER);
-
- deleteUserRoles.setString(1, username);
- deleteUser.setString(1, username);
-
- deleteUserRoles.execute();
- deleteUser.execute();
-
- deleteUserRoles.close();
- deleteUser.close();
-
- close();
- } catch (SQLException e) {
- e.printStackTrace();
- return false;
- }
- return true;
- }
-
/*
* Methods to initialise the default state of the database.
*/
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
index 554a06397..1e073b391 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
@@ -1,300 +1,106 @@
package org.owasp.webgoat.session;
-import java.util.ArrayList;
-import java.util.Collection;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
import java.util.HashMap;
-import java.util.Iterator;
import java.util.Map;
+import java.util.Optional;
/**
- *************************************************************************************************
- *
- *
+ * ************************************************************************************************
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
* please see http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under the terms of the
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License along with this program; if
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
* 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
*
* @author Bruce Mayhew WebGoat
- * @since October 29, 2003
* @version $Id: $Id
+ * @since October 29, 2003
*/
-public class UserTracker
-{
+@Component
+public class UserTracker {
- private static UserTracker instance;
+ private static Map> storage = new HashMap<>();
+ private final String webgoatHome;
+ private final WebSession webSession;
- // FIXME: persist this somehow!
+ public UserTracker(@Value("${webgoat.user.directory}") final String webgoatHome, final WebSession webSession) {
+ this.webgoatHome = webgoatHome;
+ this.webSession = webSession;
+ }
- private static HashMap> storage = new HashMap>();
+ /**
+ * getCurrentLessonTracker.
+ *
+ * @return a {@link org.owasp.webgoat.session.LessonTracker} object.
+ */
+ public LessonTracker getCurrentLessonTracker() {
+ String lessonTitle = webSession.getCurrentLesson().getTitle();
+ String username = webSession.getUserName();
+ HashMap usermap = getUserMap(username);
+ LessonTracker tracker = usermap.get(lessonTitle);
+ if (tracker == null) {
+ // Creates a new lesson tracker, if one does not exist on disk.
+ tracker = LessonTracker.load(webSession, username, webSession.getCurrentLesson());
+ usermap.put(lessonTitle, tracker);
+ }
+ return tracker;
+ }
- private static UserDatabase usersDB = new UserDatabase();
+ /**
+ * Returns the lesson tracker for a specific lesson if available.
+ *
+ * @param lesson the lesson
+ * @return the optional lesson tracker
+ */
+ public Optional getLessonTracker(AbstractLesson lesson) {
+ String username = webSession.getUserName();
+ return Optional.ofNullable(getUserMap(username).getOrDefault(lesson.getTitle(), null));
+ }
- /**
- * Constructor for the UserTracker object
- */
- private UserTracker()
- {
- }
- /**
- * Gets the completed attribute of the UserTracker object
- *
- * @param userName
- * Description of the Parameter
- * @return The completed value
- */
- public int getCompleted(String userName)
- {
+ /**
+ * Gets the userMap attribute of the UserTracker object
+ *
+ * @param userName Description of the Parameter
+ * @return The userMap value
+ */
+ private HashMap getUserMap(String userName) {
- HashMap usermap = getUserMap(userName);
+ HashMap usermap = storage.get(userName);
- Iterator i = usermap.entrySet().iterator();
+ if (usermap == null) {
- int count = 0;
+ usermap = new HashMap<>();
- while (i.hasNext())
- {
+ storage.put(userName, usermap);
- Map.Entry entry = (Map.Entry) i.next();
+ }
- int value = ((Integer) entry.getValue()).intValue();
-
- if (value > 5)
- {
- count++;
- }
-
- }
-
- return count;
- }
-
- /**
- * Gets the users attribute of the UserTracker object
- *
- * @return The users value
- */
- public Collection getUsers()
- {
- return storage.keySet();
- }
-
- /**
- * getAllUsers.
- *
- * @param roleName a {@link java.lang.String} object.
- * @return a {@link java.util.Collection} object.
- */
- public Collection getAllUsers(String roleName)
- {
- synchronized (usersDB)
- {
- Collection allUsers = new ArrayList();
- try
- {
- usersDB.open();
- Iterator users = usersDB.getUsers();
- while (users.hasNext())
- {
- User user = (User) users.next();
- Iterator roles = user.getRoles();
- while (roles.hasNext())
- {
- Role role = (Role) roles.next();
- if (role.getRolename().trim().equals(roleName))
- {
- allUsers.add(user.getUsername());
- }
- }
- }
- usersDB.close();
- } catch (Exception e)
- {
- }
- return allUsers;
- }
- }
-
- /**
- * deleteUser.
- *
- * @param user a {@link java.lang.String} object.
- */
- public void deleteUser(String user)
- {
- synchronized (usersDB)
- {
- try
- {
- usersDB.open();
- Iterator users = usersDB.getUsers();
- while (users.hasNext())
- {
- User tomcatUser = (User) users.next();
- if (tomcatUser.getUsername().equals(user))
- {
- usersDB.removeUser(tomcatUser);
- // FIXME: delete all the lesson tracking property files
- break;
- }
- }
- usersDB.close();
-
- } catch (Exception e)
- {
- }
- }
- }
-
- /**
- * Gets the lessonTracker attribute of the UserTracker object
- *
- * @param screen
- * Description of the Parameter
- * @return The lessonTracker value
- * @param screen
- * Description of the Parameter
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public LessonTracker getLessonTracker(WebSession s, Screen screen)
- {
- return getLessonTracker(s, s.getUserName(), screen);
- }
-
- /**
- * getLessonTracker.
- *
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- * @param user a {@link java.lang.String} object.
- * @param screen a {@link org.owasp.webgoat.session.Screen} object.
- * @return a {@link org.owasp.webgoat.session.LessonTracker} object.
- */
- public LessonTracker getLessonTracker(WebSession s, String user, Screen screen)
- {
- HashMap usermap = getUserMap(user);
- LessonTracker tracker = (LessonTracker) usermap.get(screen.getTitle());
- if (tracker == null)
- {
- // Creates a new lesson tracker, if one does not exist on disk.
- tracker = LessonTracker.load(s, user, screen);
- usermap.put(screen.getTitle(), tracker);
- }
- // System.out.println( "User: [" + userName + "] UserTracker:getLessonTracker() LTH " +
- // tracker.hashCode() + " for " + screen );
- return tracker;
- }
-
- /**
- * Gets the status attribute of the UserTracker object
- *
- * @param screen
- * Description of the Parameter
- * @return The status value
- * @param screen
- * Description of the Parameter
- * @param s a {@link org.owasp.webgoat.session.WebSession} object.
- */
- public String getStatus(WebSession s, Screen screen)
- {
- return ("User [" + s.getUserName() + "] has accessed " + screen + " UserTracker:getStatus()LTH = " + getLessonTracker(
- s,
- screen)
- .hashCode());
- }
-
- /**
- * Gets the userMap attribute of the UserTracker object
- *
- * @param userName
- * Description of the Parameter
- * @return The userMap value
- */
- private HashMap getUserMap(String userName)
- {
-
- HashMap usermap = storage.get(userName);
-
- if (usermap == null)
- {
-
- usermap = new HashMap();
-
- storage.put(userName, usermap);
-
- }
-
- return (usermap);
- }
-
- /**
- * Description of the Method
- *
- * @return Description of the Return Value
- */
- public static synchronized UserTracker instance()
- {
-
- if (instance == null)
- {
-
- instance = new UserTracker();
-
- }
-
- return instance;
- }
-
- /**
- * Description of the Method
- *
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param screen
- * Description of the Parameter
- * @param s
- * Description of the Parameter
- */
- public void update(WebSession s, Screen screen)
- {
-
- LessonTracker tracker = getLessonTracker(s, screen);
-
- // System.out.println( "User [" + s.getUserName() + "] TRACKER: updating " + screen +
- // " LTH " + tracker.hashCode() );
- tracker.store(s, screen);
-
- HashMap usermap = getUserMap(s.getUserName());
- usermap.put(screen.getTitle(), tracker);
-
- }
+ return (usermap);
+ }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/ValidationException.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/ValidationException.java
deleted file mode 100644
index ef025153c..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/ValidationException.java
+++ /dev/null
@@ -1,58 +0,0 @@
-
-package org.owasp.webgoat.session;
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class ValidationException extends Exception
-{
-
- /**
- *
- */
- private static final long serialVersionUID = -8358754606830400708L;
-
- /**
- * Constructor for ValidationException.
- */
- public ValidationException()
- {
- super();
- }
-
- /**
- * Constructor for ValidationException.
- *
- * @param message a {@link java.lang.String} object.
- */
- public ValidationException(String message)
- {
- super(message);
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
index 3c552c012..e70ac70cd 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
@@ -2,254 +2,58 @@ package org.owasp.webgoat.session;
import lombok.extern.slf4j.Slf4j;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.Category;
-import org.owasp.webgoat.lessons.RandomLessonAdapter;
-import org.owasp.webgoat.lessons.SequentialLessonAdapter;
-import org.owasp.webgoat.lessons.model.RequestParameter;
-import org.owasp.webgoat.util.BeanProvider;
-import org.owasp.webgoat.util.LabelManager;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.User;
-import javax.servlet.ServletContext;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.security.Principal;
import java.sql.Connection;
import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.Hashtable;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Vector;
/**
* *************************************************************************************************
- *
- *
+ *
+ *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see
* http://www.owasp.org/
- *
+ *
* Copyright (c) 2002 - 20014 Bruce Mayhew
- *
+ *
* This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
* License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later
* version.
- *
+ *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License along with this program; if not, write to the Free
* Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- *
+ *
* Getting Source ==============
- *
+ *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
*
* @author Jeff Williams Aspect Security
* @author Bruce Mayhew WebGoat
- * @since October 28, 2003
* @version $Id: $Id
+ * @since October 28, 2003
*/
@Slf4j
public class WebSession {
- /**
- * @TODO_NB Spring can take inject this bean bound to a specific scope no longer necessary to bound it to a HTTP session
- */
-
- /**
- * Description of the Field
- */
- public final static String ADMIN = "admin";
-
- /**
- * Tomcat role for a webgoat user
- */
- public final static String WEBGOAT_USER = "ROLE_WEBGOAT_USER";
-
- /**
- * Tomcat role for a webgoat admin
- */
- public final static String WEBGOAT_ADMIN = "ROLE_WEBGOAT_ADMIN";
-
- /**
- * Description of the Field
- */
- public final static String CHALLENGE = "Challenge";
-
- /**
- * Description of the Field
- */
- public final static String COLOR = "color";
-
- /** Constant COURSE="course" */
- public final static String COURSE = "course";
-
- /**
- * Error screen number
- */
- public final static int ERROR = 0;
-
- /** Constant STAGE="stage" */
- public static final String STAGE = "stage";
-
- /**
- * session id string
- */
- public final static String JSESSION_ID = "jsessionid";
-
- /**
- * Logout parameter name
- */
- public final static String LOGOUT = "Logout";
-
- /**
- * Restart parameter name
- */
- public final static String RESTART = "Restart";
-
- /**
- * menu parameter name
- */
- public final static String MENU = "menu";
-
- /**
- * Screen parameter name
- */
- public final static String SCREEN = "Screen";
-
- /**
- * Description of the Field
- */
- public final static String SESSION = "websession";
-
- /** Constant SHOWSOURCE="ShowSource" */
- public final static String SHOWSOURCE = "ShowSource";
-
- /** Constant SHOWSOLUTION="ShowSolution" */
- public final static String SHOWSOLUTION = "ShowSolution";
-
- /** Constant SHOWHINTS="ShowHints" */
- public final static String SHOWHINTS = "ShowHints";
-
- /** Constant SHOW="show" */
- public final static String SHOW = "show";
-
- /** Constant SHOW_NEXTHINT="NextHint" */
- public final static String SHOW_NEXTHINT = "NextHint";
-
- /** Constant SHOW_PREVIOUSHINT="PreviousHint" */
- public final static String SHOW_PREVIOUSHINT = "PreviousHint";
-
- /** Constant SHOW_PARAMS="Params" */
- public final static String SHOW_PARAMS = "Params";
-
- /** Constant SHOW_COOKIES="Cookies" */
- public final static String SHOW_COOKIES = "Cookies";
-
- /** Constant SHOW_SOURCE="Source" */
- public final static String SHOW_SOURCE = "Source";
-
- /** Constant SHOW_SOLUTION="Solution" */
- public final static String SHOW_SOLUTION = "Solution";
-
- /** Constant DEBUG="debug" */
- public final static String DEBUG = "debug";
-
- /** Constant LANGUAGE="language" */
- public final static String LANGUAGE = "language";
-
- /**
- * Description of the Field
- */
- public final static int WELCOME = -1;
-
- private WebgoatContext webgoatContext;
-
- private ServletContext context = null;
-
- private Course course;
-
- private int currentScreen = WELCOME;
-
- private int previousScreen = ERROR;
-
- private int previousStage = -1;
-
- private int hintNum = -1;
-
- private boolean isAdmin = false;
-
- private boolean isHackedAdmin = false;
-
- private boolean isAuthenticated = false;
-
- private boolean isColor = false;
-
- private boolean isDebug = false;
-
- private boolean hasHackedHackableAdmin = false;
-
- private StringBuffer message = new StringBuffer("");
-
- private ParameterParser myParser;
-
- private HttpServletRequest request = null;
-
- private HttpServletResponse response = null;
-
- private String servletName;
-
- private HashMap session = new HashMap();
-
- private boolean showCookies = false;
-
- private boolean showParams = false;
-
- private boolean showRequest = false;
-
- private boolean showSource = false;
-
- private boolean showSolution = false;
-
- private boolean completedHackableAdmin = false;
-
- private int currentMenu;
-
- private String currentLanguage = null;
-
- private List cookiesOnLastRequest;
-
- private List parmsOnLastRequest;
+ private final User currentUser;
+ private final WebgoatContext webgoatContext;
+ private AbstractLesson currentLesson;
/**
* Constructor for the WebSession object
*
* @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
- * @param context Description of the Parameter
*/
@Autowired
- public WebSession(Course course, WebgoatContext webgoatContext, ServletContext context) {
+ public WebSession(WebgoatContext webgoatContext) {
this.webgoatContext = webgoatContext;
- // initialize from web.xml
- showParams = webgoatContext.isShowParams();
- showCookies = webgoatContext.isShowCookies();
- showSource = webgoatContext.isShowSource();
- showSolution = webgoatContext.isShowSolution();
- showRequest = webgoatContext.isShowRequest();
- currentLanguage = webgoatContext.getDefaultLanguage();
- this.context = context;
- this.course = course;
-
+ this.currentUser = (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
}
/**
@@ -272,162 +76,14 @@ public class WebSession {
DatabaseUtilities.returnConnection(s.getUserName());
}
- /**
- * Description of the Method
- *
- * @param key Description of the Parameter
- * @param value Description of the Parameter
- */
- public void add(String key, Object value) {
- session.put(key, value);
- }
-
- /**
- * Description of the Method
- */
- public void clearMessage() {
- message.setLength(0);
- }
-
- /**
- * Marks all cookies but the JSESSIONID for deletion and adds them to the response.
- */
- public void eatCookies() {
- Cookie[] cookies = request.getCookies();
-
- for (int loop = 0; loop < cookies.length; loop++) {
- if (!cookies[loop].getName().startsWith("JS")) {// skip jsessionid cookie
- cookies[loop].setMaxAge(0);// mark for deletion by browser
- response.addCookie(cookies[loop]);
- }
- }
- }
-
- /**
- * Description of the Method
- *
- * @param key Description of the Parameter
- * @return Description of the Return Value
- */
- public Object get(String key) {
- return (session.get(key));
- }
-
- /**
- * Gets the context attribute of the WebSession object
- *
- * @return The context value
- */
- public ServletContext getContext() {
- return context;
- }
-
- /**
- * getRoles.
- *
- * @return a {@link java.util.List} object.
- */
- public List getRoles() {
- List roles = new ArrayList();
-
- roles.add(AbstractLesson.USER_ROLE);
- if (isAdmin()) {
- roles.add(AbstractLesson.ADMIN_ROLE);
- }
-
- return roles;
- }
-
- /**
- * Sets the admin flag - this routine is ONLY here to allow someone a backdoor to setting the user up as an admin.
- *
- * This is also used by the WebSession to set the admin, but the method should be private
- *
- * @param state a boolean.
- */
- public void setAdmin(boolean state) {
- isAdmin = state;
-
- }
-
- /**
- * getRole.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getRole() {
-
- String role = "";
- if (isAdmin()) {
- role = AbstractLesson.ADMIN_ROLE;
- } else if (isHackedAdmin()) {
- role = AbstractLesson.HACKED_ADMIN_ROLE;
- } else if (isChallenge()) {
- role = AbstractLesson.CHALLENGE_ROLE;
- } else {
- role = AbstractLesson.USER_ROLE;
- }
-
- return role;
- }
-
- /**
- * Gets the course attribute of the WebSession object
- *
- * @return The course value
- */
- public Course getCourse() {
- return course;
- }
-
- /**
- * Setter for the field course.
- *
- * @param course a {@link org.owasp.webgoat.session.Course} object.
- */
- public void setCourse(Course course) {
- this.course = course;
- }
-
- /**
- * Gets the currentScreen attribute of the WebSession object
- *
- * @return The currentScreen value
- */
- public int getCurrentScreen() {
- return (currentScreen);
- }
/**
* Setter for the field currentScreen.
*
- * @param screen a int.
+ * @param lesson current lesson
*/
- public void setCurrentScreen(int screen) {
- currentScreen = screen;
- }
-
- /**
- * getCurrentLink.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getCurrentLink() {
- String thisLink = "attack";
- Enumeration e = request.getParameterNames();
- boolean isFirstParameter = true;
- while (e.hasMoreElements()) {
- String name = e.nextElement();
- if (isFirstParameter) {
- isFirstParameter = false;
- thisLink += "?";
- } else {
- thisLink += "&";
- }
- thisLink = thisLink + name + "=" + request.getParameter(name);
- }
-
- return thisLink;
+ public void setCurrentLesson(AbstractLesson lesson) {
+ this.currentLesson = lesson;
}
/**
@@ -436,436 +92,7 @@ public class WebSession {
* @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
*/
public AbstractLesson getCurrentLesson() {
- return getCourse().getLesson(this, getCurrentScreen(), getRoles());
- }
-
- /**
- * getLesson.
- *
- * @param id a int.
- * @return a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- */
- public AbstractLesson getLesson(int id) {
- return getCourse().getLesson(this, id, getRoles());
- }
-
- /**
- * getLessons.
- *
- * @param category a {@link org.owasp.webgoat.lessons.Category} object.
- * @return a {@link java.util.List} object.
- */
- public List getLessons(Category category) {
- return getCourse().getLessons(this, category, getRoles());
- }
-
- /**
- * Gets the hint1 attribute of the WebSession object
- *
- * @return The hint1 value
- */
- private int getHintNum() {
- return (hintNum);
- }
-
- /**
- * getHint.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getHint() {
- String hint = null;
- int hints = getCurrentLesson().getHintCount(this);
- if (getHintNum() > hints) {
- hintNum = -1;
- }
- if (getHintNum() >= 0) // FIXME
- {
- hint = getCurrentLesson().getHint(this, getHintNum());
- }
-
- return hint;
- }
-
- /**
- * getParams.
- *
- * @return a {@link java.util.List} object.
- */
- public List getParams() {
- Vector params = null;
-
- if (showParams() && getParser() != null) {
- params = new Vector();
-
- Enumeration e = getParser().getParameterNames();
-
- while ((e != null) && e.hasMoreElements()) {
- String name = (String) e.nextElement();
- String[] values = getParser().getParameterValues(name);
-
- for (int loop = 0; (values != null) && (loop < values.length); loop++) {
- params.add(new Parameter(name, values[loop]));
- // params.add( name + " -> " + values[loop] );
- }
- }
-
- Collections.sort(params);
- }
-
- return params;
- }
-
- /**
- * Gets the cookie attribute of the CookieScreen object
- *
- * @return The cookie value
- * @param cookieName a {@link java.lang.String} object.
- */
- public String getCookie(String cookieName) {
- Cookie[] cookies = getRequest().getCookies();
-
- for (int i = 0; i < cookies.length; i++) {
- if (cookies[i].getName().equalsIgnoreCase(cookieName)) {
- return (cookies[i].getValue());
- }
- }
-
- return (null);
- }
-
- /**
- * getSource.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSource() {
- return "Sorry. No Java Source viewing available.";
- // return getCurrentLesson().getSource(this);
- }
-
- /**
- * getSolution.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getSolution() {
- return "Sorry. No solution is available.";
- // return getCurrentLesson().getSolution(this);
- }
-
- /**
- * getInstructions.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getInstructions() {
- return getCurrentLesson().getInstructions(this);
- }
-
- /**
- * Gets the message attribute of the WebSession object
- *
- * @return The message value
- */
- public String getMessage() {
- return (message.toString());
- }
-
- /**
- * Gets the parser attribute of the WebSession object
- *
- * @return The parser value
- */
- public ParameterParser getParser() {
- return (myParser);
- }
-
- /**
- * Gets the previousScreen attribute of the WebSession object
- *
- * @return The previousScreen value
- */
- public int getPreviousScreen() {
- return (previousScreen);
- }
-
- /**
- * Gets the request attribute of the WebSession object
- *
- * @return The request value
- */
- public HttpServletRequest getRequest() {
- return request;
- }
-
- /**
- * Setter for the field request.
- *
- * @param request a {@link javax.servlet.http.HttpServletRequest} object.
- */
- public void setRequest(HttpServletRequest request) {
- this.request = request;
- }
-
- /**
- * Gets the response attribute of the WebSession object
- *
- * @return The response value
- */
- public HttpServletResponse getResponse() {
- return response;
- }
-
- /**
- * Gets the servletName attribute of the WebSession object
- *
- * @return The servletName value
- */
- public String getServletName() {
- return (servletName);
- }
-
- /**
- * Gets the sourceFile attribute of the WebSession object
- *
- * @return The sourceFile value
- * @param fileName a {@link java.lang.String} object.
- */
- public String getWebResource(String fileName) {
- // Note: doesn't work for admin path! Maybe with a ../ attack
- return (context.getRealPath(fileName));
- }
-
- /**
- * Gets the admin attribute of the WebSession object
- *
- * @return The admin value
- */
- public boolean isAdmin() {
- return (isAdmin);
- }
-
- /**
- * Gets the hackedAdmin attribute of the WebSession object
- *
- * @return The hackedAdmin value
- */
- public boolean isHackedAdmin() {
- return (isHackedAdmin);
- }
-
- /**
- * Has the user ever hacked the hackable admin
- *
- * @return The hackedAdmin value
- */
- public boolean completedHackableAdmin() {
- return (completedHackableAdmin);
- }
-
- /**
- * Gets the authenticated attribute of the WebSession object
- *
- * @return The authenticated value
- */
- public boolean isAuthenticated() {
- return (isAuthenticated);
- }
-
- private Map lessonSessions = new Hashtable();
-
- /**
- * isAuthenticatedInLesson.
- *
- * @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- * @return a boolean.
- */
- public boolean isAuthenticatedInLesson(AbstractLesson lesson) {
- boolean authenticated = false;
-
- LessonSession lessonSession = getLessonSession(lesson);
- if (lessonSession != null) {
- authenticated = lessonSession.isAuthenticated();
- }
- // System.out.println("Authenticated for lesson " + lesson + "? " + authenticated);
-
- return authenticated;
- }
-
- /**
- * isAuthorizedInLesson.
- *
- * @param employeeId a int.
- * @param functionId a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean isAuthorizedInLesson(int employeeId, String functionId) {
- return getCurrentLesson().isAuthorized(this, employeeId, functionId);
- }
-
- /**
- * isAuthorizedInLesson.
- *
- * @param role a {@link java.lang.String} object.
- * @param functionId a {@link java.lang.String} object.
- * @return a boolean.
- */
- public boolean isAuthorizedInLesson(String role, String functionId) {
- return getCurrentLesson().isAuthorized(this, role, functionId);
- }
-
- /**
- * getUserIdInLesson.
- *
- * @return a int.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public int getUserIdInLesson() throws ParameterNotFoundException {
- return getCurrentLesson().getUserId(this);
- }
-
- /**
- * getUserNameInLesson.
- *
- * @return a {@link java.lang.String} object.
- * @throws org.owasp.webgoat.session.ParameterNotFoundException if any.
- */
- public String getUserNameInLesson() throws ParameterNotFoundException {
- return getCurrentLesson().getUserName(this);
- }
-
- /**
- * openLessonSession.
- *
- * @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- */
- public void openLessonSession(AbstractLesson lesson) {
- System.out.println("Opening new lesson session for lesson " + lesson);
- LessonSession lessonSession = new LessonSession();
- lessonSessions.put(lesson, lessonSession);
- }
-
- /**
- * closeLessonSession.
- *
- * @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- */
- public void closeLessonSession(AbstractLesson lesson) {
- lessonSessions.remove(lesson);
- }
-
- /**
- * getLessonSession.
- *
- * @param lesson a {@link org.owasp.webgoat.lessons.AbstractLesson} object.
- * @return a {@link org.owasp.webgoat.session.LessonSession} object.
- */
- public LessonSession getLessonSession(AbstractLesson lesson) {
- return lessonSessions.get(lesson);
- }
-
- /**
- * Gets the challenge attribute of the WebSession object
- *
- * @return The challenge value
- */
- public boolean isChallenge() {
- if (getCurrentLesson() != null) {
- return (Category.CHALLENGE.equals(getCurrentLesson().getCategory()));
- }
- return false;
- }
-
- /**
- * Gets the color attribute of the WebSession object
- *
- * @return The color value
- */
- public boolean isColor() {
- return (isColor);
- }
-
- /**
- * Gets the screen attribute of the WebSession object
- *
- * @param value Description of the Parameter
- * @return The screen value
- */
- public boolean isScreen(int value) {
- return (getCurrentScreen() == value);
- }
-
- /**
- * Gets the user attribute of the WebSession object
- *
- * @return The user value
- */
- public boolean isUser() {
- return (!isAdmin && !isChallenge());
- }
-
- /**
- * Sets the message attribute of the WebSession object
- *
- * @param text The new message value
- */
- public void setMessage(String text) {
- message.append(" setLineBreak.
- *
- * @param text a {@link java.lang.String} object.
- */
- public void setLineBreak(String text) {
- message.append(" showSolution.
- *
- * @return a boolean.
- */
- public boolean showSolution() {
- return (showSolution);
+ return this.currentLesson;
}
/**
@@ -874,415 +101,7 @@ public class WebSession {
* @return The userName value
*/
public String getUserName() {
- HttpServletRequest request = getRequest();
- if (request == null) {
- throw new RuntimeException("Could not find the ServletRequest in the web session");
- }
- Principal principal = request.getUserPrincipal();
- if (principal == null) {
- throw new RuntimeException("Could not find the Principal in the Servlet Request");
- }
- return principal.getName();
- }
-
- /**
- * Parse parameters from the given request, handle any servlet commands, and update this session based on the
- * parameters.
- *
- * @param request Description of the Parameter
- * @param response Description of the Parameter
- * @param name Description of the Parameter
- * @throws java.io.IOException if any.
- */
- public void update(HttpServletRequest request, HttpServletResponse response, String name) throws IOException {
- String content = null;
-
- this.request = request;
- this.response = response;
- this.servletName = name;
-
- clearMessage();
- updateParser(request);
-
- // System.out.println("Current Screen 1: " + currentScreen );
- // System.out.println("Previous Screen 1: " + previousScreen );
- // FIXME: requires ?Logout=true
- // FIXME: doesn't work right -- no reauthentication
- // REMOVED - we have explicit logout now via spriing security
- /*
- * if (myParser.getRawParameter(LOGOUT, null) != null) { System.out.println("Logout " +
- * request.getUserPrincipal()); eatCookies(); request.getSession().invalidate(); currentScreen = WELCOME;
- * previousScreen = ERROR; }
- */
-
- updateScreenProperties(request);
-
- if (this.getCurrentScreen() != this.getPreviousScreen()) {
- clearScreenProperties();
- } else if (myParser.getRawParameter(STAGE, null) != null) {
- updateCurrentScreenStage();
- } else {
- content = updateCurrentScreen(content);
- }
-
- updateParameters(request);
- updateContent(response, content);
- }
-
- /**
- * Updates parameters isAdmin, isHackedAdmin, hasHackedHackableAdmin, isColor and isDebug
- *
- * @param request
- */
- private void updateParameters(HttpServletRequest request) {
- isAdmin = request.isUserInRole(WEBGOAT_ADMIN);
- isHackedAdmin = myParser.getBooleanParameter(ADMIN, isAdmin);
- if (isHackedAdmin) {
- System.out.println("Hacked admin");
- hasHackedHackableAdmin = true;
- }
- isColor = myParser.getBooleanParameter(COLOR, isColor);
- isDebug = myParser.getBooleanParameter(DEBUG, isDebug);
- }
-
- /**
- * If the content is not already set we get the response and sends it on its way
- *
- * @param response
- * @param content to send
- * @throws IOException
- */
- private void updateContent(HttpServletResponse response, String content) throws IOException {
- // System.out.println( "showParams:" + showParams );
- // System.out.println( "showSource:" + showSource );
- // System.out.println( "showSolution:" + showSolution );
- // System.out.println( "showCookies:" + showCookies );
- // System.out.println( "showRequest:" + showRequest );
- if (content != null) {
- response.setContentType("text/html");
- PrintWriter out = new PrintWriter(response.getOutputStream());
- out.print(content);
- out.flush();
- out.close();
- }
- }
-
- /**
- * Checks to see if the lesson should be restarted. Also handles parsing of "show" commands for getting hints,
- * params, cookies, source and solution.
- *
- * @param content
- * @return the updated content
- */
- private String updateCurrentScreen(String content) {
- // else update global variables for the current screen
- // Handle "restart" commands
- int lessonId = myParser.getIntParameter(RESTART, -1);
- if (lessonId != -1) {
- restartLesson(lessonId);
- }
- // if ( myParser.getBooleanParameter( RESTART, false ) )
- // {
- // getCurrentLesson().getLessonTracker( this ).getLessonProperties().setProperty(
- // CHALLENGE_STAGE, "1" );
- // }
-
- // Handle "show" commands
- String showCommand = myParser.getStringParameter(SHOW, null);
- if (showCommand != null) {
- if (showCommand.equalsIgnoreCase(SHOW_PARAMS)) {
- showParams = !showParams;
- } else if (showCommand.equalsIgnoreCase(SHOW_COOKIES)) {
- showCookies = !showCookies;
- } else if (showCommand.equalsIgnoreCase(SHOW_SOURCE)) {
- content = getSource();
- // showSource = true;
- } else if (showCommand.equalsIgnoreCase(SHOW_SOLUTION)) {
- content = getSolution();
- // showSource = true;
- } else if (showCommand.equalsIgnoreCase(SHOW_NEXTHINT)) {
- getNextHint();
- } else if (showCommand.equalsIgnoreCase(SHOW_PREVIOUSHINT)) {
- getPreviousHint();
- }
- }
- return content;
- }
-
- /**
- * Checks to see what kind of lesson we are viewing and parses the "stage" parameter accordingly. Sets the stage for
- * the lesson using setStage on the lesson object.
- */
- private void updateCurrentScreenStage() {
- AbstractLesson al = getCurrentLesson();
- if (al instanceof SequentialLessonAdapter) {
- updateSlaStage((SequentialLessonAdapter) al);
- } else if (al instanceof RandomLessonAdapter) {
- updateRlaStage((RandomLessonAdapter) al);
- }
- }
-
- /**
- * Updates the stage for a RandomLessonAdapter
- *
- * @param rla
- */
- private void updateRlaStage(RandomLessonAdapter rla) {
- try {
- if (!myParser.getRawParameter(STAGE).equals("null")) {
- int currentStage = myParser.getIntParameter(STAGE) - 1;
- if (previousStage != currentStage) {
- previousStage = currentStage;
- String[] stages = rla.getStages();
- if (stages == null) {
- stages = new String[0];
- }
- if (currentStage >= 0 && currentStage < stages.length) {
- rla.setStage(this, stages[currentStage]);
- }
- }
- } else {
- rla.setStage(this, null);
- }
- } catch (ParameterNotFoundException pnfe) {
- log.warn("ParameterNotFoundException when updating stage for RandomLessonAdapter: " + pnfe.getMessage() + " " + pnfe.getCause());
- }
- }
-
- /**
- * Updates the stage for a SequentialLessonAdapter
- *
- * @param sla
- */
- private void updateSlaStage(SequentialLessonAdapter sla) {
- int stage = myParser.getIntParameter(STAGE, sla.getStage(this));
- if (stage > 0 && stage <= sla.getStageCount()) {
- sla.setStage(this, stage);
- }
- }
-
- /**
- * Eats all the cookies and resets hintNum and previousStage
- */
- private void clearScreenProperties() {
- if (webgoatContext.isDebug()) {
- setMessage("Changed to a new screen, clearing cookies and hints");
- }
- eatCookies();
- hintNum = -1;
- previousStage = -1;
- }
-
- /**
- * Updates the properties currentScreen, previousScreen and hintNum depending on which scenario is being handled.
- *
- * @param request
- */
- private void updateScreenProperties(HttpServletRequest request) {
- // There are several scenarios where we want the first lesson to be loaded
- // 1) Previous screen is Welcome - Start of the course
- // 2) After a logout and after the session has been reinitialized
- if ((this.getPreviousScreen() == WebSession.WELCOME) ||
- (getRequest().getSession(false) != null &&
- // getRequest().getSession(false).isNew() &&
- this.getCurrentScreen() == WebSession.WELCOME &&
- this.getPreviousScreen() == WebSession.ERROR)) {
- currentScreen = course.getFirstLesson().getScreenId();
- hintNum = -1;
- }
-
- // System.out.println("Current Screen 2: " + currentScreen );
- // System.out.println("Previous Screen 2: " + previousScreen );
- // update the screen variables
- previousScreen = currentScreen;
-
- try {
- // If the request is new there should be no parameters.
- // This can occur from a session timeout or a the starting of a new course.
- if (!request.getSession().isNew()) {
- currentScreen = myParser.getIntParameter(SCREEN, currentScreen);
- } else {
- if (!myParser.getRawParameter(SCREEN, "NULL").equals("NULL")) {
- this.setMessage("Session Timeout - Starting new Session.");
- }
- }
- } catch (Exception e) {
- log.warn("Exception when updating properties in updateScreenProperties: " + e.getMessage() + " " + e.getCause());
- }
- }
-
- /**
- * Updates the labelmanager local based on the labelManager bean
- *
- * @param request
- */
- private void updateLocale(HttpServletRequest request) {
- Locale locale = request.getLocale();
- if (locale != null) {
- LabelManager labelManager = BeanProvider.getBean("labelManager", LabelManager.class);
- labelManager.setLocale(locale);
- }
- }
-
- /**
- * Creates a new parser if not created yet. Sets the request on the parser for later use.
- *
- * @param request
- */
- private void updateParser(HttpServletRequest request) {
- if (myParser == null) {
- myParser = new ParameterParser(request);
- } else {
- myParser.update(request);
- }
- }
-
- /**
- * updateLastAttackRequestInfo.
- *
- * @param request a {@link javax.servlet.http.HttpServletRequest} object.
- */
- public void updateLastAttackRequestInfo(HttpServletRequest request) {
- // store cookies
- Cookie[] cookies = request.getCookies();
- if (cookies == null) {
- this.cookiesOnLastRequest = new ArrayList();
- } else {
- this.cookiesOnLastRequest = Arrays.asList(cookies);
- }
- // store parameters
- Map parmMap = request.getParameterMap();
- log.info("PARM MAP: " + parmMap);
- if (parmMap == null) {
- this.parmsOnLastRequest = new ArrayList();
- } else {
- this.parmsOnLastRequest = new ArrayList();
- for (String name : parmMap.keySet()) {
- String[] values = parmMap.get(name);
- String delim = "";
- StringBuffer sb = new StringBuffer();
- if (values != null && values.length > 0) {
- for (String parm : values) {
- sb.append(delim).append(parm);
- delim = ",";
- }
- }
- RequestParameter parm = new RequestParameter(name, sb.toString());
- this.parmsOnLastRequest.add(parm);
- }
- }
- }
-
- /**
- * restartLesson.
- *
- * @param lessonId a int.
- */
- public void restartLesson(int lessonId) {
- AbstractLesson al = getLesson(lessonId);
- System.out.println("Restarting lesson: " + al);
- al.restartLesson();
- al.getLessonTracker(this).setCompleted(false);
- if (al instanceof SequentialLessonAdapter) {
- SequentialLessonAdapter sla = (SequentialLessonAdapter) al;
- sla.getLessonTracker(this).setStage(1);
- } else if (al instanceof RandomLessonAdapter) {
- RandomLessonAdapter rla = (RandomLessonAdapter) al;
- rla.setStage(this, rla.getStages()[0]);
- }
- }
-
- /**
- * setHasHackableAdmin.
- *
- * @param role a {@link java.lang.String} object.
- */
- public void setHasHackableAdmin(String role) {
- hasHackedHackableAdmin = (AbstractLesson.HACKED_ADMIN_ROLE.equals(role) & hasHackedHackableAdmin);
-
- // if the user got the Admin=true parameter correct AND they accessed an admin screen
- if (hasHackedHackableAdmin) {
- completedHackableAdmin = true;
- }
- }
-
- /**
- * isDebug.
- *
- * @return Returns the isDebug.
- */
- public boolean isDebug() {
- return isDebug;
- }
-
- /**
- * getHeader.
- *
- * @param header - request header value to return
- * @return a {@link java.lang.String} object.
- */
- public String getHeader(String header) {
- return getRequest().getHeader(header);
- }
-
- /**
- * getNextHint.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getNextHint() {
- String hint = null;
-
- // FIXME
- int maxHints = getCurrentLesson().getHintCount(this);
- if (hintNum < maxHints - 1) {
- hintNum++;
-
- // Hints are indexed from 0
- getCurrentLesson().getLessonTracker(this).setMaxHintLevel(getHintNum() + 1);
-
- hint = (String) getCurrentLesson().getHint(this, getHintNum());
- }
-
- return hint;
- }
-
- /**
- * getPreviousHint.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getPreviousHint() {
- String hint = null;
-
- if (hintNum > 0) {
- hintNum--;
-
- // Hints are indexed from 0
- getCurrentLesson().getLessonTracker(this).setMaxHintLevel(getHintNum() + 1);
-
- hint = (String) getCurrentLesson().getHint(this, getHintNum());
- }
-
- return hint;
- }
-
- /**
- * Setter for the field currentMenu.
- *
- * @param ranking a {@link java.lang.Integer} object.
- */
- public void setCurrentMenu(Integer ranking) {
- currentMenu = ranking.intValue();
- }
-
- /**
- * Getter for the field currentMenu.
- *
- * @return a int.
- */
- public int getCurrentMenu() {
- return currentMenu;
+ return currentUser.getUsername();
}
/**
@@ -1293,32 +112,4 @@ public class WebSession {
public WebgoatContext getWebgoatContext() {
return webgoatContext;
}
-
- /**
- * getCurrrentLanguage.
- *
- * @return a {@link java.lang.String} object.
- */
- public String getCurrrentLanguage() {
- return currentLanguage;
- }
-
- /**
- * Getter for the field cookiesOnLastRequest.
- *
- * @return the cookiesOnLastRequest
- */
- public List getCookiesOnLastRequest() {
- return cookiesOnLastRequest;
- }
-
- /**
- * Getter for the field parmsOnLastRequest.
- *
- * @return the parmsOnLastRequest
- */
- public List getParmsOnLastRequest() {
- return parmsOnLastRequest;
- }
-
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java
deleted file mode 100644
index 44c97daf3..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java
+++ /dev/null
@@ -1,113 +0,0 @@
-package org.owasp.webgoat.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.env.Environment;
-import org.springframework.stereotype.Component;
-
-/**
- * *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project
- * utility. For details, please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; either version 2 of the License, or (at your option) any later
- * version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
- * for free software projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-@Component
-public class WebgoatProperties {
-
- @Autowired
- private Environment env;
-
- /**
- *
- */
- private static final long serialVersionUID = 4351681705558227918L;
- final Logger logger = LoggerFactory.getLogger(WebgoatProperties.class);
-
-
- /**
- * getIntProperty.
- *
- * @param key a {@link java.lang.String} object.
- * @param defaultValue a int.
- * @return a int.
- */
- public int getIntProperty(String key, int defaultValue) {
- int value = defaultValue;
-
- String s = env.getProperty(key);
- if (s != null) {
- value = Integer.parseInt(s);
- }
-
- return value;
- }
-
- /**
- * getBooleanProperty.
- *
- * @param key a {@link java.lang.String} object.
- * @param defaultValue a boolean.
- * @return a boolean.
- */
- public boolean getBooleanProperty(String key, boolean defaultValue) {
- boolean value = defaultValue;
- key = this.trimLesson(key);
-
- String s = env.getProperty(key);
- if (s != null) {
- if (s.equalsIgnoreCase("true")) {
- value = true;
- } else if (s.equalsIgnoreCase("yes")) {
- value = true;
- } else if (s.equalsIgnoreCase("on")) {
- value = true;
- } else if (s.equalsIgnoreCase("false")) {
- value = false;
- } else if (s.equalsIgnoreCase("no")) {
- value = false;
- } else if (s.equalsIgnoreCase("off")) {
- value = false;
- }
- }
-
- return value;
- }
-
- private String trimLesson(String lesson) {
- String result = "";
-
- if (lesson.startsWith("org.owasp.webgoat.lessons.")) {
- result = lesson.substring("org.owasp.webgoat.lessons.".length(), lesson.length());
- } else {
- result = lesson;
- }
-
- return result;
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/util/BeanProvider.java b/webgoat-container/src/main/java/org/owasp/webgoat/util/BeanProvider.java
deleted file mode 100644
index 49629eaf3..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/util/BeanProvider.java
+++ /dev/null
@@ -1,67 +0,0 @@
-
-package org.owasp.webgoat.util;
-
-import org.springframework.beans.BeansException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.stereotype.Component;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for
- * free software projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-@Component
-public class BeanProvider implements ApplicationContextAware
-{
- private static ApplicationContext ctx;
-
- /** {@inheritDoc} */
- @Override
- public void setApplicationContext(ApplicationContext applicationContext) throws BeansException
- {
- ctx = applicationContext;
-
- }
-
- /**
- * Get access to managed beans from id.
- *
- * @param beanName
- * the id of the searched bean
- * @param beanClass
- * the type of tye searched bean
- * @param a T object.
- * @return a T object.
- */
- @SuppressWarnings("unchecked")
- public static T getBean(final String beanName, final Class beanClass)
- {
- return (T) ctx.getBean(beanName);
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/util/HtmlEncoder.java b/webgoat-container/src/main/java/org/owasp/webgoat/util/HtmlEncoder.java
deleted file mode 100644
index 3b7dfa62d..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/util/HtmlEncoder.java
+++ /dev/null
@@ -1,228 +0,0 @@
-
-package org.owasp.webgoat.util;
-
-import java.util.HashMap;
-import java.util.Map;
-
-
-/**
- *************************************************************************************************
- *
- *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class HtmlEncoder
-{
-
- static Map e2i = new HashMap();
-
- static Map i2e = new HashMap();
-
- // html entity list
- private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote
- { "amp", new Integer(38) }, // - ampersand
- { "lt", new Integer(60) }, // - less-than
- { "gt", new Integer(62) }, // - greater-than
- { "nbsp", new Integer(160) }, // non-breaking space
- { "copy", new Integer(169) }, // - copyright
- { "reg", new Integer(174) }, // - registered trademark
- { "Agrave", new Integer(192) }, // - uppercase A, grave accent
- { "Aacute", new Integer(193) }, // - uppercase A, acute accent
- { "Acirc", new Integer(194) }, // - uppercase A, circumflex accent
- { "Atilde", new Integer(195) }, // - uppercase A, tilde
- { "Auml", new Integer(196) }, // - uppercase A, umlaut
- { "Aring", new Integer(197) }, // - uppercase A, ring
- { "AElig", new Integer(198) }, // - uppercase AE
- { "Ccedil", new Integer(199) }, // - uppercase C, cedilla
- { "Egrave", new Integer(200) }, // - uppercase E, grave accent
- { "Eacute", new Integer(201) }, // - uppercase E, acute accent
- { "Ecirc", new Integer(202) }, // - uppercase E, circumflex accent
- { "Euml", new Integer(203) }, // - uppercase E, umlaut
- { "Igrave", new Integer(204) }, // - uppercase I, grave accent
- { "Iacute", new Integer(205) }, // - uppercase I, acute accent
- { "Icirc", new Integer(206) }, // - uppercase I, circumflex accent
- { "Iuml", new Integer(207) }, // - uppercase I, umlaut
- { "ETH", new Integer(208) }, // - uppercase Eth, Icelandic
- { "Ntilde", new Integer(209) }, // - uppercase N, tilde
- { "Ograve", new Integer(210) }, // - uppercase O, grave accent
- { "Oacute", new Integer(211) }, // - uppercase O, acute accent
- { "Ocirc", new Integer(212) }, // - uppercase O, circumflex accent
- { "Otilde", new Integer(213) }, // - uppercase O, tilde
- { "Ouml", new Integer(214) }, // - uppercase O, umlaut
- { "Oslash", new Integer(216) }, // - uppercase O, slash
- { "Ugrave", new Integer(217) }, // - uppercase U, grave accent
- { "Uacute", new Integer(218) }, // - uppercase U, acute accent
- { "Ucirc", new Integer(219) }, // - uppercase U, circumflex accent
- { "Uuml", new Integer(220) }, // - uppercase U, umlaut
- { "Yacute", new Integer(221) }, // - uppercase Y, acute accent
- { "THORN", new Integer(222) }, // - uppercase THORN, Icelandic
- { "szlig", new Integer(223) }, // - lowercase sharps, German
- { "agrave", new Integer(224) }, // - lowercase a, grave accent
- { "aacute", new Integer(225) }, // - lowercase a, acute accent
- { "acirc", new Integer(226) }, // - lowercase a, circumflex accent
- { "atilde", new Integer(227) }, // - lowercase a, tilde
- { "auml", new Integer(228) }, // - lowercase a, umlaut
- { "aring", new Integer(229) }, // - lowercase a, ring
- { "aelig", new Integer(230) }, // - lowercase ae
- { "ccedil", new Integer(231) }, // - lowercase c, cedilla
- { "egrave", new Integer(232) }, // - lowercase e, grave accent
- { "eacute", new Integer(233) }, // - lowercase e, acute accent
- { "ecirc", new Integer(234) }, // - lowercase e, circumflex accent
- { "euml", new Integer(235) }, // - lowercase e, umlaut
- { "igrave", new Integer(236) }, // - lowercase i, grave accent
- { "iacute", new Integer(237) }, // - lowercase i, acute accent
- { "icirc", new Integer(238) }, // - lowercase i, circumflex accent
- { "iuml", new Integer(239) }, // - lowercase i, umlaut
- { "igrave", new Integer(236) }, // - lowercase i, grave accent
- { "iacute", new Integer(237) }, // - lowercase i, acute accent
- { "icirc", new Integer(238) }, // - lowercase i, circumflex accent
- { "iuml", new Integer(239) }, // - lowercase i, umlaut
- { "eth", new Integer(240) }, // - lowercase eth, Icelandic
- { "ntilde", new Integer(241) }, // - lowercase n, tilde
- { "ograve", new Integer(242) }, // - lowercase o, grave accent
- { "oacute", new Integer(243) }, // - lowercase o, acute accent
- { "ocirc", new Integer(244) }, // - lowercase o, circumflex accent
- { "otilde", new Integer(245) }, // - lowercase o, tilde
- { "ouml", new Integer(246) }, // - lowercase o, umlaut
- { "oslash", new Integer(248) }, // - lowercase o, slash
- { "ugrave", new Integer(249) }, // - lowercase u, grave accent
- { "uacute", new Integer(250) }, // - lowercase u, acute accent
- { "ucirc", new Integer(251) }, // - lowercase u, circumflex accent
- { "uuml", new Integer(252) }, // - lowercase u, umlaut
- { "yacute", new Integer(253) }, // - lowercase y, acute accent
- { "thorn", new Integer(254) }, // - lowercase thorn, Icelandic
- { "yuml", new Integer(255) }, // - lowercase y, umlaut
- { "euro", new Integer(8364) },// Euro symbol
- };
-
- /**
- * Initialises the mappings between entities and characters
- */
- static {
- for (int i = 0; i < entities.length; i++)
- e2i.put((String) entities[i][0], (Integer) entities[i][1]);
- for (int i = 0; i < entities.length; i++)
- i2e.put((Integer) entities[i][1], (String) entities[i][0]);
- }
-
- /**
- * Turns funky characters into HTML entity equivalents
- *
- * e.g. {@code "bread" & "butter"} = {@code "bread" &
- * "butter"}. Update: supports nearly all HTML entities, including funky
- * accents. See the source code for more detail. Adapted from
- * http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
- *
- * @param s1
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static String encode(String s1)
- {
- StringBuffer buf = new StringBuffer();
-
- int i;
- for (i = 0; i < s1.length(); ++i)
- {
- char ch = s1.charAt(i);
-
- String entity = i2e.get(new Integer((int) ch));
-
- if (entity == null)
- {
- if (((int) ch) > 128)
- {
- buf.append("&#" + ((int) ch) + ";");
- }
- else
- {
- buf.append(ch);
- }
- }
- else
- {
- buf.append("&" + entity + ";");
- }
- }
-
- return buf.toString();
- }
-
- /**
- * Given a string containing entity escapes, returns a string containing the actual Unicode
- * characters corresponding to the escapes. Adapted from
- * http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
- *
- * @param s1
- * Description of the Parameter
- * @return Description of the Return Value
- */
- public static String decode(String s1)
- {
- StringBuffer buf = new StringBuffer();
-
- int i;
- for (i = 0; i < s1.length(); ++i)
- {
- char ch = s1.charAt(i);
-
- if (ch == '&')
- {
- int semi = s1.indexOf(';', i + 1);
- if (semi == -1)
- {
- buf.append(ch);
- continue;
- }
- String entity = s1.substring(i + 1, semi);
- Integer iso;
- if (entity.charAt(0) == '#')
- {
- iso = new Integer(entity.substring(1));
- }
- else
- {
- iso = e2i.get(entity);
- }
- if (iso == null)
- {
- buf.append("&" + entity + ";");
- }
- else
- {
- buf.append((char) (iso.intValue()));
- }
- i = semi;
- }
- else
- {
- buf.append(ch);
- }
- }
-
- return buf.toString();
- }
-}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/util/WebGoatI18N.java b/webgoat-container/src/main/java/org/owasp/webgoat/util/WebGoatI18N.java
deleted file mode 100644
index d46d57ef5..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/util/WebGoatI18N.java
+++ /dev/null
@@ -1,95 +0,0 @@
-package org.owasp.webgoat.util;
-
-import org.owasp.webgoat.session.WebgoatContext;
-
-import java.util.HashMap;
-import java.util.Locale;
-import java.util.ResourceBundle;
-
-
-
-@Deprecated
-/**
- * WebGoatI18N class.
- *
- * @version $Id: $Id
- * @author dm
- */
-public class WebGoatI18N
-{
-
- private static HashMap labels = new HashMap();
- private static Locale currentLocale;
- private static WebGoatResourceBundleController localeController;
-
- /**
- * Constructor for WebGoatI18N.
- *
- * @param context a {@link org.owasp.webgoat.session.WebgoatContext} object.
- */
- public WebGoatI18N(WebgoatContext context)
- {
- currentLocale = new Locale(context.getDefaultLanguage());
- localeController = new WebGoatResourceBundleController(currentLocale);
- }
-
- /**
- * loadLanguage.
- *
- * @param language a {@link java.lang.String} object.
- */
- @Deprecated
- public static void loadLanguage(String language)
- {
- // Do nothing
- }
-
- /**
- * Setter for the field currentLocale.
- *
- * @param locale a {@link java.util.Locale} object.
- */
- public static void setCurrentLocale(Locale locale)
- {
- if (!currentLocale.equals(locale))
- {
- if (!labels.containsKey(locale))
- {
- ResourceBundle resBundle = ResourceBundle.getBundle("WebGoatLabels", locale, localeController);
- labels.put(locale, resBundle);
- }
- WebGoatI18N.currentLocale = locale;
- }
- }
-
- /**
- * get.
- *
- * @param strName a {@link java.lang.String} object.
- * @return a {@link java.lang.String} object.
- */
- public static String get(String strName)
- {
- return labels.get(WebGoatI18N.currentLocale).getString(strName);
- }
-
- private static class WebGoatResourceBundleController extends ResourceBundle.Control
- {
- private Locale fallbackLocale;
-
- public WebGoatResourceBundleController(Locale l)
- {
- fallbackLocale = l;
- }
-
- @Override
- public Locale getFallbackLocale(String baseName, Locale locale)
- {
- if(! fallbackLocale.equals(locale)) {
- return fallbackLocale;
- }
- return Locale.ROOT;
- }
- }
-
-}
diff --git a/webgoat-container/src/main/old/META-INF/MANIFEST.MF b/webgoat-container/src/main/old/META-INF/MANIFEST.MF
deleted file mode 100644
index 348f1bdd3..000000000
--- a/webgoat-container/src/main/old/META-INF/MANIFEST.MF
+++ /dev/null
@@ -1 +0,0 @@
-Manifest-Version: 1.0
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/META-INF/context.xml b/webgoat-container/src/main/old/META-INF/context.xml
deleted file mode 100644
index adc5cb807..000000000
--- a/webgoat-container/src/main/old/META-INF/context.xml
+++ /dev/null
@@ -1,4 +0,0 @@
-
-
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/context.xml b/webgoat-container/src/main/old/WEB-INF/context.xml
deleted file mode 100644
index 658058885..000000000
--- a/webgoat-container/src/main/old/WEB-INF/context.xml
+++ /dev/null
@@ -1,2 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/WEB-INF/pages/about.jsp b/webgoat-container/src/main/old/WEB-INF/pages/about.jsp
deleted file mode 100644
index 0d3fd96b0..000000000
--- a/webgoat-container/src/main/old/WEB-INF/pages/about.jsp
+++ /dev/null
@@ -1,113 +0,0 @@
-<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
- errorPage=""%>
-
-
-
-
-
-
-
Thanks for hacking The Goat!
-
WebGoat is a demonstration of common web application flaws. The
- associated exercises are intended to provide hands-on experience with
- techniques aimed at demonstrating and testing application penetration.
-
-
From the entire WebGoat team, we appreciate your interest and efforts
- in making applications not just better, but safer and more secure for
- everyone. We, as well as our sacrificial goat, thank you.
-
- Version: ${version}, Build: ${build}
-
-
-
-
-
Contact us:
-
- WebGoat mailing list: ${emailList}
- Bruce Mayhew: ${contactEmail}
-
-
-
-
-
-
-
WebGoat Authors
-
- Bruce Mayhew (Author and Project Lead)
- Jeff Williams (Author and Original Idea)
- Nanne Baars (Plugin Architecture)
- Richard Lawson (Architect)
-
-
-
-
-
Active Contributors
-
- Nanne Baars (Developer)
- Jason White (Developer)
- Doug Morato (Developer and CI)
- Jeff Wayman (Docs)
- Bruce Mayhew (Developer)
- Michael Dever (Developer)
-
-
-
-
-
-
-
WebGoat Design Team (Active)
-
- Nanne Baars (Plugin Architecture)
- Bruce Mayhew (Goat Herder)
- Jeff Wayman (Website and Docs)
- Jason White (User Interface)
-
-
-
Corporate Sponsorship - Companies that have donated significant time to WebGoat development
-
- Aspect Security
- Ounce Labs
-
-
-
Did we miss you? Our sincere apologies, as we know there have
- been many contributors over the years. If your name does not
- appear in any of the lists above, please send us a note. We'll
- get you added with no further sacrifices required.
-
-
-
Past Contributors
-
- Dave Cowden (Everything)
- Richard Lawson (Service Layer)
- Keith Gasser (Survey/Security)
- Devin Mayhew (Setup/Admin)
- Li Simon (Developer)
- Ali Looney (UI Design)
- David Anderson (Developer/Design)
- Christopher Blum (Lessons)
- Laurence Casey (Graphics)
- Brian Ciomei (Bug fixes)
- Rogan Dawes (Lessons)
- Erwin Geirnaert (Solutions)
- Aung Knant (Documentation)
- Ryan Knell (Lessons)
- Christine Koppeit (Build)
- Sherif Kousa (Lessons/Documentation)
- Reto Lippuner (Lessons)
- PartNet (Lessons)
- Yiannis Pavlosoglou (Lessons)
- Eric Sheridan (Lessons)
- Alex Smolen (Lessons)
- Chuck Willis (Lessons)
- Marcel Wirth (Lessons)
-
-
-
-
-
-
-
Login Page
-
-
-
-
-
-
-
-
-
-
-
- ${error}
-
-
- ${msg}
-
- The following accounts are built into Webgoat
-
-
- Account User Password
-
- Webgoat User guest guest Webgoat Admin webgoat webgoat
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/WEB-INF/pages/logout.jsp b/webgoat-container/src/main/old/WEB-INF/pages/logout.jsp
deleted file mode 100644
index 2ee704beb..000000000
--- a/webgoat-container/src/main/old/WEB-INF/pages/logout.jsp
+++ /dev/null
@@ -1,68 +0,0 @@
-<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
-
-
- Logout Page
-
-
-
-
-
-
-
-
-
-
-
-
- ${error}
-
-
- ${msg}
-
-
- You have logged out successfully
-
-
- Click here if you would like to log back in:
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/pages/main_new.jsp b/webgoat-container/src/main/old/WEB-INF/pages/main_new.jsp
deleted file mode 100644
index 05cd72828..000000000
--- a/webgoat-container/src/main/old/WEB-INF/pages/main_new.jsp
+++ /dev/null
@@ -1,207 +0,0 @@
-<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
- errorPage=""%>
-<%@page import="org.owasp.webgoat.session.WebSession"%>
-<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
-<%
- WebSession webSession = ((WebSession) session.getAttribute(WebSession.SESSION));
-%>
-
-
-
-
- WebGoat
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Show Source
- Show Solution
- Show Plan
- Show Hints
- Restart Lesson
-
-
-
-
-
-
-
-
-
-
-
Cookies / Parameters
-
-
-
-
-
Cookies
-
-
-
Params
-
-
-
-
-
Developer controls
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/pages/widgets/cookies_and_params.jsp b/webgoat-container/src/main/old/WEB-INF/pages/widgets/cookies_and_params.jsp
deleted file mode 100644
index d89410105..000000000
--- a/webgoat-container/src/main/old/WEB-INF/pages/widgets/cookies_and_params.jsp
+++ /dev/null
@@ -1,39 +0,0 @@
-<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
-<%--
- Document : hints
- Created on : Aug 27, 2014, 3:41:46 PM
- Author : rlawson
---%>
-
-<%@page contentType="text/html" pageEncoding="windows-1252"%>
-
-
- Parameters
- Name Value
-
-
- ${wgparam.name} ${wgparam.value}
-
-
-
-
- Cookies
- Name Value
-
-
- ${wgcookie.name} ${wgcookie.value}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- http://xml.apache.org/axis/wsdd/
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/spring-security.xmlold b/webgoat-container/src/main/old/WEB-INF/spring-security.xmlold
deleted file mode 100644
index ca19c1d4b..000000000
--- a/webgoat-container/src/main/old/WEB-INF/spring-security.xmlold
+++ /dev/null
@@ -1,52 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/WEB-INF/web.xmlold b/webgoat-container/src/main/old/WEB-INF/web.xmlold
deleted file mode 100644
index 4145558e8..000000000
--- a/webgoat-container/src/main/old/WEB-INF/web.xmlold
+++ /dev/null
@@ -1,286 +0,0 @@
-
-
-
- WebGoat
-
- This web application is designed to demonstrate web
- application security flaws for the purpose of educating
- developers and security professionals about web
- application security problems. Please contact Bruce Mayhew
- (webgoat@owasp.org) if you have any questions.
-
-
-
-
- The EMAIL address of the administrator to whom questions
- and comments about this application should be addressed.
-
- email
- webgoat@owasp.org
-
-
-
- The EMAIL address of the webgoat email list
-
- emaillist
- owasp-webgoat@lists.owasp.org
-
-
-
- contextConfigLocation
-
- /WEB-INF/mvc-dispatcher-servlet.xml,
- /WEB-INF/spring-security.xml
-
-
-
-
- Apache-Axis Servlet
- AxisServlet
-
- org.apache.axis.transport.http.AxisServlet
-
-
-
- Axis Admin Servlet
- AdminServlet
-
- org.apache.axis.transport.http.AdminServlet
-
- 100
-
-
- SOAPMonitorService
- SOAPMonitorService
-
- org.apache.axis.monitor.SOAPMonitorService
-
-
- SOAPMonitorPort
- 5001
-
- 100
-
-
-
- This servlet plays the "controller" role in the MVC architecture
- used in this application.
-
- The initialization parameter namess for this servlet are the
- "servlet path" that will be received by this servlet (after the
- filename extension is removed). The corresponding value is the
- name of the action class that will be used to process this request.
-
- WebGoat
- org.owasp.webgoat.HammerHead
-
- The EMAIL address of the administrator to whom questions
- and comments about this application should be addressed.
-
- email
- WebGoat@owasp.org
-
-
- debug
- false
-
-
- CookieDebug
- true
-
-
- DefuseOSCommands
- false
-
-
- Enterprise
- true
-
-
- CodingExercises
- true
-
-
-
-
-
- FeedbackAddress
-
- <A HREF=mailto:webgoat@owasp.org>webgoat@owasp.org</A>
-
-
-
- DatabaseDriver
-
- org.hsqldb.jdbcDriver
-
-
-
- DatabaseConnectionString
-
- jdbc:hsqldb:mem:${USER}
-
-
-
- 5
-
-
-
- This servlet returns the Java source of the current lesson.
-
- LessonSource
- org.owasp.webgoat.LessonSource
-
-
-
- This servlet catches any posts and marks the appropriate lesson property.
-
- Catcher
- org.owasp.webgoat.Catcher
-
-
-
- mvc-dispatcher
- org.springframework.web.servlet.DispatcherServlet
- 1
-
-
- mvc-dispatcher
- *.mvc
-
-
- Spring context init
- org.springframework.web.context.ContextLoaderListener
-
-
- Spring context init
- org.springframework.web.context.request.RequestContextListener
-
-
- WebGoat application init
- org.owasp.webgoat.application.WebGoatServletListener
-
-
-
-
- springSecurityFilterChain
- org.springframework.web.filter.DelegatingFilterProxy
-
-
- springSecurityFilterChain
- /*
-
-
-
-
- AxisServlet
- /servlet/AxisServlet
-
-
- AxisServlet
- *.jws
-
-
- AxisServlet
- /services/*
-
-
- SOAPMonitorService
- /SOAPMonitor
-
-
-
- AdminServlet
- /servlet/AdminServlet
-
-
- WebGoat
- /attack
-
-
- LessonSource
- /source
-
-
- Catcher
- /catcher
-
-
-
-
- 2880
-
-
- wmv
- video/x-ms-wmv
-
-
- index.jsp
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/webgoat-class.properties b/webgoat-container/src/main/old/WEB-INF/webgoat-class.properties
deleted file mode 100644
index 52818894f..000000000
--- a/webgoat-container/src/main/old/WEB-INF/webgoat-class.properties
+++ /dev/null
@@ -1,60 +0,0 @@
-category.General.ranking=11
-lesson.HttpBasics.ranking=10
-lesson.HttpSplitting.ranking=20
-lesson.ThreadSafetyProblem.ranking=30
-
-category.Broken\ Authentication\ and\ Session\ Management.ranking=21
-lesson.BasicAuthentication.ranking=10
-lesson.WeakAuthenticationCookie.ranking=20
-
-category.Broken\ Access\ Control.ranking=31
-lesson.AccessControlMatrix.ranking=10
-lesson.PathBasedAccessControl.ranking=20
-lesson.RoleBasedAccessControl.hidden=true
-
-category.Cross-Site\ Scripting\ (XSS).ranking=41
-lesson.StoredXss.ranking=10
-lesson.ReflectedXSS.ranking=20
-lesson.CSRF.ranking=30
-lesson.CsrfPromptByPass.ranking=40
-lesson.CsrfTokenByPass.ranking=50
-lesson.CrossSiteScripting.hidden=true
-
-category.Unvalidated\ Parameters.ranking=51
-lesson.HiddenFieldTampering.ranking=10
-lesson.JavaScriptValidation.ranking=20
-lesson.UncheckedEmail.ranking=30
-
-category.Insecure\ Storage.ranking=61
-lesson.Encoding.ranking=10
-
-category.Injection\ Flaws.ranking=71
-lesson.SqlNumericInjection.ranking=10
-lesson.SqlStringInjection.ranking=20
-lesson.CommandInjection.ranking=30
-lesson.LogSpoofing.ranking=40
-lesson.SQLInjection.hidden=true
-
-category.Improper\ Error\ Handling.ranking=81
-lesson.FailOpenAuthentication.ranking=10
-
-category.Code\ Quality.ranking=91
-lesson.HtmlClues.ranking=10
-
-category.Web\ Services.category.ranking=101
-lesson.SoapRequest.ranking=10
-lesson.WSDLScanning.ranking=20
-lesson.WsSqlInjection.ranking=30
-
-category.New\ Lesson.category.ranking=111
-lesson.HowToAddNewLesson.ranking=10
-
-lesson.WeakSessionID.hidden=true
-lesson.BufferOverflow.hidden=true
-lesson.BlindSqlInjection.hidden=true
-lesson.DOS_Login.hidden=true
-lesson.ForcedBrowsing.hidden=true
-lesson.ForgotPassword.hidden=true
-lesson.ParameterInjection.hidden=true
-lesson.RemoteAdminFlaw.hidden=true
-lesson.ChallengeScreen.hidden=true
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/WEB-INF/webgoat-lab.properties b/webgoat-container/src/main/old/WEB-INF/webgoat-lab.properties
deleted file mode 100644
index 1e37e2b27..000000000
--- a/webgoat-container/src/main/old/WEB-INF/webgoat-lab.properties
+++ /dev/null
@@ -1,57 +0,0 @@
-category.General.ranking=11
-lesson.HttpBasics.ranking=10
-lesson.HttpSplitting.ranking=20
-lesson.ThreadSafetyProblem.ranking=30
-
-category.Broken\ Authentication\ and\ Session\ Management.ranking=21
-lesson.BasicAuthentication.ranking=10
-lesson.WeakAuthenticationCookie.ranking=20
-
-category.Broken\ Access\ Control.ranking=31
-lesson.AccessControlMatrix.ranking=10
-lesson.PathBasedAccessControl.ranking=20
-
-category.Cross-Site\ Scripting\ (XSS).ranking=41
-lesson.StoredXss.ranking=10
-lesson.ReflectedXSS.ranking=20
-lesson.CSRF.ranking=30
-lesson.CsrfPromptByPass.ranking=40
-lesson.CsrfTokenByPass.ranking=50
-
-category.Unvalidated\ Parameters.ranking=51
-lesson.HiddenFieldTampering.ranking=10
-lesson.JavaScriptValidation.ranking=20
-lesson.UncheckedEmail.ranking=30
-
-category.Insecure\ Storage.ranking=61
-lesson.Encoding.ranking=10
-
-category.Injection\ Flaws.ranking=71
-lesson.SqlNumericInjection.ranking=10
-lesson.SqlStringInjection.ranking=20
-lesson.CommandInjection.ranking=30
-lesson.LogSpoofing.ranking=40
-
-category.Improper\ Error\ Handling.ranking=81
-lesson.FailOpenAuthentication.ranking=10
-
-category.Code\ Quality.ranking=91
-lesson.HtmlClues.ranking=10
-
-category.Web\ Services.category.ranking=101
-lesson.SoapRequest.ranking=10
-lesson.WSDLScanning.ranking=20
-lesson.WsSqlInjection.ranking=30
-
-category.New\ Lesson.category.ranking=111
-lesson.HowToAddNewLesson.ranking=10
-
-lesson.WeakSessionID.hidden=true
-lesson.BufferOverflow.hidden=true
-lesson.BlindSqlInjection.hidden=true
-lesson.DOS_Login.hidden=true
-lesson.ForcedBrowsing.hidden=true
-lesson.ForgotPassword.hidden=true
-lesson.ParameterInjection.hidden=true
-lesson.RemoteAdminFlaw.hidden=true
-lesson.ChallengeScreen.hidden=true
diff --git a/webgoat-container/src/main/old/WEB-INF/webgoat-owasp.properties b/webgoat-container/src/main/old/WEB-INF/webgoat-owasp.properties
deleted file mode 100644
index c572d25ca..000000000
--- a/webgoat-container/src/main/old/WEB-INF/webgoat-owasp.properties
+++ /dev/null
@@ -1,2 +0,0 @@
-#lesson.BufferOverflow.hidden=true
-lesson.BlindScript.hidden=true
diff --git a/webgoat-container/src/main/old/WEB-INF/webgoat_oracle.sql b/webgoat-container/src/main/old/WEB-INF/webgoat_oracle.sql
deleted file mode 100644
index 932998e58..000000000
--- a/webgoat-container/src/main/old/WEB-INF/webgoat_oracle.sql
+++ /dev/null
@@ -1,132 +0,0 @@
-DROP USER webgoat_guest CASCADE;
-CREATE USER webgoat_guest IDENTIFIED BY webgoat DEFAULT TABLESPACE users;
-GRANT CONNECT, RESOURCE TO webgoat_guest;
-GRANT CREATE PROCEDURE TO webgoat_guest;
-
-CREATE TABLE WEBGOAT_guest.EMPLOYEE (
- userid INT NOT NULL PRIMARY KEY,
- first_name VARCHAR(20),
- last_name VARCHAR(20),
- ssn VARCHAR(12),
- password VARCHAR(10),
- title VARCHAR(20),
- phone VARCHAR(13),
- address1 VARCHAR(80),
- address2 VARCHAR(80),
- manager INT,
- start_date CHAR(8),
- salary INT,
- ccn VARCHAR(30),
- ccn_limit INT,
- disciplined_date CHAR(8),
- disciplined_notes VARCHAR(60),
- personal_description VARCHAR(60)
-);
-
-
-CREATE OR REPLACE FUNCTION WEBGOAT_guest.EMPLOYEE_LOGIN(v_id NUMBER, v_password VARCHAR) RETURN NUMBER AS
- stmt VARCHAR(32767);cnt NUMBER;
-BEGIN
- stmt := 'SELECT COUNT (*) FROM EMPLOYEE WHERE USERID = ' || v_id || ' AND PASSWORD = ''' || v_password || '''';
- EXECUTE IMMEDIATE stmt INTO cnt;
- RETURN cnt;
-END;
-/
-
-CREATE OR REPLACE FUNCTION WEBGOAT_guest.EMPLOYEE_LOGIN_BACKUP(v_id NUMBER, v_password VARCHAR) RETURN NUMBER AS
- stmt VARCHAR(32767);cnt NUMBER;
-BEGIN
- stmt := 'SELECT COUNT (*) FROM EMPLOYEE WHERE USERID = ' || v_id || ' AND PASSWORD = ''' || v_password || '''';
- EXECUTE IMMEDIATE stmt INTO cnt;
- RETURN cnt;
-END;
-/
-
-CREATE OR REPLACE PROCEDURE WEBGOAT_guest.UPDATE_EMPLOYEE(
- v_userid IN employee.userid%type,
- v_first_name IN employee.first_name%type,
- v_last_name IN employee.last_name%type,
- v_ssn IN employee.ssn%type,
- v_title IN employee.title%type,
- v_phone IN employee.phone%type,
- v_address1 IN employee.address1%type,
- v_address2 IN employee.address2%type,
- v_manager IN employee.manager%type,
- v_start_date IN employee.start_date%type,
- v_salary IN employee.salary%type,
- v_ccn IN employee.ccn%type,
- v_ccn_limit IN employee.ccn_limit%type,
- v_disciplined_date IN employee.disciplined_date%type,
- v_disciplined_notes IN employee.disciplined_notes%type,
- v_personal_description IN employee.personal_description%type
-)
-AS
-BEGIN
- UPDATE EMPLOYEE
- SET
- first_name = v_first_name,
- last_name = v_last_name,
- ssn = v_ssn,
- title = v_title,
- phone = v_phone,
- address1 = v_address1,
- address2 = v_address2,
- manager = v_manager,
- start_date = v_Start_date,
- salary = v_salary,
- ccn = v_ccn,
- ccn_limit = v_ccn_limit,
- disciplined_date = v_disciplined_date,
- disciplined_notes = v_disciplined_notes,
- personal_description = v_personal_description
- WHERE
- userid = v_userid;
-END;
-/
-
-CREATE OR REPLACE PROCEDURE WEBGOAT_guest.UPDATE_EMPLOYEE_BACKUP(
- v_userid IN employee.userid%type,
- v_first_name IN employee.first_name%type,
- v_last_name IN employee.last_name%type,
- v_ssn IN employee.ssn%type,
- v_title IN employee.title%type,
- v_phone IN employee.phone%type,
- v_address1 IN employee.address1%type,
- v_address2 IN employee.address2%type,
- v_manager IN employee.manager%type,
- v_start_date IN employee.start_date%type,
- v_salary IN employee.salary%type,
- v_ccn IN employee.ccn%type,
- v_ccn_limit IN employee.ccn_limit%type,
- v_disciplined_date IN employee.disciplined_date%type,
- v_disciplined_notes IN employee.disciplined_notes%type,
- v_personal_description IN employee.personal_description%type
-)
-AS
-BEGIN
- UPDATE EMPLOYEE
- SET
- first_name = v_first_name,
- last_name = v_last_name,
- ssn = v_ssn,
- title = v_title,
- phone = v_phone,
- address1 = v_address1,
- address2 = v_address2,
- manager = v_manager,
- start_date = v_Start_date,
- salary = v_salary,
- ccn = v_ccn,
- ccn_limit = v_ccn_limit,
- disciplined_date = v_disciplined_date,
- disciplined_notes = v_disciplined_notes,
- personal_description = v_personal_description
- WHERE
- userid = v_userid;
-END;
-/
-
-
-exit;
-
-
diff --git a/webgoat-container/src/main/old/WEB-INF/webgoat_sqlserver.sql b/webgoat-container/src/main/old/WEB-INF/webgoat_sqlserver.sql
deleted file mode 100644
index 7be4b17a7..000000000
--- a/webgoat-container/src/main/old/WEB-INF/webgoat_sqlserver.sql
+++ /dev/null
@@ -1,226 +0,0 @@
-EXEC sp_configure 'clr enabled', 1
-GO
-
-RECONFIGURE
-GO
-
-USE master;
-
-go
-
-DROP LOGIN webgoat_guest;
-
-go
-
-DROP database webgoat;
-
-go
-
-
-CREATE database webgoat;
-
-go
-
-USE webgoat;
-
-go
-
-CREATE SCHEMA webgoat_guest;
-
-go
-
-CREATE LOGIN webgoat_guest with password = '_webgoat';
-
-go
-
-CREATE USER webgoat_guest with default_schema = webgoat_guest;
-
-go
-
-GRANT CONTROL TO webgoat_guest;
-
-go
-
-
-CREATE TABLE WEBGOAT_guest.EMPLOYEE (
- userid INT NOT NULL PRIMARY KEY,
- first_name VARCHAR(20),
- last_name VARCHAR(20),
- ssn VARCHAR(12),
- password VARCHAR(10),
- title VARCHAR(20),
- phone VARCHAR(13),
- address1 VARCHAR(80),
- address2 VARCHAR(80),
- manager INT,
- start_date CHAR(8),
- salary INT,
- ccn VARCHAR(30),
- ccn_limit INT,
- disciplined_date CHAR(8),
- disciplined_notes VARCHAR(60),
- personal_description VARCHAR(60)
-);
-
-go
-
-IF EXISTS
-(
- SELECT 1
- FROM INFORMATION_SCHEMA.ROUTINES
- WHERE ROUTINE_NAME = 'UPDATE_EMPLOYEE'
- AND ROUTINE_SCHEMA = 'webgoat_guest'
- AND ROUTINE_TYPE = 'PROCEDURE'
-)
-BEGIN
- DROP PROCEDURE webgoat_guest.UPDATE_EMPLOYEE
- DROP PROCEDURE webgoat_guest.UPDATE_EMPLOYEE_BACKUP
-END
-GO
-
-CREATE PROCEDURE webgoat_guest.UPDATE_EMPLOYEE
- @v_userid INT,
- @v_first_name VARCHAR(20),
- @v_last_name VARCHAR(20),
- @v_ssn VARCHAR(12),
- @v_title VARCHAR(20),
- @v_phone VARCHAR(13),
- @v_address1 VARCHAR(80),
- @v_address2 VARCHAR(80),
- @v_manager INT,
- @v_start_date CHAR(8),
- @v_salary INT,
- @v_ccn VARCHAR(30),
- @v_ccn_limit INT,
- @v_disciplined_date CHAR(8),
- @v_disciplined_notes VARCHAR(60),
- @v_personal_description VARCHAR(60)
-AS
- UPDATE EMPLOYEE
- SET
- first_name = @v_first_name,
- last_name = @v_last_name,
- ssn = @v_ssn,
- title = @v_title,
- phone = @v_phone,
- address1 = @v_address1,
- address2 = @v_address2,
- manager = @v_manager,
- start_date = @v_Start_date,
- salary = @v_salary,
- ccn = @v_ccn,
- ccn_limit = @v_ccn_limit,
- disciplined_date = @v_disciplined_date,
- disciplined_notes = @v_disciplined_notes,
- personal_description = @v_personal_description
- WHERE
- userid = @v_userid;
-
-go
-
-CREATE PROCEDURE webgoat_guest.UPDATE_EMPLOYEE_BACKUP
- @v_userid INT,
- @v_first_name VARCHAR(20),
- @v_last_name VARCHAR(20),
- @v_ssn VARCHAR(12),
- @v_title VARCHAR(20),
- @v_phone VARCHAR(13),
- @v_address1 VARCHAR(80),
- @v_address2 VARCHAR(80),
- @v_manager INT,
- @v_start_date CHAR(8),
- @v_salary INT,
- @v_ccn VARCHAR(30),
- @v_ccn_limit INT,
- @v_disciplined_date CHAR(8),
- @v_disciplined_notes VARCHAR(60),
- @v_personal_description VARCHAR(60)
-AS
- UPDATE EMPLOYEE
- SET
- first_name = @v_first_name,
- last_name = @v_last_name,
- ssn = @v_ssn,
- title = @v_title,
- phone = @v_phone,
- address1 = @v_address1,
- address2 = @v_address2,
- manager = @v_manager,
- start_date = @v_Start_date,
- salary = @v_salary,
- ccn = @v_ccn,
- ccn_limit = @v_ccn_limit,
- disciplined_date = @v_disciplined_date,
- disciplined_notes = @v_disciplined_notes,
- personal_description = @v_personal_description
- WHERE
- userid = @v_userid;
-
-go
-
-IF EXISTS
-(
- SELECT 1
- FROM INFORMATION_SCHEMA.ROUTINES
- WHERE ROUTINE_NAME = 'EMPLOYEE_LOGIN'
- AND ROUTINE_SCHEMA = 'webgoat_guest'
- AND ROUTINE_TYPE = 'FUNCTION'
-)
-BEGIN
- DROP FUNCTION webgoat_guest.EMPLOYEE_LOGIN
- DROP FUNCTION webgoat_guest.EMPLOYEE_LOGIN_BACKUP
-END
-GO
-
-CREATE FUNCTION webgoat_guest.EMPLOYEE_LOGIN (
- @v_id INT,
- @v_password VARCHAR(100)
-) RETURNS INTEGER
-AS
- BEGIN
- DECLARE @sql nvarchar(4000), @count int
- SELECT @sql = N'SELECT @cnt = COUNT(*) FROM EMPLOYEE WHERE USERID = ' + convert(varchar(10),@v_id) + N' AND PASSWORD = ''' + @v_password + N'''';
- EXEC sp_executesql @sql, N'@cnt int OUTPUT', @cnt = @count OUTPUT
- return @count
- END
-GO
-
-CREATE FUNCTION webgoat_guest.EMPLOYEE_LOGIN_BACKUP (
- @v_id INT,
- @v_password VARCHAR(100)
-) RETURNS INTEGER
-AS
- BEGIN
- DECLARE @sql nvarchar(4000), @count int
- SELECT @sql = N'SELECT @cnt = COUNT(*) FROM EMPLOYEE WHERE USERID = ' + convert(varchar(10),@v_id) + N' AND PASSWORD = ''' + @v_password + N'''';
- EXEC sp_executesql @sql, N'@cnt int OUTPUT', @cnt = @count OUTPUT
- return @count
- END
-GO
-
-IF EXISTS
-(
- SELECT 1
- FROM INFORMATION_SCHEMA.ROUTINES
- WHERE ROUTINE_NAME = 'RegexMatch'
- AND ROUTINE_SCHEMA = 'webgoat_guest'
- AND ROUTINE_TYPE = 'FUNCTION'
-)
-BEGIN
- DROP FUNCTION webgoat_guest.RegexMatch
-END
-GO
-
-IF EXISTS (SELECT name FROM sys.assemblies WHERE name = N'RegexMatch')
- DROP ASSEMBLY RegexMatch;
-GO
-
-CREATE ASSEMBLY RegexMatch FROM 'C:\AspectClass\Database\Labs\tomcat\webapps\WebGoat\WEB-INF\RegexMatch.dll' WITH PERMISSION_SET = SAFE;
-GO
-
-CREATE FUNCTION webgoat_guest.RegexMatch (
-@input NVARCHAR(MAX),
-@pattern NVARCHAR(MAX)
-) RETURNS BIT
-AS EXTERNAL NAME RegexMatch.[UserDefinedFunctions].RegexMatch;
-GO
diff --git a/webgoat-container/src/main/old/database/database.prp b/webgoat-container/src/main/old/database/database.prp
deleted file mode 100644
index 5767d09ff..000000000
--- a/webgoat-container/src/main/old/database/database.prp
+++ /dev/null
@@ -1,365 +0,0 @@
-!---------------------------------------------------------------------
-!
-! BASIC PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! Path where index tables are held. Can be absolute or relative
-! to the properties file. Defaults to tablePath.
-!
-indexPath=./indexes
-!
-! Path where system tables are held. Can be absolute or relative to
-! the properties file. Defaults to tablePath.
-!
-systemPath=./system
-!
-! Path where database tables are held. Can be absolute or relative
-! to the properties file. Defaults to "current" directory.
-!
-tablePath=./tables
-!
-! Path where results set tables are held. Can be absolute or relative
-! to the properties file. Defaults to tablePath.
-!
-tmpPath=./tmp
-!
-! Non-zero means paths are relative to the properties file.
-! Default is absolute paths for files.
-!
-relativeToProperties=1
-!
-! Alternative partitions can be defined so that tables can be placed
-! in multiple locations. Each partition is numbered: 1, 2, 3,... Tables
-! can be created on partitions using the syntax
-!
-! CREATE TABLE ON PARTITION ...
-!
-! The partition count has to be supplied.
-!
-!partitionCount=2
-!
-! The locations of each partition must be supplied. These are always
-! absolute path names.
-!
-!partition1=d:/petes
-!partition2=c:/temp
-
-
-!---------------------------------------------------------------------
-!
-! TUNING PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! The amount of each column to cache, expressed either as an absolute
-! number of rows or as a percentage figure. Defaults to 256 or 10 respectively.
-!
-! This value applies only when tables are first created. It has no effect
-! when a table is being re-opened.
-!
-cacheAmount=512
-!
-! CACHE_ROWS Must be one of CACHE_ROWS or CACHE_PERCENT. Determines whether
-! to cache columns in tables based on an absolute number of rows, or the
-! percentage number of rows in the table.
-!
-! This value applies only when tables are first created. It has no effect
-! when a table is being re-opened.
-!
-cacheCondition=CACHE_ROWS
-!
-! The amount of the system tables to be cached. Defaults to 100.
-!
-! This value applies only when tables are first created. It has no effect
-! when a table is being re-opened.
-!
-!systemCacheSize=10
-!
-! Similar to cacheCondition, but applies only to the system tables.
-!
-! This value applies only when tables are first created. It has no effect
-! when a table is being re-opened.
-!
-!systemCacheCondition=CACHE_ROWS
-!
-! The percentage cache hit improvement required in order to move the
-! cache to a new location in a column.
-!
-! (Currently not implemented).
-!
-cacheResetPercent=10
-!
-! Non-zero means that database changes do not get written to the
-! database immediately. See tuning.html.
-!
-fastUpdate=0
-!
-! Percentage of free space in an index that must be present before
-! the index reorganises itself. High values means frequent index
-! reorganisation. Low values means slow index inserts.
-!
-indexLoad=5
-!
-! The number of cache misses to include in calculations of the next
-! base for the cache.
-!
-! (Currently not implemented).
-!
-missesInCacheStats=100
-!
-! Non-zero means that results sets get instantiated on disk. By default
-! InstantDB holds results sets emtirely in memory (apart from Binary
-! columns). For large results sets this can be a problem. This property
-! forces all results sets to be held on disk.
-!
-resultsOnDisk=0
-!
-! Similar to cacheCondition but applies only to disk based
-! results sets. Default is CACHE_ROWS.
-!
-resultsSetCache=CACHE_ROWS
-!
-! Similar to cacheAmount but applies only to disk based
-! results sets. Default is 100.
-!
-resultsSetCacheAmount=100
-!
-! Number of rows to read into the disk read ahead buffer.
-! Recommended to be set somewhere around 128 to 256.
-! Default is 20.
-!
-rowCacheSize=128
-!
-! The read ahead buffer is effective at speeding up full
-! table scans. However for indexed lookups or multiple
-! simultaneous scans it is better to read a single row at
-! a time. Each table holds a small number of single row
-! buffers to improve such operations. Default is 8.
-!
-!singleRowCount=4
-!
-! Sometimes the look ahead buffer can be held by a single
-! thread even though it is not retrieveing many values from it.
-! If too many lookups retrieve data from the single row
-! buffers then it is better to flush the look ahead buffer and
-! make it available for re-use. Default is 128.
-!
-!flushAfterCacheMisses=64
-!
-! Number of rows to read ahead for system tables. By default
-! system tables cache everything, so it is wasteful to have large
-! read ahead buffers since they will very rarely be used. This
-! allows the size of the system read ahead buffers to be reduced
-! if necessary. Defaults to rowCacheSize.
-!
-!systemRows=20
-!
-! The control column in all tables normally has a large cache
-! since this speeds up all operation on that table. This can be
-! varied to either improve performance or to reduce space.
-! default is 8192.
-!
-! This value applies only when tables are first created. It has no effect
-! when a table is being re-opened.
-!
-!controlColCacheSize=512
-!
-! By default, InstantDB only does a cursory search for deleted rows during
-! UPDATE statements. Setting searchDeletes=1 causes more detailed searches
-! for deleted rows. This slows down UPDATE executions, but reults in more
-! compact tables. Default is 0.
-!
-searchDeletes=0
-!
-! The interval, in milliseconds, between checks for statement execution
-! timeouts. Default is 5000.
-!
-!timerCheck=5000
-!
-! The number of statements between checks on available memory. If set
-! to 100 (say), then every 100 statements, InstantDB will check to
-! see how much memory is still free. If too little is avilable (see
-! below) then java.lang.System.gc() is called.
-!
-! If set to zero (the default) then no memory checking takes place.
-!
-!garbageCollectStatements=100
-!
-! If InstantDB is performing period memory checks (see above) then
-! this is the value in percent of available memory that must be
-! used before System.gc() gets called.
-!
-!garbageCollectPercent=70
-
-!---------------------------------------------------------------------
-!
-! LOGGING AND DEBUGGING PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! Non-zero means include SQL statements in the export file.
-!
-exportSQL=0
-!
-! Non-zero means trace output also directed to console.
-! Defaults to 0.
-!
-traceConsole=1
-!
-! Relative or absolute path where exporting and tracing goes.
-!
-! NOTE - A relative path is relative to the current Java
-! runtime directory. It is *not* relative to this properties
-! file. This is regardless of the relativeToProperties
-! setting above.
-!
-traceFile=./trace.log
-!
-! Bitmap of various items that can be traced. See debug.html.
-! Defaults to 0.
-!
-traceLevel=2
-
-!---------------------------------------------------------------------
-!
-! TRANSACTION AND RECOVERY PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! 0 means do not perform recovery on startup.
-! 1 means perform automatic recovery
-! 2 (default) means prompt the user using standard in
-!
-recoveryPolicy=1
-!
-! Sets the level of transaction journalling. See trans.html.
-! Defaults to 1.
-!
-! 0 - No journalling takes place.
-! 1 - Normal journalling (default).
-! 2 - Full journalling.
-!
-transLevel=1
-!
-! When doing an import, defines the number of rows imported
-! before the transaction is committed. Recommended value 8192.
-! defaults to 100.
-!
-transImports=100
-!
-! Sets the default transaction isolation level. This is a complex
-! topic, but basically, the higher the level, the more locking
-! goes on. The allowed values are:
-!
-! TRANSACTION_READ_UNCOMMITTED = 1
-! TRANSACTION_READ_COMMITTED = 2
-! TRANSACTION_REPEATABLE_READ = 4
-! TRANSACTION_SERIALIZABLE = 8 (default)
-!
-! SERIALIZABLE means that InstantDB takes exclusive access to all
-! tables in a transaction until the transaction completes. Even if
-! the transaction only performs reads.
-!
-! REPEATABLE_READ transactions takes read locks for SELECTs and
-! write locks for everything else. All locks released on transaction
-! completion.
-!
-! READ_COMMITTED transactions are the same as REPEATABLE_READ
-! except that read locks get freed on statement completion.
-!
-! READ_UNCOMMITTED transactions do not take read locks. A result
-! set can include data being modified by another transaction.
-!
-!defaultIsolationLevel=2
-
-!---------------------------------------------------------------------
-!
-! DATE, TIME AND CURRENCY PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! Number of digits after decimal point in currency outputs. Defaults to 2.
-!
-currencyDecimal=2
-!
-! Currency symbol used in currency outputs. Defaults to $.
-!
-currencySymbol=$
-!
-! Default format for date columns. Defaults to "yyyy-mm-dd".
-!
-!dateFormat=yyyy-mm-dd
-!
-! Default format for timestamp columns. Defaults to "yyyy-mm-dd hh:nn:ss.lll".
-!
-!dateTimeFormat=yyyy-mm-dd hh:nn:ss.lll
-!
-! Default format for time columns. Defaults to "hh:nn:ss.lll".
-!
-!timeFormat=hh:nn:ss.lll
-!
-! If set, then all two digit dates less than its value are interpreted
-! as 21st century dates.
-!
-!milleniumBoundary=50
-!
-! Set to 1 causes the date string "now" to store a full timestamp.
-! Default is to store only the date for fields with now hour in the
-! format string.
-!
-nowMeansTime=0
-
-!---------------------------------------------------------------------
-!
-! STRING HANDLING PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! If set to 1 then String hashes use the JDK Object.hashCode() function.
-! By default, uses InstantDB's String hashing.
-!
-altStringHashing=0
-!
-! Set to 1 to cause LIKE clauses to always perform case insensitive
-! comparisons.
-!
-likeIgnoreCase=0
-!
-! Same as SET LITERAL STRICT_ON. Prevents string literals being interpreted
-! as column names or numbers. Default is 0.
-!
-strictLiterals=0
-!
-! Set this value to 1 (one) if you would like PreparedStatement.setString()
-! to ignore "\" (backslash) characters when proceesing string constants.
-! When set, InstantDB will not attempt to interpret \ as the start of an
-! escape sequence. Default is 0.
-!
-!prepareIgnoresEscapes=1
-
-!---------------------------------------------------------------------
-!
-! MISCELLANEOUS PROPERTIES
-!
-!---------------------------------------------------------------------
-
-!
-! Allows selected InstantDB keywords to be un-reserved.
-! e.g. ignoreKeywords=url,quote would allow the keywords
-! url and quote to be used as table or column names.
-!
-! This faciliy is provided for compatatbility reasons only.
-! It's use is not recommended AND IS NOT SUPPORTED.
-!
-!ignoreKeywords
-!
-! Non-zero means database is opened in read only mode.
-!
-readOnly=0
diff --git a/webgoat-container/src/main/old/index.jsp b/webgoat-container/src/main/old/index.jsp
deleted file mode 100644
index 0db641a6f..000000000
--- a/webgoat-container/src/main/old/index.jsp
+++ /dev/null
@@ -1,3 +0,0 @@
-<%@ page session="false" %>
-<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
-
- <%
- AbstractLesson lesson = webSession.getCurrentLesson();
- if (lesson instanceof RandomLessonAdapter) {
- RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
- %>
-
Stage <%= rla.getLessonTracker(webSession).getStageNumber(rla.getStage(webSession)) + 1%>
- <%
- }
- %>
- <%=webSession.getInstructions()%>
<%=webSession.getMessage()%>
-
-<%
- if (currentLesson.getTemplatePage(webSession) != null) {
- //System.out.println("Main.jsp - current lesson: " + currentLesson.getName() );
- //System.out.println(" - template Page: " + currentLesson.getTemplatePage(webSession));
-%>
-<%=currentLesson.getContent()%>
-<%
- }
-%>
-
-
-
-
-
-
diff --git a/webgoat-container/src/main/old/lessons/ConfManagement/config.jsp b/webgoat-container/src/main/old/lessons/ConfManagement/config.jsp
deleted file mode 100644
index ffde1a484..000000000
--- a/webgoat-container/src/main/old/lessons/ConfManagement/config.jsp
+++ /dev/null
@@ -1,19 +0,0 @@
-<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
- pageEncoding="ISO-8859-1"%>
-<%@page import="org.owasp.webgoat.session.WebSession"%>
-<%
-WebSession webSession = ((WebSession)session.getAttribute("websession"));
-%>
-
-
-
-Configuration Page
-
-
-<% response.sendRedirect(webSession.getCurrentLesson().getLink() +
- "&succeeded=yes");
-%>
-
-
-
\ No newline at end of file
diff --git a/webgoat-container/src/main/old/main.jsp b/webgoat-container/src/main/old/main.jsp
deleted file mode 100644
index e66d05858..000000000
--- a/webgoat-container/src/main/old/main.jsp
+++ /dev/null
@@ -1,292 +0,0 @@
-<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
- import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.Category, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*, java.util.*"
- errorPage="" %>
-<%
- WebSession webSession = ((WebSession) session.getAttribute(WebSession.SESSION));
- Course course = webSession.getCourse();
- AbstractLesson currentLesson = webSession.getCurrentLesson();
- LabelManager labelManager = BeanProvider.getBean("labelManager", LabelManager.class);
-%>
-
-
-<%@page import="org.owasp.webgoat.lessons.RandomLessonAdapter"%>
-
-
- <%=currentLesson.getTitle()%>
-
- <%
- int topCord = 140;
- int zIndex = 105;
-
- Iterator iter2 = categories.iterator();
- while (iter2.hasNext()) {
- Category category = (Category) iter2.next();
- %>
-
- <%
- topCord = topCord + 30;
- zIndex = zIndex + 1;
- }
-
- int topSubMenu = 72;
-
- Iterator iter3 = categories.iterator();
- while (iter3.hasNext()) {
- Category category = (Category) iter3.next();
- List lessons = webSession.getLessons(category);
- Iterator iter4 = lessons.iterator();
- %>
- <%
- }%>
-
-
-
- <% if (currentLesson.getAvailableLanguages().size() != 0) {
- %>
-
- <%
- } else {
- %>
- Internationalization is not available for this lesson
- <%
- }
- %>
-
-
-
-
-
<%=currentLesson.getTitle()%>
-
-
-
-
- <%
- if (currentLesson != null) {
- %>
-
- <%
- }
- %>
-
-
- <%
- if (webSession.getHint() != null) {
- printHint = "
" + webSession.getHint() + "
";
- out.println(printHint);
- }
-
- if (webSession.getParams() != null) {
- Iterator i = webSession.getParams().iterator();
- while (i.hasNext()) {
- Parameter p = (Parameter) i.next();
- printParameters = "
" + p.getName() + "=" + p.getValue() + "
";
- out.println(printParameters);
- }
- }
-
- if (webSession.getCookies() != null) {
- Iterator i = webSession.getCookies().iterator();
- while (i.hasNext()) {
- Cookie c = (Cookie) i.next();
- printCookies = "
" + c.getName() + "
" + c.getValue() + "
";
- out.println(printCookies);
- }
- }%>
-
-
- <%
- AbstractLesson lesson = webSession.getCurrentLesson();
- if (lesson instanceof RandomLessonAdapter) {
- RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
- %>
-
Stage <%= rla.getLessonTracker(webSession).getStageNumber(rla.getStage(webSession)) + 1%>
- <%
- }
- %>
- <%=webSession.getInstructions()%>
-
<%=webSession.getMessage()%>
-
- <%
- if (currentLesson.getTemplatePage(webSession) != null) {
- //System.out.println("Main.jsp - current lesson: " + currentLesson.getName() );
- //System.out.println(" - template Page: " + currentLesson.getTemplatePage(webSession));
-%>
-
- <%
- } else {
- %>
-
<%=currentLesson.getContent()%>
- <%
- }
- %>
-
-
-
-
-
WebGoat V5.4
-
-
-
-
Thank you for taking the time to improve WebGoat!
-
The lesson you were on was: <%=webSession.getCurrentLesson().getName()%>
-
There are several ways to report a bug, fix a bug, or get help.
-
-
To report a bug:
-
- File a WebGoat defect using Google Code
- WebGoat Issues . Please be as specific as possible. If you have a
- recommended solution for a bug, include the solution in the bug report.
-
-
To get help:
-
- Look in the FAQ ,
- the most common problems are in the FAQ. The FAQ also allows user comments,
- but it is not monitored like the WebGoat mailing list.
- Send an email to the WebGoat
- mail list . The WebGoat mail list is the preferred method to ask for
- help. It is likely that someone has already experienced the issue you
- are seeing. In order to post to the list you must be subscribed
- to the WebGoat Mail List.
- Send an email to Bruce
- Mayhew
-
-
To fix a bug, typo, or enhance WebGoat:
-
- Send an email to Bruce
- Mayhew . This will start the discussion of getting you added to the WebGoat
- Contributers List . Once you become a WebGoat contributor, you can fix
- as many bugs/lessons as you desire.
-
-
-
-
-
-
Untitled Document
-
- <%
- String source = webSession.getSource();
- if (source != null)
- {
- String printSource = "
" + source + "
";
- out.println(printSource);
- }
- %>
-
WebGoat V5.4
-
-
-
-
Thank you for using WebGoat! This program is a demonstration of common web application flaws.
- The exercises are intended to provide hands on experience with
- application penetration testing techniques.
-
The WebGoat project is led
- by Bruce Mayhew. Please send all comments to Bruce at [TODO, session was blowing up here for some reason].
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- WebGoat Authors
-
-
-
-
-
- Bruce Mayhew
-
-
-
-
-
- Jeff Williams
-
-
-
-
-
-
-
-
-
-
-
-
- David Anderson
- Laurence Casey (Graphics)
- Rogan Dawes
- Bruce Mayhew
-
-
- Sherif Koussa
- Yiannis Pavlosoglou
-
-
-
-
-
-
- Special Thanks
- for V5.4
-
-
- Documentation
- Contributers
-
-
-
-
- Brian Ciomei (Multitude of bug fixes)
- To all who have sent comments
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
WARNING
-
-
-
-
Thanks for hacking The Goat!
-
WebGoat is a demonstration of common web application flaws. The
- associated exercises are intended to provide hands-on experience with
- techniques aimed at demonstrating and testing application penetration.
-
-
From the entire WebGoat team, we appreciate your interest and efforts
- in making applications not just better, but safer and more secure for
- everyone. We, as well as our sacrificial goat, thank you.
-
- Version: ${version}, Build: ${build}
-
-
-
-
-
Contact us:
-
- WebGoat mailing list: ${emailList}
- Bruce Mayhew: ${contactEmail}
-
-
-
-
-
-
-
WebGoat Authors
-
- Bruce Mayhew (Project Lead)
- Jeff Williams (Original Idea)
- Richard Lawson (Architect)
- Jason White (Architect)
-
-
-
-
-
WebGoat Design Team
-
- Richard Lawson
- Bruce Mayhew
- Jason White
- Ali Looney (User Interface)
- Jeff Wayman (Website and Docs)
-
-
-
-
-
-
-
Active Contributors
-
- Nanne Baars (Developer)
- Dave Cowden (Everything)
- Keith Gasser (Survey/Security)
- Devin Mayhew (Setup/Admin)
- Li Simon (Developer)
-
-
-
-
-
Past Contributors
-
- David Anderson (Developer/Design)
- Christopher Blum (Lessons)
- Laurence Casey (Graphics)
- Brian Ciomei (Bug fixes)
- Rogan Dawes (Lessons)
- Erwin Geirnaert (Solutions)
- Aung Knant (Documentation)
- Ryan Knell (Lessons)
- Christine Koppeit (Build)
- Sherif Kousa (Lessons/Documentation)
- Reto Lippuner (Lessons)
- PartNet (Lessons)
- Yiannis Pavlosoglou (Lessons)
- Eric Sheridan (Lessons)
- Alex Smolen (Lessons)
- Chuck Willis (Lessons)
- Marcel Wirth (Lessons)
-
-
-
Did we miss you? Our sincere apologies, as we know there have
- been many contributors over the years. If your name does not
- appear in any of the lists above, please send us a note. We'll
- get you added with no further sacrifices required.
-
-
-
-
-